Nmap 6 Cookbook: The Fat Free Guide to Network Security Scanning (2015)

Section 15: Ncat

Overview

Ncat is another new addition to the Nmap suite. Beginning with Nmap 5, Ncat was released as a modern replacement for the popular Netcat program that is no longer actively developed. Ncat is designed to be a "Swiss Army Knife" for all things TCP/IP. You can use Ncat to act as a client or server for virtually any type of service or protocol. This allows you to see and manipulate raw protocol behavior in real-time, which can be useful for troubleshooting or security auditing.

Note: Ncat is a complex tool that has countless uses. I could come up with enough material to write a whole book just on this one utility. Unfortunately, this is not that book. This guide is written from a network administrator's point of view. As such, it only covers basic usage of the utility for testing and troubleshooting. This section covers the basic operation of Ncat and it's up to you to find creative uses for the tool.

Summary of features covered in this section:

Test a Webserver

Test a SMTP Server

Transfer a File

Create an Ad Hoc Chat Server

Create an Ad Hoc Webserver

Test a Webserver

Using Ncat to connect to port 80 or 443 on a webserver allows you to test the functionality of the system by issuing HTTP requests.

Usage syntax (HTTP): ncat -C [target] 80
Usage syntax (SSL): ncat -C --ssl [target] 443

$ ncat 192.168.1.103 80

HEAD / HTTP/1.0<ENTER><ENTER>

HTTP/1.1 200 OK

Date: Sun, 25 Jan 2015 06:23:33 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Sun, 25 Jan 2015 06:08:46 GMT

ETag: "2cf6-50d73dac8beb2"

Accept-Ranges: bytes

Content-Length: 11510

Vary: Accept-Encoding

Connection: close

Content-Type: text/html

Output of a webserver test using ncat

Using Ncat can be helpful when testing webserver configuration without having to open a browser or clear caches. It can also show you HTTP headers from the server (demonstrated above) which browsers normally hide from end users. In this example, Ncat connects to a web server on port 80. The HTTP request “HEAD / HTTP/1.0” is issued (followed by hitting the <ENTER> key twice) which displays some basic information about the server. The command “GET / HTTP/1.0” could also be issued to dump the HTML contents of the server’s index page to the screen. When finished, pressing <CTRL + D> ends the session.

Note: Some webservers may require adding the -C option when connecting to send proper CRLF line endings.

Ncat can be especially helpful when testing virtual hosting configuration. On vhosts, additional information is required in order to form a proper HTTP request. The next example displays the syntax for testing a virtual webserver.

$ ncat www.example.com.com 80

GET / HTTP/1.0

HOST: www.example.com<ENTER><ENTER>

[...]

Testing a virtual hosted system

Test a SMTP Server

Another neat use for Ncat is testing a SMTP (Simple Mail Transfer Protocol) server.

Usage syntax: ncat [target] 25

$ ncat 192.168.1.103 25

220 E6420 ESMTP Postfix (Ubuntu)

HELO test

250 E6420

QUIT

221 2.0.0 Bye

Testing a SMTP server connection

Connecting to a SMTP server on port 25 allows you to see and interact with a mail server. This is helpful if you are trying to troubleshoot problems with mail systems. You could actually use Ncat in this situation to craft a complete message and send it, assuming you have relay access from your location and understand proper SMTP command syntax.

In the example above, the Ncat client connects to port 25 on the SMTP server and is greeted with a 220 banner displaying some basic information about the server. Issuing the command “HELO test” results in a 250 response from the server. These responses indicate the server is working properly. Once we are satisfied that the server is working we issue the “QUIT” command and then see a 221 message which ends the session. Pressing <CTRL + D> then causes Ncat to return to the shell.

Transfer a File

Ncat provides a simple way to send a single file to another system on the fly without having to use a client/server protocol like FTP.

Usage syntax (receiver): ncat -l >[output]
Usage syntax (sender): ncat --send-only [target] < [input]

# ncat -l > test.png

Setting up the receiving system to listen for a file

In the first example, we set up the receiving system to listen for a connection and redirect the output to a file. In this case the file being transferred is test.png. The example below shows the syntax used to send the file with the --send-only option and redirect the test.png file as input.

# ncat --send-only 192.168.1.103 < test.png

Transferring the file from the sending system

This will transfer the test.png file to the listening system and then close the connection. In a pinch, this can be very handy for sending a file to a remote system quickly.

Tip: You can use a checksum program such as md5sum (Linux) or md5 (Unix/BSD) to verify the integrity of the transferred file. This command can be found on most Unix/Linux systems, but is not available on Windows.

Create an Ad Hoc Chat Server

Ncat can also be used as a simple chat server between one or more users.

Usage syntax (host): ncat -l
Usage syntax (guest): ncat [host]

# ncat -l

Setting up ncat to listen as a host

To setup a chat simply have one user run Ncat in listen mode (as shown above) and then connect from another system (demonstrated below).

# ncat 192.168.1.103

Sup?

Nothing

Let's go get some tacos!

Ok, meet me downstairs in 5 min.

Connecting to the host system and sending messages

Once connected, you can exchange messages between the two systems. Pressing <CTRL + D> ends the session when you are finished.

Tip: The --chat option is also provided to help facilitate chats between multiple users. This will give each user a unique ID to help keep conversations straight. Include the --chat option on the listening system to enable this feature.

Create an Ad Hoc Webserver

Using a simple HTTP response and a few HTML tags, you can get Ncat to act like a webserver.

Usage syntax: ncat -l [port] < [file]

# ncat -l 80 < web.server

Setting up Ncat to listen on port 80

In the example above, a file called web.server is used as input for Ncat listening on port 80. The contents of the web.server file are shown below and consist of an HTTP response code and then the minimum amount of HTML code needed to serve up a web page.

$ cat web.server

HTTP/1.0 200 OK

<html>

<body>

<h1>Hello, world!</h1>

</body>

</html>

Creating a simple HTTP response and HTML document

The resulting web page when accessed from a browser is displayed below.

A web browser accessing the Ad Hoc Ncat webserver

On the listening end, Ncat displays the HTTP request along with the User-Agent information supplied by the client. The output of the client request is shown below.

GET / HTTP/1.1

Host: 10.10.4.1

Connection: keep-alive

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Output of a client request to Ncat