Networking Fundamentals for Ethical Hackers
Building the Foundation for Penetration Testing Success
OSI Model and TCP/IP
# OSI Model (7 Layers) 7. Application - HTTP, FTP, SMTP, DNS 6. Presentation - SSL/TLS, ASCII, JPEG 5. Session - NetBIOS, RPC 4. Transport - TCP, UDP, Ports 3. Network - IP, Routing, ICMP 2. Data Link - Ethernet, ARP, MAC 1. Physical - Cables, Signals # TCP 3-Way Handshake (Connection) Client ---SYN---> Server Client <--SYN-ACK- Server Client ---ACK---> Server Connection Established! # Common Ports 20/21 FTP (file transfer) 22 SSH (secure shell) 23 Telnet (unencrypted) 25 SMTP (email) 53 DNS (domain resolution) 80 HTTP (web) 443 HTTPS (secure web) 3306 MySQL 3389 RDP (Windows) 5432 PostgreSQL
Network Scanning Commands
# Host Discovery nmap -sn 192.168.1.0/24 # Ping sweep nmap -PR -sn 192.168.1.0/24 # ARP scan netdiscover -i eth0 -r 192.168.1.0/24 # Port Scanning nmap -sS -p- 192.168.1.100 # SYN scan all ports nmap -sV -p 22,80,443,3306 target # Version detection nmap -O target.com # OS detection nmap -A target.com # Aggressive scan # Service Enumeration nmap --script=banner target.com # Banner grabbing nmap --script=http-enum target.com # HTTP enum nmap --script=smb-enum-users target # SMB enum # Output Options nmap -oA scan_results target.com # All formats nmap -oX results.xml target.com # XML format nmap -oN results.nmap target.com # Normal format
Network Attack Vectors
ARP Poisoning
Spoof ARP table to intercept traffic
DNS Spoofing
Redirect victims to fake websites
Man-in-the-Middle
Intercept communications between parties
MAC Flooding
Overwhelm switch MAC table
Frequently Asked Questions
What networking concepts are essential for ethical hacking?
Essential concepts: TCP/IP model and protocols, OSI model layers, IP addressing (IPv4/IPv6), subnetting, routing and switching, DNS, DHCP, ARP, common ports (HTTP=80, HTTPS=443, SSH=22, FTP=21), packet analysis, network segmentation, and firewall concepts. Understanding how data moves across networks is fundamental to both attacking and defending systems.
How does TCP/IP work for penetration testers?
TCP/IP model: Application layer (HTTP, FTP, DNS), Transport layer (TCP/UDP with ports), Internet layer (IP addressing, routing), Link layer (MAC addresses, ARP). Each layer offers attack vectors: DNS spoofing, port exploitation, IP spoofing, ARP poisoning. Understanding the 3-way handshake (SYN, SYN-ACK, ACK) is crucial for understanding port scanning and connection-based attacks.
What are the most important ports for hackers to know?
Critical ports: 21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 80/443 (HTTP/HTTPS), 110/143 (Email), 139/445 (SMB), 3306 (MySQL), 3389 (RDP), 5432 (PostgreSQL), 8080 (HTTP Alt). During enumeration, scan these ports first as they commonly expose vulnerabilities. UDP ports like 53 (DNS), 67 (DHCP) also important.
How do I perform network reconnaissance?
Network recon steps: 1) Discover live hosts (ping sweep, ARP scan), 2) Identify OS (TTL analysis, banner grabbing), 3) Port scan (nmap syn scan), 4) Service enumeration (version detection), 5) OS fingerprinting, 6) Vulnerability assessment. Tools: nmap, masscan, rustscan for scanning; Wireshark for traffic analysis; netdiscover for ARP enumeration.
What is the difference between TCP and UDP scanning?
TCP scanning: Reliable, connection-oriented, 3-way handshake, slower but accurate. Types: SYN scan (stealth), Connect scan, ACK scan (firewall detection). UDP scanning: Faster, connectionless, unreliable. UDP services often go undetected. UDP scan sends packet and checks for ICMP port unreachable. Results less reliable - scan common UDP ports (53, 161, 123) explicitly.
Master Networking with Cyber Defence
Build solid networking foundations for your ethical hacking career.
View Course