 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 2
Networking Fundamentals for Ethical Hackers
⚠️ LEARNING PURPOSE ONLY: Everything in this tutorial is for educational and defensive security learning. Perform practical exercises only on systems, networks, applications, or labs that you own or have explicit permission to test. Do not scan, probe, exploit, or attempt unauthorized access to third-party systems.
Welcome to Day 2. Before learning tools such as Nmap, Wireshark, and Burp Suite, you need to understand how computers communicate.
🎯 Today's Learning Objectives
By the end of Day 2, you should understand:
What an IP address is
Private vs. public IP addresses
IPv4 and IPv6
MAC addresses
Ports
TCP vs. UDP
DNS
HTTP vs. HTTPS
Default gateway
Client-server communication
Basic network commands on Linux, Windows, and macOS
1. How Devices Communicate
Imagine your computer wants to access a website:
Your Computer
│
│ Request
▼
Router / Gateway
│
▼
Internet
│
▼
Web Server
│
│ Response
▼
Your Computer
A network allows devices to communicate using standardized protocols.
Some important protocols are:
| Protocol | Purpose |
|---|---|
| IP | Device addressing |
| TCP | Reliable communication |
| UDP | Fast connectionless communication |
| DNS | Domain → IP resolution |
| HTTP | Web communication |
| HTTPS | Encrypted web communication |
| SSH | Secure remote administration |
| DHCP | Automatic network configuration |
2. What Is an IP Address?
An IP address identifies a device/interface on an IP network.
Example IPv4:
192.168.1.25
IPv4 addresses contain four numerical sections:
192 . 168 . 1 . 25
Each section can range from:
0 - 255
Private IPv4 ranges
The major private ranges are:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
These are commonly used inside homes, offices, and private networks.
3. Public vs. Private IP
Private IP
Used inside a private network.
Example:
192.168.1.20
Public IP
Used to identify a network/interface on the public Internet.
For example:
203.0.113.10
The important concept is:
Private Network
↓
Router
↓
Public Internet
Your home router normally performs NAT (Network Address Translation) between internal private addresses and the public-facing connection.
4. What Is a MAC Address?
A MAC address is a link-layer address associated with a network interface.
Example:
00:1A:2B:3C:4D:5E
You'll commonly encounter MAC addresses when studying:
Ethernet
Wi-Fi
ARP
Network troubleshooting
Network discovery
Don't confuse:
IP address → Network-layer addressing
MAC address → Link-layer addressing
5. What Is a Port?
Think of an IP address as the address of a building and a port as a specific door/service.
For example:
192.168.1.20:443
Here:
IP = 192.168.1.20
Port = 443
Some commonly encountered ports:
| Port | Common service |
|---|---|
| 22 | SSH |
| 53 | DNS |
| 80 | HTTP |
| 443 | HTTPS |
| 25 | SMTP |
| 110 | POP3 |
| 143 | IMAP |
| 3389 | RDP |
⚠️ A port number alone does not guarantee that a particular service is actually running there.
6. TCP vs UDP
TCP
TCP provides reliable, connection-oriented communication.
It is commonly used where reliable delivery matters.
Examples:
HTTP/HTTPS
SSH
Email protocols
Conceptually:
Client → Establish connection → Server
Client ← Reliable data ← Server
Client → Close connection → Server
UDP
UDP is connectionless and has less protocol overhead.
It is commonly useful where speed and low overhead are important.
Examples include:
DNS
DHCP
Streaming/real-time applications
A simplified comparison:
| TCP | UDP |
|---|---|
| Connection-oriented | Connectionless |
| Reliable delivery | No built-in delivery guarantee |
| More overhead | Lower overhead |
| Ordered data | No built-in ordering |
7. What Is DNS?
DNS stands for Domain Name System.
Humans prefer:
example.com
Computers communicate using IP addresses.
DNS helps translate names into IP addresses:
example.com
↓
DNS
↓
IP address
You can think of DNS as the Internet's name-resolution system.
8. What Are HTTP and HTTPS?
When you open a website, your browser commonly communicates using HTTP-based protocols.
HTTP
HTTP
Port 80
HTTPS
HTTPS
Port 443
HTTPS provides encrypted communication using TLS.
Conceptually:
Browser
│
│ HTTPS
│ 🔐 Encrypted
▼
Web Server
This is extremely important in web security because we'll later study:
TLS
Cookies
Sessions
Authentication
HTTP headers
Requests/responses
Web application vulnerabilities
🧪 Day 2 Practical Lab
Today we're going to examine your own computer's network configuration.
No vulnerability scanning is required.
🐧 Linux Practical
Step 1 — View IP configuration
Run:
ip addr
Look for an interface such as:
eth0
ens33
wlan0
or another interface name.
Look for:
inet 192.168.x.x
Step 2 — View your routes
Run:
ip route
You may see something similar to:
default via 192.168.1.1 dev wlan0
Here:
default via 192.168.1.1
usually indicates your default gateway.
Step 3 — View DNS configuration
Depending on your Linux distribution:
resolvectl status
If resolvectl isn't available, you can inspect:
cat /etc/resolv.conf
Step 4 — Check listening network services
Run:
ss -tuln
This shows listening TCP/UDP sockets.
You may see entries similar to:
LISTEN
0.0.0.0:22
127.0.0.1:5432
Don't assume that every listening port is a vulnerability.
Today we're learning to observe—not attack.
🪟 Windows Practical
Open PowerShell.
Step 1 — View IP configuration
ipconfig
For more detailed information:
ipconfig /all
Look for:
IPv4 Address
Default Gateway
DNS Servers
Physical Address
Step 2 — View your routing table
Run:
route print
This allows you to see how Windows determines where network traffic should go.
Step 3 — DNS lookup
Run:
nslookup example.com
You'll see DNS information returned by your configured resolver.
This is a normal DNS lookup—not a security scan.
Step 4 — View network connections
Run:
netstat -ano
You may see:
Local Address
Foreign Address
State
PID
For example:
127.0.0.1:5432
means a service is listening on port 5432 on the local machine/interface.
🍎 macOS Practical
Open Terminal.
Step 1 — View network interfaces
Run:
ifconfig
Look for your active interface, often:
en0
or:
en1
Look for:
inet 192.168.x.x
Step 2 — Find your default gateway
Run:
route -n get default
Look for:
gateway: 192.168.1.1
Step 3 — DNS information
Run:
scutil --dns
This displays DNS configuration information used by macOS.
Step 4 — View listening services
Run:
lsof -nP -iTCP -sTCP:LISTEN
This can show applications listening for TCP connections.
Again, this is local inspection of your own Mac, not scanning another machine.
🌐 Cross-Platform Practical: DNS
All three operating systems can perform a basic DNS lookup.
Linux
nslookup example.com
If nslookup isn't installed, you can often use:
dig example.com
Windows
nslookup example.com
macOS
nslookup example.com
or:
dig example.com
Observe the returned DNS information.
What are you learning?
You're observing the process:
Domain Name
↓
DNS Resolver
↓
IP Address
🔎 Practical Exercise: Understand Your Own Network
Create a small table based on the information you found.
| Information | Your Result |
|---|---|
| Operating System | __________ |
| Private IPv4 | __________ |
| IPv6 | __________ |
| MAC Address | __________ |
| Default Gateway | __________ |
| DNS Server | __________ |
| Active Network Interface | __________ |
| Listening TCP Ports | __________ |
Don't post your public IP, MAC address, or other sensitive network information publicly.
🧪 Safe Connectivity Test
You can test your own machine using the loopback address:
127.0.0.1
Linux
ping -c 4 127.0.0.1
macOS
ping -c 4 127.0.0.1
Windows
ping 127.0.0.1 -n 4
Expected behavior is successful replies from your own machine.
🧠 Understanding the Result
If you run:
ping 127.0.0.1
you're essentially testing:
Your Computer
↓
127.0.0.1
↓
Your Computer
This does not test your Internet connection.
For a beginner, it's important to distinguish:
127.0.0.1
↓
Your own computer
192.168.x.x
↓
Your private/local network
Public IP
↓
Your Internet-facing address
📝 Day 2 Assignment
Answer these questions:
1. What is an IP address?
2. What is the difference between a private and public IP address?
3. What is a MAC address?
4. What is a network port?
5. What is the difference between TCP and UDP?
6. What does DNS do?
7. What is the difference between HTTP and HTTPS?
8. What is a default gateway?
9. What does 127.0.0.1 mean?
10. Which command did you use on your operating system to see listening network services?
🎯 Day 2 Challenge
On your own machine, identify:
1. Your network interface
2. Your private IP
3. Your default gateway
4. Your DNS resolver
5. At least one listening service
Then explain what each one means.
Don't worry if the output looks complicated. Learning to read command output is an important part of becoming a security professional.
⚠️ Ethical Hacking Reminder
LEARNING PURPOSE ONLY: The commands in this lesson are intended for education, troubleshooting, and authorized security learning. Do not replace the example/local targets with random IP addresses, servers, websites, Wi-Fi networks, or devices that you don't own or have explicit authorization to test.
Ethical hacking requires permission, scope, and responsibility before technical ability.
✅ Day 2 Summary
Today you learned:
IP addresses
IPv4 and IPv6
Private/public addressing
MAC addresses
Ports
TCP and UDP
DNS
HTTP/HTTPS
Default gateways
Network interfaces
Basic network inspection on Linux
Basic network inspection on Windows
Basic network inspection on macOS
🔜 Day 3
Linux, Windows & macOS Fundamentals for Ethical Hackers
We'll learn:
File systems
Users and groups
Permissions
Processes
Services
Environment variables
Command-line navigation
Important security-related commands
Practical exercises on all three operating systems
🔐 Remember: Learn → Practice → Understand → Secure.
No comments:
Post a Comment