Virtual Box Network Config

See this video

https://www.youtube.com/watch?v=Jk5Kfm2-Muk

To make virtual machine connects both the host and public Internet
We need Host-only Adapter and NAT

Host-only Adapter makes virtual machine can ONLY connect to Host server
NAT makes virtual machine connects to public Internet, does not require IP setup, just use DHCP

In addition, sometime we need to use Bridged as an alternate way to connect other IPs in LAN

Bridged Adapter

makes virtual machine connects to public Internet, we need to make sure the ip,subnet, gateway are in the same range with host.

SSH

See here first if network has issues http://gvace.blogspot.com/2016/04/linux-network-configs.html

Without password

1. Client save its public key to remote ssh server.
2. When ssh login, remote ssh server send client a random string.
3. Client use its private key to encrypt this random string.
4. Client send ssh server the encrypted string.
5. SSH server use saved public key to decrypt.
6. If decrypt succeed, ssh server allow client to login, without password.

ssh client

Generate key
ssh-keygen -t rsa
generated public and private key will be in ~/.ssh
private key file: id_rsa
public key file: id_rsa.pub


copy the public key to target ssh-server
ssh-copy-id user1@192.168.3.4
this command will copy the public key from client to ssh server, saved in ~/.ssh/authorized_keys

keep public key and private key in ssh-client side

ssh server

Check if SSH is running

sudo netstat -anp | grep sshd

If nothing on port 22, means ssh-server is not running, install ssh-server or start it.

check firewall(iptables which is ufw), make sure ssh can go through

Linux Network configs

Check port 61616
netstat -an|grep "61616"


Which program is using port 61616
netstat -nlap|grep 61616




check all networks
ifconfig -a

Config IP address dhcp netmask gateway etc..

/etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto em1
iface em1 inet dhcp
# This is an autoconfigured IPv6 interface
iface em1 inet6 auto
#another
auto enp0s3
iface enp0s3 inet static
address 192.168.56.95
netmask 255.255.255.0
network 192.168.56.0
broadcast 192.168.56.255

Change hostname
/etc/hostname

Assign ip to hostname
/etc/hosts



iptables

ubuntu
https://help.ubuntu.com/community/IptablesHowTo
sudo iptables -L

centOS
service iptables status


See what port is opened
netstat -tnlp

Scan device in network, find IP/ports

ip addr

sudo arp-scan --interface wlp2s0 192.168.68.0/23

sudo arp-scan --interface wlp2s0 192.168.68.0/23|grep -i '00:0e'

Scan open ports of ip

nmap 192.168.69.91 -p 1-65535

Wireshark Filters

Search string from tcp
tcp contains facebook

To search HTTP contents from TLSv1.2 protocol
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/


Logical expression

!(ip.src == 192.168.68.18)
!(ip.src == 192.168.68.18) and  (ip.dst == 192.168.69.7)
(ip.src == 192.168.68.18) or  (ip.dst == 192.168.69.7)

IP
ip.addr == 192.168.0.1
ip.src == 192.168.0.1
ip.dst == 192.168.0.1

Input Protocol names directly

tcp
dns
http
udp
tcp or udp

tcp.port == 80

!(arp or dns or icmp)


Packet lost or re-transmission tracking

tcp.analysis.flags


Track one TCP connection
Right click on the record, "Follow TCP Stream"


HTTP Request
http.request
http.response.code == 200

Security usages
If server being attack

tcp.flags.syn == 1
tcp.flags.reset == 1

Signal RTP
sip && rtp

TCP/IP Protocols

TCP Port Numbers

21 FTP
23 Telnet
25 SMTP
80 HTTP
110 POP3
443 HTTPS

UDP Port Numbers
69 TFTP
520 RIP

TCP/UDP Common Ports
53 DNS
161 SNMP
531 AOL Instant Messenger IRC

OSI Model Layers

1. Application Layer
2. Presentation Layer
3. Session Layer
4. Transport Layer
5. Network Layer
6. Data Link Layer
7. Physical Layer

Reduced Layers

1. Application Layer
2. Transmission Layer
3. Internet Layer
4. Data Link Layer
5. Physical Layer

TCP: Three-way handshake

=> SYN Seq=0

<= SYN, ACK Seq=0 Ack=1

=> ACK Seq=1 ACK=1

(response ACK = received Seq+1)

HTTP Protocol

1. http is built based on tcp/ip
2. Hyper Text Transfer Protocol
3. Http 1.0, and 1.1, now normally using 1.1
    http1.0: short time connection, disconnect immediately
    http1.1: longer time connection, 30 seconds

Request Header

GET /test/hello.html HTTP/1.1
Accept: */*
Referer: http://localhost:8080/test/abc.html
Accept-Language: zh-cn
User-Agent: Mozilla/4.0
Accept-Encoding: gzip, deflate
Host: localhost:8080
Connection: Keep-Alive
[empty line]
dataname1=data1
dataname2=data2

1. Accept: text/html, image/*
2. Accept-Charset: ISO-8859-1
3. Accept-Encoding: gzip, compress
4. Accept-Language: en-us,zh-cn
5. Host: www.sohu.com:80
6. If-Modified-Since: Tue, 11 Jul 2000 18:23:51 GMT    //cache time, refresh if there is newer
7. Referer: http://www.sohu.com/index.jsp //tell host where this request come from, prevent spam
8. User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
9. Cookie
10. Connection: close    // or Keep-Alive
11. Date: Tue, 11 Jul 2000 18:23:51 GMT

Request Methods:

POST GET HEAD OPTIONS DELETE TRACE PUT


Response Header

1. HTTP/1.1 200 OK
2. Location: http://www.baidu.com //tell browser to redirect new url
3. Server: apache tomcat
4. Content-Encoding: gzip
5. Content-Length: 80
6. Content-Language: zh-cn
7. Content-Type: text/html; charset=GB2312 //response.setContentType("text/html;charset=GB2312");
8. Last-Modified: Tue, 11 Jul 2000 18:23:51 GMT
9. Refresh: 1;url=http://www.baidu.com     //redirect to url after 1 second
   //response.setHeader("Refresh", "5;url=http://www.sohu.com");
10. Content-Disposition: attachment; filename=aaa.zip
    //tell browser that there is file to download
    //response.setHeader("Content-Disposition","attachment; filename=aaa.zip");
11. Transfer-Encoding: chunked     //checksum verified
12. Set-Cookie:SS=Q0=5Lb_nQ; path=/search   //to be introduced
13. Expires: -1                               //tell browser(IE) how to cache data
14. Cache-Control: no-cache         //tell browser(FireFox) how to cache data
15. Pragma: no-cache                    //tell browser(some browser) how to cache data
    //response.setDateHeader("Expires",-1); //or value to System.currentTimeMillis()+1*1000;
    //response.setHeader("Cache-Control","no-cache");
    //response.setHeader("Pragma","no-cache");
16. Connection: close/Keep-Alive
17. Date: Tue, 11 Jul 2000 18:23:51 GMT

State Code

• 200 normal
• 302 server request browser redirect to another resource
  response.sendRedirect("anotherPage")
  // or response.setStatus(302); response.setHeader("Location","anotherPage");
• 404 not found
• 500 server error
  throw new RuntimeException();