4 ms·

Anyone want to give a few examples of cool things they actually do with netcat?

yan 16y ago
I use it for: - creating quick and dirty proxies (nc > fifo > nc). (edit: you can also bridge udp->tcp this way, which makes proxying UDP through an ssh tunnel possible) - making simple GET requests (printf "GET / HTTP/1.0\r\nHost: www\r\n\r\n" | nc host 80, or save the full request and pipe that to netcat) - checking if a port is open (nc -p 8080 host, tends to be quicker than nmap and less to type) - dumb file transfers ('nc -l port > file' on one machine, 'file | nc host2 port') on another (or using tar for directories). Usually I use ssh/scp, but sometimes that nc trick works just fine..
- jrmxrf 16y ago
  I suggest, evolve. ssh, curl/wget, nmap, scp But yeah, 10100111001
LiveTheDream 16y ago
Shutting down redis (from default init.d script): echo -n "Sending SHUTDOWN\r\n" | nc localhost $REDISPORT &
silentbicycle 16y ago
1. Schlepping files between computers. computer A: nc -l $ARBITRARY_PORT | tar vzxf - computer B: tar vzcf - files_or_directories | nc computer_a $ARBITRARY_PORT 2. Testing socket servers: cat canned_request | nc server 80 There are probably other things, but I don't think, "Oh, this is a good use for netcat", I just do it. It's almost as handy as awk.
- wazoox 16y ago
  > Schlepping files between computers. What about using rsync instead ?
  - silentbicycle 16y ago
    nc is simple and I know its syntax. rsync is more powerful, but I need to look up its options half the time.
    - wazoox 16y ago
      "rsync source host:destination" just works, no need for options :)
iuguy 16y ago
This is pretty much the fastest way I've found to clone a disk over a network. To clone from one host's /dev/sda to another host's /dev/sda in Linux, try this. On the target host, run the following: nc -l 31337 | bzip2 -d | dd bs=16M of=/dev/sda On the host you're copying from, do this: dd bs=16M if=/dev/sda | bzip2 -c |nc dest.host.com 31337 Bear in mind that this isn't secure (everything goes over the wire in clear and there's no auth) and that for best results you should only do this from a live cd (if you're dd'ing from or to the live drive you've mounted there's a high risk that you'll change the filesystem mid-copy, depending on source FS used, this could corrupt the destination).
- 1337p337 16y ago
  As a method of obscuring the data slightly (although really it doesn't add much), I sometimes like to add "conv=swab" to the dd. But for the CPU that's being spent on the bzip2, you could do it slightly more easily with a single command on one machine: dd bs=16M if=/dev/sda | ssh dest.host.com 'bzip2 -d >/dev/sda' Of course, that presupposes a running sshd on dest.host.com. You could secure it from being observed (although not from being interfered with) under Linux using loopback devices: ## On the destination machine: LOD=`losetup -f` losetup -e aes $LOD /dev/sda # You'll be prompted for a password for the encryption. nc -l 31337 | bzip2 -d | dd bs=16M of=$LOD ## On the source machine: LOD=`losetup -f` losetup -e aes $LOD /dev/sda # You'll be prompted for a password; use the same one. dd bs=16M if=$LOD | bzip2 -c |nc dest.host.com 31337 Most people just use encrypted loopback devices for things like disk encryption, but losetup (like netcat) has so many other fun potential applications. (Edited twice due to formatting sadness.)
  - iuguy 16y ago
    That second one's really interesting. I've tried the SSH route and while it works (and works well) it really knocks up the time to send an image over the wire. We've used this for forensic imaging in the past and have relied upon digital signatures as integrity checks. It's not great I know, but it's the best way to get disk images from a big server onto a NAS (when you can't plug the NAS into the server).
1amzave 16y ago
A few days ago I was wondering if the link between two remote hosts was 100Mbps or 1Gbps, and didn't have root access to run ethtool (sidenote: is there an easier way for an unprivileged user to determine this?), so out came netcat and dd: host1$ dd if=/dev/zero | nc host2 5432 host2$ nc -l 5432 > /dev/null Let it run for a moment and then ctrl-C'd host1; the stats dd printed on exit gave a pretty clear answer to my question.
- JoachimSchipper 16y ago
  For an easier way, consider ifconfig. You can run it as non-root, you know - you just won't be able to change anything.
russellsilva 16y ago
I use netcat to simulate a network connectivity failures. For instance, if server:port 1000 is the normal host and port my application would connect to, I set up a forward from port 2000: nc -L server:1000 2000 then run my application to connect to localhost:2000 my_application --server=localhost --port=2000 Now my application is connected to localhost:2000, which is forwarded to server:1000 through netcat. To simulate a network connectivity failure I just kill netcat.
dolinsky 16y ago
I use it to poll our memcached servers w/o first jumping into telnet. echo "STATS" | nc localhost 11211 STATS can be replaced w/ other memcached-accepted arguments
deleted 16y ago
[deleted]
justinbach 16y ago
I spent a few summers at the National Institutes of Health building a DICOM (Digital Imaging and Communications in Medicine) suite for the storage and retrieval of Nuclear Medicine and CT images. It consisted of a client and a server and was built completely in IDL. It used Netcat both to listen/respond on the server side and to issue queries and retrieve (meta)data on the client side. Like others in this thread, I too received a few bureaucratic slaps on the wrist for doing unauthorized port-scanning during the development process (we were trying to find a set of suitable unused ports for the package). Apparently it was worth the trouble, though--it was nearly 10 years ago that I built the package, and the software's still in use!
dacort 16y ago
Poor man's remote command execution (when compiled with -DGAPING_SECURITY_HOLE): nc -l -p 80 -e /bin/sh And then just telnet or netcat to that port and you get yourself a shell.

yan 16y ago

I use it for: - creating quick and dirty proxies (nc > fifo > nc). (edit: you can also bridge udp->tcp this way, which makes proxying UDP through an ssh tunnel possible) - making simple GET requests (printf "GET / HTTP/1.0\r\nHost: www\r\n\r\n" | nc host 80, or save the full request and pipe that to netcat) - checking if a port is open (nc -p 8080 host, tends to be quicker than nmap and less to type) - dumb file transfers ('nc -l port > file' on one machine, 'file | nc host2 port') on another (or using tar for directories). Usually I use ssh/scp, but sometimes that nc trick works just fine..

jrmxrf 16y ago
I suggest, evolve. ssh, curl/wget, nmap, scp But yeah, 10100111001

LiveTheDream 16y ago

Shutting down redis (from default init.d script): echo -n "Sending SHUTDOWN\r\n" | nc localhost $REDISPORT &

silentbicycle 16y ago

1. Schlepping files between computers. computer A: nc -l $ARBITRARY_PORT | tar vzxf - computer B: tar vzcf - files_or_directories | nc computer_a $ARBITRARY_PORT 2. Testing socket servers: cat canned_request | nc server 80 There are probably other things, but I don't think, "Oh, this is a good use for netcat", I just do it. It's almost as handy as awk.

wazoox 16y ago
> Schlepping files between computers. What about using rsync instead ?
- silentbicycle 16y ago
  nc is simple and I know its syntax. rsync is more powerful, but I need to look up its options half the time.
  - wazoox 16y ago
    "rsync source host:destination" just works, no need for options :)

iuguy 16y ago

This is pretty much the fastest way I've found to clone a disk over a network. To clone from one host's /dev/sda to another host's /dev/sda in Linux, try this. On the target host, run the following: nc -l 31337 | bzip2 -d | dd bs=16M of=/dev/sda On the host you're copying from, do this: dd bs=16M if=/dev/sda | bzip2 -c |nc dest.host.com 31337 Bear in mind that this isn't secure (everything goes over the wire in clear and there's no auth) and that for best results you should only do this from a live cd (if you're dd'ing from or to the live drive you've mounted there's a high risk that you'll change the filesystem mid-copy, depending on source FS used, this could corrupt the destination).

1337p337 16y ago
As a method of obscuring the data slightly (although really it doesn't add much), I sometimes like to add "conv=swab" to the dd. But for the CPU that's being spent on the bzip2, you could do it slightly more easily with a single command on one machine: dd bs=16M if=/dev/sda | ssh dest.host.com 'bzip2 -d >/dev/sda' Of course, that presupposes a running sshd on dest.host.com. You could secure it from being observed (although not from being interfered with) under Linux using loopback devices: ## On the destination machine: LOD=`losetup -f` losetup -e aes $LOD /dev/sda # You'll be prompted for a password for the encryption. nc -l 31337 | bzip2 -d | dd bs=16M of=$LOD ## On the source machine: LOD=`losetup -f` losetup -e aes $LOD /dev/sda # You'll be prompted for a password; use the same one. dd bs=16M if=$LOD | bzip2 -c |nc dest.host.com 31337 Most people just use encrypted loopback devices for things like disk encryption, but losetup (like netcat) has so many other fun potential applications. (Edited twice due to formatting sadness.)
- iuguy 16y ago
  That second one's really interesting. I've tried the SSH route and while it works (and works well) it really knocks up the time to send an image over the wire. We've used this for forensic imaging in the past and have relied upon digital signatures as integrity checks. It's not great I know, but it's the best way to get disk images from a big server onto a NAS (when you can't plug the NAS into the server).

1amzave 16y ago

A few days ago I was wondering if the link between two remote hosts was 100Mbps or 1Gbps, and didn't have root access to run ethtool (sidenote: is there an easier way for an unprivileged user to determine this?), so out came netcat and dd: host1$ dd if=/dev/zero | nc host2 5432 host2$ nc -l 5432 > /dev/null Let it run for a moment and then ctrl-C'd host1; the stats dd printed on exit gave a pretty clear answer to my question.

JoachimSchipper 16y ago
For an easier way, consider ifconfig. You can run it as non-root, you know - you just won't be able to change anything.

russellsilva 16y ago

I use netcat to simulate a network connectivity failures. For instance, if server:port 1000 is the normal host and port my application would connect to, I set up a forward from port 2000: nc -L server:1000 2000 then run my application to connect to localhost:2000 my_application --server=localhost --port=2000 Now my application is connected to localhost:2000, which is forwarded to server:1000 through netcat. To simulate a network connectivity failure I just kill netcat.

dolinsky 16y ago

I use it to poll our memcached servers w/o first jumping into telnet. echo "STATS" | nc localhost 11211 STATS can be replaced w/ other memcached-accepted arguments

deleted 16y ago

[deleted]

justinbach 16y ago

I spent a few summers at the National Institutes of Health building a DICOM (Digital Imaging and Communications in Medicine) suite for the storage and retrieval of Nuclear Medicine and CT images. It consisted of a client and a server and was built completely in IDL. It used Netcat both to listen/respond on the server side and to issue queries and retrieve (meta)data on the client side. Like others in this thread, I too received a few bureaucratic slaps on the wrist for doing unauthorized port-scanning during the development process (we were trying to find a set of suitable unused ports for the package). Apparently it was worth the trouble, though--it was nearly 10 years ago that I built the package, and the software's still in use!

dacort 16y ago

Poor man's remote command execution (when compiled with -DGAPING_SECURITY_HOLE): nc -l -p 80 -e /bin/sh And then just telnet or netcat to that port and you get yourself a shell.