netstat, ss, nmap, nc.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Netstat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Kernel Interface table\n",
      "Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg\n",
      "enp3s0     1500 0    555086      0      0 0        563301      0      0      0 BMRU\n",
      "lo        65536 0    197296      0      0 0        197296      0      0      0 LRU\n"
     ]
    }
   ],
   "source": [
    "netstat -i # interfaces"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Kernel IP routing table\n",
      "Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface\n",
      "0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 enp3s0\n",
      "192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 enp3s0\n"
     ]
    }
   ],
   "source": [
    "netstat -rn # routing table"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "traceroute to 8.8.4.4 (8.8.4.4), 30 hops max, 60 byte packets\n",
      " 1  192.168.1.1 (192.168.1.1)  0.444 ms  0.486 ms  0.551 ms\n"
     ]
    }
   ],
   "source": [
    "traceroute 8.8.4.4 | head -2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "tcp        0      0 localhost:46209         localhost:49724         ESTABLISHED\n",
      "tcp        0      0 localhost:46209         localhost:42836         ESTABLISHED\n"
     ]
    }
   ],
   "source": [
    "netstat -tu | head -4 | tail -2 # tcp/udp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "tcp        0      0 localhost:43820         *:*                     LISTEN     \n",
      "tcp        0      0 localhost:37554         *:*                     LISTEN     \n",
      "tcp        0      0 localhost:48466         *:*                     LISTEN     \n",
      "tcp        0      0 localhost:36696         *:*                     LISTEN     \n"
     ]
    }
   ],
   "source": [
    "netstat -tu -a | grep -i listen | head -4 # all connections -> connected, listening, etc. default is stablished, time_wait"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [],
   "source": [
    "netstat -atu -e # extended"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [],
   "source": [
    "netstat -elt | head -4 # only listening"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "tcp        0      0 192.168.56.1:50076      192.168.56.12\u001b[01;31m\u001b[K:22\u001b[m\u001b[K        ESTABLISHED\n"
     ]
    }
   ],
   "source": [
    "netstat -tn | grep :22"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "tcp        0      0 192.168.56.1:50076      192.168.56.12:\u001b[01;31m\u001b[Kssh\u001b[m\u001b[K       ESTABLISHED\n"
     ]
    }
   ],
   "source": [
    "netstat -t | grep -i ssh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [],
   "source": [
    "netstat -s # summery"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 56,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(Not all processes could be identified, non-owned process info\n",
      " will not be shown, you would have to be root to see it all.)\n",
      "tcp        0      0 localhost:43820         *:*                     LISTEN      13525/python3   \n",
      "tcp        0      0 localhost:37554         *:*                     LISTEN      13525/python3   \n"
     ]
    }
   ],
   "source": [
    "netstat -plt | grep --color=no 'python' | head -2 |  tail -2 # program"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# my favorite is peanut, like peanut butter :)\n",
    "sudo netstat -peanut"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### SS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              \n",
      "ESTAB      0      0      127.0.0.1:42658              127.0.0.1:51951              \n",
      "ESTAB      0      0      127.0.0.1:43614              127.0.0.1:53910              \n"
     ]
    }
   ],
   "source": [
    "ss -tn | head -3"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              \n",
      "UNCONN     0      0      127.0.0.1:53                       *:*                  \n",
      "UNCONN     0      0            *:68                       *:*                  \n"
     ]
    }
   ],
   "source": [
    "ss -ulna # connection less"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              \n",
      "ESTAB      0      0      192.168.1.102:47372              54.229.110.205:443                \n"
     ]
    }
   ],
   "source": [
    "ss -nt '( dport = :80 or dport = :443 )' src 192.168.1.0/24 dst 54.229.110.0/24"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              \n",
      "UNCONN     0      0      127.0.0.1:53                       *:*                  \n"
     ]
    }
   ],
   "source": [
    "ss -lnu sport = :domain"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "tcp    LISTEN     0      100    127.0.0.1:37774                 *:*                     users:((\"python3\",pid=6821,fd=23))\n"
     ]
    }
   ],
   "source": [
    "ss -lp | grep python | head -1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                \n",
      "UNCONN     0      0      127.0.0.1:domain                   *:*                    \n",
      "UNCONN     0      0          *:bootpc                   *:*                    \n"
     ]
    }
   ],
   "source": [
    "ss -lup"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Nmap"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {},
   "outputs": [],
   "source": [
    "nmap 192.168.0.1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 69,
   "metadata": {},
   "outputs": [],
   "source": [
    "nmap 192.168.0.0/30  # 192.168.0.*  192.168.0.0-80 --exclude 192.168.1.100\n",
    "# nmap -iL /tmp/scanlist.txt --excludefile /tmp/exclude.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "nmap -iL ./listToScan --excludefile ./excludeLst"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "nmap 192.168.0.1 -p 80"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "nmap 192.168.0.1 -p 80-800"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 77,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "PORT    STATE  SERVICE  VERSION\n",
      "20/tcp  closed ftp-data\n",
      "21/tcp  open   ftp      vsftpd 2.0.8 or later\n",
      "22/tcp  closed ssh\n",
      "23/tcp  closed telnet\n",
      "80/tcp  closed http\n"
     ]
    }
   ],
   "source": [
    "nmap 192.168.0.1 -p 80,443,22,23,20-21 -sV | head | tail -6 #  -sV determine service/version info"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo nmap -O 192.168.0.1 # Os"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 78,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Starting Nmap 7.01 ( https://nmap.org ) at 2017-03-21 02:14 IRST\n",
      "Nmap scan report for 192.168.1.1\n",
      "Host is up (0.00052s latency).\n",
      "PORT   STATE SERVICE\n",
      "80/tcp open  http\n",
      "\n",
      "Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds\n"
     ]
    }
   ],
   "source": [
    "nmap -p80 192.168.1.1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Starting Nmap 7.01 ( https://nmap.org ) at 2017-03-24 02:10 IRDT\n",
      "Nmap scan report for 192.168.1.1\n",
      "Host is up, received syn-ack (0.0083s latency).\n",
      "Not shown: 98 closed ports\n",
      "Reason: 98 conn-refused\n",
      "PORT   STATE SERVICE REASON\n",
      "53/tcp open  domain  syn-ack\n",
      "80/tcp open  http    syn-ack\n",
      "\n",
      "Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds\n"
     ]
    }
   ],
   "source": [
    "nmap --reason -F 192.168.1.1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Starting Nmap 7.01 ( https://nmap.org ) at 2017-03-24 02:23 IRDT\n",
      "Nmap scan report for 192.168.1.1\n",
      "Host is up (0.00064s latency).\n",
      "Nmap scan report for 192.168.1.102\n",
      "Host is up (0.00013s latency).\n",
      "Nmap done: 3 IP addresses (2 hosts up) scanned in 1.20 seconds\n"
     ]
    }
   ],
   "source": [
    "nmap -sP 192.168.1.1,100,102 #  do not scan ports :same as -sn --- only show which one are up  /24  0-20"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "nmap -p80 192.168.1.1 -vvv"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[01;31m\u001b[Kvboxnet1 (vboxnet1) (none)/0                    ethernet down 1500  0A:00:27:00:00:01\u001b[m\u001b[K\n"
     ]
    }
   ],
   "source": [
    "nmap --iflist | grep vbox.*1$ # interface and routes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "8888/tcp \u001b[01;31m\u001b[Kopen\u001b[m\u001b[K  sun-answerbook\n"
     ]
    }
   ],
   "source": [
    "nmap -sT -sU 127.0.0.1 -p T:8888,U:53 | grep open # sT, sU search tcp, udp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "21/tcp  \u001b[01;31m\u001b[Kclose\u001b[m\u001b[Kd ftp\n",
      "22/tcp  \u001b[01;31m\u001b[Kclose\u001b[m\u001b[Kd ssh\n",
      "23/tcp  \u001b[01;31m\u001b[Kclose\u001b[m\u001b[Kd telnet\n",
      "80/tcp  \u001b[01;31m\u001b[Kopen\u001b[m\u001b[K   http\n",
      "443/tcp \u001b[01;31m\u001b[Kclose\u001b[m\u001b[Kd https\n"
     ]
    }
   ],
   "source": [
    "nmap --top-ports 5 192.168.1.1 | egrep 'open|close'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "metadata": {},
   "outputs": [],
   "source": [
    "nmap -f 127.0.0.1 # use tiny fragmented IP packets"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 72,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[01;31m\u001b[KSpo\u001b[m\u001b[Kofing MAC address 9F:E3:A6:2F:EC:13 (No registered vendor)\n"
     ]
    }
   ],
   "source": [
    "nmap --spoof-mac 0 127.0.0.1 | grep Spo"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo nmap -n -D 127.0.0.1,127.0.0.2,127.0.0.3 192.x.x.1 --spoof-mac 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "nmap -PU # udp ping to bypass fw"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### nc / netcat\n",
    "\n",
    "The nc (or netcat) utility is used for just about anything under the sun involving TCP, UDP, or UNIX-domain sockets.  \n",
    "It can open TCP connections, send UDP packets, listen on arbitrary TCP and UDP ports, do port scanning, and deal with both IPv4 and IPv6."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Connection to 192.168.1.1 53 port [tcp/domain] succeeded!\n",
      "Connection to 192.168.1.1 80 port [tcp/http] succeeded!\n"
     ]
    }
   ],
   "source": [
    "nc -zv 192.168.1.1 53 80"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Connection to 192.168.1.1 53 port [tcp/domain] succeeded!\n",
      "Connection to 192.168.1.1 80 port [tcp/http] succeeded!\n"
     ]
    }
   ],
   "source": [
    "nc -zv 192.168.1.1 53-80 2>&1 | grep -vi ref"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "nc towel.blinkenlights.nl 23 # star wars"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nc: getaddrinfo: Temporary failure in name resolution\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# simple chat\n",
    "nc -l 6030 # srv\n",
    "nc 127.0.0.1 6033 # client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Netid  State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                \n"
     ]
    }
   ],
   "source": [
    "# send date\n",
    "ss sport = 6033"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "cat slackware.iso | pv | nc -l 6033 # srv\n",
    "nc 127.0.0.1 6033 > slackware.iso"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "nc -ul4 8080 # use udp instead of default tcp "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                \n",
      "UNCONN     0      0      127.0.0.1:http-alt                 *:*                    \n"
     ]
    }
   ],
   "source": [
    "ss -lu src 127.0.0.1 sport = http-alt # 8080"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### ncat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "ncat -ltk 127.0.0.1 40601 # same as nc keep open (alive) nc has it too"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "40601/tcp \u001b[01;31m\u001b[Kopen\u001b[m\u001b[K  unknown\n"
     ]
    }
   ],
   "source": [
    "nmap 127.0.0.1 -p 40601 | grep open"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                \n",
      "LISTEN     0      10     127.0.0.1:40601                    *:*                    \n"
     ]
    }
   ],
   "source": [
    "ss -tl sport = 40601"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "ncat -u -e /bin/bash -l 127.0.0.1 40401 -k --allow 127.0.0.1 -m 2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "udp        0      0 127.0.0.1:\u001b[01;31m\u001b[K40401\u001b[m\u001b[K         0.0.0.0:*                          \n"
     ]
    }
   ],
   "source": [
    "netstat -luan | grep 40401"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "metadata": {},
   "outputs": [],
   "source": [
    "sudo nmap -sU 127.0.0.1 -p 40401 --reason"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<img src='img/network/nmap-udp.png' />"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "Resources:\n",
    "\n",
    "man netstat\n",
    "man nmap\n",
    "man ss\n",
    "man netcat (nc is same)\n",
    "man ncat"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- - -\n",
    "## Lecture notes\n",
    "\n",
    "- All lecture notes are available at github in `ipynb` format: [https://github.com/ravexina/linux-notes](https://github.com/ravexina/linux-notes). \n",
    "\n",
    "\n",
    "- There are `html` exports of project available at: [https://ravexina.github.io/linux-notes](https://ravexina.github.io/linux-notes).\n",
    "\n",
    "## License\n",
    "<a rel=\"license\" href=\"http://creativecommons.org/licenses/by-nc-sa/4.0/\">\n",
    "<img alt=\"Creative Commons License\" style=\"border-width:0\" src=\"https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png\" />\n",
    "</a>\n",
    "\n",
    "<span property=\"dct:title\">Linux Notes</span> by \n",
    "<a href=\"http://github.com/ravexina/Linux-Notes\" property=\"cc:attributionName\" rel=\"cc:attributionURL\">Milad As (Ravexina)</a> is licensed under a <a rel=\"license\" href=\"http://creativecommons.org/licenses/by-nc-sa/4.0/\">Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License</a>.\n",
    "\n",
    "- - -\n",
    "\n",
    "<a rel=\"license\" href=\"https://gitlab.com/ravexina/\"><img alt=\"ravexina's gitlab\" style=\"display:inline;border-width:0;height:30px;float:left;\" src=\"img/logo/logo-square.png\" /></a> \n",
    "\n",
    "<a rel=\"license\" href=\"https://github.com/ravexina/\"><img alt=\"ravexina's github\" style=\"float:right;display:inline;border-width:0;height:30px;\" src=\"img/logo/GitHub_Logo.png\" /></a>"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}