E-NC
nc
Open a TCP or UDP connection by hand — probe a port, grab a banner, or move a file.
OVERVIEW
nc is netcat: a thin client that connects or listens on a TCP or UDP port and shovels bytes. The binary on macOS, OpenBSD, and many Linux distros (including Kali’s default `nc`) is OpenBSD netcat (man.openbsd.org/nc). Nmap ships a separate `ncat` with SSL and proxy flags; GNU netcat is a third dialect. Flags are not interchangeable — check `nc -h` on the box you are on.
In an engagement the honest uses are small: `nc -vz` to see if a port answers, typing a protocol by hand to read a banner, or piping a file between two authorized hosts when scp is not available. It is not a substitute for a scoped C2 channel; long-lived listeners and interactive shells are a different, louder class of activity and need explicit sign-off.
USE CASES
Practical use cases
- 01
Checking that a single TCP port on a scoped host answers before running a heavier scan.
- 02
Reading a service banner by connecting and typing a protocol probe by hand.
- 03
Moving a small file between two authorized hosts when no other copy tool is present.
- 04
Confirming UDP reachability to a scoped service that does not speak a friendlier client.
QUICK START
When a port is open and you need a raw TCP or UDP conversation — a banner, a one-shot probe, or a file copy between two hosts already in scope.
- Confirm the destination host and port are in the authorized scope.
- Check which nc you have (`nc -h`) so -z, -v, and -u mean what you think.
- Probe the port first; only then send protocol bytes or a file.
- Stop the process when the check is done — do not leave a listener running.
nc -vz 10.10.10.5 22BEFORE YOU RUN IT
What to check before running it
OpenBSD nc, GNU netcat, and ncat disagree on -e, -z, and TLS flags; a command copied from another distro may do nothing, or do something else.
A listening nc is visible to local process listings and to network monitoring; do not leave one bound on a production host.
Interactive shells and persistence via nc need the same written authorization as any other post-exploitation channel — they are not a free extra of a port probe.