_ ReconLab
Commands  / Post-Exploitation  / socat

socat

Multipurpose relay — “netcat on steroids”.

KaliParrotLinuxmedium

pkg: socat

socat connects two bidirectional byte streams (sockets, files, PTYs, TLS) and is ideal for fully-interactive and encrypted shells.

Syntax

socat {addr1} {addr2}

Example

socat TCP-LISTEN:4444,reuseaddr FILE:`tty`,raw,echo=0

Listens on 4444 and binds the shell to a real PTY for a fully-interactive reverse shell.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

TCP-LISTEN:PORTListen for TCP on a port (add ,reuseaddr,fork).
FILE:`tty`,raw,echo=0Bind to a real PTY for a fully-interactive shell.
EXEC:cmdExecute a program and connect its I/O.
OPENSSL:host:portConnect over TLS.
OPENSSL-LISTEN:portListen with TLS (encrypted shell).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

socat

Usage examples

socat TCP-LISTEN:4444,reuseaddr,fork FILE:`tty`,raw,echo=0

Catch a fully-interactive reverse shell.

socat OPENSSL-LISTEN:4444,cert=s.pem,verify=0 STDOUT

Encrypted listener.

Advantages
  • Far more capable than nc
  • TLS-encrypted channels
  • Proper PTY/interactive shells
Disadvantages
  • Dense, cryptic syntax
  • Not installed by default everywhere
  • Easy to misconfigure
Tags
#relay#shell#tls

Official docs: socat ↗

Related commands

Chisel

Fast TCP/UDP tunnel over HTTP/SSH.

Netcat (nc)

The TCP/IP “swiss-army knife”.

Frequently asked questions

What is socat used for?
socat connects two bidirectional byte streams (sockets, files, PTYs, TLS) and is ideal for fully-interactive and encrypted shells.
What is an example socat command?
A common example is: socat TCP-LISTEN:4444,reuseaddr FILE:`tty`,raw,echo=0 — Listens on 4444 and binds the shell to a real PTY for a fully-interactive reverse shell.
Is socat part of Kali Linux?
Yes. socat ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install socat.
What category of security tool is socat?
socat is a Post-Exploitation tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →