Network Security Tools

# Basic port scan
nmap -sV -sC 192.168.1.0/24

# Full port scan with service detection
nmap -sV -sC -p- 203.0.113.50

# Stealth SYN scan (half-open scan, faster)
nmap -sS -T4 -Pn 203.0.113.0/24

# OS detection
nmap -O 203.0.113.50

# Script scanning (vulnerability, exploit, enumeration)
nmap --script vuln 203.0.113.50
nmap --script smb-enum-shares 203.0.113.50
nmap --script http-headers,http-methods,http-title example.com

# Output formats
nmap -oA scan_output 192.168.1.0/24
# Creates: scan_output.nmap, scan_output.gnmap, scan_output.xml

# Capture all traffic on interface
tcpdump -i eth0 -w capture.pcap

# Capture specific port
tcpdump -i eth0 port 443 -w https_traffic.pcap

# Capture traffic from a specific host
tcpdump -i eth0 host 192.168.1.100 -w host_traffic.pcap

# Capture with protocol filter
tcpdump -i eth0 tcp port 80 -w http_traffic.pcap

# Read and analyse a capture
tcpdump -r capture.pcap
tcpdump -r capture.pcap -X  # Show hex and ASCII
tcpdump -r capture.pcap port 53  # Filter DNS queries only
tcpdump -r capture.pcap -c 100  # Show first 100 packets

# Advanced filtering
tcpdump -i eth0 "tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0"
  # ^ Shows only SYN packets (half-open connections)

tcpdump -i eth0 "icmp and src host 10.0.0.5"
  # ^ Shows ICMP from specific source

# Count packets per IP
tcpdump -r capture.pcap | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -nr

# Install Zeek
sudo apt-get install zeek

# Monitor an interface
zeek -i eth0 local

# Zeek log types (automatically generated)
# conn.log — all network connections (source, dest, protocol, duration, bytes)
# http.log — all HTTP requests (method, URI, user-agent, response code, mime type)
# dns.log — all DNS queries (query, answer, query type, response code)
# ssl.log — all TLS handshakes (version, cipher, certificate, SNI)
# files.log — all file transfers (filename, mime type, MD5/SHA1)
# dhcp.log — DHCP assignments (IP to MAC mapping)
# smtp.log — Email traffic metadata
# ftp.log — FTP session details

# Find hosts making DNS queries to newly registered domains
cat dns.log | zeek-cut query answers | sort | uniq -c | sort -nr | head -20

# Find hosts with TLS connections to unusual ports
cat ssl.log | zeek-cut server_name orig_h resp_p | grep -v "443$"

# Find long-duration connections (possible data exfiltration or C2)
cat conn.log | awk '$NF > 3600' | zeek-cut ts id.orig_h id.resp_h proto service duration

# Detect beaconing (periodic C2 communication) using conn.log
cat conn.log | zeek-cut ts id.orig_h id.resp_h | sort | uniq -c | sort -nr

# Find HTTP requests with unusual user agents
cat http.log | zeek-cut ts host uri user_agent | sort -k4 | uniq -c | sort -nr

# Detect DNS queries for algorithmically generated domains (DGA)
cat dns.log | zeek-cut query | grep -E '^[a-z]{10,}\.' | sort -u

# Find SSL certificates from untrusted issuers
cat ssl.log | zeek-cut subject issuer | grep -v "Let's Encrypt" | grep -v "DigiCert"

# Run Suricata in IDS mode
suricata -c /etc/suricata/suricata.yaml -i eth0

# Run Suricata against a pcap file
suricata -c /etc/suricata/suricata.yaml -r capture.pcap

# Check alerts in real-time
tail -f /var/log/suricata/eve.json | jq 'select(.alert != null) | {timestamp, alert}'

# Alert summary
cat /var/log/suricata/eve.json | jq -r 'select(.alert != null) | [.timestamp, .alert.signature, .alert.severity] | @tsv'

# Statistics
cat /var/log/suricata/stats.log | grep -E "decoder|detect"

# Import pcap into Zed
zed ingest capture.pcap

# Query all HTTP POST requests
zed query 'from capture | where http.method == "POST"'

# Find connections to suspicious ports
zed query 'from capture | where id.resp_p == 4444 or id.resp_p == 8443'

# Analyse DNS queries for DGA
zed query 'from capture | dns | count() by query | sort count desc | head 20'