In this blog post, I'll focus on the basics of netcat. More advanced options and scenarios will follow in separate posts at some point.
Netcat is available on almost any Linux host and is easy to use. It is an excellent tool for troubleshooting network issues or gathering information and a great addition to any tool portfolio.
Netcat and nc can be used interchangeably. I've decided to use nc for this blog post. On RHEL, it is often called ncat and part of the nmap packet.
nc [ options ] host portnc 10.20.10.7 22CTRL + d or c. nc --helpman nc-n-v-4 # IPv4 only-6 # IPv6 only-uSometimes it is necessary to specify an interface since hosts often enough have multiple. You can choose the source/interface IP on both sides with the -s flag and the source port on the client with the -p flag.
nc -p 10101 -s 10.20.10.8 10.20.10.7 9999-p 10101 # use the source port 10101-s 10.20.10.8 # use the source IP to connect to the server10.20.10.7 # IP of the server9999 # destination port of the serverYou can choose multiple destination ports for most Netcat functions on the client side.
1-9080 443httpsshsmtpssh 2222 10022-10080There are better options like nmap, but it is often enough all you need.
nc -v -z example.com 20-23-z # scan instead of initiating a connection-v # get a more verbose outputOutput
nc -vz 10.20.10.8 20-23
nc: connect to 10.20.10.8 port 20 (tcp) failed: Connection refused
nc: connect to 10.20.10.8 port 21 (tcp) failed: Connection refused
Connection to 10.20.10.8 22 port [tcp/ssh] succeeded!
nc: connect to 10.20.10.8 port 23 (tcp) failed: Connection refused
Side note: The results are being sent to standard error, and not standard out. If you want to filter the results with grep, you need to redirect standard error to standard out with 2>&1 like in the following example:
nc -vz 10.20.10.8 20-23 2>&1 | grep succeeded
Connection to 10.20.10.8 22 port [tcp/ssh] succeeded!
You can get more information about the running service with the following command:
Information about the SSH Service
kuser@pleasejustwork: echo "QUIT" | nc 10.20.10.8 22
SSH-2.0-OpenSSH_8.0
Information about the Web server
kuser@pleasejustwork: echo "QUIT" | nc ittavern.com 443
HTTP/1.1 400 Bad Request
Server: nginx
Date: Sun, 23 Jul 2023 09:18:01 GMT
Content-Type: text/html
Content-Length: 150
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>
</html>
Two Netcat instances can connect to each other in a server-client relationship to let you transfer text and files in both directions. Which host is the server, and which is the client only relevant for the initial connection?
You can use the -l flag to let Netcat listen on a specific port like this:
nc -l 9999nc 10.20.10.7 9999Side note: Netcat will listen to all interfaces by default. To limit it to a single one, use the -s flag with the desired IP as a parameter. You'll need to add the -p flag in front of the port, or it will run in a syntax error as a side note within the side note.
There won't be any notifications on either side, but after successfully connecting to the server, you can send messages to each host. You can close the connection with CTRL + d or c.
When the connection is closed, the server will stop listening by default. You can use -k to keep the server listening. There can be only one active TCP connection per server and port.
Side note: Non-root users are by default limited to ports above 1023 for security reasons, and all communication is unencrypted by default!
With Netcat, we are not limited to chat messages and can use it to transfer files in both directions. Just as a reminder: the transfer will be unencrypted by default!
nc -l 9999 > random-config.txtnc -N 10.20.10.8 9999 < random-config.txt-N # shuts down the network socket after the transferIn this example, we would transfer the file random-config.txt from the sender to the receiver in the current directory. The files don't need to have the same name.
Netcat is one of my most used tools for my day-to-day work as it is easy to use and installed on almost any Linux host. I've provided you with the basics of Netcat, so you can add it to your portfolio of tools.
In the future, I plan to provide you with more advanced Netcat functions like a simple web server, bandwidth check, TCP proxy, encryption, and reverse shell.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。