GoCat Part 2: TLS, Proxies, and Interactive Mode

Part 1 gave you the raw pipe: listen, connect, TCP/UDP, IPv6, file transfer. Part 2 is about the two things plain netcat makes painful — encryption and routing — plus the conveniences that make the tool pleasant to actually sit in.

As in part 1: examples are illustrative. Confirm flag names with gocat --help on your build.

TLS without the duct tape#

With classic netcat, encryption means bolting openssl s_client onto one end and hoping both sides agree on termination. GoCat speaks TLS natively, so the encrypted channel is a first-class mode rather than a pipe union.

# TLS listener (server side)
gocat --tls -l 4444
 
# TLS client
gocat --tls 10.0.0.5 4444

Everything that worked over the plain pipe — chat, file transfer, piped commands — now runs inside a TLS session. What you get from TLS here is confidentiality and integrity in transit: passive observers on the path see ciphertext, and tampering breaks the session.

What you do not get for free is authentication. Real TLS security needs the client to verify who the server is; a tool that happily connects to any certificate is encrypting to someone, not the right someone. For anything beyond a lab, treat certificate verification and trust as your responsibility, not the tool's.

Routing through a proxy#

When egress must go through an HTTP or SOCKS proxy, GoCat carries the proxy configuration itself:

# Connect to the endpoint via a SOCKS5 proxy
gocat --proxy socks5://127.0.0.1:1080 10.0.0.5 4444
 
# Via an HTTP proxy
gocat --proxy http://127.0.0.1:8080 10.0.0.5 4444

This matters in two places: corporate networks where direct egress is blocked, and engagements where you want traffic to originate from a specific point rather than your own host. Combine with --tls and you have an encrypted channel through a proxy:

gocat --tls --proxy socks5://127.0.0.1:1080 10.0.0.5 4444

Interactive mode#

A raw pipe is unbuffered and unforgiving: no line editing, no history, easy to send a stray byte that kills a binary stream. Interactive mode is the human-friendly layer on top — line editing, history, and cleaner framing of what you send and receive. Use it when a person is at the keyboard driving the session; skip it when you are piping files, where you want the raw, unbuffered stream.

Rule of thumb:

• Person typing → interactive mode.
• Script or file on stdin → raw pipe, no interactive layer.

Multiple listeners#

Monitoring several ports normally means several terminals. GoCat's multiple-listener support lets one process watch more than one port, which is the difference between a wall of tabs and one pane for a lab box:

gocat -l 4444 -l 5555 -l 6666

Now one instance accepts connections across all three. Handy for catching a beacon on an unknown port, or for a lab range where you want a single collection point.

Putting it together#

The features in this part compose. A realistic lab command — an encrypted session routed through a proxy, driven by hand:

gocat --tls --proxy socks5://127.0.0.1:1080 10.0.0.5 4444

Part 3 takes the tool to the other side of the fence: scanning, reading binary protocols with hex output, and where a flexible network tool fits into a penetration test without overstating what it does.

Project: github.com/realibrahimsql/Gocat.