Remake of Cybersecurity Fall 2022 by Bryan Tran

Protection Measures

30934431 — 2022-12-15 05:33:46 UTC

- Always lock your computer when you step away for best practice.
- Multiple words with embedded numbers, symbols, and capitalization make the best passwords and passphrases.
- Do create a strong password.
- Don’t share passwords.
- Don’t type your password if someone is looking. Politely ask them to please look away while you type your password.
- Don’t write your passwords down, as this makes them no longer secret.
- Do change your passwords every few months. Attackers can break in, download password files, and run algorithms for months to try to match passwords. It’s essential to change your password if a site you are using has suffered a recent cyber attack.
- Do look away from the keyboard to let them know you are not trying to discover their password.
- Don’t ask for or use someone else’s password.
- Have strong passwords.
- Turn on alerts about any unrecognized logins.
- Enable any extra security like two-step verification logins.
- Enable encryption whenever possible.
- Restrict who can see and comment on your posts to friends only, not the public.
- Control what posts you want to be tagged in.
- Restrict who can search for you and who can follow you.
- Permanently delete the email and exit your email application.
- Delete any downloads that may have occurred.
- Update and run antivirus software—you will learn about in the next lesson.
- If the spam or phishing email was posing as a legitimate site (for example, your bank) you should notify the organization that someone is attempting to spam or phish their customers.
- Browse carefully and intelligently.
- Keep your devices up to date; frequently check for operating system and software updates, or configure your devices for automatic updates.
- Make sure your firewall is enabled and running and that unnecessary services, such as FTP and HTTP(S), are disabled
- Install antivirus software and ensure it is regularly updated. - Run specific scans after you download suspicious files or receive suspicious email.
- Create a recovery drive and back up important data regularly.
- Remember that the contents of deleted files are not really deleted.
- Automatically opening a file that contains malicious software can cause the malware to be installed and/or executed on your computer. Rather than double-clicking a file that you are not familiar with, use the right-click menu to view or to edit a file.
- Always show filename extensions and check them before you open a file.
- As the user or administrator of a computer, you should know the other legitimate users; suspicious users can create suspicious files.
- If you keep a record of the installation dates of your installed applications, you can use the file’s Date modified property to find applications that you did not install, indicating they might be malware.
- Searching for executable scripts can help you find suspicious files.
- Know where applications come from, that is, know where the executable application files reside and their properties. This can help you track down malware.
- Both file and process ownership can indicate malware. If you see that a process or a file is owned by an unknown or strange user, you should be suspicious of that process or file.
- Become familiar with processes running on your computer. Cybersecurity experts can identify all of the processes running on a standard system, but this kind of knowledge can take years to acquire!
- Know how to manage child and parent processes so you can find and stop malware.
- Store private company information on a separate host, not connected to the web server.
- Store critical data on a separate host and connect to the web server for controlled and secured non-public access.
- Web servers should not use default settings and file locations (such as log files and other sensitive content).
Servers should not provide services such as FTP (and especially anonymous FTP!) unless it’s truly crucial for the business needs. If enabled, access should only be granted to authorized users, configured with strong passwords, and preferably reside on a host that is separate from the one that stores sensitive information, such as customer and payment records.
- Similar to FTP service, SMTP service increases the attack surface of a host and its network. SMTP should only be running if needed, and preferably on a host that’s separate from the one that stores sensitive information, such as customer and payment records.
- Security professionals protect against cross-site scripting exploits by ensuring that the proper data cleansing techniques are in place on a company’s websites.
- To protect against SQL Injection exploits, security professionals apply the appropriate data cleansing to all data input to their website.
- As with all cybersecurity tools, you should never use Wireshark to monitor private or sensitive information unless you have permission to do so.
- Use a packet sniffer tool like Wireshark to monitor and analyze network traffic.
- Configure firewalls to protect against common malware attacks such as a ping flood attack.
- Since malware can happen at nearly any stage of network communication, security experts analyze the different stages of host-to-host communication to validate legitimate sessions. This can include:
>Validate broadcast message information including network devices
>Confirm secured connections (handshakes)
>Verify remote hosts are safe and secure
>Ensure that web content contains no vulnerabilities or exploits
>Security experts analyze network traffic at various levels of abstraction to identify suspicious activity, such as unsecured protocols, vulnerabilities in scripts, and brute force attacks.
- It is extremely important that you keep your private key safe and not share it with anyone.
- You can enable encryption options in applications and create security certificates to control the security and privacy of your sensitive information, including messages, documents, and media files.
- Securing files with access control, knowing how file types behave, and hiding and encrypting sensitive files are all ways to improve the security of data stored on a computer.
- Learning about the processes that are running on a system can tell you a lot about what services and other configurations are available on a system.
- The multi-spawning technique is a common way malicious users hide their presence and the presence of their malicious software in operating systems.
- In general, the root login is a powerful user. Only use it when absolutely necessary.
- Baseline data is a critical tool that security professionals use to analyze networks and detect anomalies.
- Both ethical and unethical hackers use the same tools to discover weaknesses in a system, such as unnecessary services and open ports used for logging in and transferring files. It is the role of the ethical hacker to stay one step ahead to secure the system and configure the best protection possible.
- Banners can be configured by system administrators and should be turned off, or at least changed, from the default loose-lipped text.
- Security scans, such as the one you just performed, are a critical part of a security professional’s job. Mitigating or fixing the vulnerabilities reported by a scanning tool (such as Nessus) will ensure the system is secure and has the best protection possible.
- Regularly performing pen tests on your systems with powerful tools like Metasploit is a valuable part of security maintenance in that the tests can expose weaknesses and vulnerabilities. These types of pen tests should be done carefully and with explicit permission of the owners of the system.
- Remediation is the last step in many security procedures. It sums up everything you have done: reconnaissance, scanning, and pen testing compromises. In the remediation phase, you implement the security solutions and verify that your system is safe and secure.

Lifecycle

30934431 — 2022-12-15 05:33:46 UTC

Windows Commands / Navigation

30934431 — 2022-12-15 05:33:46 UTC

> dir -or- ls
lists the contents of the working directory
> cd
changes working directory
> python
execute python scripts
> up arrow key
repeats last entered command to modify
> ""
used to enter strings with illegal symbols or spaces, as to not process them as commands or arguments
> wmic (windows management interface command)
allows for display of requested information
> process get name,parentprocessid,processid
used in wmic
used to show process names along with pid and ppid

Code of Conduct

30934431 — 2022-12-15 05:33:46 UTC

Password Cracking Scripts

30934431 — 2022-12-15 05:33:46 UTC

crack_1word_pw.py
crack_2word_pw.py
crack_common_pw.py
crack_symbol_pw.py
gen_pw.py
wordlist_common.xlsx
wordlist_dictionary.xlsx

30934431 — 2022-12-15 05:33:46 UTC

Topologies

30934431 — 2022-12-15 05:33:46 UTC

Simple LAN Technology
Switched Topology
Router Topology
Network router to internet
Wireless router

30934431 — 2022-12-15 05:33:46 UTC

1.1 Vocabulary

30934431 — 2022-12-15 05:33:46 UTC

1.2 Vocabulary

30934431 — 2022-12-15 05:33:46 UTC

General System Securities - Personal

30934431 — 2022-12-15 05:33:46 UTC

1) Operating system is up to date
2) Firewall enabled, disable FTP port, check for ports 20, 21, 80, 443. Filter by group to look for other ports assigned to the same use
3) Antivirus enabled and up to date, enable scans
4) Have a backup plan: control panel > systems and security > administrative tools > windows server backup
5) Delete doesn't delete.

Firewall Log files

30934431 — 2022-12-15 05:33:46 UTC

Event viewer > applications and service logs > microsoft > windows > windows firewall with advanced security > firewall

Ports

30934431 — 2022-12-15 05:33:46 UTC

20 & 21 - FTP
80 - HTTP
443 - HTTPS
25 - SMTP
137, 138, 139 - Windows File Sharing NetBios and SMB

File Ownership

30934431 — 2022-12-15 05:33:46 UTC

Enable ownership column in file explorer
Maintain a list of trusted users of your computer

File Extensions and Behavior

30934431 — 2022-12-15 05:33:46 UTC

Verify and validate file extensions
Enable show file extensions in view options
View executables before executing
Be mindful of double extensions
Observe icons and "type" column for suspicious filetypes

Searching

30934431 — 2022-12-15 05:33:46 UTC

Windows file explorer search functions also covers extensions
In the refine panel, you can select "date modified" and "today"
kind:=folder OR datemodified:today
Wildcards are special characters that represent others, example: * takes the place of any number of any character

Applications and Tools

30934431 — 2022-12-15 05:33:46 UTC

- Powershell: Interprets operating system commands; in other words, follows any given system instructions
- Command Prompt (cmd): Does the same as powershell. In Linux systems, the equivalent would be called a Terminal Shell
- Windows Updates, Firewall settings, Antivirus: all need checked and updates for a computer
- File explorer: shows files and can be modified to show more information
- IIS Manager: part of Microsoft's server management software. Open Server Manager program and click tools in the top right to get there. Here you can change settings for IIS website server.
- Wireshark: packet sniffer. helps to organize and manage data packets so you can monitor and analyze network traffic. watching and analyzing packets is called sniffing. Identify suspicious network traffic such as invalid data requests, suspicious sources, and suspicious content. check using ping status of host, modify to prevent attacks.
- PuTTY: provides remote logins
- Kleopatra: certification manager and GUI for GNUPG. The software stores your OpenPGP certificates and keys. It is available for Windows and Linux.
- Bitlocker: uses what's known as the Trusted Platform Module (TPM), a mechanism that provides secure encryption for a drive. Also TrueCrypt for containers.
- grepWin: search for strings and expressions
- John the Ripper: password cracking and an encrypted container or file
- Microsoft New Technology File System (NTFS): NTFS files all have a feature called Alternate Data Streams (ADS) which allows a user to attach data to a file without changing the content of the file or file size.
- JPHS for Windows: an application that lets you hide data in JPG image files, uses random numbers to hide data in a random location in the file.
- HashMyFiles: a program that can collect multiple files and create hash values for each file.
- AccessData FTK Imager: Used to image (make a copy of) a drive without modifying the data on that system, then used to investigate the original data on the new image without affecting the disk image you created.

Process Management

30934431 — 2022-12-15 05:33:46 UTC

Use task manager to see what's running and who owns it
Check CPU tab for unexplained peaks
View source file locations using right-click on desktop icon or task manager entry. From here you can check its certificate.
%windir% is an environment variable
validated trusted owners of process
Use the parent/child process tree to kill malicious processes

30934431 — 2022-12-15 05:33:46 UTC

URL sections

30934431 — 2022-12-15 05:33:46 UTC

Protocol: https://
Subdomain: www.
Domain: pltw.org
File path: /our-programs

uniform resource locator

Securing Your Browser

30934431 — 2022-12-15 05:33:46 UTC

Avoid illegal content
Look for typos (typosquatting)
HTTPS preferred
Keep browser up to date
Verify site settings for: pop-ups, cookies, history, site certificates, downloads and location.

1.2.5 Plan of Action

30934431 — 2022-12-15 05:33:46 UTC

Passive Analysis Commands

30934431 — 2022-12-15 05:33:46 UTC

PowerShell or Command Prompt or Terminal
> ipconfig -a
Default gateway = Router
> whois
who owns and info about the domain
> ping
for network connectivity, name resolution
4 pks out, 4 pks back (echo reply), time
Request Timed Out - no connection or blocked
> tracert
for path via IP address, time
> nslookup
> netstat -a
for what is open, listening, assigned, TCP and UDP
> cls clear screen
Developer tools in browser:
- Chrome > three dots > more tools > developer tools
- Network tab will show load times, details of traffic, remote IP addresses
- Application tab shows local storage URLs, these may not have public access rather used in their information architecture

30934431 — 2022-12-15 05:33:46 UTC

DDoS attacks

30934431 — 2022-12-15 05:33:46 UTC

Ping Flood: attacker takes down a victim’s computer by overwhelming it with ICMP echo requests
Ping of Death: attacker attempts to crash, destabilize, or freeze the targeted computer or service by sending malformed or oversized packets

Smurf Attack: like the regular ping flood, however, Smurf is an amplification attack vector that boosts its damage potential by exploiting characteristics of broadcast networks

Mailbomb: attack designed to overwhelm an inbox or inhibit a server by sending a massive number of emails to a specific person or system.

Teardrop: The attacker sends fragmented packets to the target server, and in some cases where there’s a TCP/IP vulnerability, the server is unable to reassemble the packet, causing overload.

30934431 — 2022-12-15 05:33:46 UTC

Server Security

30934431 — 2022-12-15 05:33:46 UTC

Forceful Web Directory Browsing
- Open Server Manager then IIS manager
- Select computer, expand sites, click on Default Web Site
- Double click Directory Browsing and press disable
Log File Locations
- Server Manager, IIS manager, then Default Web Site
- Double click logging
- Click browse button and set this to something not under inetpub
- click apply
FTP
- Server manager, manage in top right, remove roles and features
- next
- select server, next
- expand IIS, uncheck FTP
- next, next
- in confirmation, check the box about restarting, and say ok to the pop-up, then press remove
- computer will restart automatically and complete removing FTP on startup
SMTP
- Server manager, then tools, IIS 6.0
- select computer, highlight SMTP virtual server
- press black square to stop
Error Messages
- Server Manager, IIS manager, Default Web Site
- double click Error Pages, then click edit feature settings
- instead of detailed errors choose custom and click OK

inetpub directory structure

30934431 — 2022-12-15 05:33:46 UTC

Wireshark

30934431 — 2022-12-15 05:33:46 UTC

- Always set up as Ethernet 2 adapter and "not port 3389" rule
- wireshark data is stored as pcap file
- Filters:
- ICMP: to only see ICMP packets, protocol to manage ip addresses, link "ping"
- Location Details:
- Arrival Time: Packet details pane > Frame > line 3
- MAC address: packet details pane > ethernet 2 > line 1 and 2
- a MAD address is a permanent identifier of a network device, contains six pairs of hexidecimal numbers
- example: 00:22:fa:3f:12:1g
- Locate a specific packet: go > go to packet > type packet # > then enter or ctrl + g
- PuTTY details:
- IP address and port 22
- login: root, password: toor
- man ping command for a manual of ping options

Server Analysis

30934431 — 2022-12-15 05:33:46 UTC

- Cross-site scripting (XSS): a type of exploit in which the attacker takes advantage of an interactive web page to insert malicious client-side code into it. Attackers insert their malicious code into the web page's fields.
- XSS stored attack: similar to XSS reflected, with one major difference: exploit permanently stores malware in the database
- lessthanscriptgreaterthan document.write("

You have been hacked!")lessthan/scriptgreaterthan
- Protect against XSS: adding measures to recognize script tags, data cleansing.
- Command executions: type of exploit that can occur on websites that use scripts, used to pull details about the server, ex. netstat, nslookup, whois, tracert, ping
`172.30.0.6 & netstat -n`

Symmetric vs Asymmetric Encryption

30934431 — 2022-12-15 05:33:46 UTC

- Symmetric advantages: Fast, simple
- Symmetric disadvantages: large key space, lower security

- Asymmetric advantages: keys are much more secret, smaller key space, private keys are hard to crack
- Asymmetric disadvantages: slower

30934431 — 2022-12-15 05:33:46 UTC

NTFS ADS

30934431 — 2022-12-15 05:33:46 UTC

To create the ADS:
echo hidden data > [filename]:[streamname]
To see the ADS:
more <[filename]:[streamname]
To remove/overwrite data:
echo > [filename]:[streamname]
or
echo "" > [filename]:[streamname]
The[streamname]:$DATA portion of the file actually stores the alternate data.

Steganography

30934431 — 2022-12-15 05:33:46 UTC

Three types (confidentiality):
1) substitution: replaces redundant or insignificant data with covert data. The most common use of substitution with a computer is the Least Significant Bit (LSB) substitution. It is easy to implement and is used in a wide variety of tools.
2) insertion: place covert information into parts of overt files that are usually ignored, example is an alternate data stream (ADS) using an NTFS file system.
> echo hello world > file.txt
> type file.txt
> dir
> echo hidden data > file.txt:mystream
> more < file.txt:mystream
> # dir /R to see mystream
3) generation: uses the covert text itself to generate an overt message
http://www.spammimic.com/
4) digital watermarking (integrity)

Steganalysis is the process of analyzing data for hidden content. There are three categories:
Erasing
Decoding
Detection

30934431 — 2022-12-15 05:33:46 UTC

Hash Functions

30934431 — 2022-12-15 05:33:46 UTC

Hashing and encryption are similar in purpose, in that they both translate original data into a disguised form. Hashing however is different from encryption in a few important ways.

Hash function: a computational process that converts data of varying size to a fixed-size, data is converted using a one-way function so the process cannot be reversed.
Recreating data that has been hashed:
1) brute force
2) rainbow table
ideal hash algorithm: deterministic, quick, infeasible to reverse, small changes impact easily seen in hash, each hash is unique to an input.
64 bit hash has 2^64 possible hash values
two most popular: Message Digest 5 (MD5) and Secure Hash Algorithm 1 (SHA-1)

30934431 — 2022-12-15 05:33:46 UTC

Linux Commands and Notes

30934431 — 2022-12-15 05:33:46 UTC

- Benefits of Linux:
> great stability, longer up-times, fast performance
> users cannot change file types in linux like in windows
> unlike windows, linux-based file extensions are just part of the filename and do not determine a file type on the operating system level. file extensions in linux are mostly for humans

- Colors:
> white: ordinary file
> blue: directory
> green: executables or recognized data file
> pink: graphic image file

- Ctrl + C to terminate a process
- Ctrl + Z to interrupt a process

- ls: lists the contents of a directory, can list subdirectories, case sensitive
- ls -R: shows the full directory structure
- ls -l: will give the long listing of a file or directory
- ls -a: shows hidden files in a directory
- cd: change directories, appends pathway, general form of a Linux prompt is:[username]@[machine_name]:[directory]$
the ~ character is shorthand for your home directory.
- cd ..: navigates up one directory level, puts you into parent directory.
- cat: displays the contents of a file
- mkdir: make a new directory
- mv: reorganize and rename files and directories, mv [source] [destination]
- touch: creates files, touch [filename]
- cp: copy command, cp [source] [destination]
- rm: remove (delete) file
- rmdir: remove (delete) directory, directories must be empty for you to remove them with rmdir
- file: reports file types, use file * to show all file types in a directory
- tab key: use the tab key to complete a command for any unique file or directory
- execute a file by typing the file name after the $
- file: reports file types
- gpg: encrypts data, will require a passphrase for that specific file, -c to create an encrypted file, -d to decrypt an encrypted file, make sure to remove the original file after creating an encrypted one
- ps: lists your currently running processes, displays process table
- ps -e: every process
- ps -ef: in a full-format listing
--sorted=uid is a flag to the ps command to show info by user id
- man: used with a command to open the "manual" for that command, lists all flags and arguments usable by that command
- man controls:
> space bar to scroll down
> b to scroll back
> /phrasehere to search for a phrase
> h for help
> q to quit
- more: control output with the keyboard instead of having to find cursor and scrollbar
- |: special syntax character called a pipe, connects things together such as the output from one command to the input of another
- ps -ef | more: can then be used with /alpha to filter for occurrences of the word alpha in the process table
- sleep: process that puts the computer in a time out, for the length of time in seconds that it should think about what its done
- bg: moves a process to the background
- fg: moves a process to the foreground from the interrupt status
- while true; do clear; ps -ef; sleep 3; done
- it runs forever
- it clears the screen and reports system processes
- it pauses for three seconds
- after the pause, the done command loops back to the do command to repeat
- grep: a search tool in linux, which comes in very handy when you want to search for instances of a certain string.
- ex: ps -ef | grep beta: this output of the ps command is
piped to grep which searches for the string "beta"
- kill: terminate processes with the kill command followed by the PID, can only be initiated by root user. kill alone issues an interrupt, kill -9 is a forceful termination
- root: the root user is the user with all permissions on a linux operating system
- su root: to change your current user to another, in this case root. $ in the command prompt changes to # to signify being signed in as the root user.
- logout: to return to a lower level of access, ex. root to alpha

- tcpdump: command line alternative to wireshark, monitors network traffic
> $ sudo tcp dump -w firstname_pumpmon_baseline1.pcap -n -s 65535 -i ens5 not port 22
> in the above command: sudo stands for "super user do." It tells the operating system to run a command as super user, aka root. sudo is being used to execute the tcpdump command with the following options:
> -w: the filename of the packet file being saved
> -n: records IP addresses instead of hostnames
> -s 65535: the size of a full packet instead of the default header information only
> -i ens5: the network interface to monitor (ethernet)
> not port 22: ignores SSH connections (ignores port 22)

- ftp commands:
> get: to retrieve a file. ex: ftp> get filename.extension
> put: to place a file. ex: ftp> put filename.extension

- lynx: command to connect to an IP address hosting a webserver and display website data in text format in the terminal

Permissions and Processes

30934431 — 2022-12-15 05:33:46 UTC

All files (including directories) are owned by one user and one group. A user is allowed access according to owner permissions. Users in a group have access according to group permissions. Everyone else has others permissions.

.sh at the end of a file on linux usually hints at being a shell command script

Bash - A bash process is a type of shell that lets you interact with the operating system. When you log into Linux, a shell is created. The shell runs in the terminal window, waiting for commands. When you type commands, the bash shell sends them to the OS to be executed.

30934431 — 2022-12-15 05:33:46 UTC

SQL Injection Exploits

30934431 — 2022-12-15 05:33:46 UTC

SQL stands for Structured query language. SQL is used to manage digital data stored as relational database. Exploit in which the attackers use SQL code to steal or modify data residing in a database. Attackers insert their malicious SQL code into the web page's input fileds
- Manipulating Data - CRUD:
- Create: Creating or inserting data into a database table
- Read: Reading or slecting data from a database table.
- Update: Updating existing data in a database table.
- Delete: Deleting existing data in a database table.

30934431 — 2022-12-15 05:33:46 UTC

Ethical Hacking

30934431 — 2022-12-15 05:33:46 UTC

Intent of the hacker to improve the system security by testing for weaknesses

Reconnaissance - probing network to understand structure, see what services are open and running
> Zenmap/Nmap - network scanning

Scanning - Taking a closer look at the services and software running on hosts. ex: application versions and OS platforms
> Nessus - scanning tool that detects network vulnerabilities of TCP ports

Compromise - actually launching exploits at targeted vulnerabilities to see whether they are genuine exposures in the system
> Metasploit - collection of tools used to perform penetration tests

Remediation - providing a remedy for the vulnerabilities found

Baseline Capture Process for pcap files between Linux Machines

30934431 — 2022-12-15 05:33:46 UTC

1. initiate tcpdump processes on both sending and receiving machines with Linux, tell it what file name to use

$ sudo tcpdump -w [YourName]_PumpMon_Baseline1.pcap -n -s 65535 -i ens5 not port 22

2. execute ftp connection and file get from receiving machine

ftp [IP address of sending machine]
username and password
get [file name] ex. pump_log.txt
quit
ls of machine to see both files are there

3. retrieve baseline files of activity from both machines

Ctrl+C to end tcpdump process
from Outside machine PowerShell ...
ftp [IP address of machine pulling file]
binary
get [name of file wanted]
quit
repeat for each machine

4. initiate tcpdump processes on one sending with Linux and one receiving machines with Windows, tell it what file name to use

$ sudo tcpdump -w [YourName]_PumpMon_Baseline2.pcap -n -s 65535 -i ens5 not port 22
Wireshark - Ethernet 4 and not (port 3389 or port 22)

5. execute ftp connection and file get from sending machine

ftp [IP address of machine]
username and password
change the remote directory to the ftproot
ftp> cd inetpub/ftproot
Use put command to copy a file, ftp> put pump_log.txt
quit
ls of machine to see both files are there

6. extract files as notes above
7. Capture baseline between two windows machines using Wireshark capture on each and then use a web browser to access the ip address of the web server.
8. extract files as noted above

iptables utility

30934431 — 2022-12-15 05:33:46 UTC

Use iptables to deny traffic you do not want, while allowing the traffic you do want. Use rules to accept (ACCEPT) or reject (REJECT/DROP) inbound (INPUT) and outbound (OUTPUT) traffic, indicating specific IP addresses of hosts of interest.

iptables is a privileged command, must use sudo.
Commands are case- and space-sensitive.

iptables -A INPUT -s 10.10.10.1 -j ACCEPT

These flags configure a firewall rule. Specifically, these flags say to accept network traffic from host 10.10.10.1:

-A INPUT tells the system to add a rule for inbound traffic.
-s 10.10.10.1 is the source address to use in creating the rule.
-j ACCEPT indicates what to do if the packet matches the target (in this case the source address).

$ sudo iptables -L INPUT
-L INPUT lists all inbound firewall rules that are in place at the moment. The listing will show the target for the rule (accept, drop, etc.), the protocol, any options, the source, and the destination (along with a port if specified).

$ sudo iptables -F INPUT
The -F argument stand for “Flush”. This will clear all firewall rules for all incoming traffic, allowing you to start fresh.

$ sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
create a rule so that SSH connections are accepted on the host. Otherwise administrators would be locked out of the system and be unable to perform maintenance

-p tcp applies the rule to packets with TCP.
--dport ssh applies the rule to packets with destination port 22.

$ sudo iptables -A INPUT -p tcp --dport ftp -s 10.2.0.6 -j ACCEPT
Add a rule that allows FTP connections from PumpMonitor

-s 10.2.0.6 applies the rule to packets coming from the source IP address.
--dport ftp applies the rule to packets with destination port 21.

$ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
To ensure FTP and SSH functionality, Why is this rule necessary?: Since subsequent connections are set up on random ports, this rule ensures functionality of legitimate “related” services that are created by “established” (and allowed) connections.

-m state with the --state ESTABLISHED,RELATED option tells the system to match the state of the connection to ESTABLISHED or RELATED .
-j specifies the action to ACCEPT or REJECT, in this case, ACCEPT.

$ sudo iptables --policy INPUT DROP
Deny all other traffic, establishes a default policy that will drop data packets if they do not match any other firewall rule.

--policy indicates a general policy rather than a specific protocol, in this case inbound traffic (INPUT).
Do not allow entry; block from the host (DROP).

$ sudo iptables-save
save new rules for them to take effect

All About Wireshark

30934431 — 2022-12-15 05:33:46 UTC

Always set up as: Ethernet 2 and 'not port 3389'
Wireshark data file is called a pcap file
Filters:

icmp - to only see ICMP packets - protocol to manage IP addresses, like 'ping'
arp - to only see broadcast type packets
ip.addr == 192.168.1.64 - to filter by a single IP address
ip.src ==192.168.1.64 - to filter for data coming from the IP address, wont show full TCP
http - to only see http content
http.content_type - to see packets with http in the packet itself

Locating Details:

Arrival Time - Packet Details pane > Frame > line 3
MAC Address - Packet Details pane > Ethernet II > line 1 and 2
- a permanent identifier of a network device, contains six pairs of hexadecimal numbers.
  00:22:fa:1c:eb:e6
- The first three pairs are organizationally unique identifier (OUI), denotes the company that manufactured it, device is typically a network interface card or NIC.
Locate a specific packet - Go > Go To Packet, type packet #, then enter OR Ctrl+G

PuTTY details:

IP Address and Port 22
login - root, password - toor
Ctrl+C to interrupt commands
man ping - for manual of ping options

ping flood Prevention:

Windows Firewall with Advanced Security > Inbound Rules > Protocol of ICMPv4 > File and Printer Sharing (Echo Request - ICMPv4-In) > Disable

Validate OUI in MAC address - use IEEE to verify authoritative source

Requesting a Web Page
Step 1: Find a Host
Check for a valid MAC address
Broadcast for all - ff:ff:ff:ff:ff:ff

Who has 192.168.1.64? Tell 192.168.1.254. The goal of this broadcast message is to find the MAC address associated with the IP address 192.168.1.64.

Step 2: Establish a Connection
TCP Handshake

SYN: This is like extending your hand.
SYN-ACK: The other person sees your hand and acknowledges it by extending their hand.
ACK: Hands are grasped and shaken.
You are now ready to communicate.
Once connected a TLSv1 packet can be sent securely, TLS stands for Transport Layer Security, and it is used in secured TCP transmissions, not all TCP transmissions are secured with this type of packet-level security

Step 3: Request Web Content

http filter > look for GET/HTTP/1.1 info line > View Hypertext Transfer Protocol in Details Pane > find Full Request URI

Step 4: Sending Web Content

use http content filter to narrow to packets with website (http) info being sent to IP requester, do a Find > String > Panel Details > "term" to look for any suspicious content
Expand the Line-based text data: text/html entry and look for one of the JavaScript functions

30934431 — 2022-12-15 05:33:46 UTC