|
Getting into cyber security can be a daunting task because there are so many subjects with infinite depth. But that’s OK. In fact, that is what most professionals love about the information security space, the fact that the subject matter is always evolving. To get everyone started I am going to share a few resources on obtaining knowledge. These sites will be applicable whether you have been in the field for years or just getting started. Feel free to send me more resources and I will treat this as an evolving blog.
General Security: Security Tube http://www.securitytube.net/ Description Security Tube offers a massive collection of tutorials, conference videos and a series called Megaprimers. The megaprimers series presents guides on various subjects such as assembly code, Metasploit, and penetration testing to name a few. Cybrary https://www.cybrary.it/ Description Cybrary offers many introductory courses as well as many courses geared towards certifications such as ITIL, Sec+, and MCSA. Microsoft Virtual Academy https://mva.microsoft.com/ Description Contains good training on Microsoft products. Who better to learn from than the creator of the products right? Penetration Testing: VulnHub https://www.vulnhub.com/ Description Vulnhub is one of the best places to go to get your hands dirty with offensive tactics. The site consists of a repository or vulnerable systems and guides for each system. HacktheBox https://www.hackthebox.eu/ Description OSCP style boxes where you VPN into a network and attempt to compromise systems. The systems are broken down into difficulty levels and operating systems, so you can target certain skill-sets.
0 Comments
Network Recon Summary
Nmap is a fundamental tool that most people with use to conduct network reconnaissance against targets. In addition to the networking capabilities, Nmap has a large library of scripts for attacks, enumeration, password attacks and more. Breaking down the default scan (no options) $ nmap 192.168.1.1 Note: We will break down the nmap scan one option at a time. After describing the option we will add it to the command and move on. This process is towards the endeavor that you better understand your tools. TCP SYN scan An nmap scan with no options defaults to a TCP SYN scan aka half-open scan, the -sS option (nmap -sS <ip> ). The scan is said to be a stealthier scan as a completed three-way handshake never occurs ( https://www.techopedia.com/definition/10339/three-way-handshake ). This is what the command would look like: $ nmap -sS 192.168.1.1 Additional Default Options In addition, according to the man page, “If no host discovery options are given, Nmap sends an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request… These defaults are equivalent to the -PE -PS443 -PA80 -PP options.” The interpreted command without options thus far would look like: $ nmap -sS -PE -PS 443 -PA 80 -PP 192.168.1.1 Top 1,000 Ports As far as port scanning goes nmap will default to the top 1,000 ports. Making the command now as follows: $ nmap -sS -PE -PS 443 -PA 80 -PP --top-ports 1000 192.168.1.1 Scanning Ports Networking can be summed up with two types of traffic TCP (stateful) and UDP (stateless). To read about the differences check out the following link http://www.diffen.com/difference/TCP_vs_UDP . One thing to remember when running UDP scans, they take much longer to run than TCP scans. What this means is that we don’t want to scan all UDP ports. Feel free to scan all 65,535 TCP ports, in CTF's especially admins like to run services on non-standard ports. Both can be scanned at the same time using the following syntax where “T:” is for TCP ports and “U:” is for UDP ports: $ nmap -p T:1-65535,U:161,162 192.168.1.1 Fingerprinting Two additional options that are needed for good initial reconnaissance is Service, Service Version, and Operating System. These bits of information will guide what other attacks and recon methods you choose to use. One thing to note is that OS will not always be accurate but the information is great if you can get it. $ nmap -sV -O 192.168.1.1 Starter SyntaxBelow is a good start for your Nmap network scan command: Nmap -O -sV -p T:1-65535,U:161,162 192.168.1.1 Conclusion Hopefully, this has helped you better understand Nmap and how powerful the tool is. Please visit https://nmap.org to learn more and really dig into the great documentation that Fyodor Vaskovich and his team has put together. After you have conquered the basics don’t forget to check out the NSE scripts. |
AuthorSilverbits Categories
All
Archives
January 2023
|
RSS Feed