Skip to main content

TcpDump

                                    TcpDump


  • Default scan 
               type tcpdump in terminal

  • Select a interface like lo,wlan0,wlan1,eth0,eth1
                  how to check interface 
                    
                 type ifconfig in kali 
                 type ipconfig in windows

   
         tcpdump -i <interface name>



  • Writing captured packets to file
               tcpdump -i <interface name > -w <filename want to write with .pcap extension>


  • Reading an old tcpdump file or captured file
                    tcpdump -r <captired file>


  • Getting more packets information with readable timestamps
               tcpdump -ttttnnvvS



  • Check packets of whole network
                 tcpdump net 192.168.1.0/24



  • To get packets based on source or destination of an IP address, use

         tcpdump src 192.168.1.100

         tcpdump dst 192.168.1.100


  • Check packets for a protocol or port number
                 


Using AND

               tcpdump src 192.168.1.100 && port 22 -w ssh_packets

  • Scan on specific port 
           tcpdump port 443 or 80 -w http_packets
                             

                                        Most Important
  • filter or extract from packets.


                   tcpdump -r <packet> | grep -v '<which you want to filter >'
                                              
                                       or 
              
                 tcpdump -r <packets> |cut -d <which you want>





                                                                                               Written By Sanjay Kumar
                                  
                                                                                                       https://www.instagram.com/sanjayer111/
                                                                                                       https://www.facebook.com/mang786
                                                                                                      https://www.linkedin.com/in/sanjaykumar111/

Comments

Post a Comment

Popular posts from this blog

exploit rpcbind

                            exploit rpcbind with nfs What is nfs?     Network File System (NFS) is a distributed file system protocol originally developed by Sun Microsystems in 1984,allowing a user on a client computer to access files over a network in a manner similar to how local storage is accessed. NFS, like many other protocols, builds on the Open Network Computing Remote Procedure Call (ONC RPC) system. The Network File System is an open standard defined in RFCs, allowing anyone to implement the protocol. What is rpcbind?     The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts rpcbind on the server with a particular RPC program number. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. Because RPC-based services
Post a Comment
Read more

Exploit and connect to port 512 ,513, and 514

               Exploit and connect to port 512 ,513, and 514 ༄ Unix Basics      TCP ports 512, 513, and 514 are known as "r" services, and have been misconfigured       to allow remote access from any host (a standard ".rhosts + +" situation).       To take advantage of this, make sure the "rsh-client" client is installed (on Ubuntu), and      run the following command as your local root user. If you are prompted for an SSH key,      this means the rsh-client tools have not been installed and Ubuntu is defaulting to       using  SSH. 🔂 Step-1:               First type "nmap -v <victim ip>" 🔄 Step-2:               type "rlogin  -l <user account> <ip address of victim>                                                                          by Er. SANJAY KUMAR                                                                                                            sanjayyadav11210@gmail.com
Post a Comment
Read more

Exploit Smtp service port 25

                          Exploit SMTP service port 25   ✍️ Total 4 Ways we can exploit Smtp service ✍️ Type  -1 --> metasploit step -1 : Type msfconsole in terminal the it will open metasploit step - 2 type - search smtp step  3 : find auxiliary/scanner/smtp/smtp_enum then use it by use command  ex  msf> use auxiliary/scanner/smtp/smtp_enum   step  4 : Show options -- for requirement identity step  5 : set attribute using set command. ex set rhost <rhostip> Step 6 : exploit/run it using exploit command.                                                                             by Er. Sanjay Kumar ✍️ Type  -2 --> smtp-user-enum smtp-user-enum smtp-user-enum is a tool for enumerating OS-level user accounts on Solaris via the SMTP service (sendmail). Enumeration is performed by inspecting the responses to VRFY, EXPN, and RCPT TO commands. It could be adapted to work against other vu
Post a Comment
Read more