Skip to main content

Table Of Contents

  • Common Ports
    • Common Ports
    • Health Care Protocol & Ports
    • Scada Protocols & Ports
    • TTL Fingerprinting
  • IPv4
    • Classful IPv4 Ranges
    • Reserved Private Ranges
    • Subnetting
    • Calculating Subnet Range
  • IPv6
    • Broadcast Addresses
    • Interface Addresses
    • IPV6 Tools
  • Networking
    • Cisco Commands
    • SNMP Tools
    • DNSRecon & NMap Reverse DNS

COMMON PORTS​

COMMON PORTS​

PORT#SERVICE|PORT#SERVICE
20FTP (Data Connection)|514Syslog
21FTP (Control Connection)|520RIP
22SSH/SCP|546-547DHCPv6
23Telnet|587SMTP
25SMTP|902VMWare Server
49TACACS|1080Socks Proxy
53DNS|1194Open VPN
67-68DHCP/BOOTP|1433-1434MS-SQL
69TFTP (UDP)|1521Oracle
80HTTP|2049NFS
88Kerberos|3128Squid Proxy
110POP3|3306MySQL
111RPC|3389RDP
123NTP (UDP)|5060SIP
135Windows RPC|5222-5223XMPP/Jabber
137-138NetBIOS|5432Postgres SQL
139SMB|5666Nagios
143IMAP4|5900VNC
161-162SNMP (UDP)|6000-6063X11
179BGP|6129 and 6133DameWare
201AppleTalk|6665-6669IRC
389LDAP|9001Tor
443HTTPS|9001HSQL
445SMB|9090-9091Openfire
500ISAKMP (UDP)|9100HP JetDirect

HEALTH CARE PROTOCOLS & PORTS​

PORT#SERVICE|PORT#SERVICE
20FTP (Data Connection)|49TACACS
21FTP (Control Connection)|53DNS
22SSH/SCP|67-68DHCP/BOOTP
23Telnet|69TFTP (UDP)
25SMTP|--

SCADA PROTOCOLS & PORTS​

PORT#SERVICE|PORT#SERVICE
20FTP (Data Connection)|502Modbus TCP
21FTP (Control Connection)|1089-1091Foundation Fieldbus HSE (UDP/TCP)
22SSH/SCP|2222Ethernet/IP (UDP)
23Telnet|4000ROC Plus (UDP/TCP)
25SMTP|4840OPC UA Discovery Server
49TACACS|4840OPC UA Discovery Server
53DNS|20000DNP3 (UDP/TCP)
67-68DHCP/BOOTP|34962-34964PROFINET (UDP/TCP)
69TFTP (UDP)|34980EtherCAT (UDP)
80OPC UA XML|44818Ethernet/IP (UDP/TCP)
102ICCP|47808BACnet/IP (UDP)
443OPC UA XML|55000-55003FL-net (UDP)

TTL FINGERPRINTING​

TTLOS|TTLOS
128Windows|255Network
64Linux|255Solaris

IPv4​

CLASSFUL IPV4 RANGES​

CLASSRANGE
Class A Range0.0.0.0   – 127.255.255.255
Class B Range128.0.0.0 – 191.255.255.255
Class C Range192.0.0.0 – 223.255.255.255
Class D Range224.0.0.0 – 239.255.255.255
Class E Range240.0.0.0 – 255.255.255.255

RESERVED PRIVATE RANGES​

CLASSRANGE
Class A Range10.0.0.0    – 10.255.255.255
Class B Range172.16.0.0  – 172.31.255.255
Class C Range192.168.0.0 - 192.168.255.255
Loopback Range127.0.0.0   – 127.255.255.255

SUBNETTING​

CIDRSUBNET-MASKUSABLE-HOSTS
/31255.255.255.2540 Useable Hosts
/30 255.255.255.2522 Hosts
/29 255.255.255.2486 Hosts
/28 255.255.255.24014 Hosts
/27 255.255.255.22430 Hosts
/26 255.255.255.19262 Hosts
/25 255.255.255.128126 Hosts
/24 255.255.255.0 254 Hosts
/23 255.255.254.0 510 Hosts
/22 255.255.252.0 1022 Hosts
/21 255.255.248.0 2046 Hosts
/20 255.255.240.0 4094 Hosts
/19 255.255.224.0 8190 Hosts
/18 255.255.192.0 16382 Hosts
/17 255.255.128.0 32766 Hosts
/16 255.255.0.065534 Hosts
/15 255.254.0.0131070 Hosts
/14 255.252.0.0 262142 Hosts
/13 255.248.0.0 524286 Hosts
/12 255.240.0.0 1048574 Hosts
/11 255.224.0.0 2097150 Hosts
/10 255.192.0.0 4194302 Hosts
/9 255.128.0.08388606 Hosts
/8 255.0.0.016777214 Hosts

CALCULATING SUBNET RANGE​

IPv6​

BROADCAST ADDRESSES​

ADDRESSTYPE
link-local nodesff02::1
node-local routersff01::2
link-local routersff02::2
site-local routersff05::2

INTERFACE ADDRESSES​

ADDRESSTYPE
link-localfe80::
routable2001::
IPv4 compatible IPv6 (Example: ::192.168.1.2)::a.b.c.d
IPv4 mapped IPv6 (Example: ::FFFF:129.144.52.38)::ffff:a.b.c.d
Global Unicast2000::/3
Unique LocalFC00::/7

IPV6 TOOLS​

Remote Network DoS

rsmurf6 <INTERFACE_NAME> <REMOTE_IPV6>

SOCAT tunnel IPv6 through IPv4 tools

socat TCP-LISTEN:<LISTEN_PORT>,reuseaddr,fork TCP6:[<IPv6_ADDRESS>]:<SEND_TO_PORT>

NETWORKING​

CISCO COMMANDS​

  • Note: Most commands below show the various prompts at which the commands are executed. For example: #, (config)#, (config-if)#, etc. Most of these prompts end in # before the command is typed in.

Enter privileged exec mode -- (Known as Enable mode. Prompt will change to '#')

> enable

Enter global configuration mode

# configure terminal

Configure FastEthernet 0/0

(config)# interface fa0/0

Add IP to fa0/0

(config-if)# ip addr <IP_ADDRESS> <SUBNET_MASK>

Configure vty line

(config)#line vty 0 4

Set telnet password

(config-line)# login
(config-line)# password <PASSWORD>

Open sessions

#show session

IOS version

#show version

Available files

#dir file systems

File information

#dir all-filesystems

List deleted, undeleted files and files with errors

#dir /all

Config loaded in mem

#show running-config

Config loaded at boot

#show startup-config

Interfaces

#show ip interface brief

Detailed interface info

#show interface <INTERFACE_NAME>

Routes

#show ip route

Access lists

#show access-lists

No limit on output

#terminal length 0

Replace start config with running config

#copy running-config startup-config

Backup the running configuration to an external TFTP server

#copy running-config tftp

SNMP TOOLS​

List Windows running services

snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep hrSWRunName | cut -d" " –f4

List Windows open TCP ports

snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep tcpConnState |cut -d" " -f6 |sort -u

List Windows installed software

snmpwalk -c public -v1 <IP_ADDRESS> 1 | grep hrSWInstalledName

List Windows users

snmpwalk -c public -v1 <IP_ADDRESS> 1.3 | grep 77.1.2.25 | cut -d -f4

DNSRECON & NMAP REVERSE DNS​

Reverse lookup for IP range

dnsrecon.py -t rvl -r <CIDR_IP_RANGE> -n <DNS_IP_ADDRESS>

Retrieve standard DNS records

dnsrecon.py -t std -d <DOMAIN_NAME>

Enumerate subdomains

dnsrecon.py -t brt -d <DOMAIN_NAME> -D <HOSTS>

DNS zone transfer

dnsrecon.py -d <DOMAIN_NAME> -t axfr

Reverse DNS lookup and output parser

nmap -R -sL -Pn -dns-servers <DNS_SERVER_IP> <IP_RANGE> | awk ‘{if(($1" "$2" "$3)=="Nmap scan report")print$5" "$6}’ | sed ‘s/(//g’ | sed ‘s/)//g’ > <OUTPUT_PATH>