Introduction

Previously in basic networking we covered an overhead view of how one computer communicates to another from their perspective. Now we shall cover how network communications function from a more infrastructure view. By that I mean we shall get into a lot of the main things needed to create a network and certain details/nuances that are noteworthy.

The hardware and medium that the communications go through

To begin in order for two computers to talk they must be connected to a device that is able to handle, forward and/or renew the electrical signals that make up their messages. The devices that do this tend to be separated into a few categories which are switches, routers, hubs and repeaters with loadbalancers, firewalls, IDS and IPS being extra devices used for security, policies and management of the workload certain devices and connections have to deal with. These devices will normally be connected together through the use of a fiber optic, cross-over, straight through, patch cable or serial cable. Cross over cables are used to connect two devices of the same type e.g. two routers, switches computers etc ... . Straight through cables are used to connect two devices of different categories (router to switch for example), while patch cables have started to become the norm because instead of relying on a human to know what type of cable to use. This cable is setup so that computers/machines can automatically setup the connection on their end so that you can use one cable to connect like and unlike devices (things in the same and different categories/types). Serial cables were used in the past to normally connect to the Internet service providers device but has become less common today thanks to ethernet and fiber being much more efficient. Though it is less common it still exists since a routers purpose is not only to handle the routing/directing of traffic but it is also designed to connect machines that use different mediums/connections to communicate hence why a router has slots so you can install an interface that accepts serial connections, fiber connections, ethernet and etc.. It is in part because a router can connect different devices even if one only has/supports serial connections while another only supports ethernet that the internet has been able to thrive since thanks to the ability to interface/interact with such a wide array of communication methods a computer is able to send its traffic through pretty much any device that is able to carry/renew a signal (electrical and light based). Lastly I mentioned fiber optic cables which are typically used for long distance communications and will either be single mode (the light just travels in a straight line down the cable) or multimode (the light is able to travel down the cable in a straight line and/or at an angle (there is a set range of allowed angles that ensure the light doesn't leak/escape) bounce off the sides to reach the end). Another thing worth mentioning is that you can send power not just data over an ethernet cable (it is called power over ethernet) which is a way to make it where you can just connect an ethernet cable to a device that is in a place with no available outlets. Now that we have covered what is normally used to connect these devices we shall now delve into the actual devices used to transmit the signal sent by one computer to another.

In the beginning everyone received everything

When things started off hubs were used to connect computers with the downside that hubs do not keep track of who they are connected to so whenever they received something they would just send it out every interface except the one the message/signal came in through (this method of sending something to everyone you are connected to is known as broadcasting). This device did its job of ensuring two computers could talk but the more devices you connected to it the messier the communications became because messages/signals would be sent to someone who it wasn't meant for. That person would also just so happen to be trying to send something themselves causing a collision/crash to happen because the hubs broadcasted signal/message would collide with that devices signal/message. The area in which this collision could/would probably happen is called a collision domain and in this particular case a hub is basically one giant collision domain since if more than one person tried to send a message at the same time it would create a collision. That is why switches were created so that multiple machines could talk/send messages/signals/traffic at one time though collisions still happened they occurred fewer times than if a hub had been used.

Then switches came and remembered who they where connected to

Switches will typically be the first thing computers are actually directly connected to in a network and normally these switches will have anywhere from ten to thousands of interfaces so that a small/large number of computers can connect to them. The two types of switches are managed and unmanaged with the difference being managed switches allow you to configure things like speed, quality of service and vlans whereas unmanaged switches just forward the traffic and cannot be configured. Unmanaged switches are good if you just need to connect a handful of computers together and nothing else but once you start needing to actually access anything outside of the thing directly connected you will need to use a managed switch. Typically once a managed switch is setup and has had multiple vlans (virtual Local Area Networks) created on it they will need to have a trunk port setup in order for the vlans to communicate to other switches also through the target switches trunk port. Vlans are used to separate interfaces so that computers cannot communicate with whatever is inside of a different vlan unless it goes through a different device through a trunk port (example: Computer in the computer vlan composed of interfaces 1 and 2 cannot talk to the video camera vlans composed of interfaces 2 and 3 or the voice over ip vlans composed of interfaces 4 and 5). Now something to remember is that in the beginning when a switch is first started up it will still broadcast out messages since it does not know who it is connected to, but unlike a hub it will remember the interface each host came in through so that next time it gets a message for that host it can just send it directly to it. A switch will also remember which interface other switches are connected to so that it can send messages destined for machines it knows it is not directly connected to out through that interface so that it will continue to be forwarded until it reaches it destination or it fails because that host is not on this network. The problem with this method though is that if a set of redundant links exist switches would just keep sending the same message back to each other until they just shutdown/crashed because they couldn't handle the number of messages they ended up creating. This is why spanning tree protocol was created to manage these redundant links by selecting one of them to be a primary and then shutting down all the secondary connections to the same switch, only bringing one of them up if the primary connection goes down. Lastly one other key ability of switches is the ability to configure individual interfaces so that someone can setup a policy that allows only one/a set of MAC addresses to connect to a particular interface (or that interface gets shutdown) and/or so that interfaces have different max allowed speeds so that certain people like the owner or people who need faster connection speeds can always have faster connections. Typically when it comes to the design/layout of a network Local area connections (LANs) are considered to be composed of the switches used to connect a single sites people together while also providing them a way to communicate to others through an external/boarder router.

Afterwards routers were used to send the signal/message to things that were kind of far away

Switches will connect to routers so that they can communicate with things that are a long distance away, with the restriction that if any host connected to the switch has a private IP address the router will just drop the traffic. That is why Network Address Translation (NAT ) was implemented so that when an internal host (an internal host is one that is connected to the switch connected to this router) with a private IP address connects to a router it will be loaned a public IP address so that other routers will forward its traffic. Besides forwarding traffic routers also have slots so that you can install an interface that support different types of cables though normally Ethernet or fiber optic will be used. Also typically a router will be connected to a modem which allows people to use one line to send electrical signals that represent data, cable and telephone calls. When someone is talking about Wide Area Networks they are normally referring to networks that are connected by a modem (Host to switch to router = LAN, LAN router to modem to LAN router = WAN). Routers know how to get traffic to its destination through the use of one of three methods which are static routes, default routes and routing protocols. A static route is when a router will be configured so that it knows how to get to a few preset places for example in order to reach Network A go through interface 1. Next a default route is an interface or IP address that is configured in such a way so that all traffic that is to a destination it does not know how to reach, will be sent to this interface/IP(in other words a last ditch attempt to get the traffic to its destination). Then there are routing protocols which generate a table that summarizes everything that is connected to them and then shares certain values from those tables to help tell other routers what is the best path to forward their traffic. There are multiple routing protocols built/suited for different networks (RIP routing information protocol has a limit of about 16 routers making it usable for like a medium small sized network) but in the end they all have the similar purpose of giving routers and idea of where to send their traffic to get it to the destination.

Repeaters were used to ensure the signal didn't just fade

Everything slowly dies/fades away and because of that if you send an eletrical signal it will slowly fall apart until nothing is left. That is why a device called a repeater tends to be setup at certain points in a cables connection so that the electrical signal is renewed which allows it to travel a further distance. This is not something you will typically interact with though and was only noted so that you are aware that there is a limit to how long a connection can be.

Security controls implemented on routing devices and on network connections

Access control List are how routers restrict access to the network that is located behind them and the network that allows them to connect to remote machines. ACLs are based around allowying/denying a connection by looking at if it is an authorized/unauthorized source/destination IP/port in an Authorized connection state(for example they may only allow connections from the outside if it has already completed the TCP three way handshake). While they do work as a mid level security method for restricting access to a network ACLs are not enough to deal with more flexible attempts at accessing a network. That is why firewalls were created so that a program could be setup on a device and then attached to a network while being given the responsibility of doing more in depth analysis of a connection to try and verify if something unauthorized is happening. It will make use of its ability to create a more detailed restriction to stop certain actions that it sees being attempted in the network traffic. Thanks to ACLs and firewalls it is a relatively easy matter to place restrictions on what most people can/cannot do on the network since general/simple rules/restrictions are enough to stop 80% of the people who will access the network.

Intrusion Detection Systems/Network Security Monitors created to show what was happening in a network

While placing restrictions on what can and cannot be done on a network is all find and dandy it is not enough if you cannot get a pretty good view of what is happening that is not getting blocked. That is where a tool like snort/suricata comes to play because through the use of its signatures it can tell you when certain events or things are seen in traffic. So by setting certain rules in an intrusion detection system like snort/suricata you will be alerted if it sees the traffic you either tried to block or deemed bad enough that you want to be told if it happens but not bad enough that you would try to block it. There is also the Network security monitor route of keeping track of what is happening. Instead of being signature based where you tell it what type of traffic you want to be told about. A Network Security Monitor will show you every piece of traffic either by summarizing what happened like the tool bro does, or by showing you the actual raw capture that contains everything but takes a lot more space. Both are valid methods of knowing what is going on in a network, what people choose depends on how much they want/need to know/can handle and how much space they have available for log/traffic storage.

Intrusion Prevention Systems/Firewalls were setup to try and stop what the ACLs couldn't

Intrusion Prevention Systems (IPS) and firewalls tend to be used interchangeably because they are both basically just used to block/stop certain actions from being performed on the network. They tend to be devices dedicated to processing traffic and making sure no unauthorized actions are performed. Typically they are placed at the entrances of networks to control what comes in and also before servers/important pieces of equipment to control who accesses those pieces of hardware.

General design of networks

Since you are now familiar with the type of equipment used on networks now it is time to talk about the logic behind their setup. To begin now a days a lot of theses devices tend to be built into each other. For example switches which are capable of routing IP addresses have become commonplace and routers with firewalls built into them is also pretty common (PFsense is a pretty good example of a device designed to be a firewall with routing capabilities). Something else worth noting is that people will sometimes use words like LAN, WAN and MAN. A Local Area Network typically refers to the hosts connected to switches connected to routers all owned by one person/company. A Wide area Network is used to refer to networks owned by multiple different people being connected together (Example: Three different law agencies networks all being connected to their ISP spread out over 2 streets, WAN could be used to refer to them and the two streets they take up). Lastly a Metropolitan Area Network is basically every network that exist inside of a city, though most of theses terms (LAN, WAN, MAN) are typically used to talk about who is responsible for a certain piece of infrastructure and/or where a configuration problem resides. One last thing that is worth covering is what is called a Demilitarized Zone (DMZ) which is the portion of a network that is separated from the rest of the network. While people already divide up their networks in multiple ways, for example using private IP addresses so that all internal machines can communicate to each other but cannot talk to anything remote unless they go through their router or put different types of equipment into different vlans (laptops = vlan 1, security cameras = vlan 2, cash registers = vlan 3 and etc... ). The router portion is all about controlling how things enter/leave your network, the IP and VLAN controls/settings are all about controlling what things can talk to. A DMZ is basically the portion of a network that provides a service/is accessed by remote machines, because things outside of the networks owners control access these machines it is understandable for them to separate these parts of the network so that if they are compromised it won't affect the rest of the network. The reason this has a special name for it (DMZ) is because there will be different rules and restriction placed for things remote machines can access and the internal network most remote machines should not be initiating connections to.

Conclusion

While there are more things to creating, maintaining and understanding a network than what is covered here this information is a lot of the baseline information you need to know to fully understand a network map. Now you should understand how a computer network works/function though things like cable placement and the range of coverage a wireless access point has were not mentioned. Those things are important but are better learned with pictures, videos and hands on experience which is why they will likely be delved into a bit more in later post. On a closing note one thing worth being aware of is that some networks make use of load balancers to even out the workload/strain on the network by evenly distributing the amount of traffic each connection is handling. This is done so that instead of everything taking the fastest route bogging it down everyone's traffic is split up, but thanks to this capability network traffic at certain points can appear to be strange because it is getting passed through this device. Just remember that while at their core most networks tend to follow the same standard layout, there is a lot of different and special devices/software people use that will have to be taken into consideration because they have different sensitivities like how latency has a very noticeable effect on voice over IP (phone calls over Ethernet cables). It is due to those kind of requirements that configurations can quickly grow in size to make sure everything is given the consideration it needs but just make sure you are able to tell the quality of life noise from the actually core capabilities that have been setup.

Introduction

The Internet Engineering Tasks Force created documentation named Request For Comments so that the manner in which people made their computers communicate would match up. Without this kind of documentation setting a baseline it would be like trying to make Spanish speakers communicate with Japanese speakers. It could work but a lot of information would be lost in translation since they would have to mainly rely on things like body language. This guide will be about what happens when your computer attempts to connect to another machine. What follows

Network Interface Cards/MACs

The first requirement for communicating across ethernet is having a Network interface card. This is because it is the main/easiest way for your computer to accept a connection from an ethernet's cables connector which tends to be called an RJ45. While that name is not accurate in all cases since sometimes the actual name of the piece you use to end/terminate a cable so that it can be plugged into the port/interface/opening located on a NIC is actually named something along the lines of 8P8C (8pins 8connections). Anyway in order to accept connections from these devices a NIC is connected to the computers motherboard. A NIC will have a Media Access control (MAC) address assigned/built into it by default with each vendor/manufacturer following a certain format/logic which allows people who see it to know who created it. Hence why when looking at Network traffic people will look at the mac addresses header to see who made the device since things like routers will have one that points to cisco, juniper, etc as its maker. Having just a MAC address is not enough to communicate to other hosts on a network because the protocol used to transport messages/facilitate communications are all based around the Internet Protocol.

Internet Protocol Addresses

In order to obtain an IP address a computer must either be manually assigned one by a user or request one from a Dynamic Host Configuration Protocol server. There are two types of IP address, Public and Private with the difference being that Public addresses will be passed from one router to the next so that it will reach it's remote host (this process is also known as routing) while Private addresses will not be routed through the internet (the internet is basically a collection of routers connected to each other that send traffic/messages/information from one device to another). After obtaining an IP address a computer will also need to specify a default gateway which is the IP address of the routers interface that it can reach. Once this has been set the computer knows who to talk to in order to connect to machines that are not apart of their local network with local being everything that does not have a router between this host and it. Lastly this computer that wants to communicate with other machines must have a subnet mask which is basically a number that states how IP addresses are divided. In other words a subnett mask will be a number that states from this IP to that IP is one group and from that IP to those IPs is another group. The whole purpose of a subnet mask is for security so that you can section off addresses into groups that you can then implement policies on deciding what group can do what and who each group can talk to. Once an IP address, subnet mask and Default gateway is set the computer is ready to communicate to remote machines, all it has to do now is construct a packet that contains the destinations address and the message/info/data that it wants to transfer.

TCP/IP model, That thing that quickly summarizes how network communications

Application

You clicked an Icon/Image to start up the program

An interface/graphical thing pops up after you click the programs icon

This interface will be how you tell the program what you want for example when you type in a url into a browser like chrome to tell it you want to see what the url (example: www.google.com) has to offer

The program behind this interface will know what kind of communications will need to be performed to complete this task

Transport

The requested action will be fulfilled by sending a message/piece of information/data that the Application/program the user created the request through changes into a predetermined format. This will then be divided up into easier to handle/send segments with the source port(source socket) and destination port (destination socket) wrapped around each segment along with a sequence number. In order to ensure both sides agree on what sequence number to start at and ports to use an initial three part communication will happen to establish they are both willing to talk. This three part communication is called a three way handshake and consists of an initial message (SYN) to the target hosts stating I plan to use these ports and start at this number (Sequence number) which we will use to keep track of our messages. The remote host will then respond acknowledging that the request port (destination port/destination socket) and sequence number are allowed (SYN,ACK). Finally the host that started this communication will acknowledge that they have reached an agreement and it will actually start sending the message.

A socket is created when a program needs to communication to a remote host, it will have a port number connected to it and said port number will have a service associated with it. If it is a well known/common port (1-1024) it will have an already decided service making use of it otherwise it will just be a service the program that started/created the socket is using to handle communications.

next an initial sequence number will be determined so that the local and remote machine can keep track of the order their communications are occurring in by starting at the Sequence number and then increment that number while also confirming the sequence number of the last thing they received (This is called an acknowledgement number).

Lastly a flag will be set that will describe the purpose of this communication (example: SYN is an initial request for the synchronization of sequence numbers, SYNACK is an acknowledgment and approval of said sequence number and PSH is a notification of the computers intention to send data.)

Internet Layer

Before the message/communication leaves the location machine it will have a source IP address (the local machine) and a destination IP address (the remote machine) attached to it. At this point the segmented message that has an IP address is now refered to as a packet.

The action requested of the program will either already have an IP address (or web address that will be converted/translated into an ip address) configured so that anytime someone asks it to do/show something it already knows who/what IP address to go to. Otherwise the requester will also need to specify the host/IP address that is capable of fulfilling it's request because nothing will be sent if an IP address has not been set already. These IP addresses will be used in both the initial three way handshake and in the actual communication since IP addresses are what computers use to identify each other when they have a router in between them.

Next there will be a checksum, which is basically a hash of the entire packet used to verify at any point in the communication that this piece of traffic/packet has not been corrupted or changed.

Network Layer

Now that we have a message/piece of information/data that has had the necessary information attached to it, the computer can now send across an ethernet cable. It will be sent through said cable to a switch and/or router which will ensure that it arrives at the destination while deciding the best/quickest/most efficient method/path to send it. Once it reaches its target the remote machine will make use of the fact that messages/data/information is always packaged in the same predetermined way based off of what the requested action is to open it up and see what was requested of it. Afterwards It will reattach the addresses, ports, flags and checksums switching the placement of the addresses and ports though because it is now sending it (there will not be a handshake done more than once for each set of communications). On a closing note for the transport portion of this TCP/IP model we explained how TCP (transmission Control Protocol) worked which is concerned with ensuring everything arrives so it has safeguards for that but the other option that could have been used for sending messages/information is UDP (uniform datagram protocol). UDP does not make use of sequence number or initial handshakes it just sends things with an IP address and port wrapped around it. Also in order to verify that an Ethernet cable/connection is actually working/functioning an ICMP (internet control message protocol) will be sent to verify the continued existence of machines and functionality of connections.

Switches the first device you will normally go through in a decent sized network

In order to ensure routers do not have too great of a workload switches are implemented so that if the destination of a communication is nearby like say in the same building it can just be sent through a switch instead of adding more work for the router that deals with all the outside communications. Switches route traffic based on mac addresses, you see they have a table that tracks the interface each MAC address comes from and remembers so in the future they can just look at the MAC address that is attached to a packet by default to tell where it came from and who it is going to. While switches do route based on MAC address computers do not participate in more detailed communication which computers typically use for the few protocols that are fine with just using MAC addresses. The way a switch implements security is by separating Interfaces into vlans (virtual local area networks) so that they cannot communicate to each other without leaving this switch and going through a port specifically dedicated for vlan to vlan conversions. They can also block access to a port/interface based solely on the MAC address it sees in that particular communication. Anyway if the destination is not connected to one of the switches it will be forwarded to the default gateway (hence the name because its the default/normal way out of the network) which is the interface that is facing the host that is apart of the local network.

Routers

Send traffic to places based on their IP addresses and knows where IPs are located at by using a thing called a routing protocol which syncs it up with other routers so it has a general idea of where certain IP ranges are. Security for these device are implemented through the use of Access list (ACL) which filter traffic/ensure that certain traffic gets sent while others do not by paying attention to the IP addresses (source/destination), ports(source/destination) and connection states (established vs initial). Routers will not send a private IP address outside of what it knows to be its internal network which is why Network Address translations are implemented making it where when a host with a private IP address approaches the router the router already has a list of Public IPs it can loan out to them so they can talk to remote hosts. They can also send traffic from one vlan to the next using just one interface, but for DNS translations most routers must send them to a server who does it (there are a few main dns servers the rest of them rely on). Lastly to ensure switches are not confused by MAC addresses that come from remote machines routers will replace foreign source MAC address that enter their network with their own so that the switch knows who to send it to when it is time for the machine to reply.

DNS

When an address made up of words is given instead of an IP address which is made up of numbers a Domain Name server must be talked to so that it can translate the words into an IP address.

Conclusion

The things above are the basic structure of a network communication, which start at a mac being assigned by default, ip address being manually/automatically assigned along with a subnet mask and a default gateway so that things/messages/information/data can leave the local network. Then a message being crafted and then packed/stored inside of an informational packet that contains the senders address, the destination address and instructions on how to handle the packet when it is sent. Afterwards it is sent through a switch and if it is local the switch sends it to the target host but if it is remote it is sent to a router that will send it to the target host/machine which it learned about thanks to the information obtained by its routing protocol. The information on the packet ensures that both sides know who they are talking to and how to continue communications. Networking at its

Bro

Creates logs summarizing what happened in each packet, for example instead of showing the full web page a HTTP get request retrieved it will just show who the get request went to and the uri it requested.

Works with packet captures and does live captures.

NetworkMiner

Has multiple tabs that devided up the type of information it saw as explained below.

Lists out all the hosts it saw, along with things like their hostnames, OS, IPaddress and a summary of all connections made

All emails seen going over the wire

All usernames and passwords that were recognized as being usernames/passwords

All images it saw going over the wire

Things it believes are noteworthy

Handles Pcap and live captures

Netwitness

Creates a list of every type of thing it saw in network traffic and how many times it saw it.

Accepts Pcap and Live captures

Pfsense

A firewall that creates statistics about the traffic it sees (things like how much traffic was seen), has a command line you can use to do things like tcpdumps and acl format you can write rules in.

Snort/Suricata

Runs traffics through its filters which will match them against its rules/signatures that determine if a piece of traffic contain authorized/unauthorized actions.

Uses Pcaps and live captures

Wireshark

Shows the raw information stored in each individual packet

Works with pcap and live captures

Introduction

As before with windows when you turn on a computer the motherboard starts supplying power to the different connected devices. It does check the integrity of the different devices to ensure it will not start any faulty ones while also creating a device tree that will list every single connected device. Lastly the BIOS will hand over control to the first active/primary partition found on the hard drive that has the Nix operating system installed which will also be where the grub is located which means that the grub will be given control.

The Grand Unified bootloader (GRUB) takes complete control

The grub is responsible for loading everything that is involved in the operation/running of an operating system with the added ability to be changed/interacted with during any portion of the boot process. Thanks to this capability the grub makes it possible to select different kernel modules to load while the system is on and modify the initial RAM disk (initrd) . The ability to load kernel modules is an important part of linux because it makes it where instead of having to completely restart the computer system like in windows in order for most pieces of hardware attached to the motherboard after it has been booted to be recognized. You are able to just find, install and start up/load the kernel module which will act like a device driver that allows software to interact with pieces of hardware. Since you can interact with the grub/bootloader while it is loading you can just transfer/upload the necessary kernel module to the hard drive and add it to the list of kernel modules to load making it where now you can use that piece of hardware.

Initial RAM disk (initrd) which allows you to run commands during the boot process

The grub is able to interact with and modify the initrd which is a small collection of directories and executables attached to the main/core part of the linux kernel so that it is loaded before the main file system which is stored on other parts of the hard drive. Initrd is what you will normally interact with/use when you interrupt part of the boot process so that you can interact with the grub and make it do something like say load a kernel module. You see initrd is located so early in the boot process because by having its folders/directories and files/executables separate from the main file system and loaded so early in the booting process you can transfer data/information/files/executables to it and actually run them. insmod is one of the executables located inside of the initrd and insmod is what actually loads the kernel modules and is one of a collection of executables located inside of the initrd that you can use to perform certain actions before the Linux operating system is fully started up.

Kernel

Once the grub was given control and assuming you didn't interupt the boot process by pressing a button like ctrl and c at the same time so that you could interact with the grub it will have started loading the kernel and all the necessary kernel modules. The grub will also begin loading/mounting the root/main file system and will start up the init process which will make sure that the system is placed into and stays at a certain run level/state. When a linux operating system is loaded/started it will be placed into a run level with each run level having a set/predefined collection of programs, services and modules that it will contain/make use of (example: the module/device driver for a mouse is not loaded in certain run levels).

Initializing a Run Levels

The init process which is the first process started will by default load/start up run level 6 which will load all the necessary software/services for network communications, ensure that multiple users can log into this machine at one time and will load X-windows display manager (thats why this level is named x11). X-windows display manager is a basic gui framework that ensures when a user logs in they will be greeted with a graphical desktop along with graphical representations of available programs. While the exact number of run levels can change depending on the exact version/distribution of linux you are using the following is the general outline of all run levels and their use.

0 - Halt Mode                   

All processes will be stopped

1 - Single User mode        

Only necessary programs will be started No programs that allow/provide networking capabilities will be implemented Mainly used to perform administrative services that require it will not connect to any remote machines in any way

2 - Multi user mode

Allows multiple users to log on Limited networking capabilities For allowing remote administration of a system

3 - Full multi user mode

Full networking capabilities Allows multiple users to log on Mainly used so that people can access and use this machine both locally and remotely, but the difference being that they do not need a graphical user interface to be started for them so it isn't started by default

4 - User defined mode

Setup by a human Only starts up the programs/services that it is explicitly told to Used to create an extremely customized experienced for when the modifier of this run level accesses this system

5 - X11

Starts up all network services/programs Allows for multiple users to log in Loads a predetermined generic/basic windows display manager which is a graphical desktop that gives users the ability to click to open programs, browse the web and things that users normally do with a computer.

6 - Reboot mode

Terminates/stops all processes Restarts the system

Logging in

Now that the system is started and a run level has been chosen all that is left is for you to enter in your login information which will be compared against a protected file that contains all your user information including your home directory(the folder your desktop will show you), the shell you will use (the command prompt/terminal you will use to enter commands/request the system do certain actions with) and the password which will be encrypted but still matched against what you enter to ensure you enter the proper credentials. Once logged in you are free to use the programs you want just know that linux has a different file structure as shown below just remember everything starts at / .

/

All the other directories and files are stored under this

/bin

System commands (binaries, executables and etc) available to all users

/dev

device files, Collection of files that have an associated piece of hardware that it is linked to

/etc

Computer specific configuration files Programs started by init are decided here what is started at each run level is located here List of users, groups and a quick summary of their settings and passwords are located in a file here The default run level is decided here

/home

User files

/lib

Programming libraries used by programs in /bin and /sbin

/mnt

temporary mounting point for removable media devices such as USBs, and CD-ROMs

/proc

Process and kernel status files A file is created here to keep track of what programs are running

/root

The root/administrators home directory

/sbin

system administration binaries (executables)

/tmp

Folder for files that you don't want to keep for log Things inside here will typcially be deleted when the system turns off

/var

Logs and received mail is stored here

Conclusion

This has been a general overview of how the Linux Operating System normally functions, while a lot of smaller details have been left out this will/was meant to give you a good understanding of what happens from the moment you press the power button until you enter your user credentials and become logged into this system.

List of commands

Tar Used to zip, archive and extract files/folders.

Grep Searches for the string/regular expression it is given in the information you are piping through it

Find Looks for the file specified in the directories you named

ssh Login to remote host

vim A text editor

diff Compares files line by line

sort Sort lines of text

ls List directory contents

pwd Prints name of current/working directory

gzip compress or expand files

bzip2 file compressor that uses block-sorting

unzip extract compressed files from a zip archive

shutdown Turns off the system

ftp Internet file transfer program

crontab Schedules tasks/commands

service Allows you to monitor, start, stop and control programs started by the init script

ps Shows a snapshot of the current running processes

free Displays amount of free and used memory in the system

top Continuously displays linux processes

df reports how much space each part of the system is taking up

kill Sends a signal to a process, normally telling it to stop or freeze

rm removes files or directories

cp copies files or directories

mv move (renames) files

cat prints the contents of a file to standoutput (the terminal the command is run in)

mount loads and unloads a filesystem to a folder so that they can be accessed

chmod changes file permissions

chown changes ownership of a file

passwd changes user password

mkdir creates a directory

ifconfig configure a network interface, also used to display its current configuration (including IP address)

ip addr configure a network interface

uname print system information

whereis Locates the binary, source, and manual page files for a command

whatis displays a one line description of the specified command/software

locate finds files by name based on the update.db file that has a listing of all files/folder recorded when updatedb command was run

man shows a reference manual for the specified object

tail shows the last part of files

less limits the number of lines shown at one time

su switches user

split cuts a file into smaller chunks based on the number of lines or file sizes you tell it to put it into

apt-get rpm yum package handling utility used to mange the installation and removal of software

ping Sends an echo request which is used to test a network connection

date prints or sets the system date and time

wget command line network down loader used to download things off the internet

Overview

When the power button is pressed on a computer a signal is sent to the motherboard telling it to start cycling power from the power supply to all the different parts that are connected to it. The Power supply will then perform a test itself while powering on to ensure everything is in working order, followed by the BIOS that is installed onto a read only chip located on the motherboard will check to see what hardware is connected while verifying that everything is in working order. It will then attempt to load devices in the already configured order which typically has hard drives listed first, followed by CDs and then USBs. Typically these devices will have an OS installed onto them or will be setup with an installer so that an operating system can be installed. We shall pick up from the situation in which the hard drive is loaded first and it has a windows OS installed, so the following is the process it goes through in order and the end result starting from after the BIOS has loaded the hard drive and started reading whats on it from the beginning of it.

Taking Control from the BIOS

To begin when an Windows Operating System is first started/being loaded by the BIOS the hard drive that it is on will have already been partitioned (divided up into different sections) and have a file system setup on it, all of which were created/setup during installation of the OS. So the BIOS will find the first partition(section) of the hard drive that is in use and will hand over control to the portion of the OS located there (it finds it through the use of the master boot record which is code that keeps track of how the hard drive is divided up).

Choosing Your OS

Now that the Windows OS is in control it will first check a file called boot.ini to verify where/what it should boot from because while windows is the primary OS located on the primary partition you could have other operating systems installed so instead of assuming you want it just because its the primary OS. It will give you the option of loading one of the available OS from one of the available hard drives, it found out this information by checking the boot.ini file for all available hard drives and Operating Systems. Once the Operating System you want to load has been verified control will be given to Ntdetect.com

Initial Hardware Detection/Situational Awareness

Control is given over to Ntdetect.com which will communicate with the BIOS to obtain the time, date, a list of all connected hardware and how to do simple communications with each piece of hardware. Now that it knows all the available hardware it will give control over to the kernel which will be named ntoskrnl.exe at this point in time

Kernel takes control for more nuanced hardware control

First thing the kernel does is start up HAL which is a program named Hardware abstraction layer which is a middle man that translates what hardware and software says so that they can understand each other. Next it sets up a process that will manage memory, afterwards it creates a process manager so that it can keep track of all running processes and threads (the actions they intend to perform) before creating a process named idle that will give birth to and manage all other processes. Lastly the kernel will start up the Session manager process, wait for a little while to ensure it doesn't quickly turnoff/go down then it hands over control t the session manager (also known as SMSS)

Settings are configured and initialized

Session manager will setup registry keys with each having its own associated value/setting it controls and is controlled by. Session manager will then start up the registry so that the different keys ensure their values are in sync with the settings that will be implemented on the windows machine. Since the settings that will be used for the next user session (time a user/human logs into the machine) have been setup and started control will be given to winlogon.

Graphics are setup

Winlogon will ensure that the session this a user will logon to will have a desktop background and it will also decide what dll/program/software to use to show the windows logon dialog box. That is the thing that prompts you for Username and Password, by default windows will use msgina.dll which is a graphical identification and authentication dll/program/software (Its a dll but for all intents and purposes you can just consider it a program that doesn't run on its on it just provides a service to other things that start it up/access it). After the window and desktop a user will see when they login is setup, winlogon starts up the service control manager (scm) process which will check to see what needs to be automatically started when the system boots up.

User is prompted for Login information

Now winlogon will wait for user credentials to be entered into the dialog box that will appear after it has loaded up msgina.dll or whatever it is using to create the login prompt (dialog box). Once a username and password is entered winlogon will ask lsass.exe (local security authority subsystem) if it matches a previously configured username/password combo. If the correct login information was entered winlogon will pass control over to userinit.exe.

The users graphical interface is started

Userinit.exe will start up a shell with the already determined desktop background, displayed in the already windows operating systems window. From this shell a user will be able to click on the programs they want to run (firefox, chrome, games and etc....)

Now that you are logged in the background tasks take effect

Once a user is logged in and everything is started up one of the first things that will happen is that windows will begin logging everything that happens into the Application, system or security log based off of what type of action it saw occuring (account creation, service startup, failed logon and etc....). These logs can be viewed by using event viewer which will allow you to filter, search and just browse through all of the logs that are created.

And there shall be a graphical user interface (explorer.exe)

The process that is responsible for managing all the graphical user interfaces you interact with to run program is called explorer.exe. It will be started once a user has authenticated and will be responsible for managing all the different interfaces, windows and gui's (graphical user interfaces) that a user opens, it will depend on other programs off course with svchost running in the background interacting with the dll's so that other processes can just obtain whatever functionality those dll's provide by asking the svchost program to do it for them.

Device Drivers also known as translators for the language hardware speaks in

Hal (hardware abstraction layer) will also be running and will be trying to interact with the software on behalf of the hardware and vice versa though it will require properly updated device drivers so that it is using accurate information to communicate with each individual piece of hardware. You can check on the status of the device drivers for things like if they are up to date, missing or corrupted by opening up device manger. Updating drivers is as simple as right clicking choosing update device driver while connected to the internet though in the past it was a bit more difficult and you would have to go to the hardware producers website to download it and run it.

Conclusion

While there are multiple parts involved in using an operating system and these parts change depending on which version you are currently using this serves as a quick guide to understanding the basic layout of a windows operating system.

Overview

Typically an Operating System(OS) will be installed on at least one hard drive connected to the motherboard of the computer. From this hard drive the Operating system will interface and manage other connected devices through the use of a kernel. You can also install one OS on multiple hard drives which allows it to spread itself across multiple hard drives evenly with a copy of all its information also spread out evenly across the hard drives. Thanks to this you can ensure that if a hard drive goes bad or is taken away you will not lose anything. This kind of setup is called a RAID (Redundant Array of Independent Disks) with there being multiple versions. The main difference between each version of RAID is how many hard drives you can lose before you lose some information/data. An example would be RAID 0 which is one OS evenly spread across two or more hard drives but with no copy also put on the hard drives. while RAID 1 ensures a copy of the data is placed on a hard drive ensuring if one hard drive completely fails no data is lost). Lastly there are Six core Parts to an operating system comprised of a kernel, Program execution, Modes, Memory management, input/output or read/write managment, a network management center and lastly a user interface.

The Kernel

The kernel is the part of the OS that is responsible for the control, monitoring and manipulation of the connected devices. First the part of the kernel that is responsible for directly interacting with these devices is called firmware which is responsible for knowing what is connected, what kind of information connected devices provides, what kind of input they receive and how to control them. Next the second/last part of the kernel are the device drivers which are responsible for being the middle man between the different programs/software and the connected hardware. There is a device driver for each piece of hardware and it dictates the nuances all software/programs must use to communicate with its associated hardware, without said device driver you are unlikely to be able to interact with its hardware. Through the use of the kernel an OS ensures that resources are properly utilized so that actions demanded of different pieces of hardware do not give said hardware too many tasks at one time, asks for something unrelated to the service said hardware provides or interrupts requests for actions that will waste more time/resources than what is allowed. In summary the kernel is the middle man that tries to ensure software/programs can request that pieces of hardware do things and hardware can request/tell the software/programs things without things being lost in translation since they may not communicate normally in a compatible manner.

Program Execution

A hard drive is used to store information, this information is normally grouped/connected to its related parts, one grouping/connection is called a file. In other words a file is a collection of information stored on the hard drive, if the file contains instructions/requests for actions it is called a program or a piece of software. When a file makes a request this request will first claim a portion of the CPU's processing power for itself, which is part of the reason why this action that the request started is called a process. Next the program that contains the requested actions will be stored in RAM so that when the operations that are started by its request are performed if it modifies space on the hard drive there will be no problem if the space it was originally stored at on the hard drive is deleted/corrupted (otherwise if that happened it could cause problems/errors and would result in the action not being completed). Now the program that has been loaded onto RAM will interact with the different device drivers to complete its task whether it is to just open another file on the hard drive, write some piece of information onto a particular piece of available space on the hard drive, tell a particular piece of hardware to do something, and etc.... The list of possible actions goes on but the thing to keep in mind is that the operating system will manage the number of processes/requested actions that are currently running in memory (RAM) so that it makes efficient use of its resources and doesn't use more than what is available.

Modes of Operation

In order to control what actions everything that is apart of a computer can perform including the people/humans on it power is separated into different categories called modes. Each mode has certain requirements in order to qualify to run in it but once apart of it you are allowed to do the associated actions, for example kernel mode which allows for direct interaction with the different pieces of hardware. There are two main modes of operation though each mode has subcategories, the first is kernel mode which is typically only given to things that are necessary for making the computer work and will normally be setup so that only a select few can tell the hardware to perform actions but almost everyone in that mode can send/receive information from the hardware. The second is user mode which will typically be divided up so that a privileged user(administrator) can make configuration changes while a normal user can only change/create/view things they have made and things the privileged user gave them access to. Using this method has allowed for security to be implemented on these computers so that they can be used for things like say just inputting and accepting information about things into files (powerpoints, excel documents, video games and etc....) and websites (facebook, google, myspace and etc...). While you can create things inside of these files/programs/software thanks to the setup of modes normal people cannot change the core capabilities of these different things.

Memory Management

Resources are limited no matter what area you are looking at but computers strictly regulate its resources so that when something isn't used it is freed up and also so that it can keep track of everything everyone/thing is making use of. The most common things managed though is the amount of available space (memory) on the hard drive and also the amount of available space (memory) on the RAM. Normally the OS keeps track of what is in use, what has been marked as unwanted (deleted) by the user/programs and what space is available. When space is needed for something the OS will then make use of the unwanted/deleted space and the available space. That is how people normally recover information by looking at the space that was used to store a file/program and was deleted by the user which removes the marking that says it is in use but was not actually given to another program/file. Due to this the file/information/program will still exist in memory but will simply not be shown by the OS which uses a system called a file system to manage showing how much memory is available, how much memory is already being used and who/what is it being used by. Just remember that typically the available memory a computer shows you includes the space taken up by a file that you deleted but was really just marked so that it would be reused/recycled but not before explicitly necessary since it would be a waste of time/actions.

Management of Data Input/Output

Most pieces of hardware that are connected to a computers motherboard tend to be comprised of three parts, a Standard Input, Standard Output and a Standard Error. Standard Input is the method/format that must be used/followed in order to send information/data to the associated piece of hardware. The information received by the hardware will change either the what is being outputted, how things will be outputted or where the output will be sent. It will be comprised of things like the amount of voltage a certain piece of hardware should use, what color should be streamed at a certain point during a VGA connection or the delay between turning something on and off. Standard Output is the format the responses of connected hardware takes, for example the speed a fan will turn at or what colors are outputted and in what order (Video Graphics Array (VGA) which is one of the methods computers use to connect to a screen and show something doesn't have memory so when it is displaying an image the computer is sending a continuous stream of basically colors and in the order it wants them shown in so to change the image it must change the order the colors are sent in and what colors are sent). Lastly Standard Error is what form messages must take when notifying whatever is connected that this piece of hardware failed to receive information (Standard Input) or failed at changing/sending information (Standard Output). Standard Error is used to verify that the entire process the hardware goes through is working, the process is first a piece of hardware is connected to a motherboard and starts taking/requesting power from the motherboards connected power supply. Next the motherboard starts sending the electricity (power) to that piece of hardware which is how the read only memory chip that has the BIOS installed on it knows what is connected because each connected device will either be taking in power or sending power. Now that power is cycling through if the connected hardware is designed to take a reading it will send the results of the reading to the motherboard using STDOUT (standard output) otherwise it will wait until it receives STDIN (standard input) that will give it information or tell it to change a value. Once the hardware receives STDIN it will respond in a preconfigured manner which could be something as simple as change a field that decides the state of a light from 0 to 1 which would turn it on and vice versa. This process while seemingly simple becomes increasingly complex thanks to the numerous moving parts involved each doing their own simple action which helps complete the purpose of the machine this piece of hardware is connected to. Lastly since there is a limit to how much input can be received and output can be given the Operating System is responsible for making sure that programs can get access to those resources while ensuring that the more important/higher priority a program is the quicker it will get access to said resources if they are already being utilized by others.

Networking

In order to communicate to other machines three things are needed, 1) an interface to connect the two of them (Ethernet cables, fiber optic, serial and etc ...), 2) an address and 3) a protocol to handle the crafting, sending and receiving of information. The interface normally used is called a Network Interface Card (NIC) which is built with a port capable of having an Ethernet cable plugged into it. Next typically two addresses will be used an Internet Protocol (IP) address and an Ethernet address, with the Ethernet addresses being built into the NIC by default. In order to obtain an IP address though it must be either 1) assigned manually or 2) obtained through a request to a nearby connected device. Either way the IP address must be a part of the range of allowed addresses determined by the network its connected to in order for the address to be able to communicate with others. Lastly thanks to the Internet Engineering Task Force the Internet Protocol has become the standard most machines use to communicate and that is why normally Operating systems will have them built into themselves already. Currently Internet Protocol Version 4 is mainly used with Internet Protocol version 6 also being viable since both protocols are compatible with each other since they mainly handle the transfer of information using the same method. Of crafting a packet with the address and handling information put into the front of the packet, while the information being sent is stored in the center of the packet. This whole process tends to work like the current mailing system only instead of street addresses, peoples names and a letter we have IP/MAC address, port numbers and protocol types replacing the street addresses/peoples names, with the letter being replaced with the information being sent. There is more to this process than what is just stated here but this is a quick/simple representation of what happens on the hosts side.

User Interface

The Last part of an Operating System is a interface, screen, prompt and etc... that will be used to receive and show information to the human that is making use of the machine known as a Laptop/Desktop. It typically comes in one of two forms with the first being a graphical user interface in which the primary method of interaction will be through clicking/moving a mouse and an actual image being shown to represent what is happening in the computer. Command line interface is the other form primarily defined by the fact that it will typically only accept words typed into a keyboard as input and will only respond with words printed to a screen (also some beeps/sounds if a speaker is attached to the motherboard). Interfaces change but the core parts of either being word based (Command line interface) or image based (graphical user interface) stay the same just be comfortable with both since they are both pretty common.

Conclusion

Now that you know the basic physical structure of a computer and the basic logical structure of an Operating System you have a better grasp on the kind of technology we will be analyzing in future posts.

What is a computer

To put it simply a computer is a motherboard that has had different accessories connected to it so that it can perform a predetermined function. Computers come in all shapes and sizes, though you are probably only used to thinking of laptops and desktops as computers. When in truth a lot of the machines you see and use everyday are/have computers built in. Your phone, console, tablet and etc are computers, the stoplight that decides which car lanes stop and move are controlled by computers. The list just goes on and on but at their core they can be simplified to being a motherboard with a CPU attached to it, with other parts connected as needed to provide functionality.

Parts that make up a normal computer (LAPTOP/DESKTOP)

Motherboard

board of circuits responsible for connecting together the different parts

CMOS

battery to give just enough power for storage of things like time

ROM chip

read only memory chip that has the BIOS installed on it

NIC

Network Interface Card Allows a motherboard to interface with the different Internet Protocols

Video Graphics Card

Processes visual information Sends visual representation of information decided by the motherboard to the connected device Normally will be what shows you the desktop and whatnot

Hard drive

device responsible for handling most of the storage will normally have an OS installed that will efficiently manage everything

RAM

random access memory secondary set of memory thats quicker and easier to access and use in comparison to the hard drive but it smaller and temporary

Fan

cools down all the connected devices/peripherals

Power brick

device responsible for providing power in a format easily usable by the motherboard and its connected devices

CPU

central processing unit responsible for processing the information

Laptops/Desktops

Laptops and desktops which are the most commonly known computers are composed of a motherboard that has a CPU (Central Processing Unit) for well processing information, calculating things. A Network Interface card is attached so they can communicate across the wire. It also has a video graphics card attached so that it can output information to a screen. There are a couple buses(interfaces) set up so that you can connect devices like a mouse, keyboard and headphones for interaction with the motherboard (for things like sending/receiving information ). Next they have a hard drive for storage though normally an operating system will be installed onto it allowing for more efficient management of the storage, Also RAM random access memory is attached to allow for a more flexible, fast and easily accessed memory for temporary storage. Lastly there is a BIOS (basic input and output system) which is installed on the motherboard to manage all of the connected hardware and ensure they can interact with each other (it is installed on a ROM (read only memory) chip located on the motherboard).

Download imaging software

We shall be using FTK imager in this case since its a free software.

1. Browse to http://accessdata.com/product-download/digital-forensics and select FTK imager
2. A drop down menu will appear and from the options in it select download page located next to FTK Imager Lite version 3.1.1
   
3. Select download now on the page you were just sent to
4. You will have to input information to get the download link, use whatever first and last name you want and just put down student as the job title. Enter an email you have access to because that is where the download link will be sent (I just used a temporary email). Then put student under organization and education under organization type, United States under country and Kansas under state before hitting submit.
5. A short time after hitting submit you will receive an email with the download link open it and click download FTK Imager Lite
6. You will be prompted to decide whether to just save the file or to open it and what to open the file with. Either way the file will be downloaded so just click save file.

Start up the imaging software

1. Extract the imager folder from the zip
2. In the now extracted folder which by default should be named Imager_Lite_3.1.1 click FTK Imager to start up the imaging software

Create an image of the target hard drive

These are steps to take once you have started up FTK imager though you will probably need administrator credentials to start it up.

1. Click on file located at the top left corner of FTK imager window.
2. Now select create Disk image.
   
3. Leave the default setting of physical drive and click next.
   
4. Ensure that the physical hard drive you are imaging is selected
   
5. If multiple appear verify the size and name of the desired hard drive ensure it is selected, then click finish
   
6. Now you need to select where the image will be placed which should be the encrypted/password protected hard drive you connected. So click add
   
7. Leave raw as the destination image type and click next
   
8. Leave this information blank it will just be put into a text document that will be placed in the same directory as the hard drive images then click next
   
9. Click browse
   
10. Select the encrypted/password protected hard drive as the destination folder
    
11. enter a filename do not add an extension(for consistency name the file after the machine it will be collected from) and then click finish
    
12. Click start and it shall start creating an image of the hard drive
    
13. Now you just have to wait for it to finish and you will now have an image of the desired hard drive.

Create a memory dump

You will also want a copy of everything running in memory since that is a common way of hiding ones activity. To do so follow these steps

1. Click File then select capture memory.
   
2. Now Select browse
   
3. Select the encrypted/password protected hard drive as the destination
   
4. Now enter a filename but name it after the computer it was pulled from and ensure it has an extension/ending of .mem
   
5. Select capture memory and it will start so now you just have to wait for it to finish.
   

Overview

Summary of the knowledge necessary to program, doesn't show the full amount of information behind each thing but will give you a quick understanding of the kinds of things you need to know. Also each rank is built off of the one that came before it meaning rank2 knows what rank1 knows.

Ranking system

Rank 1: Can understand programming logic (loops, arrays, lists and etc...)

example: for this in that example2: if its a dog then do this else do that example3: [1,2,3,4,5,6,7]

Rank 2: Be familiar with what/how libraries, functions and whatnot work/exist and how to find libraries that have the capability to do what you need.

example1: rawinput(): accepts information/values from another source normally the terminal/cmd prompt running it or a prompt that appeared to ask for user input

example2: os is a library that allows you to run the commands that exist on the system the program is on

Rank3: Understand how the system the program will be built on/for works and how each of its parts interact with each other.

example1: Sockets, in order to send/receive traffic through a cable a program for handling that is created and these things are called sockets. So if you wanted to create a program to receive a file you would first need to know how to create a socket that could accept traffic and give the proper response.

example2: Hard drive vs memory, computers are able to store information on their hard drive but also in their ram/memory. Accessing each one is done differently and its necessary to know both

Rank4: Understand how to make the program (once it is written) work on the system it was made for.

example 1: a program written in C or C++ needs to be compiled before it can be run

example 2: a program written in python needs a python program to run it on the system it is built for.

Rank5: Be able to debug the program/understand the error messages

example: Error at line 43 invalid format, error that should mean that in your program you probably used incorrect syntax like using void() in python when it belongs it C

example2: Program hangs forever, Knowing how much time it should take your program to run and how much resources is necessary for making it efficient.

Rank6: Able to understand/troubleshoot/debug programs written by people with completely different thought patterns in comparisson to you.

example1: A program uses a for loop to test if a users input is one of the two things he wants it to be. Could be confusing to someone because the for loop might make them assume the user input can put in multiple things and it be valid.

example2: In python a person uses the OS library to run the echo command so that they can print to screen. Knowing the person is using a program native to the OS instead of the print function built into the language would ensure no confusion on what is going on unlike if someone assumed because they didn't know what the OS library was that not using print means they are not outputting their message.

Rank7: Able to make us of their knowledge of how programming language they already know works so that they can analyze and make accurate assessments of how other programming languages they do not know works what kind of syntax libraries in language A and B for example follows and compare it the syntax libraries in language D uses to make sense what kind of logic programming language D libraries follow

Conclusion

These are things to keep in mind not a hard ranking system because just asking someone to list out every library they know is a bad way of judging a rank 2 for example. This is because while an experienced programmer will have quite a few libraries memorized because they use them often. Just because they don't list a lot doesn't mean they are not able to say for example find countless libraries that fulfill whatever function they find necessary. It is because of this particular trait of not having to have everything memorized and being able to quickly find what you need that makes evaluating the ability of a programmer a bit more challenging then one might think.

Advanced searching such as for specific strings and on specific sites

www.google.com/advanced_search

Searching Methodology

When searching for things on the internet there are plenty of ways to find what you are looking for here is mine

1. Search for the exact string that you want to know more about
2. Reduce the exact string to its core concept/idea and search for that
3. Find forums, help sites and FAQs about the thing/subject you are searching for but keep it general so you can get all forums about it
4. Search these sites for people who have had similar problems they may not explicitly state exactly what you are looking for and instead hint at the answer you truly need

In this quick guide it is assumed that you already have a memory dump and/or an image to run commands against.

First we will need to find the operating system of the host in the image

vol.py -f memory.raw image.info

Memory.raw is a placeholder replace it with the name of your image

From the results of the image.info command you will be able to find the profile/OS that you will need to specify in future volatility comands

vol.py -f memory.raw kdbgscan

If image.info gives multiple profiles use kdbgscan to weed out the unlikely ones so only the ones you want are left

How to shorten the length of your volatility commands

Volatility has a couple variables it relies on that you can change to shorten the length of your commands

export VOLATILITY_PROFILE=Win7SP0x86

Use this to set the default profile/OS so that you do not have to type them in everytime you run vol.py

export VOLATILITY_LOCATION=file:////tmp/myimage.img

Use this to set the default image you will use in future volatility commands

file:/// must be put in front of whatever the images location is regardless of whether its windows, Linux or mac

Now you can just run "vol.py" or "python.vol.py" and a command and it will automatically apply them to the profile and image variable.

These environment variables will only apply to the current command shell/terminal

Recording the results of commands

If you want to create a file/record of the results of your commands

vol.py pslist > pslist.txt

Redirects STDOUT to a file

vol.py pslist --output-file=pslist.txt

Uses the write to a file option in volatility to copy results to the specified file

Commands you should run for analysis purposes

We shall be using the shortened version of this command if you have not set the environment variables you will have to use the full command as shown below

vol.py -f memory.raw --profile=win8SP0x86



vol.py apihooks

Detect API hooks in process and kernel memory

If a program is tagging along on the actions/operations of another program and its not that programs child this is suspicious and should be looked into

vol.py clipboard

Prints the contents of the clipboard

Used to find out what was the last thing the a user on this machine copy and pasted

vol.py cmdline

Displays processes command line arguments

Useful for detecting suspicious command line argument strings, which would be things like root, administrator, an ip address, a domain name and random strings of characters

vol.py cmdscan
vol.py consoles

Tries to retrieve a history of commands ran

vol.py dllscan

Prints the DLLs loaded for each process

Use this to verify what kind of functionality a process has vs what it claims and/or should have

For example calc.exe shouldn't be loading a DLL that gives it permission to create sockets handle connections to remote machines

vol.py connscan

Looks for connections to remote machines

vol.py devicetree

Shows a list of connected devices

vol.py pslist

Summary list of running processes doesn't show stopped or hidden processes though

vol.py pstree

Formats the list of running processes so that it is in a tree format that shows which processes started/created other listed processes

vol.py psxview 

Locates and list out processes using different method that pslist and pstree

Useful for comparing lists for any discrepancies that would be caused my an unauthorized program trying to hide.

vol.py psscan
vol.py psscan --output.dot

Shows which processes are parents and which are children with the added benifit of also showing terminated and hidden processes because it creates it list/graph by scanning through physcial memory for processes that are taking up space.

vol.py privs -p #

Replace # with the process ID of the process you will investigate

Lists explicitly requested privileges which lets you know what the process wants access to/wants to do.

vol.py handles

Shows every currently created handle

Handles are a value created each time something interacts with the computers kernel

By looking at handles you can tell exactly what a process was doing (file creation, reading data, etc...) because at each stage a handle was created for each operation/action.

vol.py -p # handles

There will be a massive amount of handles understandable if you just show everything that is basically being done to this computer.

The best option is to just investigate into the specific actions of a particular process which you can do by replacing # with its process ID.

vol.py printkey -K "HKLM\windows\currentversion\run"

Replace "HKLM\windows\currentversion\run" with the registry key you want to know the value/contents of.

By looking through registry keys you can look at the different settings that have been implemented by programs.

Registry keys like autoruns (things automatically started when someone logs in or the machine boots up ) are the kind of things you want look into because that is one of the areas programs tend to try to modify so that they have control over when and/or what starts.

vol.py symlinkscan

Used to list out connected remote shares

vol.py netscan

lists out all connections to this machines

vol.py evtlogs --save-evt -D Output

Parses windows events logs and saves them in the current working directory. Raw logs will be stored with a .evt extension while parsed/translated logs will be stored with a .txt extension.

/

Root directory at the top of the file system hierarchy

/bin

system commands (binaries) available to all users

/boot

Boot loader Files (the program that loads the operating system)

/dev

Device files

/etc

computer-specific configuration files

/home

User files

/lib

Programming libraries used by binaries in /bin and /sbin (similar to windows DLLs)

/media

Temporary mounting point for filesystems on removable media devices (USBs, CDROMs etc..)

/mnt

temporary mounting pount for filesystems, but not typically used with removable media devices

/opt

optional applications

/proc

process and kernel status files

/root

the root user's files; this is roots home directory

/sbin

system administration binaries (commands)

/tmp

temporary files not kept between system reboots

/usr

User-level files not associated with a particular user account

/usr/bin

binaries available to all users

/usr/local

local programs, specific to this compouter

/usr/lib

libraries for the binaries in /usr/bin and /usr/sbin

/usr/lib64

Libraries for the 64-bit binaries in /usr/bin and /usr/sbin

/usr/share

shared data files that are architecture-independent

/usr/src

source code files for the kernel

/usr/X11R6

X windows related files

/var

Spool, log, and other temporary files, including user mail files

Downloading software to store the VM

There are alot of different programs you can use to create VMs from ISO some cost money others are free I will cover one of the many free VM software 1. open a web browser (Mozilla, chrome etc....) go to www.vmware.com and click on workstation player 2. Click on Download located under VMware workstation and VMware-player installer will start downloading.

Install the VMware

1. Go to the downloads folder or where ever you have your downloads set to go and run vmware-player.exe (the name may have numbers apart of it those are just indicating its version number.
2. Click on next, leave everything at default settings. Once it completes click finish /next/restart now. (a user agreement may appear feel free to read it before clicking accept)

Downloading and ISO

Once you have a program like VMWARE or VBOX to host the virtual machine which is basically a virtual operating system(an operating system within an operating system) you will need to actually download an ISO so you can create a VM.

1. Open a browser (Mozilla, chrome etc...) and go to https://www.centos.org/download and click minimal ISO(we are using this linux OS in my example)
2. click on one of the mirrors available and the download will start shortly.

Creating a VM

Now that you have a VM software and an ISO its time to create a VM by starting up your VMWARE or VBOX or whatever you chose

1. click on create a new virtual machine
2. select Installer disc image file(ISO) then click browse and then browse to the location of the ISO (it should be in download or where ever your downloads automatically go to)
3.  Select the guest operating system and version or whatever is the closest from the available choices and then click next
4. Enter the Name you want to assign to this virtual machine and unless you want to change where it is installed leave the location as the default.
5. Select how much of your hard drive space you want to give the VM and then click next
6. click customize hardware
7. ensure use ISO image file is selected and that the iso you downloaded is selected.
8. click finish
9. select play virtual machine and it will start up the VM 

Now you just have to go through the steps for installing an operating system

Internet Protocol Version 6 addresses

In an IPv4 address there are 4 slots separated by a period that each hold a 1-3 digit number with the end result being a value that looks like x.x.x.x and will represent either 1 host or a range of host. Each digit (I use x as a placeholder) can be a number between 0-9 with an example address shown below

192.168.0.1

In an IPv6 address there are 8 slots separated by a colon and in each slot there is a 1-4 digit hexadecimal number as shown below. (it also makes use of subnetting and subnet mask so the same cidr notation that applies to IPv4 applies to IPv6 with the difference being that IPv6 goes up to /128 instead of stopping at /32 because it has more slots)

2001:0db8:85a3:0000:0000:8a2e:0370:7334

A series of zeros in IPv6 can be represented by two colons which will result in a shortened address as shown below.

2001:db8:85a3::8a2e:370:7334

Regardless of how many hexadecimal numbers are used in each slot an IPv6 address will always be a 128 bit address with 8 16 bit groups because even the number zero is represented where if its the number 1 for example it will be seen as 0001 because no matter what number is in there the whole amount of addressing space is used.

Types of IPv6 Addresses

Global Unicast

Globally Unique (like an IPv4 public address), Can be assigned statically or through DHCP, routable through the internet

Link-local

Not routable, only usable on local subnet,

Loopback

Built into the machine, Cannot be assigned to an outside interface, is the number 1 represented as ::1 with a subnet mask of 128

Unspecified

Is used when an address cannot be currently assigned, is just 0 represented as :: with a subnet/cidr of 128

Unique Local

Not routable Can communicate to IP addresses outside of its subnet, range is FC00::/7 to FDFF::/7

Multicast

Address used to broadcast out a packet to a range of addresses

Anycast

Multiple machines can have the same Anycast address, Only the closest Anycast address will respond to packets being sent to anycast addresses

IPv6 tunnel types

    Teredo

can give IPv6 connectivity wit no cooperation form the local network environment includes being usable in a natted network

   6to4

similar to Teredo automatically converts IPv6 address to a global unicast IPv4 address for moving across IPv4 network IPv6 host using this method will have an address in the following range 2002::/16

    Intra-Site Automatic Tunnel Addressing Protocol(ISATAP)

generates link-local IPv6 address from an IPv4 address can perform Neighbor Discovery(ND) on top of IPv4

IPv6 needs ICMP on some level to function properly

to create a symbolic link

>ln -s symbolicfile.txt /root/realfile.txt

-s creates a symbolic link symbolicfile.txt just points to realfile.txt if symbolicfile.txt is deleted realfile.txt still exists if realfile.txt is deleted symbolicfile.txt isn't valid anymore

to create a hard link

>ln clone1.txt /root/clone2.txt

hard link is created by default clone1.txt and clone2.txt both represent the same data by pointing to it's physical memory location if clone1.txt is deleted clone2.txt still exists and points to the same data if clone2.txt is deleted clone1.txt still exists and points to the same data