Common Ports
| PORT# | SERVICE |
----------------------------------------
| 20 | FTP (Data Connection) |
| 21 | FTP (Control Connection) |
| 22 | SSH/SCP |
| 23 | Telnet |
| 25 | SMTP |
| 49 | TACACS |
| 53 | DNS |
| 67-68 | DHCP/BOOTP |
| 69 | TFTP (UDP) |
| 80 | HTTP |
| 88 | Kerberos |
| 110 | POP3 |
| 111 | RPC |
| 123 | NTP (UDP) |
| 135 | Windows RPC |
| 137-138 | NetBIOS |
| 139 | SMB |
| 143 | IMAP4 |
| 161-162 | SNMP (UDP) |
| 179 | BGP |
| 201 | AppleTalk |
| 389 | LDAP |
| 443 | HTTPS |
| 445 | SMB |
| 500 | ISAKMP (UDP) |
| 514 | Syslog |
| 520 | RIP |
| 546-547 | DHCPv6 |
| 587 | SMTP |
| 902 | VMWare Server |
| 1080 | Socks Proxy |
| 1194 | Open VPN |
| 1433-1434 | MS-SQL |
| 1521 | Oracle |
| 2049 | NFS |
| 3128 | Squid Proxy |
| 3306 | MySQL |
| 3389 | RDP |
| 5060 | SIP |
| 5222-5223 | XMPP/Jabber |
| 5432 | Postgres SQL |
| 5666 | Nagios |
| 5900 | VNC |
| 6000-6063 | X11 |
| 6129;6133 | DameWare |
| 6665-6669 | IRC |
| 9001 | Tor |
| 9001 | HSQL |
| 9090-9091 | Openfire |
| 9100 | HP JetDirect |
----------------------------------------
Health Care Protocols and Ports
| PORT# | SERVICE |
------------------------------------
| 20 | FTP (Data Connection) |
| 21 | FTP (Control Connection) |
| 22 | SSH/SCP |
| 23 | Telnet |
| 25 | SMTP |
| 49 | TACACS |
| 53 | DNS |
| 67-68 | DHCP/BOOTP |
| 69 | TFTP (UDP) |
------------------------------------
SCADA Protocols and Ports
More info at ITI’s Github page.
| PORT# | SERVICE |
---------------------------------------------------
| 20 | FTP (Data Connection) |
| 21 | FTP (Control Connection) |
| 22 | SSH/SCP |
| 23 | Telnet |
| 25 | SMTP |
| 49 | TACACS |
| 53 | DNS |
| 67-68 | DHCP/BOOTP |
| 69 | TFTP (UDP) |
| 80 | OPC UA XML |
| 102 | ICCP |
| 443 | OPC UA XML |
| 502 | Modbus TCP |
| 1089-1091 | Foundation Fieldbus HSE (UDP/TCP) |
| 2222 | Ethernet/IP (UDP) |
| 4000 | ROC Plus (UDP/TCP) |
| 4840 | OPC UA Discovery Server |
| 4840 | OPC UA Discovery Server |
| 20000 | DNP3 (UDP/TCP) |
| 34962-34964 | PROFINET (UDP/TCP) |
| 34980 | EtherCAT (UDP) |
| 44818 | Ethernet/IP (UDP/TCP) |
| 47808 | BACnet/IP (UDP) |
| 55000-55003 | FL-net (UDP) |
---------------------------------------------------
TTL Fingerprinting
| TTL | OS |
-----------------
| 64 | Linux |
| 128 | Windows |
| 255 | Network |
| 255 | Solaris |
-----------------
IPv4
Classful IPv4 Ranges
| CLASS | RANGE |
-----------------------------------------------
| Class A Range | 0.0.0.0 – 127.255.255.255 |
| Class B Range | 128.0.0.0 – 191.255.255.255 |
| Class C Range | 192.0.0.0 – 223.255.255.255 |
| Class D Range | 224.0.0.0 – 239.255.255.255 |
| Class E Range | 240.0.0.0 – 255.255.255.255 |
-----------------------------------------------
Reserved Private Ranges
| CLASS | RANGE |
--------------------------------------------------
| Class A Range | 10.0.0.0 – 10.255.255.255 |
| Class B Range | 172.16.0.0 – 172.31.255.255 |
| Class C Range | 192.168.0.0 - 192.168.255.255 |
| Loopback Range | 127.0.0.0 – 127.255.255.255 |
--------------------------------------------------
Subnetting
| CIDR| SUBNET-MASK | USABLE-HOSTS |
-------------------------------------------
| /31 | 255.255.255.254 | 0 Useable Hosts |
| /30 | 255.255.255.252 | 2 Hosts |
| /29 | 255.255.255.248 | 6 Hosts |
| /28 | 255.255.255.240 | 14 Hosts |
| /27 | 255.255.255.224 | 30 Hosts |
| /26 | 255.255.255.192 | 62 Hosts |
| /25 | 255.255.255.128 | 126 Hosts |
| /24 | 255.255.255.0 | 254 Hosts |
| /23 | 255.255.254.0 | 510 Hosts |
| /22 | 255.255.252.0 | 1022 Hosts |
| /21 | 255.255.248.0 | 2046 Hosts |
| /20 | 255.255.240.0 | 4094 Hosts |
| /19 | 255.255.224.0 | 8190 Hosts |
| /18 | 255.255.192.0 | 16382 Hosts |
| /17 | 255.255.128.0 | 32766 Hosts |
| /16 | 255.255.0.0 | 65534 Hosts |
| /15 | 255.254.0.0 | 131070 Hosts |
| /14 | 255.252.0.0 | 262142 Hosts |
| /13 | 255.248.0.0 | 524286 Hosts |
| /12 | 255.240.0.0 | 1048574 Hosts |
| /11 | 255.224.0.0 | 2097150 Hosts |
| /10 | 255.192.0.0 | 4194302 Hosts |
| /9 | 255.128.0.0 | 8388606 Hosts |
| /8 | 255.0.0.0 | 16777214 Hosts |
-------------------------------------------
Calculating Subnet Range
For further info, check out the online calculator.
Example:
# Given: 1.1.1.101/28
# /28 = 255.255.255.240 netmask
# Calculation: 256 – 240 = 16 = subnet ranges of 16, i.e.
# 1.1.1.0
# 1.1.1.16
# 1.1.1.32
# ...
# Range where given IP falls: 1.1.1.96 – 1.1.1.111
IPv6
Broadcast Addresses
| ADDRESS | TYPE |
--------------------------------
| link-local nodes | ff02::1 |
| node-local routers | ff01::2 |
| link-local routers | ff02::2 |
| site-local routers | ff05::2 |
--------------------------------
Interface Addresses
| ADDRESS | TYPE |
---------------------------------------------------------------------
| link-local | fe80:: |
| routable | 2001:: |
| IPv4 compatible IPv6 (Example: ::192.168.1.2) | ::a.b.c.d |
| IPv4 mapped IPv6 (Example: ::FFFF:129.144.52.38) | ::ffff:a.b.c.d |
| Global Unicast | 2000::/3 |
| Unique Local | FC00::/7 |
---------------------------------------------------------------------
IPv6 Tools
More info at VanHauser’s Github page.
# Remote Network DoS
rsmurf6 <INTERFACE_NAME> <REMOTE_IPV6>
# SOCAT tunnel IPv6 through IPv4 tools
socat TCP-LISTEN:<LISTEN_PORT>,reuseaddr,fork TCP6:[<IPv6_ADDRESS>]:<SEND_TO_PORT>
Networking
Cisco Commands
Most commands below show the various prompts at which the commands are executed. For example: #, (config)#, (config-if)#, etc. Most of these prompts end in # before the command is typed in.
# Enter privileged exec mode
# Known as Enable mode
# Prompt will change from '>' to '#'
enable
# Enter global configuration mode
# Prompt will change from '#' to '(config)#'
configure terminal
# Configure FastEthernet 0/0
interface fa0/0
# Add IP to fa0/0
ip addr <IP_ADDRESS> <SUBNET_MASK>
# Configure vty line
line vty 0 4
# Set telnet password
login
password <PASSWORD>
# Open sessions
show session
# IOS version
show version
# Available files
dir file systems
# File information
dir all-filesystems
# List deleted, undeleted files and files with errors
dir /all
# Config loaded in mem
show running-config
# Config loaded at boot
show startup-config
# Interfaces
show ip interface brief
# Detailed interface info
show interface <INTERFACE_NAME>
# Routes
show ip route
# Access lists
show access-lists
# No limit on output
terminal length 0
# Replace start config with running config
copy running-config startup-config
# Backup the running configuration to an external TFTP server
copy running-config tftp
SNMP Tools
# List Windows running services
snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep hrSWRunName | cut -d" " –f4
# List Windows open TCP ports
snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep tcpConnState |cut -d" " -f6 |sort -u
# List Windows installed software
snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep hrSWInstalledName
# List Windows users
snmpwalk -c public -v1 <IP_ADDRESS> 1.3 | grep 77.1.2.25 | cut -d -f4
DNSRECON and Nmap Reverse DNS
More info at DNSRECON’s source page.
# Reverse lookup for IP range
dnsrecon.py -t rvl -r <CIDR_IP_RANGE> -n <DNS_IP_ADDRESS>
# Retrieve standard DNS records
dnsrecon.py -t std -d <DOMAIN_NAME>
# Enumerate subdomains
dnsrecon.py -t brt -d <DOMAIN_NAME> -D <HOSTS>
# DNS zone transfer
dnsrecon.py -d <DOMAIN_NAME> -t axfr
# Reverse DNS lookup and output parser
nmap -R -sL -Pn -dns-servers <DNS_SERVER_IP> <IP_RANGE> | awk ‘{if(($1" "$2" "$3)=="Nmap scan report")print$5" "$6}’ | sed ‘s/(//g’ | sed ‘s/)//g’ > <OUTPUT_PATH>