Wireshark® | TCPDump Packet Capturing

Packet Capture Analysis Security feat. Ethereal® - Module VI

• Introduction - Topology - Features
  • Discuss course outline
  • Explore system configuration
  • Identify key network interfaces to be used for captures
  • Identify connected interfaces on Cisco Switch
  • Explore network topology - IPv4 & IPv6
  • Identify Ethereal installation
  • Enumerate and discuss key Ethereal features
•  
• Ethereal® Graphical User Interface (GUI)
  • Identify installation footprint
  • Differentiate between promiscuous and non-promiscuous modes
  • Configure X.org to permit non-privileged user to write output to screen
  • Launch Ethereal GUI
  • Identify the primary GUI components /Packet List | Packet Details | Packet Bytes/
  • Discuss defaults
  • Explore key menu items
•  
• TCPDump | WinDump - Packet Capturing for /Linux|Unix|Windows/
  • Discuss defaults, features and applications
  • Use TCPDump on Linux to capture packets
  • Log traffic using default PCAP/TCPDump format
  • Discuss Berkeley Packet Filters (BPFs)
  • Capture and log specific packets using BPFs for analysis with Ethereal
  • Connect to Windows 2003 Server using Remote Desktop (RDesktop) utility
  • Install WinDump and WinPCAP on Windows 2003 Server
  • Identify available network interfaces using WinDump
  • Capture and log packets using WinDump
  • Capture and log specific packets using BPFs with WinDump for analysis with Ethereal
  • Upload captures to Linux system for analysis in Ethereal
•  
• Snort® NIDS Packet Capturing & Logging
  • Discuss Snort NIDS's features
  • Confirm prerequisites - /PCRE|LibPCAP|GCC|Make/
  • Download and Import Snort G/PGP key and MD5SUM for Snort NIDS
  • Download, verify, compile and install Snort NIDS
  • Discuss BPF directional, type, and protocol qualifiers
  • Identify clear-text based network applications and define appropriate BPFs
  • Execute Snort NIDS in sniffer mode with BPFs enabled to match interesting traffic
  • Log to the active pseudo-terminal console and examine the packet flows
  • Combine BPF qualifiers to increase packet-matching capabilities
  • Use logical operators to define more flexible BPFs
  • Create captures for further analysis with Ethereal
•  
• Sun Snoop Packet Capturing & Logging
  • Connect to Solaris 10 system and prepare to use Snoop
  • Draw parallels to TCPDump
  • Enumerate key features
  • Sniff and log generic traffic
  • Sniff and log specific traffic using filters
  • Sniff using Snoop, HTTP and FTP traffic
  • Save filters for analysis by Ethereal
  • Snoop various Solaris interfaces for interesting traffic
•  
• Layer-2 & Internet Control Messaging Protocol (ICMP) Captures
  • Launch Ethereal
  • Identify sniffing interfaces
  • Capture Address Resolution Protocol (ARP) Packets using Capture Filters
  • Discuss and Identify Protocol Data Units (PDUs)
  • Identify default Ethereal capture file
  • Peruse packet capture statistics
  • Identify Cisco VOIP router generating ARP requests
  • Peruse time precision features - deci - nano-seconds
  • Discuss time manipulations - relative to first packet - actual time
  • Reveal protocol information from layer-1 through 7
  • Identify network broadcasts in the packet stream
  • Generate Layer-2 ARP traffic using PING and capture and analyze results
  • Sniff traffic based on MAC addresses using Ethereal and Capture FIlters
•  
• User Datagram Protocol (UDP) Captures & Analyses
  • Discuss UDP Characteristics
  • Focus on Network Time Protocol (NTP)
  • Setup NTP strata for testing between multiple systems
  • Analyze NTP - UDP traffic using Ethereal
  • Focus on Domain Name Service (DNS)
  • Install a BIND DNS Caching-Only Server
  • Analyze DIG queries
  • Analyze 'nslookup' queries
•  
• Transmission Control Protocol (TCP) Captures & Analyses
  • Discuss TCP Characteristics - Connection-Oriented Services
  • Explain TCP connection rules - Socket creation
  • Sniff TCP traffic using Capture Filters in Ethereal
  • Use Display Filters to parse TCP traffic
  • Sniff FTP traffic
  • Reconstruct FTP flows using TCP Stream Reassembly
  • Differentiate between client and server flows
  • Quantify client and server flows
  • Discuss embedded Protocol Data Units (PDUs)
  • Sniff Internet Protocol Version 6 (IPv6) traffic
  • Peruse and discuss the IPv6:TCP:FTP traffic dump
  • Analyze TCP Sockets
•  
• Ethereal Display Filters - Post Processing Filters
  • Identify previously captured - TCPDump - Ethereal - Snort - Snoop - Dumps
  • Discuss features
  • Explain Display Filter syntax
  • Post-process previously captured traffic dumps
  • Identify the various methods to exact display filters
  • Filter data using the expression builder
  • Filter traffic based on interesting properties
  • Filter traffic using logical operators
•  
• Ethereal Statistics
• Discuss features
• Explore the summary (metadata) of captured packets
• Peruse the protocol hierarchy - Layer's 1 - 7 of OSI
• Examine network conversations of captured packets
• Identify Destinations in packet dumps
• Examine ICMP statistics
•  
• Text-based Captures with Tethereal
  • Discuss features and applications
  • Identify 'tethereal' and invoke
  • Enumerate network interfaces
  • Sniff generic network traffic
  • Suppress capture output
  • Apply Capture Filters
  • Capture UDP Traffic
  • Capture TCP Traffic
•  
• Intranet-based Captures & Analysis
  • Discuss Intranet monitoring objectives
  • Analyze the network topology drawing
  • Discuss Unicast, Broadcast and Multicast traffic
  • Discuss Switch Port Mirroring - SPAN
  • Configure Port Mirroring - SPAN on Cisco Switch for interesting ports
  • Dedicate a network interface for sniffing traffic
  • Configure Snort NIDS to sniff traffic on dedicated network interface
  • Analyze Snort NIDS captures in Ethereal
  • Sniff traffic between various Intranet hosts
•  
• Internet-based Captures & Analysis
  • Discuss Internet monitoring objectives
  • Identify key external interfaces to monitor
  • Update the Port Mirroring configuration to capture Internet traffic
  • Capture external traffic
  • Analyze using Ethereal
•  
• Wireless-based Captures & Analysis
  • Discuss Wireless monitoring objectives
  • Connect to remote system with wireless interface
  • Enable wireless interface
  • Sniff traffic on wireless network
  • Analyze using Ethereal
•  
• Windows-based Captures & Analysis on Windows
  • Download and Install Ethereal for Windows
  • Explore interface
  • Load previously captured data
  • Analyze data
  • Compare and contrast with Ethereal for Linux|Unix systems
•  
• WireShark® on MacOSX®
  • Download and Install
  • Explore interface
  • Load previously captured data
  • Analyze data
  • Capture new data
  • Evaluate results
•  

Sums

• Various Tools
• Remote Confirmations
• File Metadata
• File Fragments
• Compress Content
• Archive Content
• DIR Hierarchy
• Password Sums
• Shared Secret
• Restrict History
• Downloaded Content
• Encrypt Content
• Site Credentials
• Site COOKIE
• Site COOKIE - Unique

CentOS9x Stream Administration

• Initial Environment
• ls, pwd, cd, cp, mv, rm, mkdir, rmdir, whoami
• alias, cat, file, chmod, chown, history
• STD(IN|OUT), Pipes, Redirection, Command Chaining
• ps, df, top, free
• Pagers, W-Commands
• Checksums
• Awk | Sed | Grep Usage
• BASH SHELL Environment
• Compression | Archival Tools
• SSH Equivalence
• SHELL Quoting
• Propagate Environment
• Secure Clients

• Identify Standard File Types
• Standard File Permissions
• Symbolic Links
• Transfer Permissions

• Identify SWAP environment
• Provision dedicated SWAP partitions
• Add | Remove SWAP from pool as needed
• Provision File System-based SWAP
• SWAP Share
• SWAP Persistence
• Identify default storage configuration
• Provision new storage as needed
• XFS - File System
• XFS - Grow File System
• Identify LVM defaults
• Add new partitions to LVM management
• Allocate storage to LVM Volume Groups
• Create Logical Volumes (LVs) as needed
• Overlay File System and mount where applicables
• LVM - Resize
• LVM - Mixed FS
• LVM - SWAP

• Features
• Install
• Defaults
• General Usage
• Update Accounts

• Defaults
• Shared PASS Gen
• Unique PASS Gen
• Encrypted PASS Gen
• Update Accounts
• Groups

• Discuss features | limitations
• Identify default system-wide schedule
• Peruse various default Cron Jobs
• Schedule simple job and monitor recurrence
• Evaluate results

• Peruse Default CONF
• Discuss Syslog Rules
• Explore Log Rotate defaults
• Ensure rotated logs are compressed
• Extend default retention scheme
• Force Log Rotation as needed

• Explore Default environment
• Install PKGs
• Dump important metadata from packages
• Apply Updates

• Default CONF
• Add | Confirm IPs as needed

• Install
• Copy Configuration
• SELinux - Confirm
• TLS | SSL Services
• cURL Client Tests
• Virtual Hosts
• ENC Sites Only

• SFTP Only USER
• SFTP Only USER - NOLOGIN
• SFTP Only Group - Control
• NMap Intro

SysLOG with rSysLogD

• Discuss Features
• Default Environment
• Kernel Firewall LOG
• Split LOGs by Priorities
• UDP | TCP Logging
• Dual L4 Logging
• Multiple Hosts
• Basic Queueing
• Reliable Event Logging Protocol (RELP)
• RELP - Remote Only
• RELP Only
• Traditional to RELP
• SysLOG Clear-Text - Confirm
• Property Filters
• Expression Filters
• Relay Chain

Netfilter Tables

• Features
• SSHGuard
• Ruleset Basics
• Persistence
• Sample Rules
• Inbound Filtering
• Dormant Table
• Manage Tables | Chains | Rules
• Counters
• Sets
• LOG Basics
• LOG with Sets
• Closed-Port LOGs
• LOG Options
• Re-Route LOGs
• Jump Targets
• Chain Jumping
• GoTo Chains
• Meta Selectors

Debian 12x Administration

• Features
• Download
• Graphical Install
• Text Install
• Post-Install Tweaks

• Explore usage of the following useful commands
• tty | /dev/pts | w | whoami | who
• set | env | export | unset
• cat | echo | touch | rm
• pwd | ls | cd | mkdir | alias | umask
• head | tail
• dd
• find
• history
• STDIN, STDOUT, STDERR, UNIX Pipes, Redirection, Command Chaining
• ps, df, free, top, dd
• stat, which, w, who
• tar | gzip | bzip2 | xz
• ZSH Setup

• Network Tools | IP Configuration
• Examine default IP configuration
• Extend IP configuration to facilitate additional addresses
• Static IP Config
• Dual: Dynamic | Static Config
• Multiple Interfaces
• Dual Network Services
• Confirm communications

PHP One-Liners

• General Usage
• Count Lines
• Word Count
• Count Chars
• Split Lines into ARRAY
• Count Instances of Fields
• Transform Delimiters
• Anonymize LOGs
• Extract Unique SRCs
• Lines by Error Code
• LOG By Code
• Summarize Error Codes
• Pre-Seed Error Codes
• Random Strings
• Varied Passwords
• Expose Undefined Passwords
• Outdated Passwords
• Hash | Un-Hash

Cloud Storage with GlusterFS

• Discuss Features:
• Default Volume Type
• Common Volume Types
• Transport Types
• File System Support
• Storage Model

• Features
• Provision Storage
• Allocate GlusterFS Brick
• Persistence
• Generate IO
• Multiple File Systems
• Various Sizes
• Stop | Remove Volume
• Reconstitute Volume
• Server Mount
• Evaluate

OpenPGP with GPG

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Signing | Verification

• Features
• General Usage
• Create Content
• Encrypt
• PassPhrase Protect
• Binary | Text Encryption
• Share
• Decrypt

SSL-TLS with OpenSSL

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Certificate Signing Requests (CSRs)
• Self-Signed Certificates
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Random String Generation
• Message Digests
• SSL-TLS Client

• Features
• General Usage
• Retrieve Site Certificates
• Determine OCSP Configuration
• Probe supported TLS Versions
• Extract Certificate for local usage
• Retrieve Certificate with NMap
• Retrieve Certificate Chain

• Discuss
• Generate Private Keys
• Generate Correlating CSRs
• Confirm Keys | CSRs
• Self-Signed Certificates

SSH Variables

• Discuss Features
• Bare VARs
• SSH Client
• Double Quotes
• Single Quotes
• SSH Environment

SHELL Variables

• Discuss Features
• Terminal (TTY)
• CLI Arguments
• Process ID
• Backgrounded
• SHELL Local
• Environment
• Persistence
• Aliases
• Command Substitution
• Increment | Decrement
• Dynamism