Networking & Linux Fluency

You do not need academic OSI trivia; you need a working stack model. Link layer gets frames to neighbors (ARP on Ethernet). IP routes packets between networks. Transport (TCP/UDP) demultiplexes to ports. Application protocols (HTTP, SMB, DNS) ride above that. Every tool you use lives at one or more of these layers, and mis-layering is why beginners misread results.

An “open port” means a process is accepting connections on that transport endpoint from your vantage point — not that the service is vulnerable, not that the same port is open from the internet, and not that the banner is truthful. Always ask: open for whom, from where, with what middleboxes in the path?

IPv4 still dominates most labs and many enterprise estates; IPv6 is increasingly present and often under-monitored. Dual-stack hosts may expose different services on different families. Include both in mental models early so you do not invent a false sense of completeness from an IPv4-only scan.

TCP connects with SYN → SYN-ACK → ACK. Half-open behavior, RSTs, and silence are the raw signals behind SYN scans, connect scans, and filtered classifications. A listening socket that answers SYN-ACK is open from your perspective; a RST usually means closed; silence often means filtered (or loss, or rate limiting).

Common states you will see with ss or netstat: LISTEN (service waiting), ESTABLISHED (active session), TIME-WAIT (recently closed), SYN-RECV (half-open). Attackers abuse half-open floods in the real world; defenders watch for them. As a tester you use the same signals carefully and only with authorization.

UDP has no handshake. “Open|filtered” is common because lack of response is ambiguous. ICMP port unreachable can mean closed; silence might mean open, filtered, or dropped. Plan extra time and application-level probes (DNS query, SNMP, etc.) when UDP matters.

Host discovery answers “is anything here?” using ICMP echo, ARP (local segment), TCP SYN/ACK to common ports, or other probes. Port scanning assumes a host is worth deeper work and maps transport endpoints. Collapsing both into one loud -A against a /16 is how you miss hosts and annoy defenders.

On a local L2 segment, ARP-based discovery is often more reliable than ICMP. Across routed networks, ICMP may be blocked while TCP/80 and TCP/443 still answer. Professionals choose discovery based on network position and observed policy, not a single default template.

Only scan addresses you are authorized to touch. In labs, document the exact subnet. In client work, use the scope file as -iL input and treat discovery results that fall outside scope as inventory questions for the client, not free targets.

Scan results are always relative to your network position. A host “filtered” from the internet may be wide open on a VPN, partner link, or internal VLAN. Conversely, internal scans may show services that internet scanners never see. Report both the finding and the vantage point.

Drop vs reject changes what you observe. Drop (silent) produces filtered-looking results and slows scanners that wait for timeouts. Reject (RST or ICMP) fails fast. Stateful firewalls may allow established return traffic only; your outbound SYN from an unexpected source network can look very different from a user on the corporate LAN.

NAT and load balancers further distort the picture: one public IP may hide many backends; one backend may appear under many names. DNS, certificates, and HTTP Host headers become part of network truth, not just “application stuff.”

DNS turns human names into addresses and often leaks inventory through zone transfers (rare but high impact when allowed), subdomain naming patterns, and public records. Learn dig/nslookup for A/AAAA/MX/TXT/NS/CNAME and for tracing resolution paths. Broken or stale DNS is both an ops problem and a recon gift.

HTTP(S) dominates external attack surface. SMB and LDAP dominate many internal Windows estates. SSH, RDP, databases, and management interfaces matter when exposed. Your protocol priorities should follow engagement type (external web vs internal AD), not a generic port-order superstition.

Practice reading packets while you generate them. Capture an Nmap SYN scan and a curl to HTTPS. Identify Ethernet, IP, TCP, and — where not encrypted — application data. Encryption hides payloads but not the fact of connections, SNI in many setups, and timing. That dual view is what separates flag memorization from fluency.

In your host-only lab, assign static IPs, run a simple listener (nc -lvnp 4444 or a web server), and scan it from the attacker VM. Change firewall rules on the target (iptables/nftables or host firewall) between drop and reject and re-scan. Record how Nmap classifications change.

Use tcpdump -i any -nn host TARGET and Wireshark display filters such as tcp.flags.syn==1 to isolate handshake behavior. Correlate ss -lntp on the target with what the scanner claims. When they disagree, you have found a middlebox, wrong interface, or wrong address family — a professional learning moment.

Build a one-page personal reference: discovery options by position, TCP vs UDP caveats, and “open/closed/filtered means…”. Update it after every lab surprise. This sheet will outlive any single tool version.

Professional operators live in a shell on Linux (or WSL/remote SSH). You need comfortable navigation (cd, ls, find, locate), inspection (file, stat, less, head, tail -f), and editing (nano or vim basics). Muscle memory here multiplies every later module.

Know where things live: /etc for configuration, /var/log for logs, /proc and /sys for kernel-exported state, /home and /opt for user and third-party tools, /tmp for ephemeral scratch (and a place attackers abuse). On target systems later, the same map drives enumeration.

Use man pages and --help deliberately. Memorizing every flag is less valuable than knowing how to learn a flag under pressure. Keep a personal cheatsheet of the twenty commands you actually use weekly.

Every file has owner user, group, and mode bits (rwx for user/group/other). Directories use execute to mean “traverse.” Misread permissions cause failed tools and missed privilege-escalation paths. Practice reading ls -l and interpreting numeric modes (e.g., 755, 640).

SUID/SGID binaries run with elevated identity — a classic privesc class when misconfigured. Linux capabilities fine-tune privileges beyond all-or-nothing root. You do not need full exploitation skill yet, but you must understand that “who runs this process” and “what file can it touch” are first-class questions.

sudo is policy, not magic. Read sudo -l in labs (authorized targets only) and understand that broad sudo ALL is high risk. On your attacker VM, use a normal user for daily work and escalate only when needed; operating as root for browser and notes is a bad habit.

ps, top/htop, and systemctl status tell you what is running. ss -lntp (or netstat) shows listening sockets and owning PIDs. Correlating a port to a binary is daily work in both offense and defense.

Logs matter: journalctl -u service, /var/log/auth.log or secure, application logs under /var/log. As an attacker in post-exploitation you will read them; as a careful lab operator you will watch them when something breaks.

Package managers (apt, dnf, pacman depending on distro) keep tools current. Prefer distro packages or documented install paths over random curl|bash from untrusted blogs. Pin versions when a lab requires reproducibility.

Labs fail in different ways: no SCP, broken GUI, limited tools on target. Practice multiple transfer methods on systems you own: scp/sftp, python3 -m http.server, nc, curl/wget, base64 paste for small files. Knowing three paths prevents dead ends.

ssh is your remote shell; keys beat passwords. Understand ~/.ssh/config host aliases, StrictHostKeyChecking for labs vs production caution, and why agent forwarding can be dangerous on untrusted jumps.

netcat remains a Swiss army knife for listeners, simple transfers, and banner grabs. Prefer ncat or traditional nc consciously; flags differ across implementations. Document which binary your distro provides.

Recon and scanning produce text. Experts pipe: sort -u, grep -E, cut, awk, sed, xargs, tee, and jq for JSON. Tools like anew help append only new lines to growing wordlists and host lists. Your goal is reproducible transforms, not one-off GUI clicks you cannot repeat in a report.

Write small bash loops for authorized lab ranges: while reading hosts from a file, run a safe check, tee results. Always test loops on one IP before launching against a list. A typo in a loop is how scope accidents happen.

OverTheWire Bandit (and similar wargames) compress months of shell pain into structured levels. If pipelines feel slow, invest evenings there before chasing exotic exploits. Shell skill compounds forever.

Keep engagement directories clean, use version-controlled personal scripts carefully (no client data in public git), and separate tool configs from loot. Encrypt disks if the laptop leaves home.

Update consciously: full upgrades mid-engagement can break a working toolset; snapshot or note versions. In labs, rebuild from golden images when the attacker VM becomes a junk drawer.

Python and bash are enough to glue workflows. Learn to read simple scripts others publish before executing them. Treat unknown offensive scripts as untrusted code — because they are.

An HTTP request has a method and path (and optional query string), headers, and sometimes a body. A response has a status code, headers, and body. If you cannot draw that on a whiteboard, web testing will feel like magic no matter how many scanner plugins you install.

Methods carry intent: GET for retrieval (should be safe/idempotent in well-behaved apps), POST for actions and bodies, PUT/PATCH/DELETE in APIs, OPTIONS for CORS preflight. Real apps misuse methods; do not assume compliance — observe behavior.

Headers are a goldmine: Host, User-Agent, Cookie, Authorization, Content-Type, Origin, Referer, X-Forwarded-For (sometimes trusted naively). Learn to read them before you automate changing them.

HTTPS encrypts HTTP over TLS. As a tester you still see endpoints, certificates, redirects, and often SNI. Certificate names feed recon; weak TLS configs can be findings; mixed content and cookie Secure flags matter.

Virtual hosts mean one IP can serve many sites. The Host header (and SNI) selects which site you hit. Content discovery and routing bugs often depend on sending the right Host value. Your mental model must include name-based routing, not only IP:port.

Use curl -v and curl -k carefully in labs. Verbose mode teaches handshake and header flow. In professional work, respect scope and avoid needless certificate validation bypasses against production without reason.

Most apps track logged-in state with cookies or bearer tokens. Cookie flags (HttpOnly, Secure, SameSite) and scope (Domain/Path) affect theft and CSRF risk. Session fixation, weak session IDs, and missing invalidation on logout are classic issues.

JWT and similar tokens appear in Authorization headers or cookies. At this stage, understand structure (header.payload.signature), that payloads are readable (Base64), and that “algorithm none” and weak secrets are classes you will test later — not that you should attack random sites.

Authorization is not authentication. Logging in as user A and accessing user B’s object (IDOR) is often higher real-world impact than a flashy XSS on a marketing page. Train yourself to watch object IDs and role boundaries early.

Burp Suite, OWASP ZAP, mitmproxy, and similar tools sit between browser and server. You configure the browser (or system) proxy, trust the lab CA, and intercept. The goal is visibility and controlled modification — not blind autopilot scanning on day one.

Repeater (or equivalent) is where understanding happens: send one request, change one variable, observe. Intruder/fuzzing comes after you have a hypothesis. History and site maps become part of your evidence pack — export them into engagement folders.

Scope the proxy to in-lab or in-engagement hosts so you do not accidentally send personal traffic through an intercepting stack or attack the wrong host. Disable intercept when navigating complex flows so you do not fight your own tool.

Status codes tell stories: 401 vs 403, 302 login redirects, 500 stack traces, 200 on “not found” soft pages that break content discovery filters. Never trust a single code without body context.

Caching and CDNs can serve different content by cookie, country, or header. CORS policy governs browser cross-origin reads; misconfiguration can leak authenticated responses to evil origins. You will test these deeply in web modules — learn the vocabulary now.

Postman and curl remain valuable for API work without a full browser. Build a small collection of lab API calls with saved tokens. Prefer replaying captured legitimate requests over inventing shapes that the app never uses.