6

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH client to do this. I've been researching for more information and found that if anything, it looks like Netcat would be better to use. This is due to a lot of networks either not having SSH installed for security reasons, or firewalls preventing SSH communication.

So, what I'm wondering is when is it appropriate to use a reverse shell with Netcat vs an SSH client? What are the pro's and con's of each? Thank you.

Improve this question
2
  • 1
    It looks like you answered your own question: you use the tools that work in the environment you are testing.
    – schroeder ♦
    Commented Dec 29, 2015 at 20:46
  • 1
    @schroeder That makes sense, thank you for your insight! I was wondering, if you're free to use whichever on a network, is there any benefit to using SSH over Netcat or does it just come down to preference at that point?
    – Henry F
    Commented Dec 29, 2015 at 20:50

1 Answer 1

Reset to default
5

The main difference is that the "SSH tunnel" is encrypted from client to server. The netcat is just unencrypted connection of what you write and read from it (or higher-level protocol).

If you do this in your trusted environment, netcat should be enough. Also it should be enough if the higher-level protocol has some kind of encryption. Otherwise there is SSH tunnel (aka TCP Forwarding) to keep your communiques secret.

And some people are more familiar with ssh commands so they rather use SSH, then to learn netcat syntax.

Improve this answer
4
  • @Jakuke Thank you so much for your insight! That makes perfect sense. Now, Ncat was brought into the mix, which in my understanding is basically the encrypted version of netcat, would your tool of choice just depend on personal preference at that point?
    – Henry F
    Commented Dec 29, 2015 at 20:56
  • Personally, I am more ssh guy so I am still a bit confused between all the nc, ncat and netcat versions. I see Ncat has support for SSL encryption, but for it you would need another checks, keys, certificates and if there is already established the SSH infrastructure (even MS decided that it makes sense), establishing another secrets is for me waste of time and resources.
    – Jakuje
    Commented Dec 29, 2015 at 21:01
  • I see, that's really good to know. Thanks a lot for sharing your knowledge I appreciate it!
    – Henry F
    Commented Dec 29, 2015 at 21:06
  • And oftentimes in a pentest netcat is not such a stable connection. If you can use ssh you're connection is more robust. So often you get a first compromise with netcat, after that you add yourself to the users to get an ssh connection if possible and remove this afterwards.
    – secf00tprint
    Commented Oct 17, 2022 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .