khanfarris

  • protocols
    • ARP
      ARP - Address Resolution Protocol
      Layer: Layer 2 (Data Link)
      Usage: Maps IP addresses to MAC addresses
      Security: No authentication, stateless
      Watch for: ARP spoofing, MITM attacks, ARP cache poisoning, MAC flooding
    • BGP - 179
      BGP - Border Gateway Protocol
      Layer: Application (Layer 7)
      Usage: Routing protocol for internet backbone
      Security: No built-in authentication
      Watch for: Route hijacking, BGP hijacking, prefix hijacking, route leaks
    • DHCP - 67, 68
      DHCP - Dynamic Host Configuration Protocol
      Layer: Application (Layer 7)
      Usage: Automatically assigns IP addresses to devices
      Security: Unauthenticated, vulnerable to spoofing
      Watch for: Rogue DHCP servers, DHCP starvation, IP conflicts
    • DNS - 53
      DNS - Domain Name System
      Layer: Application (Layer 7)
      Usage: Translates domain names to IP addresses
      Security: Unencrypted by default
      Watch for: DNS tunneling, cache poisoning, DDoS amplification, NXDOMAIN attacks
    • FTP - 20, 21
      FTP - File Transfer Protocol
      Layer: Application (Layer 7)
      Usage: File transfers between client and server
      Security: Unencrypted credentials and data
      Watch for: Brute force, credential theft, unauthorized file access
    • HTTP - 80
      HTTP - Hypertext Transfer Protocol
      Layer: Application (Layer 7)
      Usage: Web page communication
      Security: Unencrypted, credentials in plaintext
      Watch for: Credential harvesting, XSS, CSRF, SQL injection, data exfiltration
    • HTTPS - 443
      HTTPS - HTTP Secure
      Layer: Application (Layer 7)
      Usage: Encrypted web communication
      Security: TLS/SSL encrypted
      Watch for: Certificate issues, TLS downgrade, weak ciphers, malware C2
    • ICMP
      ICMP - Internet Control Message Protocol
      Layer: Layer 3 (Network)
      Usage: Error reporting and network diagnostics
      Security: Can be used for reconnaissance
      Watch for: Ping floods, traceroute scans, ICMP tunneling, Smurf attacks
    • IPSec
      IPSec - IP Security
      Layer: Network (Layer 3)
      Usage: Secure IP communications, VPN
      Security: Encrypted IP packets
      Watch for: Weak encryption, IKE protocol vulnerabilities, misconfigurations
    • Kerberos - 88
      Kerberos
      Layer: Application (Layer 7)
      Usage: Network authentication protocol
      Security: Encrypted tickets, time-bound
      Watch for: Golden ticket, silver ticket, Kerberoasting, AS-REP roasting
    • LDAP - 389
      LDAP - Lightweight Directory Access Protocol
      Layer: Application (Layer 7)
      Usage: Directory services, authentication
      Security: Unencrypted by default
      Watch for: Null bind attacks, LDAP injection, credential harvesting, enumeration
    • NAT
      NAT - Network Address Translation
      Layer: Layer 3 (Network)
      Usage: Translates private IPs to public IPs
      Security: Hides internal network structure
      Watch for: NAT bypass attempts, port exhaustion, source IP obfuscation
    • NTLM
      NTLM - NT LAN Manager
      Layer: Application (Layer 7)
      Usage: Windows authentication protocol
      Security: Weak encryption, vulnerable
      Watch for: Pass-the-hash, NTLM relay, credential dumping, hash cracking
    • OSPF
      OSPF - Open Shortest Path First
      Layer: Network (Layer 3)
      Usage: Dynamic routing protocol for IP networks
      Security: Authentication available but often disabled
      Watch for: Route injection, LSA flooding, unauthorized router insertion
    • RDP - 3389
      RDP - Remote Desktop Protocol
      Layer: Application (Layer 7)
      Usage: Remote desktop access
      Security: Targeted by attackers
      Watch for: Brute force, BlueKeep, unauthorized access, lateral movement
    • SMB - 445
      SMB - Server Message Block
      Layer: Application (Layer 7)
      Usage: File sharing, printer access on Windows
      Security: Vulnerable to exploits
      Watch for: EternalBlue, lateral movement, ransomware, null sessions
    • SMTP - 25
      SMTP - Simple Mail Transfer Protocol
      Layer: Application (Layer 7)
      Usage: Email transmission between servers
      Security: Unencrypted by default
      Watch for: Spam, phishing, email spoofing, relay attacks
    • SNMP - 161
      SNMP - Simple Network Management Protocol
      Layer: Application (Layer 7)
      Usage: Network device monitoring and management
      Security: Weak community strings (v1/v2c)
      Watch for: Default community strings, information disclosure, OID enumeration
    • SSH - 22
      SSH - Secure Shell
      Layer: Application (Layer 7)
      Usage: Secure remote administration
      Security: Encrypted, strong authentication
      Watch for: Brute force attacks, key compromise, SSH tunneling abuse
    • STP
      STP - Spanning Tree Protocol
      Layer: Data Link (Layer 2)
      Usage: Prevents network loops in switched networks
      Security: No authentication
      Watch for: Root bridge takeover, BPDU manipulation, DoS attacks
    • TCP
      TCP - Transmission Control Protocol
      Layer: Layer 4 (Transport)
      Usage: Reliable, connection-oriented data transmission
      Security: Connection state tracking
      Watch for: SYN floods, TCP hijacking, port scans, connection exhaustion
    • TLS/SSL
      TLS/SSL - Transport Layer Security
      Layer: Session/Presentation (Layers 5-6)
      Usage: Encrypts application layer protocols
      Security: Encrypted communication
      Watch for: Weak ciphers, certificate validation issues, POODLE, BEAST attacks
    • UDP
      UDP - User Datagram Protocol
      Layer: Layer 4 (Transport)
      Usage: Fast, connectionless data transmission
      Security: No connection state, easily spoofed
      Watch for: UDP floods, DNS amplification, spoofed packets
    • VLAN
      VLAN - Virtual LAN
      Layer: Data Link (Layer 2)
      Usage: Segments network logically
      Security: Logical separation
      Watch for: VLAN hopping, double tagging, unauthorized VLAN access
    • VPN
      VPN - Virtual Private Network
      Layer: Network (Layer 3)
      Usage: Creates secure tunnel over public network
      Security: Encrypted tunnel
      Watch for: Unauthorized VPN access, split tunneling abuse, VPN leaks
© khanfarris
Notes
Enter Password to Save Notes
Incorrect password. Please try again.