Search: [network] - code

foralyse

xubuntu 20.04 - focal

virt-manager

host

<filesystem type="mount" accessmode="mapped" fmode="0660" dmode="0770">
  <source dir="/vms/share"/>
  <target dir="/hostshare"/>
  <address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0"/>
</filesystem>

#sudo usermod -G libvirtd -a $USER
sudo usermod -G libvirt-qemu -a $USER
hostpath=/vms/share
sudo chown -R libvirt-qemu:libvirt-qemu $hostpath
sudo setfacl -Rm g:libvirt-qemu:rwx $hostpath
sudo setfacl -d -Rm g:libvirt-qemu:rwx $hostpath

guest

sudo sh -c 'echo "9p
9pnet
9pnet_virtio" >> /etc/initramfs-tools/modules'
sudo update-initramfs -u

sudo sh -c 'echo "# qemu share
hostshare                                /share        9p     trans=virtio,version=9p2000.L,rw,umask=002    0 0" >> /etc/fstab'

global

install

update

sudo apt remove -y gimp* libreoffice-* thunderbird* transmission-gtk
sudo apt update
sudo apt list --upgradable
sudo apt -y dist-upgrade
sudo apt -y autoremove

system

sudo apt install -y binutils-common bsdmainutils curl debconf-utils exfat git gnupg2 gparted hfsprogs htop kpartx lnav most net-tools p7zip-full p7zip-rar pv rar sysstat testdisk tmux tree unrar vim xsysinfo # openssh-server

sudo apt install -y dconf-editor firefox-locale-fr galculator gpicview meld plank qt5ct qt5-gtk2-platformtheme thunar-media-tags-plugin tumbler-plugins-extra

conf

qt5-ct to fusion

global

sudo swapoff -av && sudo sh -c 'echo vm.swappiness=10 > /etc/sysctl.d/99-swappiness.conf' # limit swap

sudo rm /etc/localtime && sudo ln -sv /usr/share/zoneinfo/Etc/UTC /etc/localtime

software-properties-gtk # add canonical partners

export QT_QPA_PLATFORMTHEME=gtk2
echo "\n# QT\nexport QT_QPA_PLATFORMTHEME=gtk2" >> ~/.profile
echo -e "\n#JAVA\nexport _JAVA_OPTIONS=\"-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true -Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel -Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel \${_JAVA_OPTIONS}\"" >> ~/.profile

menulibre # edit menu

path=~/.config/autostart
[ -d ${path} ] || mkdir ${path}
echo '[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=plank
Comment=plank
Exec=plank
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false' > ${path}/plank.desktop

plank --preferences &

trans

# HOST
path=/vms/share/trans; [ -d ${path} ] || mkdir -p ${path}
cp -r ~/dev/ /vms/share/trans/

# GUEST
path=~/.local/share/icons; [ -d ${path} ] || mkdir -p ${path}
path=~/.local/share/applications; [ -d ${path} ] || mkdir -p ${path}

path=/share/trans/dev
path_conf=${path}/install-desktop/conf

cp ${path_conf}/foralyse/.bashrc ~/
cp ${path_conf}/foralyse/.bash_alias ~/
sudo cp ${path_conf}/foralyse/.bashrc /root/
sudo cp ${path_conf}/foralyse/.bash_alias /root/
cp ${path}/install/conf/foralyse/.vimrc ~/
sudo cp ${path}/install/conf/vim/* /usr/share/vim/vim*/colors/
sudo cp ${path_conf}/soft/meld-dark.xml /usr/share/meld/styles/
sudo cp ${path_conf}/wp/* /usr/share/xfce4/backdrops/
sudo cp ${path_conf}/bash-completion/* /usr/share/bash-completion/completions/
sudo cp ${path_conf}/icons/tmux.svg /usr/share/icons/default/
sudo cp ${path_conf}/foralyse/xfce4-terminal-tmux.desktop ~/.local/share/applications/
cp ${path_conf}/foralyse/xfce4-terminal-tmux.desktop ~/.local/share/applications/
cp ${path_conf}/icons/* ~/.local/share/icons

sudo ln -sv /usr/share/bash-completion/completions/tmux.git /usr/share/bash-completion/completions/tmux

sudo chmod +r /usr/share/icons/default/tmux.svg
sudo chmod +r /usr/share/bash-completion/completions/tmux*
sudo chmod +r /usr/share/xfce4/backdrops/*

sublime text

file="/etc/hosts"
sudo sh -c "echo '\n# sublime-text hack\n127.0.0.1\tsublimetext.com\n127.0.0.1\twww.sublimetext.com\n127.0.0.1\tlicense.sublimehq.com' >> ${file}"

ips="45.55.255.55"
for ip in ${ips}; do sudo iptables -A OUTPUT -d ${ip} -j DROP; done
path=/etc/iptables
[ -d "${path}" ] || sudo mkdir "${path}"
sudo sh -c 'iptables-save > /etc/iptables/rules.v4'

cat ${S_PATH_INSTALL_CONF}/soft/sublime-text.license

forensic

global

# network
sudo apt install -y whois

# pwd & evtx & process
sudo apt install -y john libscca-utils pev radare2

# hive
sudo apt install -y libhivex-bin chntpw reglookup

# gui
sudo apt install -y bless geany ghex gpicview gtkhash wxhexeditor

conf

bless

cp /usr/share/bless/*.layout ~/.config/bless/layouts/

kali

#sudo sh -c "echo '# kali\ndeb http://http.kali.org/kali kali-rolling main non-free contrib' > /etc/apt/sources.list.d/kali.list
#wget -q -O - archive.kali.org/archive-key.asc | sudo apt-key add -
#sudo apt update

#sed -i '/^deb/ s|^|#|' /etc/apt/sources.list.d/kali.list
#sudo apt update

python

sudo apt-get install -y python3 python3-pip
. ~/.profile

sudo apt-get install -y python2 # python2-dev
cd /tmp && curl -sSL https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
python2 get-pip.py

pip2

python2 -m pip install -U balbuzard

pip3

python3 -m pip install -U malcarve regrippy

binwalk

dependencies

sudo apt install mtd-utils gzip bzip2 tar arj lhasa p7zip p7zip-full cabextract cramfsswap squashfs-tools lzop srecord

python3 -m pip install -U nose coverage pycryptodome pyqtgraph capstone matplotlib
. ~/.profile

github

# Install sasquatch to extract non-standard SquashFS images
sudo apt install -y zlib1g-dev liblzma-dev liblzo2-dev
cd /tmp && git clone https://github.com/devttys0/sasquatch
cd sasquatch && ./build.sh

# Install jefferson to extract JFFS2 file systems
python3 -m pip install -U cstruct
cd /tmp && git clone https://github.com/sviehb/jefferson
cd jefferson && sudo python3 setup.py install

# Install ubi_reader to extract UBIFS file systems
sudo apt install -y liblzo2-dev
python3 -m pip install -U python-lzo
cd /tmp && git clone https://github.com/jrspruitt/ubi_reader
cd ubi_reader && sudo python3 setup.py install

# Install yaffshiv to extract YAFFS file systems
cd /tmp && git clone https://github.com/devttys0/yaffshiv
cd yaffshiv && sudo python3 setup.py install

# Install unstuff (closed source) to extract StuffIt archive files
cd /tmp && curl -sS http://downloads.tuxfamily.org/sdtraces/stuffit520.611linux-i386.tar.gz | tar -zxv
sudo cp bin/unstuff /usr/local/bin/

pandoc

# sudo apt install pandoc texlive-latex-base texlive-latex-recommended texlive-latex-extra

# pandoc -s -o $fileout $filein

binwalk

cd /tmp && git clone https://github.com/ReFirmLabs/binwalk
cd binwalk && sudo python3 setup.py install

regripper

sudo apt-get install -y libparse-win32registry-perl
path=$(find /usr/share -name Win32Registry)
cd /usr/share && sudo git clone https://github.com/keydet89/RegRipper3.0.git 
sudo mv RegRipper3.0 regripper
for file in WinNT/File.pm WinNT/Key.pm Base.pm; do sudo mv ${path}/${file} ${path}/${file}.$(date +%s); sudo ln -sv /usr/share/regripper/${file##*/} ${path}/${file}; done
cd regripper
sudo cp -a rip.pl rip.pl.$(date +%s)
sudo sed -i '/^my @alerts = ();/a my \$plugindir = "/usr/share/regripper/plugins/";' rip.pl
sudo sed -i "1c #! $(which perl)\nuse lib qw(/usr/lib/perl5/);" rip.pl
sudo chmod +x rip.pl
sudo ln -sv /usr/share/regripper/rip.pl /usr/bin/regripper
sudo ln -sv /usr/share/regripper/rip.pl /usr/bin/rip

volatility

volatility3

python3 -m pip install -U pefile yara-python capstone pycryptodome jsonschema leechcorepyc python-snappy

python3 -m pip install -U volatility3
cd ~/.local/bin && ln -sv vol vol3

volatility2

https://github.com/volatilityfoundation/volatility/wiki/Installation

sudo apt -y install pcregrep libpcre++-dev python-dev

python2 -m pip install distorm3 ipython openpyxl pycrypto pytz ujson yara-python

libforensic1394

sudo apt install -y cmake

cd /tmp
git clone https://github.com/FreddieWitherden/libforensic1394
cd libforensic1394
mkdir build && cd build
cmake -G"Unix Makefiles" ../
sudo make install
cd ../python
sudo python setup.py install
sudo ln -sv /usr/local/lib/libforensic1394.so.0.3.0 /usr/lib/libforensic1394.so.2

cd
sudo rm -fR /tmp/libforensic1394
sudo apt remove cmake
sudo apt autoremove

volatility

cd /opt
git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
rm -fR .git
sudo python setup.py install

cd /usr/local/bin
sudo ln -sv vol.py vol2
vol2 -h

wireshark

sudo add-apt-repository -y ppa:wireshark-dev/stable
sudo apt update
sudo apt install -y tshark wireshark

autopsy

global

path_share=/share

sudo apt-get update

sudo apt install -y afflib-tools testdisk ewf-tools xmount fdupes java-common

sudo apt-get install -y imagemagick libde265-0 libheif1

java

java_file=$(ls ${path_share}/jdk-8*linux-x64.tar.gz)
file=/usr/local/bin/oracle-java-installer.sh
sudo curl -sS https://raw.githubusercontent.com/labcif/oracle-java-installer/master/oracle-java-installer.sh -o ${file}
#sudo sed -i s'/update-java-alternatives -a/update-alternatives --auto java/' /usr/local/bin/oracle-java-installer.sh
#sudo sed -i s'/update-java-alternatives -l/update-alternatives --list java/' /usr/local/bin/oracle-java-installer.sh
sudo sed -i 's|tar -xvzf|tar -xzf|' /usr/local/bin/oracle-java-installer.sh
sudo chmod +x ${file}
sudo ${file} --install ${java_file}
. /etc/profile.d/jdk.sh
${file} --status ${java_file}

base64sha

file=/usr/local/bin/b64sha
sudo curl -sS https://raw.githubusercontent.com/labcif/Base64SHA/master/b64sha -o ${file}
sudo chmod +x ${file}

sleuthkit

sleuthkit_file=$(ls ${path_share}/sleuthkit-java_*_amd64.deb)
read sleuthkit_version_major sleuthkit_version_minor <<<$(echo ${sleuthkit_file}|sed 's|^.*/sleuthkit-java_\([0-9_\.]\+\)-\([0-9]\)_amd64.deb|\1 \2|')

sudo apt install ${sleuthkit_file}

autopsy

file=$(ls ${path_share}/autopsy-*.zip)
path=${file%.zip} && path=/opt/${path##*/}
sudo unzip -q -d /opt/ ${file}

sudo chown -R ${USER}:${USER} ${path}
cd /opt && sudo ln -sv ${path##*/} autopsy
cd ${path}
sh unix_setup.sh

ln -sv ${path}/bin/autopsy ~/.local/bin/autopsy
autopsy --nosplash

launcher

echo "[Desktop Entry]
Version=1.0
Type=Application
Terminal=false
Icon=/opt/autopsy/icon.ico
Name=Autopsy
Exec=autopsy" > ~/.local/share/applications/autopsy.desktop

addons

disk · foralyse · forensic · memory · network · ubuntu

Fri Jun 3 08:41:58 2022 * · permalink

http://code.ambau.ovh/snippets/foralyse.html

tshark

Operators

See wireshark

Usefull

select

tshark -r ${dump} -e ip.src # get all source ip addresses
tshark -r ${dump} -e ip.proto -Tfields
tshark -r ${file} -e http.user_agent -Tfields

filter

tshark -r ${dump} -e ip.src # get all source ip addresses
tshark -r ${dump} -Y http -w filtered.pcapng # filter all http streams to file
tshark -r ${dump} -Y "not ip.addr == 93.184.221.240" -w filtered.pcapng # filter by IP address
tshark -r ${dump} -Y "frame.time_epoch >= 1631211000" -w filtered.pcapng # filter by frame time epoch

help

tshark [ -i <capture interface>|- ] [ -f <capture filter> ] [ -2 ] [ -r <infile> ] [ -w <outfile>|- ] [ options ] [ <filter> ]

qtshark -G [ <report type> ] [ --elastic-mapping-filter <protocols> ]

Dump and analyze network traffic

Capture interface

-i <interface>, --interface <interface> # name or idx of interface (def: first non-loopback)
-f <capture filter> # packet filter in libpcap filter syntax
-s <snaplen>, --snapshot-length <snaplen> # packet snapshot length (def: appropriate maximum)
-p, --no-promiscuous-mode # don't capture in promiscuous mode
-I, --monitor-mode # capture in monitor mode, if available
-B <buffer size>, --buffer-size <buffer size> # size of kernel buffer (def: 2MB)
-y <link type>, --linktype <link type> # link layer type (def: first appropriate)
--time-stamp-type <type> # timestamp method for interface
-D, --list-interfaces # print list of interfaces and exit
-L, --list-data-link-types # print list of link-layer types of iface and exit
--list-time-stamp-types # print list of timestamp types for iface and exit

Capture stop conditions

-c <packet count>        stop after n packets (def: infinite)
-a <autostop cond.> ..., --autostop <autostop cond.> ...
    duration:NUM - stop after NUM seconds
    filesize:NUM - stop this file after NUM KB
       files:NUM - stop after NUM files
     packets:NUM - stop after NUM packets```

Capture output

-b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
    duration:NUM - switch to next file after NUM secs
    filesize:NUM - switch to next file after NUM KB
       files:NUM - ringbuffer: replace after NUM files
     packets:NUM - switch to next file after NUM packets
    interval:NUM - switch to next file when the time is an exact multiple of NUM secs

Input file

  -r <infile>, --read-file <infile>

Processing

-2 # perform a two-pass analysis
-M <packet count> # perform session auto reset
-R <read filter>, --read-filter <read filter> # packet Read filter in Wireshark display filter syntax (requires -2)
-Y <display filter>, --display-filter <display filter> # packet displaY filter in Wireshark display filter syntax
-n # disable all name resolutions (def: all enabled) 
-N <name resolve flags> # enable specific name resolution(s): "mnNtdv"
-d <layer_type>==<selector>,<decode_as_protocol> ... # "Decode As", see the man page for details Example: tcp.port==8888,http
-H <hosts file> # read a list of entries from a hosts file, which will then be written to a capture file. (Implies -W n)
--enable-protocol <proto_name> # enable dissection of proto_name
--disable-protocol <proto_name> # disable dissection of proto_name
--enable-heuristic <short_name> # enable dissection of heuristic protocol
--disable-heuristic <short_name> # disable dissection of heuristic protocol

Output

-w <outfile|-> # write packets to a pcapng-format file named "outfile" (or '-' for stdout)
--capture-comment <comment> # set the capture file comment, if supported
-C <config profile> # start with specified configuration profile
-F <output file type> # set the output file type, default is pcapng an empty "-F" option will list the file types
-V # add output of packet tree # (Packet Details)
-O <protocols> # Only show packet details of these protocols, comma separated
-P, --print # print packet summary even when writing to a file
-S <separator> # the line separator to print between packets
-x # add output of hex and ASCII dump (Packet Bytes)
-T pdml|ps|psml|json|jsonraw|ek|tabs|text|fields|? # format of text output (def: text)
-j <protocolfilter> # protocols layers filter if -T ek|pdml|json selected (e.g. "ip ip.flags text", filter does not expand child nodes, unless child is specified also in the filter)
-J <protocolfilter> # top level protocol filter if -T ek|pdml|json selected (e.g. "http tcp", filter which expands all child nodes)
-e <field> # field to print if -Tfields selected (e.g. tcp.port, _ws.col.Info) this option can be repeated to print multiple fields
-E<fieldsoption>=<value> set options for output when -Tfields selected:
   bom=y|n # print a UTF-8 BOM
   header=y|n # switch headers on and off
   separator=/t|/s|<char> # select tab, space, printable character as separator
   occurrence=f|l|a # print first, last or all occurrences of each field
   aggregator=,|/s|<char> # select comma, space, printable character as aggregator
   quote=d|s|n # select double, single, no quotes for values
-t a|ad|adoy|d|dd|e|r|u|ud|udoy # output format of time stamps (def: r: rel. to first)
-u s|hms # output format of seconds (def: s: seconds)
-l # flush standard output after each packet
-q # be more quiet on stdout (e.g. when using statistics)
-Q # only log true errors to stderr (quieter than -q)
-g # enable group read access on the output file(s)
-W n # Save extra information in the file, if supported. n = write network address resolution information
-X <key>:<value> # eXtension options, see the man page for details
-U tap_name # PDUs export mode, see the man page for details
-z <statistics> # various statistics, see the man page for details
--export-objects <protocol>,<destdir> # save exported objects for a protocol to a directory named "destdir"
--color # color output text similarly to the Wireshark GUI, requires a terminal with 24-bit color support Also supplies color attributes to pdml and psml formats (Note that attributes are nonstandard)
--no-duplicate-keys # If -T json is specified, merge duplicate keys in an object into a single key with as value a json array containing all values
--elastic-mapping-filter <protocols> # If -G elastic-mapping is specified, put only the specified protocols within the mapping file

Miscellaneous

-h, --help # display this help and exit
-v, --version # display version info and exit
-o <name>:<value> ... # override preference setting
-K <keytab> # keytab file to use for kerberos decryption
-G [report] # dump one of several available reports and exit default report="fields" use "-G help" for more help

bash · forensic · network

Wed Mar 30 16:32:08 2022 * · permalink

http://code.ambau.ovh/snippets/tshark.html

wireshark

Operators

https://www.wireshark.org/docs/man-pages/wireshark-filter.html

Logical expressions

and, && # Logical AND
or,  || # Logical OR
not, !  # Logical NOT

Comparaison

eq, == # Equal
ne, != # Not Equal
gt, > # Greater Than
lt, < # Less Than
ge, >= # Greater than or Equal to
le, <= # Less than or Equal to

Search

contains # Does the protocol, field or slice contain a value (case-sensitive)
matches, ~ # Does the protocol or text string match the given case-insensitive Perl-compatible regular expression (case-insensitive)

In

tcp.port in {80, 443, 8080} # <=> tcp.port == 80 or tcp.port == 443 or tcp.port == 8080
http.request.method in {"HEAD", "GET"}

# ranges
tcp.port in {443, 4430..4434}
ip.addr in {10.0.0.5 .. 10.0.0.9, 192.168.1.1..192.168.1.9}
frame.time_delta in {10 .. 10.5}

Functions

upper(string-field) # converts a string field to uppercase
lower(string-field) # converts a string field to lowercase
len(field) # returns the byte length of a string or bytes field
count(field) # returns the number of field occurrences in a frame
string(field) # converts a non-string field to string

Encoding

frame.len > 10
frame.len > 012
frame.len > 0xa
frame.len > '\n'
frame.len > '\x0a'
frame.len > '\012'

Slice

[i:j] # i = start_offset, j = length
[i-j] # i = start_offset, j = end_offset, inclusive.
[i] # i = start_offset, length = 1
[:j] # start_offset = 0, length = j
[i:] # start_offset = i, end_offset = end_of_field

# examples
eth.src[0:3] == 00:00:83
http.content_type[0:4] == "text"
token[0:5] ne 0.0.0.1.1
llc[0] eq aa
frame[100-199] contains "wireshark"

Protocol

sip # Session Initiation Protocol
rtp # Real-time Transport Protocol

http.request # only requests
http.response == # only response
http.response.code == # only response code

tcp.port == # both source and destination port
tcp.srcport == # source port
tcp.dstport == # destination port
tcp.analysis.flags # completye analysis about flags
tcp.contains # search text in any fields
tcp.flags.syn == # tcp syn flag
tcp.flags.reset == # tcp reset flag

udp.contains # search text in any fields

ip.addr == # both source and destination addresses
ip.src == # source addresses
ip.dst == # destination addresses

Capture Filter

forensic · network

Tue Mar 29 22:37:44 2022 * · permalink

http://code.ambau.ovh/snippets/wireshark.html

packettracer

Install

https://forum.manjaro.org/t/how-to-get-cisco-packet-tracer-on-manjaro/25506/3

wget https://aur.archlinux.org/cgit/aur.git/snapshot/packettracer.tar.gz
tar xzf packettracer.tar.gz
cd packettracer
# get CiscoPacketTracer_810_Ubuntu_64bit.deb from cisco 
makepkg
sudo pacman -U packettracer-8.1.0-1-x86_64.pkg.tar.zst

Commands

Global

? # show possible commands / options
enable # get in admistrative area

Hub

hostname $hostname # modify device name

Switch

clear mac-address-table dynamic

copy running-config startup-config # save actual configuration to memory for next startup

hostname $hostname # modify device name

show interfaces trunk
show ip interface
show mac-address-table
show startup-config # show if startup configuration have been recorded
show vlan

configure terminal
  interface $inter $p/$p
    ip proxy-arp # set proxy-arp for $inter $p/$p
    no ip proxy-arp # unset proxy-arp for $inter $p/$p
    vlan switchport access vlan $v # set port $p/$p to vlan $v (create vlan if not exists)
  vlan $v
    name $name # set vlan name for $v
  no vlan $v # remove vlan $v

Router

hostname $hostname # modify device name
configure terminal # enter in configuration terminal mode
ip route $network_address $mask $next_hop # add a route to router

end devices

hostname $hostname # modify device name

manjaro · network

Sun Jan 16 13:22:11 2022 * · permalink

http://code.ambau.ovh/snippets/packettracer.html

wifi

USB

RTL8821CU

https://github.com/brektrou/rtl8821CU

RTL88x2BU / RTL8822BU

manjaro

https://github.com/cilynx/rtl88x2BU_WiFi_linux_v5.3.1_27678.20180430_COEX20180427-5959

ubuntu

https://github.com/cilynx/rtl88x2bu

bash · manjaro · network · ubuntu

Sun Dec 20 07:43:05 2020 * · permalink

http://code.ambau.ovh/snippets/wifi.html

bash - network

IP

ip a / ip addr show # print informations about all interface

ip addr show dev <device> # print informations about specified device
ip -br addr show dev <device> # print brief informations about specified device

ip -4 a / ip -4 addr show # print informations about all interface for inet family
ip -6 a / ip -6 addr show # print informations about all interface for inet6 family

ip -4 -o route show to default # get device name for default IP v4 route
ip -6 -o route show to default # get device name for default IP v6 route

ip -br -4 -o address show dev <interface> | sed 's|.*\s\+\([0-9\.]\+\)/.*|\1|' # get ip v4 of given interface
ip -br -6 -o address show dev <interface> | sed 's|.*\s\+\([0-9a-z:]\+\)/128.*|\1|' # get ip v6 of given interface

NSTAT

Show open port

options

-a # all sockets (default connected)
-l # listening ports
-p # display the process
-n # numerical addresses  (no DNS resolution)
-t # only TCP ports
-u # only UDP ports

tricks

netstat -pl | netstat -pla # listening process
netstat -plu # listening process for UDP
netstat -plt # listening process for TCP
netstat -pln # listening process with IP (no NDS resolution)
netstat -patn # process (listening or not) for TCP with IP  (no NDS resolution)
netstat -plutn # show listening process for UDP & TCP with IP  (no NDS resolution)
netstat -antup

NMAP

Scan network

tricks

# Scan from 192.168.1.0 to 192.168.1.255
nmap 192.168.1.0-10
# Scan with specified range of ports
nmap -p 81-1024 192.168.1.3
# Scan open ports, send a ICMP ECHO (ping) request
nmap -sP 192.168.1.*
# return all open TCP ports by sending SYN messages
nmap -sS $IP
# return all open UDP ports
nmap -sU $IP
# return informations about OS
nmap -O $IP
nmap -A -T4 $IP
# return potential version of OS
nmap -O --osscan-guess $IP
# Scan with a random mac address
nmap --spoof-mac B0:65:BD:01:01:01 192.168.1.3

TRICKS

show open ssh connection

netstat -n --protocol inet | grep ':22'
lsof -i -n | egrep 'ssh'
lsof -i -n | egrep 'sshd'

create mac address

mac=$(< /dev/urandom tr -dc a-z0-9 | head -c10 |sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)/02:\1:\2:\3:\4:\5/')

resolution of domain name

nslookup $DOMAIN

get ip for eth0

ifconfig eth0 | sed -n 's|^[[:space:]]\+inet \(addr:\)\?\([0-9\.]\+\) .*|\2|p'

get ctid for eth0 (openVZ)

ifconfig eth0  | sed -n 's|^[[:space:]]\+inet \(addr:\)\?[0-9\.]\+\.\([0-9]\+\) .*|\2|p'

SCAN

arp

arp -ne -i wlan0 # scan interface wlan0 without dns & print in shell mode

arp-scan -lI wlan0 # scan the entire locanet interface wlan0
arp-scan -lI eth0 129.20.228.1/24 # scan the interface eth0 with a mask 0.0.0.31
arp-scan -I wlan0 192.168.0.100-192.168.0.200 # scan the locanet interface wlan0 with ips between 192.168.0.100 and 192.168.0.200

nmap

nmap -sP 192.168.0.1/24 # scan by pinging ip addresses with mask 0.0.0.255
nmap -e wlan0 -sP 192.168.0.100-199 # scan the interface wlan0 with ips between 192.168.0.100 and 192.168.0.200
nmap -e wlan0 -sP 192.168.0.,1,101 -oG $file # scan the interface wlan0 with ips 192.168.0.100 & print the result in grepable format to file
nmap -e wlan0 -sL 192.168.0.5,10-20 # List cached informations on ips : 192.168.0.5 & between 192.168.0.10 & 192.168.0.2

nc

nc -v -u -z -w 3 91.121.112.140 514 # test udp port open

WIFI

iwconfig wlo1 | iw dev wlo1 link # print technical informations
lshw -C network
iwlist scan # scan & print informations about wifi networks
nmcli connection show # show available connections about wifi networks
nmcli dev wifi

bash · bashroot · network

Mon Oct 8 10:07:15 2018 * · permalink

http://code.ambau.ovh/snippets/bash_network.html

foralyse

virt-manager

global

install

conf

sublime text

forensic

global

conf

python

binwalk

dependencies

binwalk

regripper

volatility

volatility3

volatility2

wireshark

autopsy

global

java

base64sha

sleuthkit

autopsy

launcher

addons

ReportModules / ForensicExpertWitnessReport

IngestModules / FileHistory

IngestModules / Volatility

tshark

Operators

Usefull

help

tshark [ -i <capture interface>|- ] [ -f <capture filter> ] [ -2 ] [ -r <infile> ] [ -w <outfile>|- ] [ options ] [ <filter> ]

qtshark -G [ <report type> ] [ --elastic-mapping-filter <protocols> ]

Dump and analyze network traffic

wireshark

Operators

Protocol

Capture Filter

packettracer

Install

Commands

Global

Hub

Switch

Router

end devices

wifi

USB

RTL8821CU

RTL88x2BU / RTL8822BU

manjaro

ubuntu

bash - network

IP

NSTAT

options

tricks

NMAP

tricks

TRICKS

show open ssh connection

create mac address

resolution of domain name

get ip for eth0

get ctid for eth0 (openVZ)

SCAN

arp

nmap

nc

WIFI