Nasser Heidari

2009-07-10

Netcat: The TCP/IP Swiss army knife

Filed under: freebsd,Linux,Miscellaneous,Security Tips and Issues — Nasser Heidari @ 13:44


Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.
It is designed to be a reliable “back-end” tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

In this little guide I’ll quickly cover some very helpful usage’s of netcat .

Simple Chat:

The simplest example of netcat usage is to create a server-client chat system. In the following example it is assumed that the machine that creates the listening socket (server) has the 192.168.0.1 IP address. So, create the chat server on this machine and set it to listen to 12345 TCP port:

# nc -lp 12345

or

# nc -l 12345

If you now connect to port 12345 on that host, everything you type will be sent to the other party, which leads us to using netcat as a chat server.
Connect to it from another machine by entering this command:

# nc 192.168.0.1 12345

Now both parties can chat!

Port Scanner:

Netcat can be a port scanner. It does not have as many features as say nmap, but if you just want to see what ports are open on a given machine, you can simply do:

# nc -vzw 1 localhost 1-1000

Transferring Files:

Let’s say you want to transfer a file from machine A to machine B . you can use netcat as a file transfer software.
On machine A do the following, where 12345 is some unused port on which you want to send the file:

# nc -lp 12345 < myfile.tar.bz2

OR

# nc -l 12345 < myfile.tar.bz2

then go to the machine B and run this command: (192.168.0.1 is machine A IP address)

# nc 192.168.0.1 12345 > myfile.tar.bz2

Aanother Examples:

# tar -czf - /etc/ | nc -lp 12345

and then:

 # nc 192.168.0.1 12345 > mybackup.tar.gz

Simple Single page Web Server:

# while true; do nc -lp 8080 -q 1 < test.html; done

now if you connect to http://YOUR-IP-ADDRESS:8080 , you will see contents of test.html page .

Netcat as a Backdoor !!!

netcat can be used as a backdoor! You can specify the shell (or for that matter any executable) you want netcat to run at a successful connection with the -e parameter:

# nc -lp 54321 -e /bin/bash

now if you connect to the port 54321 , you will have a shell :

Getting System Information

# while true; do nc -lp 12345 -e /usr/bin/uptime; done

The user who wants to obtain system information has to issue the following command:

# nc 192.168.0.1 12345 
Advertisements

Identifying the version of a Web server

Filed under: Miscellaneous — Nasser Heidari @ 12:35

I will show you how you can identify the version of a Web server by issuing telnet command.
In the following example, we want to determine the version of a Web server by issuing a Hypertext Transfer Protocol (HTTP) HEAD request. The HEAD method allows a client to request HTTP header information. The output from the HEAD request will help us identify important information about the server, including the type and version of the Web server that is running. To perform a HEAD request, we’ll need to make a connection to the target Web server using the telnet command:

telnet www.microsoft.com 80

This simply makes a TCP connection to the Web server. Once the connection established, you need to issue the following command into the telnet Window:

HEAD / HTTP/1.0

After you hit enter two times, we get the following response (http header information)
from the Web server.

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 1020
Content-Type: text/html
Last-Modified: Mon, 16 Mar 2009 20:35:26 GMT
Accept-Ranges: bytes
ETag: "67991fbd76a6c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 10 Jul 2009 12:33:15 GMT
Connection: keep-alive

As you can see from the results , http://www.microsoft.com is surprisingly running a Microsoft-IIS/7.5 Web server using the ASP.NET Web application framework.