Hack Like a Pro: Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Inthe first partofthis series, I introduced you to the basics of networking including IP addresses, ports, NAT, and DHCP. In this lesson, I want to introduce you to the basics of TCP/IP, i.e., Transmission Control Protocol (TCP) and Internet Protocol (IP). These are the most common protocols used on the internet for communication.Image viaShutterstockTo become a proficient hacker,forensic investigator, or simply be a good network engineer, you should understand the structure and anatomy of these protocols. From my experience,manyprofessionals in these fields do not understand the basics of TCP/IP, which means that you will definitely have an advantage over them if you do understand TCP/IP.When trying to create a new hacking tool or investigate a network attack, understanding these protocols and their fields is essential. Otherwise, you will be simply wasting your time.What Are Protocols?Protocols are simply an agreed upon way to communicate. For instance, we here on Null Byte have agreed upon the English language with all its rules and grammar as our way to communicate. That is our protocol. If we did not have an agreed upon way to communicate, people would be using many languages, grammar, and rules and none of us would understand each other.Protocols are similar. A protocol simply defines a way of communication with all its rules. These rules are usually defined by a RFC (Request for Comments).There are many, many protocols in use on the internet. These include TCP, IP, UDP, FTP, HTTP, SMTP, etc., and each has its own set of rules that must be complied with in order to communicate effectively (similar to the rules we use in communication via written languages). Probably the two most important protocols for use over the internet are IP and TCP, so let's take a look at each of these.IP (Internet Protocol)IP, or Internet Protocol, is the protocol that is used to define the source and destination IP address of a packet as it traverses the internet. It is often used in conjunction with other protocols such as TCP, hence the often used conjunction, TCP/IP.Let's take a look at an IP packet header and see what information itcontains that can be useful to the aspiring hacker and/or forensic investigator.Row 1Version: This defines the version of IP, either v4 or v6.IHL: Defines the header length.Type of Service (TOS): This defines the type of service of this packet. These include minimize delay, maximize throughput, maximize reliability, and minimize monetary cost.Total Length: This defines the total length of the IP datagram (including the data) or the fragment. Its maximum value is 65,535.Row 2Identification: This field uniquely identifies each packet. It can be critical in reassembling fragmented packets.IP Flags: This field defines whether the packet is fragmented (M) or not (D). The manipulation of the field can be used to evade IDS and firewalls. Check out my tutorials onNmapandHping3on how we can manipulate packets to evade intrusion detection systems and other security devices. It can also be used in conjunction with the Window field to identify the operating system of the sender.Fragment Offset: This field is used when packets are fragmented. It defines where the packets should be reassembled from the beginning of the IP header.Row 3TTL: This is the "time to live." This defines how many hops across the internet before the packet expires. It varies by operating system making it useful to identify the OS of the sender.Protocol: This field defines what protocol is being used with IP. Most often, it will be 6 or TCP, 1 for ICMP, 17 for UDP, among others.Header Checksum: This is an error checking field. It calculates the checksum (a simple algorithm) to determine the integrity of the data in the header.Rows 4 & 5Source / Destination: These rows of the IP header are probably the most important part of the header as it contains the source and destination IP address.Row 6Options: This field is variable length and its use is optional (as you might expect).Padding: This field is used to fill out, if necessary, the remaining bits and bytes of the header.TCP (Transmission Control Protocol)In the TCP header, there are numerous critical fields that the aspiring hacker and/or forensic investigator should understand.Row 1Source Port / Destination Port: Probably most importantly, these are the source port and destination port. These fields determine what port the communication came from and where it is going.Row 2Sequence Number: The sequence number is generated by the source machine's TCP stack and is used to make certain that packets are arranged in the proper sequence when they arrive. It is also important in defeatingMitM attacks.Row 3Acknowledgement Number: This is an echo of the Sequence Number sent back by the receiving system. It basically says, "I received the packet with the Sequence #." In this way, the sender knows that the packet arrived. If the sender does not receive an Acknowledgment Number back in a fixed amount of time, it will resend the packet to make certain the receiver gets the packet. In this way, TCP is reliable (for instance, UDP does not do this and is therefore unreliable).Row 4The fourth row has some critical information. Let's skip over theData Offsetand theReservedfields. That takes us to 8 bits near the middle of Row 4. These are the infamous flags of the three-way handshake andNmapscans. The first two bits,CWRandECE, are beyond the scope of this lesson. The next six bits are the URG, ACK, PSH, RST, SYN, and FIN flags. These flags are used by TCP to communicate;SYN: The opening of a new connection.FIN: The normal, soft closing of a connection.ACK: The acknowledgment of a packet. All packets after the three-way handshake should have this bit set.RST: The hard-close of a connection and usually used to communicate that the packet has arrived at the wrong port or IP.URG: This flag indicates that the following data is urgent.PSH: Push the data past the buffer to the application.If you are familiar withNmaporHping3asrecon tools, you have used scans utilizing all of these flags. By creating packets with flag combinations that should not be seen in the wild, we may be able to elicit a response from a very secure system or even evade detection.Window Size: In some diagrams, this is simply described as theWindowfield. Its role is to communicate the size of the window that the TCP stack has to buffer packets. This is the way that TCP manages flow control. From a recon or forensics perspective, this field alone can be enough to identify the OS that sent the packet. This field varies from OS to OS and even from SP to SP. Given this bit of information, one can predict with about 80% accuracy the OS that sent the packet. In fact, it is this field and a few others (DF and TTL in the IP header) that such operating system fingerprinters such asp0fuse to identify the OS.Row 5Checksum: This field uses a simple algorithm to check for errors. In essence, it is an integrity checker.URG Pointer: This field points to the last byte of the sequence number of urgent data. The URG flag must be set in conjunction to activate this field.Row 6Options: Like the IP header, the TCP header has an options field that can be used if necessary and it is varying length.Padding: The padding is necessary to bring the TCP header to a multiple of 32 bits.If you have any questions on these basics of TCP/IP, ask in the comments below and we'll try and help you understand better.Keep coming back, my greenhorn hackers, as we explorethe basics of networkingto make you a professional hacker!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hacker Fundamentals:A Tale of Two StandardsHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Networking Basics for the Aspiring Hacker, Part 1Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHacker Fundamentals:The Everyman's Guide to How Network Packets Are Routed Across the WebHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)How To:Create Packets from Scratch with Scapy for Scanning & DoSingHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)How To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)Hack Like a Pro:How to Conduct Active Reconnaissance on Your Target with hping3Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Advanced Nmap for ReconnaissanceHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing HabitsHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHow To:Code a Basic TCP/IP Client & Server Duo in PythonHacker Fundamentals:A Gentle Introduction to How IP Addresses WorkGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Assign a Static IP Address in Windows 7Community Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingHow To:Hack Wireless Router Passwords & Networks Using HydraCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker Training