Module 02: Networking for Security¶

← Module 01: Introduction | Topic Home | Next: Web Application Security →

Understanding protocols from the attacker's perspective reveals why they are attacked, not just how to use them — this is the foundation for every network-level security technique.

[!NOTE] Stub Module — This module outline is complete. Full theory content will be expanded in a future update. The structure, objectives, and cross-links are authoritative; the Theory section is a scaffold for the complete content.

Table of Contents¶

1. Overview
2. Prerequisites
3. Objectives
4. Theory
5. Key Concepts
6. Examples
7. Common Pitfalls
8. Cross-Links
9. Summary

Overview¶

Every security technique — port scanning, protocol exploitation, web application attacks, privilege escalation — operates on top of networking. Before you can attack or defend a network, you must understand how the networks and protocols work at the level an attacker sees them. This module covers the OSI model from the attacker's perspective, examines the protocols most commonly exploited in penetration tests, and introduces network reconnaissance.

The shift from "I know how HTTP works" to "I know how an attacker sees HTTP" is fundamental. HTTP headers leak server information. DNS answers reveal infrastructure. SMB shares expose files. FTP can transmit credentials in cleartext. This module maps each protocol to its attack surface.

Prerequisites¶

• [[pentesting-security/modules/01_introduction]] — Ethics and legal framework, lab setup
• [[networks]] — Basic TCP/IP, IP addressing, DNS, HTTP fundamentals

Objectives¶

By the end of this module, you will be able to:

1. Explain the OSI model and map common attacks to the layers where they operate
2. Use nmap to perform host discovery, port scanning, service version detection, and OS fingerprinting
3. Describe the attack surface of HTTP, DNS, SMB, FTP, and SMTP from an attacker's perspective
4. Perform basic network reconnaissance against an authorized target (DVWA, Metasploitable)
5. Identify the difference between a port scan, a service scan, and a vulnerability scan
6. Explain how Wireshark can be used to analyze network traffic in an authorized context

Theory¶

The OSI Model for Attackers¶

The OSI model is not just a networking educational tool — it is a map of where attacks happen. Each layer has characteristic vulnerability classes:

Most penetration testing and bug bounty work happens at Layers 4–7. Understanding the lower layers helps explain why certain attacks work and how network-level defenses (firewalls, IDS/IPS) operate.

Common Protocols from the Attacker's Perspective¶

Each protocol that a system exposes is part of its attack surface. The attacker asks: what does this protocol expose, and what can I do with it?

HTTP/HTTPS (port 80/443): The primary target for web application security. HTTP headers reveal server software versions, framework details, and cookies. HTTP is stateless, which creates session management challenges. HTTPS encrypts traffic but the attacker can still see the destination hostname via SNI (Server Name Indication) and the request metadata.

DNS (port 53/UDP): DNS reveals infrastructure. Zone transfers (if misconfigured) expose all hostnames in a domain. Subdomain enumeration via brute force reveals attack surface. DNS can also be used for data exfiltration (DNS tunneling) and C2 communication in post-exploitation.

SMB (port 445): The Windows file sharing protocol. Historical goldmine for attackers: EternalBlue (MS17-010) exploited SMB for WannaCry. SMB often exposes shared files, can be used for lateral movement with valid credentials, and supports NTLM authentication (vulnerable to relay attacks).

FTP (port 21): Often transmits credentials in cleartext. Anonymous FTP access is a common misconfiguration. FTPS and SFTP are the secure alternatives.

SSH (port 22): Generally secure when configured correctly. Attack vectors: weak passwords (brute force), insecure key management, outdated SSH versions with known vulnerabilities, and SSH key reuse across systems.

SMTP (port 25/587): Email protocol. Open relays allow spam and phishing campaigns. SMTP enumeration can reveal valid usernames (VRFY/EXPN commands). SPF/DKIM/DMARC misconfigurations enable email spoofing.

Network Reconnaissance with nmap¶

# Step 1: Discover live hosts on your local network (authorized range)
# -sn = ping scan (no port scan), just host discovery
nmap -sn 192.168.56.0/24

# Step 2: Basic port scan of a target host
# Top 1000 ports by default
nmap 192.168.56.101

# Step 3: Full port scan with service version detection
# -p- = all 65535 ports, -sV = service version, -T4 = faster timing
nmap -p- -sV -T4 192.168.56.101

# Step 4: OS detection and NSE script scan
# -O = OS detection (requires root), -A = aggressive (version + scripts + OS + traceroute)
sudo nmap -A 192.168.56.101

# Step 5: Vulnerability scan using built-in NSE scripts
nmap --script vuln 192.168.56.101

# Step 6: Save output for your report
nmap -sV -p- -oA ~/pentest/recon/nmap_full 192.168.56.101

Wireshark — Packet Analysis¶

Wireshark captures and analyzes network traffic. In an authorized network testing context, it reveals exactly what protocols are transmitting in cleartext, what services are communicating, and how authentication works at the wire level.

# Capture traffic on eth0 interface (requires root/sudo)
sudo wireshark -i eth0

# Useful Wireshark display filters:
# http                          — show only HTTP traffic
# http.request.method == "POST" — show only POST requests
# dns                           — show only DNS traffic
# tcp.flags.syn == 1            — show TCP SYN packets (connection attempts)
# ip.addr == 192.168.56.101     — show traffic to/from specific IP
# ftp                           — show FTP traffic (will show credentials if cleartext)

Key Concepts¶

Port — A 16-bit number (0–65535) that identifies a specific process or service on a host. Ports 0–1023 are "well-known" ports assigned to standard services (80=HTTP, 443=HTTPS, 22=SSH). Ports 1024–49151 are registered ports; 49152–65535 are dynamic/ephemeral.

TCP vs UDP — TCP (Transmission Control Protocol) provides reliable, ordered delivery with connection establishment (SYN-SYN/ACK-ACK handshake). UDP (User Datagram Protocol) is connectionless and best-effort. Attackers care because: TCP scans are more reliable but more detectable; UDP services are often overlooked in security reviews.

Banner Grabbing — Reading the service banner (the initial message a service sends when you connect) to identify the software and version. Example: nc 192.168.56.101 22 may reveal the SSH version string.

ARP Spoofing — Sending fake ARP (Address Resolution Protocol) replies to associate your MAC address with another host's IP address, enabling man-in-the-middle attacks on a local network segment. Tool: arpspoof (from dsniff package).

Network Segmentation — Defensive practice of dividing a network into isolated segments (VLANs, subnets, firewall zones) to limit the blast radius of a compromise. A properly segmented network prevents an attacker who compromises a web server from immediately reaching the database or internal HR systems.

Examples¶

Example 1: Scanning Metasploitable 2¶

Scenario: You have Metasploitable 2 running at 192.168.56.101 on a host-only network. Perform initial reconnaissance and document what you find.

# Initial quick scan
nmap -sV -T4 192.168.56.101

# Expected output (abbreviated) — Metasploitable is intentionally insecure:
# PORT     STATE SERVICE     VERSION
# 21/tcp   open  ftp         vsftpd 2.3.4
# 22/tcp   open  ssh         OpenSSH 4.7p1 Debian (protocol 2.0)
# 23/tcp   open  telnet      Linux telnetd
# 25/tcp   open  smtp        Postfix smtpd
# 53/tcp   open  domain      ISC BIND 9.4.2
# 80/tcp   open  http        Apache httpd 2.2.8
# 139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
# 3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
# ...and many more

The attacker immediately notes: vsftpd 2.3.4 is a famous vulnerable version (backdoor CVE-2011-2523), Telnet is cleartext, the SSH version is ancient, and MySQL is exposed on a public port.

Example 2: DNS Enumeration¶

# DNS lookup — get all records
host -t any example.com

# Subdomain brute force using gobuster DNS mode (authorized context only)
gobuster dns -d example.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Check for zone transfer misconfiguration (almost always blocked, but worth checking)
dig axfr @ns1.example.com example.com
# If successful (rare), returns ALL DNS records for the domain — goldmine for recon

Common Pitfalls¶

Pitfall 1: Running aggressive scans without understanding the noise they create. An nmap -A -p- scan against a production system (if you somehow have permission for that) will generate thousands of packets and almost certainly trigger IDS/IPS alerts. Always start with a quieter scan and escalate.

Pitfall 2: Ignoring UDP services. Most beginners scan only TCP. Many interesting services run on UDP: DNS (53), SNMP (161/162), TFTP (69), NTP (123). SNMP in particular often leaks system information if community strings are default ("public").

Pitfall 3: Assuming a closed port means no service. A port can be filtered (no response) rather than closed (RST). Filtered ports may still have services behind a firewall. nmap distinguishes: open, closed, filtered.

Cross-Links¶

• [[networks]] — The foundational networking topic covers the underlying protocols in depth
• [[pentesting-security/modules/07_recon-and-osint]] — Module 07 builds on this module's reconnaissance concepts with OSINT techniques and advanced enumeration
• [[pentesting-security/modules/08_exploitation-basics]] — Module 08 uses the port scan findings from this module as the starting point for exploitation

Summary¶

• The OSI model maps attack classes to specific layers — most pentesting happens at Layers 4–7
• Every exposed protocol is part of the attack surface; each has characteristic vulnerabilities
• nmap is the standard tool for port scanning and service fingerprinting
• HTTP, DNS, SMB, FTP, SSH, and SMTP are the most commonly targeted protocols in network-level pentests
• Wireshark reveals what is visible on the wire — cleartext protocols expose credentials
• Network segmentation is the primary network-level defensive control; understand it to understand what you're working around during an authorized internal pentest