LifesFun's 101

"The only true wisdom is in knowing you know nothing." - Socrates


Pentest Primer: Basic Networking Concepts: Practical Demo

16 Nov 2024

This hands-on demonstration showcases the practical application of networking concepts covered in the previous lesson, including IP addresses, network interfaces, subnets, default gateways, and ARP tables.

Understanding networking theory is important, but seeing these concepts in action helps solidify the knowledge and provides practical skills necessary for penetration testing and network security assessments. This demo walks through essential commands that every cybersecurity professional should know.

Viewing Network Interfaces

Network interfaces are the connection points between your computer and the network. Each interface has its own configuration, including IP addresses, MAC addresses, and other network parameters. Understanding how to view and interpret network interface information is fundamental for troubleshooting and security testing.

Common commands for viewing network interfaces include:

Linux/Mac: ip addr show or ifconfig displays detailed information about all network interfaces, including their IP addresses, MAC addresses, and status.

Windows: ipconfig or ipconfig /all provides comprehensive network configuration details for all adapters.

These commands reveal:

  • Interface names (eth0, wlan0, ens33, etc.)
  • IPv4 and IPv6 addresses assigned to each interface
  • MAC (hardware) addresses
  • Subnet masks and network prefixes
  • Interface status (up/down)

Identifying IP Addresses and Subnets

Each network interface can have one or more IP addresses assigned. Understanding how to identify these addresses and their associated subnets is crucial for:

  • Determining your position within a network
  • Identifying which subnets you can directly communicate with
  • Planning network reconnaissance during penetration testing
  • Understanding network segmentation and access controls

The subnet mask or CIDR notation displayed alongside IP addresses indicates the size of the network and which hosts are on the same local network segment.

Default Gateway

The default gateway is the router that forwards traffic destined for networks outside your local subnet. It serves as the exit point from your local network to reach the internet or other networks.

Viewing the default gateway helps you:

  • Understand the network topology
  • Identify potential routing paths for traffic
  • Determine where network traffic is being directed
  • Identify targets for man-in-the-middle attacks during penetration testing

Linux: ip route show or route -n displays routing table including the default gateway

Windows: ipconfig shows the default gateway, or use route print for detailed routing information

Mac: netstat -nr displays the routing table

Understanding ARP Tables

The Address Resolution Protocol (ARP) maps IP addresses to MAC (hardware) addresses on the local network. The ARP table (also called ARP cache) maintains a record of these mappings to optimize network communication.

Why ARP Matters for Security:

ARP operates at a low level without authentication, making it vulnerable to ARP spoofing attacks. Attackers can poison ARP caches to redirect traffic, enabling man-in-the-middle attacks. Understanding ARP is essential for both offensive and defensive security.

Viewing the ARP Table:

Linux: ip neigh show or arp -a displays the ARP cache

Windows: arp -a shows the ARP table

Mac: arp -a displays cached ARP entries

The ARP table reveals:

  • IP addresses of devices you’ve recently communicated with
  • MAC addresses of those devices
  • Whether entries are static or dynamic
  • The interface used for communication

This information is valuable during penetration testing for:

  • Identifying active hosts on the network
  • Discovering network infrastructure devices
  • Planning ARP-based attacks
  • Understanding network communication patterns

Practical Applications for Penetration Testing

These networking commands form the foundation of network reconnaissance and assessment:

Host Discovery: Using network interface information to identify your position in the network and accessible subnets

Network Mapping: Combining ARP tables, routing information, and interface details to map network topology

Gateway Identification: Locating routers and potential pivot points for further network access

Traffic Analysis: Understanding which devices communicate with your system and how traffic flows through the network

Attack Planning: Using this information to plan lateral movement, man-in-the-middle attacks, or network-based exploitation

Hands-On Practice

To truly understand these concepts, practice running these commands in various network environments:

  • Home networks
  • Public WiFi networks (with permission)
  • Virtual lab environments
  • Corporate networks (with authorization)

Compare the outputs, identify patterns, and understand what each piece of information reveals about the network structure and your position within it.

This practical knowledge complements theoretical understanding and prepares you for more advanced networking topics and security testing techniques.


comments powered by Disqus