We had so much fun in the other episode talking about OS utilities.
I'm like why don't we just keep going.
Now keep in mind I am going through the utilities that are specified in the comp t.a security plus x
y 0 5 0 1 so I'm not saying this is all there is but these are definitely on the exam.
So the next thing I think we should be talking about is really not just one utility but a bunch of different
utilities that kind of work the same way.
So I'm just going to call this IP config.
There's a lot of scenarios in the I.T. security world where you have to answer one basic question who
am I and how am I configured.
So what I want to talk about real quick are really three different commands to do the same thing IP
config the IP command and the deprecated I-F config.
So actually I'm just going to talk about two commands IP config which is a Windows tool an IP which
is a Linux tool.
I have config is like I said deprecated although there are ways if you actually want to install it and
use it you still can.
The important thing is that the IP command does everything the IAF config command does and a little
bit more so we'll just stick with that one.
So let's go in and start with IP config.
So I'm just going to go ahead and run IP config here on my Windows system.
Now if I run it by itself it gives me a lot of great information.
In particular I've got my IP V-6 address.
Now when does this temporary IP D6 addresses.
So those change very very quickly.
I've got my link local IP V-6 address I got my IP address my subnet mask and my default gateway.
The big deal here is not that IP config is that unique of a command.
What gets people in trouble is that you have to know your network for the IP config command to do you
any good.
For example on the network ID that I'm doing this video shoot on is one day to 168 four.
And if we take a look up here will see that I have 192 168 for address so life is good.
Now I've also got a couple I've got a virtual machine on here and this is the trio tiling adapter which
you'll still see in Windows 10.
The only thing I'm really interested in right here is my Ethernet adapter.
So IP config by itself is handy but if you really want to get some good information do an IP config
slash hall and this is going to give you a lot of really detailed information I need to warn you Security
plus Well Tia is a little bit notorious for taking questions from other types of certification and plopping
them in one certification so a great example would be right here where you might see a a plus type question
where it's like gee how can you determine what your MAC addresses.
And the answer is that you have to type IP config slash all.
And if you look right there there's my MAC address so any type of scenario where you need to ask a question
who is my IP config is going to be your go to tool.
Now the other thing I need to stress is that if you know your network you can get great information
here like for example here's my IP address and it's 192 168 for not 34.
What if it suddenly became 169 54.
Well now you know I've got a DHC problem or one.
Heaven forbid it becomes 10 11 not 13 or something like that.
I'd have a rogue DHC server so the power of IP config is new in your network and being able to take
a quick snapshot and look for situations that might be causing problems.
So what I want to do now is let's do this all over again except this time let's use the Linux IP command.
So I'm going to type the most famous version of the IP command IP a DDR.
And when I type this you can see we've got a lot of great information and now you'll notice I've got
two adapters on here.
One of them is just the loop back EHLO and right here is my actual Ethernet right here.
So we take a look.
We've got examples we've got our mac address here.
We've got our IP address.
We've got our subnet mask as well 24.
We can see it's dynamic.
There's a ton of information in here.
Here is our link local address for IP D6.
So I can go in here and get a quick snapshot of what's going on with my system in particular my MAC
address my IP configuration.
So that's why we put IP config and the IP command together.
It's different operating systems but they really do the same thing.
OK that was fun but I think it's time to start moving into the world of DNS.
Anybody feeling like a little N.S. look up
DNS problems can drive you absolutely bonkers.
And that's when we turn to tools like Gudel N.S. look up and the slightly better dig.
Now before I get started here I need to warn you DNS has been a problem now for years in terms of bad
guys doing things.
So a lot of the query tools that we use like N.S. look up and deg have been kind to well shut down.
It's not that the tools don't know how to query it just DNS servers have learned not to make responses
to these types of tools.
So a lot of the things we used to be able to do within is look up and dig are kind of gone.
However if you need to make queries to DNS servers there are some things we can still do at these tools
and probably the most important one is what is my DNS server.
You know what.
Let's make it the most important to what is my DNS server and then the other question you could ask
is is this particular system a DNS server.
So let's say you've got a scenario where your DNS simply isn't working.
N.S. look what is going to be the tool to turn to to queer your DNS server and check things.
Now I'm going to be using N.S. Look-Up in Windows but keep in mind that in this look up also works just
fine in Linux as well.
So N.S. look up now you can type it by itself and put it into interactive mode.
I personally don't like that so I'm going to do stuff like this I can do this look up w w w dot total
Sam dot com.
So what I'm doing right here is I've made a query and I want to know what server am I using for DNS.
And then what is the IP address for WW total so noncom.
And if you take a look here you'll see that my DNS server is currently this machine called Total home
DC to that total home.
And then the address is an internal address so I know that I've got an internal DNS server.
I'm just not using my Comcast DNS or whatever it might be.
And it does a query for me and it tells me the IP address.
Now that's handy but we can do a couple of other things too.
For example I am going to go into interactive mode.
Know watch what happens.
So it's just going to sit here like this and I'm going to change my DNS server.
So what I've done is I've said I don't care what my DNS server normally is.
I want you to try a different one when you run into scenarios where you're worried that your DNS server
might be the problem running in this look out.
And just quickly just making a change you go well let's try this server and we can go ahead and see
if things work better.
Now I have famous public DNS servers like 8.8 that 8.8 memorized but I can go ahead and just do little
queries right here and see if anything comes up.
So.
So you can see what I've done is I've queried total CENTCOM again.
I got the same IP address as I should but you'll see that I'm using a different DNS server.
N.S. look up is a great way.
Instead of going into your system and actually changing your DNS settings you can just use atus look
up and go Look my DNS server isn't working.
Let me try another one and see if everything starts to suddenly work.
So it does a really good job with that.
Now it's look up used to be able to do a lot more but it's been pretty much shut down the DNS servers
don't allow the types of queries that look up does.
However there is one tool that's a little bit better than Enis look up and that tools called Dig.
Now there is not a native Windows version of Digg that I know of there's third party tools that actually
work great.
Even some graphical ones.
But if you really want to get into Digg we've got to go head over to Linux.
All right so here I am in a Linux system and I'm just going to run a couple of big commands and get
some idea of some of the power you can do.
Now dig will work like an S look up.
So if I've got a scenario where I'm worried about a particular system I can go ahead and run Digg and
then whatever domain I want.
Now there's a couple of things that are interesting here.
You can see that it resolves total some com just fine right here.
But notice what its server has.
It's a local server.
It's simply telling us that if there's a cache on this the system has been asking about W W W not total
CENTCOM so much that it had it locally and it's ready to rock and roll.
So just like with NSLookup if we want to change the DNS server it's no big deal.
All we do is we type in an at sign and then the IP address of whatever server we want to use.
And you'll see that I get the same response as I should but notice down here you'll see that the server
has changed to reflect that I'm using a different box.
Now there are a few small things you can do a dig that you cannot do with an s look up.
One of the things that's kind of interesting is that you can queery certain records for example start
of authority or MX records.
So you're looking for a mail server.
You can actually query a domain to determine things like that.
So let's just do one example where I'm going to query total dot and find out what the mail server is.
So I'll type Digg and then M-x and then whatever I'm interested in and you'll see what's happened here
is that I now see the next record hey looks like total seminars is using Office 365.
It says outlook dot com so you can see Digg has a little bit more power than N.S. look up in that it
can query more public records like start of authority name server MX records things like that but you're
not going to be able to use Digg to query things like a records where suddenly it discovers every host
in your network because all your records pop up that stuff has been pretty well blocked off.
All right.
That stuff was fun.
But I've got one more very very interesting too.
I want to show you the netcat.
I wish I could talk for two hours about this one utility netcat netcat is the Swiss Army knife.
Does anything utility that runs on Linux systems that gives you the opportunity to do stuff.
That's actually kind of fascinating.
Netcat because it's a Swiss army knife does so very many things that it's almost hard to wrap it up.
But let me get you through the security plus.
Basically netcat can open and listen on ports and it can also open and act as a client on just about
any port you want.
So let me give you a quick example here.
So I'm going to type sudo netcat I'm going to type in minus L and then I can just type in any arbitrary
port that I want.
Let's use something that's rare and weird and what I've just done is I've opened up port 2:31 on this
system as a listening port.
So what I'm going to need to do is open up another terminal here
and on this terminal I'm going to to just run net stat just so we can see the results of this
get back up towards the top.
And if you see right there you can see that this system is now listening on port to 31.
Now the downside to this is that it's just an open port.
So if I open up a listening port on port 80 For example I would take input from clients who were querying
it.
Now it's not a real web server so it wouldn't be able to respond.
But the important thing is is that with netcat This is the other part of netcat that's fun.
I can open a port as a client and by opening as a client I can just take a text file it's got all kinds
of evil testing stuff and start attacking a particular web server or I can do all kinds of strange queries.
I can do all kinds of stuff.
Netcat is a tool for aggressive action.
You're using netcat because you're doing a vulnerability assessment or are you doing some form of Penn.
testing and you want to do what's known as bannered grabbing where you're just trying to get a server
to respond to go Oh hi I am the HDTV server and these types of situations.
It gives you the ability to be able to do stuff like if you opened up a web browser.
I mean things like chrome they're not going to let you type naughty things in because Google likes their
product but with netcat you can do stuff like that that cat can be used for so much more and I'm just
barely touching those.
You can do file transfer with it.
You can do just about anything but remember the most important thing about netcat is it is a tool for
aggressive use.
It's not something that your administrator is going to be running on a daily basis.
All right.
Well I think we have finally covered all of the different OS utilities and you're going to be seen on
the comp security plus exam take some time play with these tools and most importantly understand the
scenarios where you're going to be applying them because you're going to see it on the exam.