The security plus exam really hits on a lot of classic command line utilities.
Not so much to test whether you know them or not because the security plussed kind of assumes that you
do.
But more importantly it generates scenarios where you would need to know what type of command line tool
to use to be able to make some determination about a network.
So this episode is dedicated to going through hopefully for you a lot of well known command line utilities
and we're going to be going through these utilities.
But what we're going to be doing is more talking about scenarios than anything else.
So we've got a lot of utilities to cover here so let's go ahead and dive right in and let's start with
Ping ping is a classic utility and hopefully one you're already familiar with.
So what I want to do here is talk about the scenarios where we use ping.
The funny part is we use pings so ubiquitously that a lot of times people don't think about what is
the scenario that's causing me to turn to that tool.
So usually pretty simple scenarios.
So let's run through a few right now things here I've got my command line up and I'm going to do one
of my absolute favorite is DNS working people never think about this with ping.
So as you can see I'm just typing ping and then some arbitrary Web site my own.
Now what you're looking at here is you'll notice that it's resolved the WWE that totals them com.
So it actually says reply from 75 126 whatever it might be.
A lot of times people will run a ping and they don't think about that it's actually a wonderful little
quick and dirty DNS tool that resolved.
So whether even get a good reply or not the fact that it's resolving tells me my DNS is up and cooking.
Now the next thing I'm going to do is can I connect to somebody and this is really where we use paying
more than anything else.
So all I'm doing is I'm typing ping and I want to connect I want to see am I getting to one person or
another.
So what I'm going to do is I'm going to type in Ping.
Let's do somebody who's always up.
Who will dot com.
You can see that I'm getting a response.
Now if you look really really closely you're going to see that I'm getting IPV six.
So another thing we can do that's actually a lot of fun is I can say OK I can ping www.youtube.com just
fine on IP V-6 But what if I want to do it only with IPB for so I can use a switch like mine is for
and you'll see that everything has changed over so now I'm getting a good response back but this time
I'm forcing it to use IPV for a lot of problems that we run into in the security world has to do with
Layer 3 issues and people aren't thinking about is it IPV 4 or IPV 6 and security plus is going to assume
that you're comfortable with that and ping is the great way to be able to separate those two.
Now the next thing I want to do is do I have an internet Mytton connection.
Now if you take a look at the screen again you'll see that we've always got our time in milliseconds
in terms of response and that's a helpful tool.
But a lot of times especially if we're talking about a serious and particular hardware intermittent
issue in the Windows world we kind of have to do something a little bit funny.
So what I'm going to do is they're going to do a ping minus T.
And again let's pick somebody who's always up
and not want you to watch very very closely.
You'll see before we always had just four responses in the Windows world by running ping with the minus
T what we're getting ourselves is the ability to say just keep running.
Now this is actually kind of funny for you Linux people out there you're like Well that is the default
behavior and the security plus is actually going to challenge you and remind you.
Do I need to use a minus T with a Linux system.
The answer is simply no.
OK.
So that was fun and everybody loves paying.
I think we should switch over to something even more common.
Let's do.
Oh I don't know.
How about that
if you need to know what sessions a particular host is running at any given moment your go to tool is
net stat nets that can be absolutely terrifying in terms of the information that it gives you.
So when I go to that stat there are two big questions.
Two scenarios that I'm always looking for and counting on stat to help me out with the first one and
the pretty obvious one is who am I talking to.
So I'm going to run a net stat real quick care.
Now I almost never run that stat by itself.
I will in variably run minus N..
What the problem is is I'm so familiar with port numbers now that it's actually hard for me to look
at output where it says stuff like HTP and HDTV.
Just the numbers please so let me run this.
And what we can take a look at.
We can see what we're connecting to right now.
Now if you take a close look first of all this is a Windows 10 system and Windows 10 is notorious for
these loopback $127 zero down 0.1 with these really big fear port numbers fifty three thousand two hundred
and something.
These are just the telemetry of Windows 10 phoning home and there are things we can do about it.
I don't worry about that too much what I'm more interested in is when we get below that you can see
that on this particular test network my internal network ID for this host is 192 168 4:34 and you can
see I've got one two three four five connections on IPV four.
And and I've got an IP V-6 connection they're all on 4:43.
So I instantaneously know that I'm talking on HTP.
Well that's great.
And I also know why they're there and that's primarily because I've got my web browser open and these
are all the different individual tabs and what those connections are for.
So in this particular situation I'm happy with what I see.
What makes me nervous is when I have for example all of my web browsers closed and I'm still connecting
on 4:43 something's connecting in there that I'm not authorizing that's a classic sense of malware or
something else.
In fact a lot of places I have an Nvidia driver that actually connects and phones home on port 443 invidia
looks at that as a feature.
It scares me a little bit but I had to do some research and figure out where it was.
But when I'm looking for scenarios where I'm not sure who's talking out of this particular host net
step with the minus an option is the way to go.
Now the other one is the exact opposite.
Not so much who am I talking to but who's trying to talk to me.
So in this particular situation am I a server or something.
So what I'll do here is our ranit stat.
But what I'm going to do is I'm going to do.
NET step minus a minus a says show me all opening ports including the ones that I'm not actually connected
to.
So if I have a web server on here and I'm not connected to anybody that's that normally wouldn't show
that.
But by putting in the mine to say I'm like I don't care whether you're actually connected or not if
you're listening show it should get quite a bit of information here.
OK.
Now as we scroll through here what I'm looking for in this case is on this side what am I listening
on.
So in this particular case look right there and you see that right there shows that I'm listening on
port 80 this system right here is running a web server.
Now again that could be a good thing.
A lot of times little phone home utilities will actually use port 80 and be like their own little web
server for driver update and stuff.
We're not doing as much as we used to.
But what's important is I can take a look here and I can quickly see hey I'm a server.
Do I want to be a server now.
Something like port 80 is fairly innocuous but because I know my port numbers well certain other things
would terrify me if I saw open port 25 for e-mail or something like that.
Now I would start to panic a little bit.
The other problem is we look through this list is that there's a lot of listening ports you see are
they all says listening and listening there.
If you don't know your ports you're going to have to be doing a little bit of research here.
Things like 135 and 4:43 I'm more familiar with those because those are going to be part of the Windows
operating system.
But I'm still going to be taking a moment to do a little research.
Next step is great for scenarios where you're worried about who you're talking to or who's trying to
talk to you.
Let's talk about trace route for a minute.
Now trace route is a very very interesting utility.
The challenge that I run into with most people who say they don't like trace route is because they don't
think about scenarios where trace route is going to do them the most good.
Look the bottom line is if you can't ping somebody go ahead and trace routing them is a questionable
thing to do with one exception.
Let me give you an example right here.
I'm going to run trace route
and let's again pick good old Google because they never go down.
Knock on wood and I type in three W's.
All right.
Now what I want you to do is watch this very very closely as we're moving along here.
It's going to take a few clicks before it gets to Google.
But what's actually not terribly important to me is all the gobbledygook got past the first two lines.
If you take a look at those first two lines that is my internal router and the next line after that
is my in-house interface too as you can see I'm running Comcast to Comcast itself.
What that's telling me is that I know the first two routers between my network and the rest of the world.
And this is where trace route can really come up in different scenarios that will help you out.
Let's say you can't trace route somebody if that trace route fails on either the first or the second
line.
I now know that I've got an in-house problem and I'm going to grab a screwdriver and go check my router
or my ISP interface.
Now if it happens three or four levels down.
Well that's Comcast problem or somebody else's.
And there's nothing I'm going to be able to do about it.
So the trick to trace route is knowing your infrastructure and if you get a failure on trace or out
no.
Is it something you can fix or are you going to have to make a phone call to your ISP.
That's the big secret.
And those are the scenarios that are going to work best for you when it comes to trace route.
Now trace routes a lot of fun but let's go ahead and do one that's even more interesting to me.
Good old arp.
I seriously hope that you don't run into a scenario where you need to be running the command.
The main reason you're going to be running ARP is because you're afraid that somebody is doing something
naughty within the world of your switches.
Now for those of you who don't recall our or address resolution protocol is a tool by which we can resolve
a ethernet Mac address from an IP address.
So what I'm going to do is I'm just going to run our are by itself doesn't do anything but what we normally
do is we're going to run our mind it's a what you're looking at right here is the ARP cash.
So this is what your system picks up over time.
Now this is Windows arp on Linux and Macs a little bit different but you get the same basic result.
So let's take a look at what we got here.
Now in this particular case I've got two interfaces I want to concentrate on the one that you see here
that says 192 168 for 34.
That is my actual ethernet connection on this system so as we take a look at this you can see that we
have both dynamic and we also have static addresses.
Windows generate static arc cache entries that never change.
If you take a look what they are it will make some sense to you.
So these are broadcast addresses.
These are multicast addresses.
And there is no reason for those to ever change dynamic.
On the other hand our addresses that will change based on ARP commands that this host is picking up.
Now what you're panicking about in this type of scenario is that somebody has put in for example an
ARP poisoner.
And these can be incredibly difficult to diagnose.
Now if you take a look here at total seminars you can see all of these different physical nics that
I have here.
And if you look at the first six letters you can see they're all different for different ones.
That's because we buy lots of different brands of nics.
But one of the things you'll see a lot of organizations do is they're like we will always buy Intel
next.
The reason they're doing that is not because they're particularly hooked on Intel although they usually
are.
But what they're doing is that they always know that all of their nics are always going to start with
those first six values because they're all Intel OEM IDs.
And that way if an art Poisoner's sneaks in unless it's a very good art Poizner who even knows how to
mimic and Intel which most of them don't.
They will make it really easy to look on this list and suddenly see a number in there that the first
six numbers are different from what they're usually established and counting on.
And that can often be a clue that you've got an art poisoner out there.
Art poisoner's are a big problem now.
Good intrusion detection should catch this stuff.
But if you really need to see who's being the bad guy you are reduced to running ARP and trying to find
MAC addresses that you don't trust.
OK so we've gone through quite a few different OS utilities in this episode but we've got a bunch more
so go ahead make sure you're comfortable with these and watch for other episodes that cover even more
OS utilities.