Video Tutorial of Using NMAP

Nmap is a free and open source utility used normally for security auditing. Nmap uses IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and more. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and both console and graphical versions are available.

This video tutorial gives a very good introduction of nmap.

Stealth Master Boot Record(MBR) rootkit

In 2005 Derek Soeder and Ryan Permeh, researchers from eEye Digital Security, presented eEye BootRoot. The technique used in their project wasn’t new and had been popular in DOS times, but they first successfully used it in Windows NT Environment.

The eEye Digital Security researchers skipped one part – BootRoot didn’t hide the real content of affected sectors like old DOS Stealth MBR viruses, but it had only been created to show the possible way to compromise Windows NT OS.

Reconnaissance – Hackers First Step.

Reconnaissance is key and the first step for an attacker to be successful. Professional attackers will take the time to learn as much about your environment as possible using several different techniques and tools freely available on the internet so that they can attack your weaknesses with as little resistance as possible.

Reconnaissance is generally carried out in the following steps

1. Gathering general information about the company.

Tcpdump Examples for troubleshooting.

Tcpdump is a unix based network utility that listens to and records traffic on a network segment hence is very usedful in troubleshooting applications and connectivity issues. Below are some of the examples of using tcpdump

syntax to look for traffic related to a particular host IP address:

$ tcpdump -p -i host
example:
$ tcpdump -p -i eth1 host 192.168.1.10

——————————————————————
syntax to look for traffic related to a particular port

$ tcpdump -p -c 25 -i port
-c : sets packet count
example:
$ tcpdump -p -i port 443