Linux & Security Flashcards
What does writing echo do?
echo Output any text that we provide
How do you find out which user you are logged in as?
whoami Find out what user we’re currently logged in as!
How do you list contents of directory with privileges? How do you include hidden files?
ls -l
ls listing
ls -a for hidden files
How do you move in and out of a directory?
cd
cd ..
cd /dir/
How do you list the contents of a file?
cat file.txt
How do you show your current working directory?
pwd
print working directory
How do you find a specific file in among different directories?
find -name specificfile.txt
How do you find a specific TYPE of file in among different directories?
find -name *.txt
How do you find a specific entry in a long file, like an IP address in a .log file?
grep “(what you’re looking for)” (file of contents).log
grep “81.143.211.90” access.log
How do you write text into an empty file using the command line?
echo (content) > (filename)
cat (content) > (filename)
echo hey > welcome
> > to keep the contents of the file without overwriting them
What is SSH and how does it work? How does SSH authenticate users, and how does this authentication work?
Secure Shell is a network communication protocol.
SSH employs encryption to ensure that hackers cannot interpret the traffic between two connected devices.
The ssh command provides a secure encrypted connection between two hosts over an insecure network. This connection can also be used for terminal access, file transfers, and for tunneling other applications. Graphical X11 applications can also be run securely over SSH from a remote location.
AUTHENTICATION
TCP based connection, 3 way handshake.
SSH daemon must be running in order to use this protocol on both sides of the communication. I.E, listening on a port for inbound SSH connections.
SSH authenticates users by using passwords or SSH keys. SSH passwords can be easily breached.
- SSH keys are a matching set of cryptographic keys which can be used for authentication. Each set contains a public and a private key. The public key can be shared freely without concern, while the private key must be vigilantly guarded and never exposed to anyone.
- To authenticate using SSH keys, a user must have an SSH key pair on their local computer. On the remote server, the public key must be copied to a file within the user’s home directory at ~/.ssh/authorized_keys. This file contains a list of public keys, one-per-line, that are authorized to log into this account.
- When a client connects to the host, wishing to use SSH key authentication, it will inform the server of this intent and will tell the server which public key to use. The server then checks its authorized_keys file for the public key, generates a random string, and encrypts it using the public key. This encrypted message can only be decrypted with the associated private key. The server will send this encrypted message to the client to test whether they actually have the associated private key.
SIMPLER EXPLANATION
An SSH key relies upon the use of two related keys, a public key and a private key, that together create a key pair that is used as the secure access credential. The private key is secret, known only to the user, and should be encrypted and stored safely. The public key can be shared freely with any SSH server to which the user wishes to connect. These keys are normally managed by an organization’s IT team, or better yet, with the help of a trusted Certificate Authority (CA) to ensure they are stored safely.
What is ARP? How does it function (1)? How can it be abused?
ARP stands for Address Resolution Protocol. It is used to discover MAC addresses and map them to IP addresses for LAN communications.
- WHOIS? ARP request broadcast of a host asking for someone’s MAC address. This is sent to every client on the network, and then discarded if it isn’t the target IP. Target client will send out ARP frame containing their MAC address.
- Host receives a MAC address, which is stored in an ARP cache. This allows for communication among the network now that both devices know their MAC addresses.
- ARP request broadcast for 192. is sent to every device on the LAN
- each device receives the request and discards it if they are not the designated recipient, whereas the target IP will respond with their
MAC. - this MAC address is saved into the senders ARP cache, where MAC addresses are stored in relation to IP addresses for other devices on the network
operating on layer 2 of the OSI7 and TCP/IP as it deals with MAC addressing
ARP can be abused via ARP cache poisoning
- hacker will send ARP packets containing false information, impersonating the MAC address of a particular device which is the endpoint of
sensitive data (usually default gateway). - target will accept this ARP information and store it in its ARP cache, effectively having it poisoned with the hacker’s spoofed MAC address
- target will begin sending it’s data to spoofed address of the hacker
You can use bettercap ARP spoof feature which will send arbitrary ARP packets to intended victims, allowing you to impersonate any device on the LAN (default gateway being the prime target to imitate)
How do you usually install the requirements for a particular package off github?
Pip.
python3 -m pip install filename.txt
How do you quickly view the history of your commands from a terminal session?
History
How do you make a new directory?
mkdir *
How do you delete a directory? How do you remove a directory if it isn’t empty?
rmdir *
rm -r
How do you get the current system details such as OS version?
hostnamectl
Detailed
uname -a
OS version and build of machine
How do you display free memory of the system?
free -m
sounds like “free -memory”
How do you display the running processes in a system?
top
htop
sounds like “top processes”
How do you display all ports the machine is listening on?
netstat
How do you list the contents of your current working directory with permissions? How do you do this for a specific file?
ls -l filename
How do you allow a file to be ran by every user? How do you allow to read, write and execute?
chmod 777 filename
How do you allow a file to be read and written by every user but not executed?
chmod 766 filename
How do you add another user?
useradd username
How do you list all disk partitions?
fdisk -l
How do you create a new disk partition on the sda directory?
fdisk /dev/sda
How do you format a particular disk partition?
mkfs.ext4 /dev/sda1
mcfucks.ext4
I mcfuck your partition
How do you display all devices connected by USB?
lsusb -tv
How do you compress a file into a .zip file?
zip filename.zip filename
How do you unzip a .zip file?
unzip filename.zip
How do you copy a file or a directory to somewhere else?
cp -r // /**/
How do you view the address of the default gateway?
ip r
How to view what DNS server your machine is configured to use?
cat /etc/resolv.conf
How do you terminate a process?
kill *
How do you view all hardware components?
lshw
How do you string together several commands in one terminal entry?
;
What is a FTP server? How does this protocol work (1)? How are FTP servers usually accessed (2)? How is a connection established for FTP (3)? What are the issues with this protocol (4)? What are the variants of FTP (5)?
File transfer protocol.
FTP uses a client server model, where a server hosts files for a client. Upload, download, delete.
you can use your browser to access, so ftp://22.35.65.123.1, or windows file explorer. Or FTP client.
FTP servers allow access through log ins or anonymously depending on permissions.
FTP uses TCP connections, established through 3 way handshakes.
SYN -> Server
Client <- SYN-ACK
ACK -> Server
FTP connections involve 2 connections over Port 21:
-Control connection: All FTP commands, such as GET
-Data connection to transfer files
FTP connections are open and unencrypted as it is a very old protocol. FTPS is a secure extension of FTP servers through TLS encryption. Regular FTP traffic can be viewed in plaintext if intercepted, which is bad for login details.
Variants of FTP:
-TFTP, trivial file transfer protocol
-SFTP, SSH file transfer protocol
-FTPS, TLS encrypted FTP connection
What is the default gateway?
A default gateway is the node in a computer network using the Internet protocol suite that serves as the forwarding host (router) to other networks when no other route specification matches the destination IP address of a packet.
How do you resolve a website domain to IPV4?
host *.com
How do you conceal all traffic including traffic from the terminal?
Conceal traffic by routing it all through tor networks, by downloading Torghost.
TorGhost redirects all internet traffic through SOCKS5 tor proxy. DNS requests are also redirected via tor, thus preventing DNSLeak.
To install TorGhost:
git clone https://github.com/SusmithKrishnan/to…
cd torghost
chmod +x build.sh
./build.sh
Torghost -s to start tor routing.
What is SOCKS5? How can it be used by hackers?
What is SOCKS5 proxy? A SOCKS5 proxy is an alternative to a VPN. It routes packets between a server and a client using a proxy server, and potentially a chain of public proxy servers.
It can be used by hackers by routing malicious traffic through their proxy server.
Unlike VPNs, SOCKS5 does not encrypt traffic, and so it can be sniffed and captured through packet analysis as it enters its entry node.
Define onion routing (2). What is it often used for (3)? How does tor encryption work (5)?
Onion routing routes your traffic through several different servers for privacy. Data moving to another tor node is called a hop.
It offers end-to-end encryption which is layered for each hop in the TOR circuit. These layers of encryption are removed with each hop (like an onion), which allows the data to be unrecognisable and anonymous between hops. This means that data intercepted between hops cannot be traced back to the original sender, unless the traffic is intercepted at the beginning or end. This is why onion routing is often used for criminal activities, as it makes it difficult to track by law enforcement.
What type of device is a WiFi Hub? What does it do (3)? How does it differ from other networking devices (5)?
A Hub connects devices on a network together. Classic Hubs are very old technology, and are largely discontinued, and have been replaced by switches.
A hub repeats data and sends it to every other client on the network, not exclusively to the correct recipient. For this reason, a hub wastes bandwidth. This also comes with security risks as all clients receive all data.
A hub uses a half-duplex, which means it cannot send and receive data at the same time. This would cause a data collision and data loss.
A hub is a Layer 1 device, and it has no knowledge of addresses (1).
What type of device is a WiFi Switch? What does it do (3)? How does it differ from other networking devices (5)?
Switches are intelligent devices which act as bridges and hubs put together. Switches connect devices on a network, while simultaneously keeping track of MAC addresses and port numbers. Switches are usually built into modern routers. (1)
Initially the switch will send data to every device on the network to learn the MAC address of the correct recipient, and this MAC address and port number will be stored on the switch. (3)
Layer 2 device. Full duplex. The switch differs to other networking devices because it is able to use MAC and port numbers to forward data directly to the intended recipient after this is stored in the switch MAC address table. (5)
What type of device is a WiFi Bridge? What does it do (3)? How does it differ from other networking devices (5)?
Bridges were classically used to combat the shortcomings of Hubs.
Bridges bridge different hubs together and segment LANs, and are Layer 2 devices which store MAC addresses.
Bridges are also old technology which have been replaced by switches.
What type of device is a WiFi Router? What does it do (5)?
Routers are intelligent networking devices which have an integrated switch. The router connects the LAN to the WAN, and routes traffic based on DHCP allocated IP addresses. (1)
Layer 3 device because it stores IP addresses, port numbers and MAC addresses.
What is a Network Interface Controller (NIC)? What is a Wireless Network Interface Controller?
The ethernet jack on a computer.
Same thing as a NIC, but it uses radio waves to connect to an access point instead of a cable.
What is the OSI 7 layer model and how does it work (2)? What are the typical uses of the OSI 7 layer model (3)? What typical protocols are associated with each layer of the model (5)?
It is A THEORETICAL FRAMEWORK ONLY. TCP/IP framework is the internet implementation of the OSI model.
When data is sent, it is sent top down.
When data is received, it is received bottom up.
- Application Layer
Applications and programs. - HTTP, FTP, SSH, DNS.
Self explanatory. Human interaction with apps and programs.
End User Layer
- Presentation Layer
Syntax Layer
Presentation of data from/to the application. - SSL, SSH, IMAP, MPEG, JPEG.
Takes data and defines how it should be encoded, encrypted or compressed for the session layer.
- Session Layer
Establishing communication channels for data communication. - APIs, Sockets.
Syncing sessions, resuming connections if interrupted.
Sync & Send Layer
- Transport Layer
Assembling data in the correct order. - TCP, UDP.
End-to-end Connections.
- Network Layer
Routing packets to the correct destinations. - IP, ICMP, IPSec, IGMP
The network layer has two main functions. One is breaking up segments into network packets, and reassembling the packets on the receiving end. The other is routing packets by discovering the best path across a physical network.
- Data Link Layer
Packets to frames, frames to packets. Logical Link Control to identify network protocols and MAC addresses to find correct devices. - Ethernet, PPP, Switch
Frames
- Physical Layer
The physical layer is responsible for the physical cable or wireless connection between network nodes. It defines the connector, the electrical cable or wireless technology connecting the devices. - Fiber, Access Points, Copper Cabling
Physical Structure
What is a shell? What is a terminal?
The shell is a program that takes commands from the keyboard and gives them to the operating system to perform.
This is a program that opens a window and lets you interact with the shell.
What is NMAP? How would you use it on a target (2)? What are the different abbreviations for NMAP (4 if you list 4, 5 if you are able to list all of them)?
Nmap is a network reconnaissance tool used to scan for open ports and services run by clients by sending various packets to the given IP range.
Hackers will port scan a network to find services which are vulnerable to known attacks, such as open SSH, or aero blue, etc.
Ports are necessary for making multiple network requests or having multiple services available.
What is the first switch listed in the help menu for a ‘Syn Scan’? SYN scans are a little more difficult to detect because they are just trying to leave a connection open and relying on the timeout to clear the connections.
-sS
Which switch would you use for a “UDP scan”?
-sU
OS detection
-O
Nmap provides a switch to detect the version of the services running on the target. What is this switch?
-sV
The default output provided by nmap often does not provide enough information for a pentester. How would you increase the verbosity?
-v
Verbosity level one is good, but verbosity level two is better! How would you set the verbosity level to two?
(Note: it’s highly advisable to always use at least this option)
-vv
What switch would you use to save the nmap results in a “normal” format?
-oN
If we don’t care about how loud we are, we can enable “aggressive” mode. This is a shorthand switch that activates service detection, operating system detection, a traceroute and common script scanning.
-A
Scan with the default nmap scripts
-sC
Port number or all ports
-p or -p-
test
What is gobuster? What can it be used for (3)? What are the different abbreviations for gobuster (4 if you list 4, 5 if you are able to list all of them)?
GoBuster is a tool used to brute-force URIs (directories and files), DNS subdomains and virtual host names. For this machine, we will focus on using it to brute-force directories.
/usr/share/wordlists.
gobuster dir -u http://:3333 -w
What is Nikto? What can it be used for (3)? What are the different abbreviations for nikto (4 if you list 4, 5 if you are able to list all of them)?
Nikto is a free software command-line vulnerability scanner that scans webservers for dangerous files/CGIs, outdated server software and other problems. It performs generic and server type specific checks. It also captures and prints any cookies received.
It can be used to find known vulnerabilities of web applications.
sudo nikto -h (IP) -p (port)
What is traceroute? What can it be used for?
The logical follow-up to the ping command is ‘traceroute’. Traceroute can be used to map the path your request takes as it heads to the target machine.
Tracks how many hops it takes to reach destination.
traceroute (IP)
What is the TCP/IP layer model and how does it work (2)? What are the typical uses of the TCP/IP layer model (3)? What typical protocols are associated with each layer of the model (5)?
TCP/IP model is a real world implementation of the OSI 7 layer model. It uses a TCP three-way handshake connection between two devices.
OSI 7 layer model is not used at all. OSI is just a theoretical model, it has never been implemented 1:1 in a real world scenario. TCP/IP is an “implementation” of the OSI model.
As mentioned earlier, TCP is a connection-based protocol. In other words, before you send any data via TCP, you must first form a stable connection between the two computers. The process of forming this connection is called the three-way handshake.
TCP
SYN
SYN/ACK
ACK
APPLICATION/ Application, presentation and session.
TRANSPORT/ Transport.
NETWORK/ Network.
NETWORK INTERFACE/ Physical and data link.
It is A THEORETICAL FRAMEWORK ONLY. TCP/IP framework is the internet implementation of the OSI model.
When data is sent, it is sent top down.
When data is received, it is received bottom up.
- Application Layer
Applications and programs. - HTTP, FTP, SSH, DNS.
Self explanatory. Human interaction with apps and programs.
End User Layer
- Presentation Layer
Syntax Layer
Presentation of data from/to the application. - SSL, SSH, IMAP, MPEG, JPEG.
Takes data and defines how it should be encoded, encrypted or compressed for the session layer.
- Session Layer
Establishing communication channels for data communication. - APIs, Sockets.
Syncing sessions, resuming connections if interrupted.
Sync & Send Layer
- Transport Layer
Assembling data in the correct order. - TCP, UDP.
End-to-end Connections.
- Network Layer
Routing packets to the correct destinations. - IP, ICMP, IPSec, IGMP
The network layer has two main functions. One is breaking up segments into network packets, and reassembling the packets on the receiving end. The other is routing packets by discovering the best path across a physical network.
- Data Link Layer
Packets to frames, frames to packets. Logical Link Control to identify network protocols and MAC addresses to find correct devices. - Ethernet, PPP, Switch
Frames
- Physical Layer
The physical layer is responsible for the physical cable or wireless connection between network nodes. It defines the connector, the electrical cable or wireless technology connecting the devices. - Fiber, Access Points, Copper Cabling
Physical Structure
What is a loopback address?
loopback address: IP shorthand for you — actually, your computer. The loopback is a special IP address (127.0.0.1) that isn’t physically connected to any network hardware. You use it to test TCP/IP services and applications without worrying about hardware problems.
What is an intranet?
An organization’s private network. If your intranet is built on TCP/IP protocols, applications, and services, it’s also an Internet.
What is subnetting? What is a subnet mask?
Dividing one large Internet into smaller networks (subnets) in which they all share the same network portion of an IP address.
/24
/25
/26
etc…
What are the different types of IP addresses?
Internal IP addresses and External IP addresses.
IPv6: 2001:db8::8a2e:370:7334.
IPv4: 192.168.0.1
How do you copy files from one directory to another?
Copying and moving files is an important functionality on a Linux machine. Starting with cp, this command takes two arguments:
cp (file) ///(destination)
