Ncat allows users to read, write, redirect, and modify network data in some very interesting ways. Think about it as an enhanced version of the traditional tool netcat. Ncatoffers the possibility of running external commands in different ways once a connection has been established successfully. One way is with the help of Lua scripts that act as programs and allow users to perform any task they wish.
The following recipe will show you how to run a HTTP server contained in a Lua script with Ncat.
- Running Lua scripts against network connections in Ncat is very straightforward; just use the
--lua-execoption to point to the Lua script you want to execute and the listening port or host to connect:
$ncat --lua-exec <path to Lua script> --listen 80- To start a web server with Ncat, locate the
httpd.luascript inside your Ncat'sscriptfolder and use the command:
$ncat --lua-exec /path/to/httpd.lua --listen 8080 --keep-open- Ncat will start listening on port
8080and execute the Lua program specified on connection. You may verify that the script is running correctly by pointing a web browser to that direction and checking whether theGot a request formessage appears on the output.
If you have ever used netcat, you will be familiar with Ncat. Similarly, Ncat can be put into listening (--listen) and connect mode. However, netcat lacks the --lua-exec option, which serves the purpose of executing an external Lua program against network sockets. This option is very handy for scripting tasks aimed at testing or debugging a wide range of services. The main strength of using this execution mode is that the programs are cross-platform as they are executed on the same built-in interpreter.
The httpd.lua script is an example distributed with Ncat to illustrate service emulation, but it should be clear that our options are endless. Lua is a very powerful language, and many tasks can be scripted with a few lines.
Ncat offers a wide range of options that are documented thoroughly at https://nmap.org/ncat/guide/index.html. Do not forget to stop there and go over the full documentation.