The $HOST
specification here is optional; if left off, nc binds to 0.0.0.0.
Note that nc will exit once the first connection closes.
(According to the nc docs, it looks like nc -l $HOST $PORT
should also work, but it doesn’t. I think — though I haven’t been able to verify — that what’s happening here is that -p
specifies the port to listen to, while the port following the $HOST
specification is the port to connect to.)
A netcat server doesn’t have to be used just for reverse shells. For example, you can also use it to catch web requests in conjunction with XSS or SQLi attacks.