Hands-On Red Team Tactics

Unencrypted reverse connections using netcat

Reverse connections can be initiated over an unencrypted channel or an encrypted one. To understand reverse connections, let's use a tool called netcat.

We started the listener on port 8080 and checked whether or not the port was in the LISTEN state by using the following command:

nc -lv 8080  
netstat -an | grep 8080 

The -b option is intended for the interface to listen on. This option is only available on a few versions of netcat.

Let's start tcpdump on port 8080. tcpdump will help us analyze network packets on the wire. To start tcpdump, run the following command:

sudo tcpdump -XX -i lo0 port ...