Presentation given on 19-3-16 at Null Bangalore.

1. NETCAT
T H E S W I S S A R M Y K N I F E
B.N.CHANDRAPAL

2. WHOAMI
• CHANDRAPAL
• Security Enthusiast
• Undergrad CS student
Contact :
• @bnchandrapal
• @HackwithGithub

3. SWISS ARMY KNIFE

4. INTRODUCTION
• ‘Netcat’ derived from two words
‘net’ - network and ‘cat’ - concatenate files
• Developed by *hobbit
• There are 2 divisions of netcat – with -e and without –e
• Netcat also used by Nmap
• Beauty – manual / program driven (automatic)
• It is available for all platforms

5. NETCAT VERSIONS
• Netcat-Traditional: ( Original Version written by Hobbits)
• Netcat-OpenBSD (includes utilities like IPv6, proxies, Unix
sockets)
• Ncat – used by Nmap (obviously better than other two)

6. MAN NC, NETCAT, NCAT

7. TOPICS COVERED
The tool demonstrations include (using netcat-traditional and
OpenBSD only):
• Chat Server
• Web Server
• Port Scanning
• File transfer
• Getting Remote Shell (Ethical way)
• Real time applications [if time permits]

8. TERMS USED
LISTENER:
System on which netcat is listening for commands
CLIENT:
System which tries to connect to another using netcat and/or
gives commands.

9. CHAT SERVER
Listener:
nc -l -p 31337
Client :
nc <IP address> 31337
NOTE:
This connection ends when socket is closed
-k [continue listening after connection closes]
-L [listen harder](for WINDOWS)
CONNECTION IS UNENCRYPTED

10. LISTENER
CLIENT
INTERCEPT

11. WEB SERVER
LISTENER :
netcat -lp 8888 –q 1< index.html
MULTIPLE REQUESTS (LINUX):
while true; do nc -lp 8888 –q 1 < index.html; done

12. PORT SCANNING
• nc -v -w <sec> <IP> -z <port range: 1-1000>
• -z: operate in 0 io mode - speeds up the process of
executing the process
NOTE:
• Targets TCP ports only
• For UDP connections
-u -n (bypasses the name resolution)

13. FILE TRANSFER
LISTENER:
netcat -l 4444 > received_file
CLIENT:
cat original_file | nc SERVER_IP 4444
OR
netcat SERVER_IP 4444 < original_file

14. GETTING REMOTE SHELL
WINDOWS
nc -Lp 31337 -vv -e cmd.exe
-Lp : Persistent listening mode
-vv : extra verbose
-e : gapping security hole
Client:
nc <ip> <port>

15. DISADVANTAGES

16. UNENCRYPTED CONNECTION

18. THANK YOU
ANY QUESTIONS