Network-Servers-Penetration-Guides-and-Tools

Networking 101

⚠ Networking 101 is a simple introduction to the most important network concepts for ethical hacking. This is a huge subject and is recommended to learn from different sources like courses, books and certifications like Cisco CCNA or CompTIA Network+. Also there is a ton of free training out there, I recommend to check this list later.

Objectives

This module follows the order:

  1. Introduction
  2. IP and MAC Addresses
  3. Subnetting
  4. TCP, UDP and 3-Way-Handshake
  5. Ports & Protocols
  6. OSI Model

1. Introduction

So, what the heck is a Network?

A network consists of two or more computers that are linked in order to share resources. Computer networks are the basis of communication in IT. They are used in a huge variety of ways and can include many different types of network. A computer network is a set of computers that are connected together so that they can share information. The earliest examples of computer networks are from the 1960s, but they have come a long way in the half-century since then.

net

LAN Network Topology - SOHO / Small Home Network

Two very common types of networks include: LAN (Local Area Network) and WAN (Wide Area Network)

Topologies

There are many different types of network, which can be used for different purposes and by different types of people and organization. Here are some of the network types that you might come across:

LAN - Local Area Network

WAN - Wide Area Network

MAN - Metropolitan Area Network

Internet

Connecting WANs through WANs until complete the entire world = Internet.

Intranet

If you’re using the TCP/IP stack and making your own LAN or WAN = Intranet.

Common Terms in Networking

2. IP & MAC Address

What is an IP Address (Internet Protocol)?

ip

An IP address is a unique address that identifies a device on the internet or a local network. IP stands for “Internet Protocol,” which is the set of rules governing the format of data sent via the internet or local network.

Check your local IP address

  1. If you are using Linux or MacOS you can open your terminal and type ifconfig command
  2. For Windows machine you can open up the cmd prompt or powershell, then type ipconfig /all

inet

More about the IPv4 decimal value:

IPv4 = 32 bits range (4 octets of 8 bits, from 0-255 each(4))

11000000.10101000.01000000.00000011   [IPv4 binary]
   192  .   168  .   64   .  3        [IPv4 decimal]

The arithmetic behind IPv4:

0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1
8th bit 7th bit 6th bit 5th bit 4th bit 3rd bit 2nd bit 1st bit
128 (2^7) 64 (2^6) 32 (2^5) 16 (2^4) 8 (2^3) 4 (2^2) 2 (2^1) 1 (2^0)

Here is how binary octets convert to decimal: The right most bit, or least significant bit, of an octet holds a value of 2^0. The bit just to the left of that holds a value of 2^1. This continues until the left-most bit, or most significant bit, which holds a value of 2^7. So if all binary bits are a one, the decimal equivalent would be 255 as shown here:

  1   1   1   1   1   1   1   1
  |   |   |   |   |   |   |   |
(128 +64 +32 +16 +8  +4  +2  +1) --> 255 

Example of octet conversion:
IP Address: 192.168.64.3

To calculate the first octet (192.), from binary format to decimal:

128  64  32  16  8   4   2   1         
 |   |   |   |   |   |   |   |
 1   1   0   0   0   0   0   0          
 |   |   |   |   |   |   |   |
128+ 64+ 0+  0+  0+  0+  0+  0 = 192   ---> final value (firt octet IPv4 in decimal)

⚠️ Why? Computers see everything in terms of binaryll; on and off.

IPv4 and IPv6

ipv

Private and Public IP Addresses

All IPv4 addresses can be divided into two major groups: global (or public, external) - this group can also be called ‘WAN addresses’ — those that are used on the Internet, and private (or local, internal) addresses — those that are used in the local network (LAN).

priv-pub

More about Private IP addresses:

Private (internal) addresses are not routed on the Internet and no traffic can be sent to them from the Internet, they only supposed to work within the local network. Private addresses include IP addresses from the following subnets:

private-ip

NAT - Network Address Translation

NAT stands for network address translation. It’s a way to map multiple local private addresses to a public one before transferring the information. Organizations that want multiple devices to employ a single IP address use NAT, as do most home routers.

nat2

  1. Static NAT

    When the local address is converted to a public one, this NAT chooses the same one. This means there will be a consistent public IP address associated with that router or NAT device.

  2. Dynamic NAT

    Instead of choosing the same IP address every time, this NAT goes through a pool of public IP addresses. This results in the router or NAT device getting a different address each time the router translates the local address to a public address.

⚠️ IP Addresses operates on Layer 3 of OSI Model

Note: This module will cover OSI model later.

osi3

3. Subnetting

Why subnetting?

The way IP addresses are constructed makes it relatively simple for Internet routers to find the right network to route data into. However, in a Class A network (for instance), there could be millions of connected devices, and it could take some time for the data to find the right device. This is why subnetting comes in handy: subnetting narrows down the IP address to usage within a range of devices.

Because an IP address is limited to indicating the network and the device address, IP addresses cannot be used to indicate which subnet an IP packet should go to. Routers within a network use something called a subnet mask to sort data into subnetworks.

⚠️ Subnetting is really important for penetration testers and aspiring hackers, eventually you will face several cases involving small or large networks in your future engagements. Understanding the IP address type, range, available hosts is crucial for any network analysis.

Cheat sheet makes easier for subnetting

subnetting

Exercises:

Subnetting comes in handy to awnser basic questions like:

IP range Subnet Hosts Network Broadcast
192.168.1.16/28 255.255.255.240 14 192.168.1.16 192.168.1.31
192.168.0.0/22 ? ? ? ?

bits

IP range Subnet Hosts Network Broadcast
192.168.0.0/22 255.255.252.0 1022 192.168.0.0 192.168.3.255

Other relevant information about IPs

MAC Addresses

macphys

The first three bytes of a MAC address were originally known as OUI’s, or Organizational Unique Identifiers. Each manufacturer of networking equipment was assigned an OUI, and was free to assign their own numbers in that block.

   OUI     NIC
    |       |
________ ________
00:0c:29:99:98:ca

Checking vendor behind MAC addresse

  1. Check your MAC address use the command ifconfig (Linux) or /ipconfig (Windows) mac

  2. Copy and save the first three bytes of your address. (The first three bytes from image above is 00:0c:29)

  3. Validate the information by performing a MAC Address Lookup on the internet. For this example I’m using: https://aruljohn.com/ mac2

  4. As you can see the OUI lookup identify a virtual network interface provided by VMware

So, to summarize, the first three bytes are assigned to a manufacturer of networking equipment and the manufacturer assigns the last three bytes of an address.

⚠️ MAC Addresses operates on Layer 2 of OSI Model

osil2

4. TCP/IP, UDP and 3-Way-Handshake

Transmission Control Protocol/Internet Protocol (TCP/IP)

TCP enables data to be transferred between applications and devices on a network. It is designed to break down a message, such as an email, into packets of data to ensure the message reaches its destination successfully and as quickly as possible.

TCP means Transmission Control Protocol, which is a communications standard for delivering data and messages through networks. TCP is a basic standard that defines the rules of the internet and is a common protocol used to deliver data in digital network communications.

tcpmod

TCP/IP Model

TCP is the most commonly used of these protocols and accounts for the most traffic used on a TCP/IP network. UDP is an alternative to TCP that does not provide error correction, is less reliable, and has less overhead, which makes it ideal for streaming.

The User Datagram Protocol (UDP)

Is a lightweight data transport protocol that works on top of IP. UDP provides a mechanism to detect corrupt data in packets, but it does not attempt to solve other problems that arise with packets, such as lost or out of order packets. That’s why UDP is sometimes known as the Unreliable Data Protocol. UDP is simple but fast, at least in comparison to other protocols that work over IP. It’s often used for time-sensitive applications (such as real-time video streaming) where speed is more important than accuracy.

The TCP format

tc

The UDP format

udp

TCP Handshake

TCP uses a three-way handshake to establish a reliable connection. The connection is full duplex, and both sides synchronize (SYN) and acknowledge (ACK) each other. The exchange of these four flags is performed in three steps:

  1. SYN
  2. SYN-ACK
  3. ACK

3wayhandshake

The three message mechanism is designed so that two computers that want to pass information back and forth to each other can negotiate the parameters of the connection before transmitting data such as HTTP browser requests.

More TCP Flags

Flag Name Function
SYN Synchronize Set during initial communication. Negotiating of parameters and sequence numbers
ACK Acknowledgment Set as an acknowledgement to the SYN flag. Always set after initial SYN
RST Reset Forces the termination of a connection (in both directions)
FIN Finish Ordered close to communications
PSH Push Forces the delivery of data without concern for buffering
URG Urgent Data inside is being sent out of band. Example is cancelling a message

Capturing 3 Way handshakes (Example)

wireshark

5. Ports & Protocols

What is a Port?

In computer networking, a port is a communication endpoint. At the software level, within an operating system, a port is a logical construct that identifies a specific process or a type of network service.

The most common ports

As a penetration tester or ethical hacker you should be familiar with the common ports and protocols used by popular services.

Port Numbers

6. OSI Model

OSI Model is a hypothetical networking framework that uses specific protocols and mechanisms in every layer of it. This model is used to divide the network architecture into seven different layers conceptually. These layers are:

osi-model

There also involves some security postures and mechanisms that a security professional must know to detect and put the security method effectively in every layer.

More about the Layers:

Layer 7 - Application

l7

Layer 6 - Presentation

l6

Layer 5 - Session Layer

l5

Layer 4 - Transport Layer

l4

Layer 3 - Network Layer

l3

Layer 2 - Data Link Layer

l2

Layer 1 - Physical Layer

l1