How can I use netcat like ping?

Question

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?

Answer 1

To identify if a server is running, you only need to determine if the port is open for requests. Using netcat, you can query a server like this:

nc -z www.example.com 80

This will tell you if it's listening on port 80, the web port, but it won't tell you anything else about the server.

To use netcat to learn more, you need to pass it the correct data to elicit a valid response. That means you have to understand http if you want to find out if it's running a web server, smtp if it's running a mail sender, etc. You have to know what port a web server runs on, the name of the server, the protocol, everything.

Here's a simple example of how I'd determine if www.example.com was hosting a live web server using netcat.

echo -e "GET http://www.example.com HTTP/1.0\n\n" | nc www.example.com 80 | less 

If this comes back with a response containing HTTP/1.0 200 OK, it's running a web server on port 80. If not, it may not be running a typical web server.

You'll have to discover and understand the protocols of mail servers and ssh servers if you want to query them in a similar fashion.

Netcat is really the wrong tool for this job, however. If you want to identify the kinds of servers a host is running, nmap is a much better tool as it's kept current with the various fingerprints of common servers you're likely to encounter.

Answer 2

Answer to what has been asked, no extra suggestions or information.

To test if the service is running on the remote server.

nc -zvn IP PORT

ex. to test smtp

nc -zvn 10.8.0.45 25

Answer 3

As I said on superuser.com:

Yes, use HPing to do that:

$ sudo hping -S -p 80 google.com
HPING google.com (p5p1 77.237.27.37): S set, 40 headers + 0 data bytes
len=46 ip=77.237.27.37 ttl=58 id=25706 sport=80 flags=SA seq=0 win=29200 rtt=7.5 ms
len=46 ip=77.237.27.37 ttl=58 id=25707 sport=80 flags=SA seq=1 win=29200 rtt=7.4 ms
len=46 ip=77.237.27.37 ttl=58 id=25708 sport=80 flags=SA seq=2 win=29200 rtt=8.5 ms
len=46 ip=77.237.27.37 ttl=58 id=25709 sport=80 flags=SA seq=3 win=29200 rtt=7.8 ms
^C
--- google.com hping statistic ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 7.4/7.8/8.5 ms

Note that it needs root privileges (or SELinux capabilities) to create raw IP packets, just like ping (which is most likely suid on your system).

Source: https://superuser.com/a/769980/171552

Answer 4

This may answer your question; netcat can do some port scanning:

"Port-scanning is a popular method for exploring what's out there. Netcat accepts its commands with options first, then the target host, and everything thereafter is interpreted as port names or numbers, or ranges of ports in M-N syntax. CAVEAT: some port names in /etc/services contain hyphens -- netcat currently will not correctly parse those, so specify ranges using numbers if you can. If more than one port is thus specified, netcat connects to all of them, sending the same batch of data from standard input [up to 8K worth] to each one that is successfully connected to. Specifying multiple ports also suppresses diagnostic messages about refused connections, unless -v is specified twice for "more verbosity". This way you normally get notified only about genuinely open connections. Example: nc -v -w 2 -z target 20-30 will try connecting to every port between 20 and 30 [inclusive] at the target, and will likely inform you about an FTP server, telnet server, and mailer along the way. The -z switch prevents sending any data to a TCP connection and very limited probe data to a UDP connection, and is thus useful as a fast scanning mode just to see what ports the target is listening on. To limit scanning speed if desired, -i will insert a delay between each port probe. There are some pitfalls with regard to UDP scanning, described later, but in general it works well."

http://nc110.sourceforge.net