GoCat Part 1: A Modern netcat Alternative in Go

GoCat is a cross-platform netcat alternative written in Go. This is a three-part series: the core workflows here, the secure and convenient features in part 2, and how it fits into security testing in part 3.

Command examples in this series are illustrative. Flag names and flags differ between versions — always confirm against gocat --help for the build you actually have. Where a capability is listed here, it comes from the project's documented feature set: TCP/UDP, SSL/TLS, proxy support, file transfer, port scanning, interactive mode, IPv6, hex output, and multiple listeners.

Why not just use netcat?#

Netcat earned its "TCP/IP Swiss Army knife" title, but its edges are dulled by 1990s assumptions:

• No native TLS. You pipe through openssl s_client or ncat --ssl and hope the tooling agrees.
• No IPv6 on classic nc. The traditional build is IPv4-only.
• Platform drift. The BSD nc, GNU netcat, and Nmap's ncat are three different tools wearing one name, with different flags for the same job.
• Opaque hex. You get a wall of bytes or nothing useful for binary protocols.

Go fixes the boring parts: a single static binary with no runtime dependencies, first-class concurrency, and a standard library that already speaks TLS, DNS, and both IP stacks.

Install#

GoCat is a Go program. If you have a Go toolchain, the idiomatic path is:

go install github.com/realibrahimsql/Gocat@latest

Or grab a prebuilt binary for your platform from the project releases and put it on your PATH. Confirm it runs:

gocat --version
gocat --help

Listening and connecting#

The two primitives are the same as any netcat: listen on a port, or connect to one.

# Listen on TCP port 4444
gocat -l 4444
 
# Connect to a host on TCP 4444
gocat 10.0.0.5 4444

In one terminal, listen; in another, connect. Everything you type in one appears in the other. That raw bidirectional pipe is the foundation for every later use — chat, banner grabbing, file transfer, reverse shells in a lab.

TCP versus UDP#

TCP gives you ordering and delivery; UDP gives you datagrams with no handshake. Pick the transport explicitly:

# UDP listener
gocat -u -l 5555
 
# UDP client
gocat -u 10.0.0.5 5555

Reach for UDP when the target service speaks it (DNS, syslog, some game and discovery protocols). Everything else is TCP.

IPv6#

Because GoCat targets both IP stacks, an IPv6 address needs no special flag — just use the address form:

gocat -l 4444                      # binds a listener
gocat 2001:db8::10 4444            # connects over IPv6

Moving files#

A netcat pipe is a file transfer channel. Redirect on each end:

# Receiver: listen and write to disk
gocat -l 4444 > received.tar.gz
 
# Sender: feed the file into the connection
gocat 10.0.0.5 4444 < archive.tar.gz

No checksums, no resumable progress — this is the raw pipe. For integrity, send a hash separately and verify:

sha256sum archive.tar.gz

This is a fine way to move a file between two hosts on a trusted segment. It is not a replacement for scp or rsync across untrusted networks, where you want encryption and authentication. Part 2 covers the TLS path.

Where this is going#

The core is a bidirectional pipe over TCP, UDP, or IPv6. Part 2 adds TLS, proxying, interactive convenience, and running more than one listener at once. Part 3 turns the tool toward security work — port scanning, binary protocols via hex output, and the lab scenarios where a tool like this earns its place.

Project: github.com/realibrahimsql/Gocat.