Hack Like a Pro: Networking Basics for the Aspiring Hacker, Part 1

Welcome back, my greenhorn hackers!

As expected with Null Byte's dramatic growth over the last year, we have added many new aspiring hackers who are still lacking in the basics of networking. In addition, with the new "White Hat" certifications coming out shortly, the exam will require some basic networking skills and knowledge to pass.

As a result, I decided to offer my own take on networking basics to make certain that everyone here has these basic skills down, which I consider foundation skills for hacking. In reality, without basic networking and Linux skills, hacking will certainly remain beyond your reach.

I will attempt to address at least one basic networking skill in each of these tutorials. In this one, I want to address some of the basics of IP addresses, NAT, DHCP, and ports.

IP Addresses

Internet Protocol addresses (IP addresses) makes the world go 'round. Or, at least, enable us to email, Skype, and navigate the web. It's almost as important as the world going around!

Each digital device (computer, laptop, phone, tablet, etc.) is assigned an IP address, and this is what enables us to communicate and connect with it. Imagine an IP address as similar to your house address. Without that address, no one could find you and send you snail mail.

The IP address system we are presently using is known as IP version 4, or IPv4 (we'll address the upcoming IPv6 in a coming tutorial). It is made up of 32 bits of four octets, or four groups of 8 bits (on/off switches).

For instance, 192.168.1.101. Each of the numbers between the periods (.) is the decimal equivalent of 8 bits. This means that we calculate the base 2 number that computers use represented by the 8 bits and convert them to decimal numbers that humans are more accustomed to working with (see the diagram below). Each one of the octets (8 bits) is capable of representing numbers within the range 0 through 255 (2 to the 8th power).

Classes of IP Addresses

IP addresses are generally put into three classes, and the ranges are:

• Class A: 0.0.0.0 - 127.255.255.255
• Class B: 128.0.0.0 - 191.255.255.255
• Class C: 192.0.0.0 - 223.255.255.255

In a future tutorial, we will address subnetting and subnet masks that vary with these different IP classes.

Public vs. Private IP Addresses

It's important to note that our IP address system has its limitations. The biggest limitation is that there are not enough IP addresses to cover all of the devices that need to connect to the internet. The IPv4 system that we are working with now has only 4.3 billion IP addresses. With 7.3 billion people on the planet and far more devices, that certainly is not enough.

As a result, a system was developed to reuse a group of IP addresses to be used within a LAN—and are not usable over the internet. These addresses can be used over and over again within each local area network, but not over the internet, thereby conserving the number of IP addresses necessary to keep the world going 'round.

These private addresses include:

• 192.168.0.0 - 192.168.255.255
• 10.0.0.0 - 10.255.255.255
• 172.16-.0.0 - 172.16.255.255

You have probably seen the private IP addresses beginning with 192.168.xxx.xxx or 10.xxx.xxx.xxx on your Kali system when you type ifconfig.

This is your private IP that is only usable on the local area network. To communicate over the internet, it must be translated to a public IP by a NAT device (see NAT below).

DHCP

Dynamic Host Configuration Protocol (DHCP) assigns IP addresses dynamically. This means that you do not have the same IP address all of the time. Most of the time, these IP address assignments are on a local area network. Remember, on LANs we use private IP addresses. When each device is connected to the LAN, it must request an IP address. That device sends that request to the DHCP server that then assigns an IP address to that system for a fixed length of time known as a "lease."

Each time you connect to the LAN, you are likely to receive a different (dynamic) IP address, but usually in the same range. For instance, 192.168.0.0 - 192.168.255.255.

NAT

Network Address Translation (NAT) is protocol whereby internal private IP addresses are "translated" to an external public IP address that can be routed through the internet to its destination. Remember, private IP addresses of the systems inside the LAN cannot use their IP addresses on the internet because they are not unique (every LAN uses basically the same IP addresses inside their network).

The NAT device accepts requests to traverse the internet from an internal machine. It then records that machine's IP address in a table and converts the IP address to the external IP address of the router. When the packet returns from its destination, the NAT device looks into its saved table of the original request and forwards on the packet to the internal IP address of the system that made the original request within the LAN. When working properly, the individual systems and users don't even realize this translation is taking place.

For instance, the diagram above shows two phones with private IP addresses behind a device that is serving as both a NAT device and a router (not uncommon). The devices use their private IP addresses within the LAN, but when they want to communicate over the internet, the NAT device translates it to one of the public IP addresses that are unique on the internet. In this way, the routers along the way know exactly where to send the packets.

Ports

Ports are a kind of subaddress. The IP address is the primary address and the port is the subaddress. Using a well-worn, but effective metaphor, think of the IP address as the street address of a building and then the port as the apartment number. I need the street address to get to the right building, but I need the apartment address to find who I am looking for. This is the same with ports. The IP address gets us to right machine, but the port takes us to correct service, say HTTP on port 80.

There are 65,536 (2 raised to the 16th power) ports. The first 1,024 are generally referred to as the common ports. People obviously don't remember all 65,536 ports (unless they are savant), or even the 1,024 most common ports. As a hacker, security engineer, and/or network engineer, though, there are a few ports that you should know by heart:

• 20 FTP
• 21 FTP
• 22 SSH
• 23 Telnet
• 25 SMTP
• 53 DNS
• 69 TFTP
• 80 HTTP
• 88 Kerberos
• 110 POP3
• 123 NTP
• 135 Microsoft's RPC
• 137-139 Microsoft's NetBIOS
• 143 IMAP
• 161 SNMP
• 389 LDAP
• 443 HTTPS or HTTP over SSL
• 445 SMB
• 500 IKE
• 514 syslog
• 3389 RDP

I will be following up with additional tutorials on networking soon (with topics on subnetting, IPv6, TCP/IP, and more) in the near future, so keep coming back, my greenhorn hackers!