A simple bash helper for ncat to spew an infinite stream of text on an arbitrary port. This stream is also technically valid HTTP for a file download, so opening your spew URL in a browser will cause it to start downloading your stream forever! Or at least until you tell it to stop. The bash script is easily modifiable for your own purposes; by default it will spew a lookalike of the CHARGEN protocol, but you can also chose to spew lines from a text file, piped command, or anything else that prints to stdout.
- bash
- ncat (NOT netcat! Specifically the utility written by the Nmap Project, for concurrency purposes)
- tcpdump (optional, for logging)
Run the ncat-spew script on any port using ncat:
ncat -l -k -p <PORT> -e ncat-spew.sh -m 65536 --send-only
The script itself can be run by a regular user with no special privileges, but you can also deploy it as a systemd service for ease of logging and restarting (example service definition provided).
Here's a useful tcpdump command to log inbound traffic to your spew port:
tcpdump -i <INTERFACE> --immediate-mode -U -w spew_$$(date +"%%Y%%m%%d_%%I%%M%%S").pcap --print -A "(src host <IP> and src port <PORT> and not tcp[13] = 24) or (dst host <IP> and dst port <PORT> and not tcp[13] = 16)
This capture will not include the output of your ncat-spew stream in order to save disk space (it does keep spewing forever...), but it will capture everything else. If you're running ncat-spew through something like Cloudflare Tunnels, you can parse the 'X-Forwarded-For' headers to determine which IPs are connecting to your spew port.
This service was written for the DawgCTF 2026 challenge "Stomach Bug". The challenge ciphertext is included in this repo as an example file to spew from. Feel free to use ncat-spew for your own CTF challenges if you think you could do something cool with it :3
