Networking Tools
This is a room for the Networking Tools session — https://pitch.com/v/Networking-Tools-i6d7aq
by Malvika Meena
Task 1 Intro to the Room
Intro to the Room
Welcome to our Networking Tools practice room!
Network analysis tools are powerful tools that allow us to explore and troubleshoot networks, identify security weaknesses, and monitor traffic.
Each tool offers unique capabilities to help us gain insight into the networks we manage.
Today, we’ll be exploring the features of each tool, how to use them, and how they can help us in our network management responsibilities. We’ll start by learning about Nmap and its various scanning techniques.
We’ll then move on to Wireshark, where we’ll discuss ways to detect anomalies in network traffic.
Finally, we’ll explore the various network commands and learn how to use them to manage and troubleshoot networks.
By the end of the session, you will have the skills and knowledge necessary to use these tools for effective network analysis. So, let’s get started!
Answer the questions below
Are you ready to start? (Yes / No)
answer- yes
Task 2 Exercise Preparation
Start the AttackBox — Linux VM (Virtual Machine)
Question Done/ no answer needed
Open the Terminal
Question Done/ no answer needed
Do you have your note-taking tool open? (Yes / No)
yes
Task 3 Nmap
Start Machine
You should first start the ‘virtual machine’ by pressing the green “Start Machine” button on the top-right corner, indicated by the black arrow on the right.
Nmap
What Is It?
Nmap (Network Mapper) is an open-source network discovery and auditing security scanner.
What Can You Do With It?
1. Scan for open ports on a network and identify the services running on them.
2. Perform network inventory and asset tracking.
3. Detect security vulnerabilities.
4. Perform OS and version detection.
5. Troubleshoot network problems.
6. Test firewalls and intrusion detection systems.
7. network mapping.
And more
How To Use It?
Run the command nmapwith different flags against an IP or network.
Nmap Common Flags
Flag
Use
-T{0–5}
Sets the timing template (Speed) 0 — Paranoid 5 — Aggressive
-O
Detect the operating system of the target system.
-sV
Detect the version of the services running on the target system.
-A
Detect OS and applications running on the target system.
-sS
Stealthy scan — Does not complete the 3-way TCP handshake.
-sU
Scans UDP ports
-sC
Default script scanning — Checks for common vulnerabilities.
-p-
Scans all ports
-p 1–800
Scans a range of ports
-p 20,21,80,443
Scans specific ports
Answer the questions below
Make sure that your AttackBox and VM is up and ready to use
Question Done /no answer required
First, we will use Nmap on our AttackBox to scan the VM with a speed of 4; which flag will you use to perform this scan?
answer: -T4
How many open ports do we have on the VM?
answer: 2
Which ports are open?
answer: 21,22
Which services are running on those ports?
answer: ftp,ssh
Now that we have some basic information let’s move to the next step and scan them with more flags to get more information.
no answer required
Which flag will you use to scan specific ports?
answer: -p
Which flag will you use to detect which OS and applications running are running?
answer: -A
Which flag will you use to use checks for common vulnerabilities?
answer: -sC
Use all the flags in one scan against the VM
answer: nmap -T4 -A -sC -p 21,22 10.10.10.89
According to the results, which OS does this VM use? W — Windows / L — Linux / M -MacOS
answer: -L
According to the results, does the FTP server allows anonymous FTP login? (Y/N)
answer: Y
Let’s log in to this FTP server with the username and password of anonymous
no answer required
login name : Anonymous
password: 230
get <file _name >
How many items can we see in this FTP server?
answer: 1
What is the name of the file?
answer: Networking_Tools.pcapng
Try to download it and exit the FTP server
Question Done
Hint
Get Malvika Meena’s stories in your inbox
Join Medium for free to get updates from this writer.
Try to run different flags, play with nmap, use man nmap to see all the flags, and learn more about Nmap. Once you are ready, move over to Wireshark
no answer required
here is the implementation of all the commands which are used to get the answers of all the questions above
Task 4 Wireshark
Wireshark
What Is It?
Wireshark is a free and open-source network protocol analyzer. It is used for network troubleshooting and analysis of communications protocol.
What Can You Do With It?
With Wireshark, you can capture and view data interactively and browse packet data from a live network or a previously saved capture file.
How To Use It?
Launch Wireshark by typing Wireshark in the terminal or using the GUI; select the type of capture you want to perform.
You can capture data from a live network or use a saved capture file.
You can use the filter box to filter the packets and view only the packets that match your criteria.
From our last task, we downloaded “Networking_Tools.pcapng”, *.pcapng is a file type you can use Wireshark to open and view the network capture file.
Answer the questions below
In the filter box, type icmp; how many packets do we have?
Correct Answer: 9
Which IP sent the first ICMP packet?
Correct Answer: 198.168.1.157
Which IP received the first ICMP packet?
Correct Answer : 192.168.1.158
Was 192.168.1.158 able to send ICMP packets successfully to 192.168.1.157? (Y/N)
Correct Answer :N
Filter by arp; how many packets do we have?
Correct Answer: 12
Which packet number was the first arp packet?
Correct Answer: 11
Now let’s filter for FTP server traffic, we can filter for ftp, but I will only give us half of the traffic; when we are looking for traffic on known ports, we need to filter it by using: tcp.port==<port_number>, in our case, we are looking for FTP, which port does FTP uses?
Correct Answer: 21
Filter for TCP traffic; how many packets do we have?
Correct Answer: 56
On packet 198, the user logs in to the FTP server; which username did he use?
Correct Answer: anonymous
On packet 206, the user logs in to the FTP server; which password did he use?
Correct Answer: anonymous
On packet 263, we see that the user has retrieved a file (downloaded a file); what is the name of that file?
Correct Answer: falg.txt
Clear the filter line, go to packet number 260, right-click it and select “Follow” and follow “TCP stream”, we can see the flag itself, what is it?
Correct Answer: Masterschool{ftp_server_4_lyfe}
Play around with Wireshark, try different ports (tcp.port==22 OR tcp.port==80), and see what you can find; once you are ready, move over to Network Commands
Question Done /no answer required
Task 5 Network Commands
Network Commands
What are Network Commands?
Networking commands used to manage and troubleshoot the network.
These commands allow users to view network settings, test network connections, troubleshoot network issues, and more.
CommandUseipconfig / ifconfig / ip a
Used to display information about the current IP address configuration.
arpUsed to display and modify the ARP table
ping
Used to check the connection between two network devices by sending an ICMP (Internet Control Message Protocol) Echo Request and waiting for an Echo Reply.
nslookup
Used to query the Domain Name System (DNS) to obtain a domain name, IP address mapping, or any other specific DNS record.
traceroute
Used to trace the path taken by packets across a network.
whois
Used to gather information on domain names, IP addresses, and other network resources.
curlUsed to transfer data from or to a server using a supported protocol.
wgetUsed to download files from the web.
Answer the questions below
Let’s start with a simple one, let’s run ip a to display the network configuration settings of a our system. on Linux we can use ip a or ifconfig ;on Windows we will use ipconfig
Correct Answer/no answers required
Let’s move to arp; you can run arp -n to see all of the devices on the network that your machine is aware of, but let’s learn something new, run sudo apt install arp-scan to install this tool and run it by typing sudo arp-scan -l, are you getting more devices now? (Y/N)
Correct Answer: Y
You can cancel the scan (Control + C); all the devices you see here are other Attackboxes and VMs, interesting no?
So let’s see if we can communicate with them; lets’s run ping -c3 <IP_address>; how many ICMP packets were sent?
answer: 3
Let’s try to ping a domain; run ping -c3 masterschool.com; did it work?
answer: Y
If you want to see a domain’s IP address, you can use nslookup masterschool.com. Does it match the IP address of the ping command? (Y/N)
answer: Y
Another grate command is traceroute; with that you can see the hops it took to get to your destination, try traceroute masterschool.com
Completed/no answer required
If, let’s say, you want to learn more about who registered the domain name, all you got to do is run
whois masterschool.com
What is the Registry Domain ID for masterschool.com?
answer : 602290248_DOMAIN_COM-VRSN
What about the Admin City?
answer: Tempe
The next command is curl. Let’s curl scanme.nmap.org; If you open a browser and go to that website and view the page source, you will see the same information.
Completed/no answer required
The last one is wget.
Let’s use wget to download a file from GitHub; run this command:
wget https://raw.githubusercontent.com/LGOG/Masterschool/Networking-Tools/flag.txt
What is inside the flag.txt?
answer: You found me!
Now it’s time for you to play around with them, learn how to use each command and when.
Completed/no answer required
