If you’re planning to take the SY0-501 exam, you should have a basic understanding of available software tools to assess the security posture of an organization. This includes using security tools such as protocol analyzers, command-line tools, logs, and audits.
For example, can you answer this practice test question?
Q. You suspect that an attacker has been sending specially crafted TCP packets to a server trying to exploit a vulnerability. You decide to capture TCP packets being sent to this server for later analysis and you want to use a command-line tool to do so. Which of the following tools will BEST meet your need?
A. Wiredump
B. Tcpdump
C. Netcat
D. Nmap
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
There are command-line tools available on Windows and Linux systems. Some tools are useful when performing vulnerability scans and penetration tests.
Tcpdump
Tcpdump is a command-line packet analyzer (or protocol analyzer). It allows you to capture packets like you can with Wireshark. The difference is that Wireshark is a Windows-based tool and tcpdump is executed from the command line. Many administrators use tcpdump to capture the packets and later use Wireshark to analyze the packet capture. One of the online labs for this chapter shows how to do this.
Kali Linux includes tcpdump, but you won’t find it on Windows systems. As with most Linux command-line tools, tcpdump is case sensitive. You need to enter tcpdump in all lowercase. Additionally, the switches must be entered with the proper case. For example, -c (lowercase c) represents count and indicates the capture should stop after receiving the specified number of packets. However, -C (uppercase C) represents file size and indicates the maximum size (in millions of bytes) of a packet capture. When the file reaches this size, tcpdump closes it and starts storing packets in a new file.
Nmap
Nmap is a network scanner. The graphical side of Nmap is Zenmap. It includes many capabilities, including identifying all the active hosts and their IP addresses in a network, the protocols and services running on each of these hosts, and the operating system of the host. When running the command, you include the scan type(s), optional options, and target specifications. As an example, consider the following command:
nmap -T4 -A -v 192.168.0.0/24
Notice that it has three switches, -T4, -A, and -v:
- T4. T4 refers to the speed of the scan. Valid switches are T0 through T5 with T0 being the slowest and T5 being the fastest. Faster scans are likely to be detected, while slower scans may not be detected.
- A. The -A switch indicates the scan should include OS detection, version detection, script scanning, and traceroute.
- -v. The -v switch indicates the verbosity You can get more data output by using -vv or -vvv.
Netcat
Chapter 3 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide discusses Netcat and how administrators often use it for remotely accessing Linux systems. It doesn’t include native encryption so it’s common to use SSH to secure the session. Additionally, Netcat can easily be used for banner grabbing. The following is a sample command used for banner grabbing:
echo “” | nc -vv -n -w1 72.52.206.134 80
It uses the netcat command (nc) along with some switches: -vv for a verbose output, -n to not resolve host names, -w1 to wait no more than 1 second for a reply. The command connects to port 80 of the system with an IP address of 72.52.206.134. The echo “” sends a blank command to the server and the pipe symbol ( | ) tells Netcat to send the command after establishing the connection.
Some other uses of Netcat include:
- Transferring files. One of the online labs for the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide shows how to create a chat session between two systems. Once this session is open, you can use the connection to copy files between the systems.
- Port scanner. You can use Netcat to run a port scan against a single IP address. It allows you to specify the range of ports, such as 10 through 1024 and randomize the ports scanned to evade detection. It also supports waiting longer periods of time between port checks, again, to evade detection.
Q. You suspect that an attacker has been sending specially crafted TCP packets to a server trying to exploit a vulnerability. You decide to capture TCP packets being sent to this server for later analysis and you want to use a command-line tool to do so. Which of the following tools will BEST meet your need?
A. Wiredump
B. Tcpdump
C. Netcat
D. Nmap
Answer is B. The tcpdump command-line tool is the best choice of the given It is a command- line packet analyzer (or protocol analyzer) and its primary purpose is to capture packets. Wiredump isn’t a valid tool name.
Wireshark (not included as an answer choice) is a graphic-based packet analyzer that can be started from the command line, but tcpdump includes more command-line options than Wireshark.
Netcat is useful for remotely accessing systems and can be used for banner grabbing, but it doesn’t capture packets.
Nmap analyzes packets during a scan. It can also use Npcap, the Nmap Project’s packet sniffing library, but Nmap isn’t the best choice to capture packets.
See Chapter 8 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on using security tools.