PAGES
← all tools
◆ Post-Exploitation

pwncat

v0.1.0 open-source

Netcat-based cyber tool supporting bind/reverse shells, port scanning, port forwarding, firewall/IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. evasion, and self-injecting shell deployment.

source ↗ rss ↗ What is a cyber toolchain?

Summary

pwncat is an open-source command-line tool, free to use, built as an extended netcat replacement with firewall and IDS/IPSIDS/IPSIntrusion Detection System / Intrusion Prevention System — network or host monitors that inspect traffic for known attack patterns, alerting on matches (IDS) or actively blocking them (IPS). evasion, bind and reverse shells, port forwarding, and port scanning, and it can be scripted in Python. It runs from the terminal on Linux, handling tasks like reconnecting reverse shells, self-injecting a shell over an existing connection, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port scans with banner detection, and forwarding local or remote ports to services such as MySQL. This puts it in the hands of red teamers and penetration testers doing post-exploitation work on compromised hosts, and its own documentation frames it as netcat on steroids rather than a plain replacement. It dates to a 2020 first commit with five contributors, but there have been no commits in the past year, so it should be treated as dormant rather than actively maintained.

Netcat-based cyber tool supporting bind/reverse shells, port scanning, port forwarding, firewall/IDS evasion, and self-injecting shell deployment.

How pwncat helps

Which ports and services are actually reachable on a host I've landed on?

runs a TCP scan against the target and grabs banners on open ports, giving service and version detail rather than a bare open/closed list

Can I turn a connection I already have into a full interactive shell?

injects a shell over the existing socket in place, so the foothold upgrades without opening a second connection an IDS might catch

How do I reach an internal database that's only listening on the compromised host?

forwards a local or remote port through the session to the internal service, so a client on my machine talks to it as if it were local

Will my shell traffic get flagged by the network's firewall or IDS?

shapes and evades traffic at the firewall/IDS level as part of the shell session, rather than sending a plain unencoded stream

How do I script a repeatable post-exploitation sequence instead of typing it by hand each time?

exposes its shell and connection handling to Python so the same reconnect, inject, or forward steps can be driven from a script

all 6 features, with the evidence for each →

Languages

Not documented

Features

6 capabilities

Built from pwncat's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What pwncat offers you

  • Command-line interface1
All capabilities 6 capabilities
Reverse shell shipped Establishes an interactive command shell to a remote listener, with support for automatic reconnection. 17 releases · 10 other sources · first seen Apr 2020

release 17 total

  • --no-shutdown keeps stdin open after EOF, matching OpenBSD netcat behavior (also closes via Changed behaviour to close after EOF on stdin) v0.1.0 · Jun 2020 · source · release history
  • Default behavior now closes connection after EOF on stdin; use --no-shutdown to revert v0.1.0 · Jun 2020 · source · release history
  • send-on-eof flag triggers data transmission upon standard input end-of-file v0.1.0 · Jun 2020 · source · release history
  • Adds --rebind-robin flag to enable round-robin port hopping during rebinds 0.0.22-alpha · May 2020 · source · release history
  • Adds --safe-word flag to trigger a specific action when a hidden safeword is detected in input 0.0.22-alpha · May 2020 · source · release history
  • Adds --rebind-wait flag to specify delay duration between reconnection attempts 0.0.22-alpha · May 2020 · source · release history

example 10 total

  • Transmit buffered data immediately when standard input reaches EOF. echo 'data' | pwncat --send-on-eof <target> v0.1.0 · Jun 2020 · source
  • Inject reverse shells to specific disjoint ports. pwncat --self-inject --port 443,8080,9090 0.0.21-alpha · May 2020 · source
  • Inject reverse shells to multiple consecutive ports starting from 443. pwncat --self-inject --port 443+10 0.0.21-alpha · May 2020 · source
  • Bind --local without specifying a local address to allow the OS to pick an available wildcard bind. pwncat --listen -L :8080 <host> <port> 0.0.19-alpha · May 2020 · source
  • Use endless retries by omitting the argument for --rebind. pwncat --rebind <target> 0.0.17-alpha · May 2020 · source
  • Connect to an IPv6 target using the new flag. pwncat -6 <target> 0.0.17-alpha · May 2020 · source
Port scanning shipped Scans target hosts for open TCP ports and detects service banners. 1 release · 1 other source · first seen May 2020

release

  • Adds --udp-sconnect and --udp-sconnect-word flags for stateless UDP connection simulation 0.0.22-alpha · May 2020 · source · release history

example

  • TCP port scan with banner detection pwncat -z 10.0.0.1 1-65535 --banner
Port scanning improvements shipped Adds stealthy port scanning capabilities and stateful UDP connection simulation. 1 release · 1 other source · first seen May 2020

release

  • Adds --zero flag to enter Zero-I/O mode for passive port scanning 0.0.22-alpha · May 2020 · source · release history

example

  • Run a stealthy port scan without establishing connections or sending data pwncat -L localhost --zero 10.0.0.1/24 0.0.22-alpha · May 2020 · source
Reconnection mechanisms shipped Provides automatic reconnection with configurable retry strategies including round-robin port hopping and delay settings. 1 release · 1 other source · first seen May 2020

release

  • Adds --rebind flag to automatically reconnect indefinitely if the connection drops 0.0.22-alpha · May 2020 · source · release history

example

  • Keep a reverse shell alive by automatically reconnecting every 5 seconds if the host drops it pwncat -L localhost 1337 --rebind --rebind-wait 5 0.0.22-alpha · May 2020 · source
Port forwarding shipped Redirects network traffic from one port to another, supporting both local and remote proxy configurations. 2 other sources

example

  • Local port forward to remote MySQL pwncat -L 0.0.0.0:5000 everythingcli.org 3306
  • Remote port forward double client proxy pwncat -R 10.0.0.1:4444 everythingcli.org 3306
Bind shell shipped Opens a listening port on the target machine to allow incoming connections as an interactive command shell. 1 other source

Also counts toward: Command-line interface

example

  • Start persistent bind shell pwncat -l -e '/bin/bash' 8080 -k

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for pwncat, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail pwncat puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

8 entries

  1. June 20201
  3. May 20206
  10. April 20201
    Show

    8 entries

    1. v0.1.0 Jun 21, 2020 · release notes

      Adds --http, send-on-eof and --no-shutdown CLI flags to control HTTP serving and EOF behavior

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.1.0 https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout v0.1.0
      └──▷ USE IT
      Transmit buffered data immediately when standard input reaches EOF.
      shell 
      echo 'data' | pwncat --send-on-eof <target>
      • send-on-eof flag triggers data transmission upon standard input end-of-file
      • --no-shutdown keeps stdin open after EOF, matching OpenBSD netcat behavior (also closes via Changed behaviour to close after EOF on stdin)

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Default behavior now closes connection after EOF on stdin; use --no-shutdown to revert
    2. 0.0.22-alpha Prerelease May 28, 2020 · release notes

      Add rebind, port hopping, zero-I/O, and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connect capabilities to pwncat CLI

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.22-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.22-alpha
      └──▷ USE IT
      Keep a reverse shell alive by automatically reconnecting every 5 seconds if the host drops it
      shell 
      pwncat -L localhost 1337 --rebind --rebind-wait 5
      Run a stealthy port scan without establishing connections or sending data
      shell 
      pwncat -L localhost --zero 10.0.0.1/24
      • Adds --rebind flag to automatically reconnect indefinitely if the connection drops
      • Adds --rebind-wait flag to specify delay duration between reconnection attempts
      • Adds --rebind-robin flag to enable round-robin port hopping during rebinds
      • Adds --ping-init flag to send an initial ping packet upon connection establishment
      • Adds --zero flag to enter Zero-I/O mode for passive port scanning
      +2 more show less
      • Adds --safe-word flag to trigger a specific action when a hidden safeword is detected in input
      • Adds --udp-sconnect and --udp-sconnect-word flags for stateless UDP connection simulation

      7 details in Everything

    3. 0.0.21-alpha Prerelease May 23, 2020 · release notes

      pwncat 0.0.21-alpha adds multi-port injection via --self-inject with range/increment support

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.21-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.21-alpha
      └──▷ USE IT
      Inject reverse shells to multiple consecutive ports starting from 443.
      shell 
      pwncat --self-inject --port 443+10
      Inject reverse shells to specific disjoint ports.
      shell 
      pwncat --self-inject --port 443,8080,9090
      • Adds --self-inject flag to inject multiple reverse shells using a port list (comma-separated, range, or increment).
      • Expands the port argument syntax to support increment notation (e.g., 443+10) alongside comma-separated values and ranges.

      2 details in Everything

    4. 0.0.19-alpha Prerelease May 19, 2020 · release notes

      pwncat 0.0.19-alpha adds dualstack IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. by default and optional --local addr

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.19-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.19-alpha
      └──▷ USE IT
      Force IPv4-only connectivity instead of the default dualstack behavior.
      shell 
      pwncat -4 <host> <port>
      Bind --local without specifying a local address to allow the OS to pick an available wildcard bind.
      shell 
      pwncat --listen -L :8080 <host> <port>
      • -4 or -6 flags now let you select single-stack IPv4 or IPv6 exclusively when the default dualstack is undesirable.
      • --local (and -L) no longer requires the addr part, enabling wildcard binds for consistency.
      • UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connections now use a stateful connect phase for better reliability.

      3 details in Everything

    5. 0.0.17-alpha Prerelease May 13, 2020 · release notes

      pwncat 0.0.17-alpha adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support and improves --rebind retry behavior

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.17-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.17-alpha
      └──▷ TRY IT
      Connect to an IPv6 target using the new flag.
      $ pwncat -6 <target>
      Use endless retries by omitting the argument for --rebind.
      $ pwncat --rebind <target>
      • Adds -6 flag to enable IPv6 connectivity
      • Updates --rebind to allow omitting an argument for endless connect retries

      2 details in Everything

    6. 0.0.14-alpha Prerelease May 8, 2020 · release notes

      Adds PSEStore instance for data persistence in scripts and a new chat-bot PSE plugin.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.14-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.14-alpha
      • Added chat-bot PSE

      1 detail in Everything

    7. 0.0.11-alpha Prerelease May 7, 2020 · release notes

      Adds --ping-word CLI flag, --crlf argument support, and unified * options

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.11-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.11-alpha
      └──▷ USE IT
      Set a custom word for the connection keepalive ping mechanism.
      shell 
      pwncat -p <port> --ping-word myPing
      Force CRLF line endings on all incoming and outgoing traffic.
      shell 
      pwncat -p <port> -C CRLF
      • Adds --ping-word option to specify a custom ping word.
      • -C/--crlf now accepts an argument to force LF, CRLF, CR or remove line feeds on input AND output.
      • Unified --udp-* options to --* to allow both UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections.

      3 details in Everything

    8. 0.0.2-alpha Prerelease Apr 18, 2020 · release notes

      Adds -e command execution and -n skip-DNS flags

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.0.2-alpha https://github.com/cytopia/pwncat.git
# already have the repo? check out this version:
$ git checkout 0.0.2-alpha
      └──▷ USE IT
      Execute a remote shell command after establishing the connection.
      shell 
      pwncat -e 'ls -la' <target>
      • Adds -e/--exec flag to execute shell commands directly via the CLI

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !Project renamed from netcat to pwncat; users must update references and package names accordingly.

    Project health

    Issue, contributor and maintainer activity in cytopia/pwncat, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 13 of 48 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 13
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,960
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    1 article · updated Nov 4, 2026

    Where pwncat turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    Tutorials & guides 1

    • A Detailed Guide on Pwncat Hacking Articles
      Pwncat penetration testing tool stands out as an open-source Python tool highly regarded for its versatility, providing a contemporary alternative to the traditional netcat utility.
      2 more quotes
      With an emphasis on user-friendly features and comprehensive functionality, Pwncat penetration testing tool facilitates seamless interactions with network services, aiding in reconnaissance and vulnerability assessment.
      To install using apt use the following command: apt install pwncat To install using pip use the following command: pip install pwncat Usage Port scanning and Banner grabbing Pwncat can be used to perform both port…

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback