class notes

Cybersecurity HW-quiz

9.1.26:

enable ssh on your mac

ssh into mac from your pi

ls, pwd, cd, cd ..

sudo nano

ctrl-o, ctrl-x

mkdir

wildcards *

less, more, cat

ctrl-c (cancel)

ctrl-x (halt)

before——————

ifconfig

arp-a

nmap -sn 192.168.8.0/24

whoami

last

history

hw: 9.1.26

network chuck episode #2

challenge:

find the machine named victim on the network
ssh in
list last users and history
show who you are
create a folder on the desktop in your name
create two files: one hidden one visible in that folder with some creative (clean) message
find the folder named herobrine
read the message and leave a message of your own in a new document

next: 9.1.26 bring headphones

linux for hackers ep02

whoami

cat, less, more

dir structure: bin, sbin, usr->bin, sbin, boot, var, tmp, lib, dev (devices)

/home/User

root user separate in /

adduser or useradd

which (shows which one you are using)

sudo nano /etc/interfaces

gpt: “make me a python game”

————ep03

man pages

what is a terminal? vt100? bit bucket? tty?

OS->shell->terminal

bash, zsh, csh (joke)

powershell=windows shell

$ = user

# = root

who vs whami

netstat

ps: process

lsof: open files

man = manual pages, space down

ctrl-c

uname -h for help

apropos usb = keyword search

create python program using ai

solve ssh known_hosts issue

9.3.26

top

htop f9

kill -9

nc -l 1234

scp

sudo apt install

(dpkg next)

pip install xyz --break-system-packages

fastfetch

python3 --version

quiz:

Make sure your laptop is on the elab network for this quiz

You will use the pi for this quiz, and open a text document called "networks" on the desktop with your numbered answers, which you will save on the desktop for me to grade.

Using your pi400 server:

there is an intruder on the cyber5 network, find the IP and MAC address for this intruder
what brand of computer is this?
what “doors” does this intruder have open?
how many computers are on this network: 192.168.5.0/24
what is the usual router for this network?
what would the netmask for this look like?

whoami, who, last, history

DNS and DHCP

nslookup, dig

DHCP leases

basic linux commands:

ctrl-c, z x

pwd, ls, cd

mkdir, sudo nano

ls -la

veda: adev100

leon: 6leon200

tandino: waikii20

rashad: drones34

philip: 99affe

niklas: 99hamburg

ali: scriptkiddie4

8.26.26 homework

what does traceroute measure?
run traceroute to 8.8.8.8 and describe your results

run the following commands and email your results:

ifconfig

route -n get default

ipconfig getifaddr en0

sudo arp-scan --localnet

nmap -sn 192.168.50.0/24 (change to match the network)

scan a target: nmap 192.168.50.20. (change for target)

deeper scan: nmap -sV 192.168.50.20 (change for target)

sudo nmap -O 192.168.50.20

sudo nmap -sS -sV -O 192.168.50.20

Plan: Q1

CIA triad
ethernet cables (the “tubes”)
connection: 8 wires
challenge: connection speed-iperf
compare with fiber, wifi: security, range, speed
homebrew: linux on owner laptops
IPNM: gui tool
terminal: arp -a and nmap -sn 192.168.8.0/24
challenge: find the intruder
nmap solo: ports
challenge: find the doors
network topology: /24 and /16
IP address, gateway, subnet, DNS (more on subnet and DNS next)
MAC address: ID of machine
challenge: ID intruder
OUI lookup: who is on what machine
IPNM: bonjour scan vs address scan (scope)
back to addresses: test at dorm, home
ethernet adapters: usb-c for laptops, home scans on wired network: compare
pi server stations: wifi at first, cyberwifi network (192.168.8.1 with tailscale on glinet)
challenge: ssh into other machines, then change password (share with me)
pi scanning tools, gui?
challenge: scan local wLAN
navigation: network chuck videos (bring headphones)
basic commands: ping, traceroute
navigation: pwd, ls, cd, mkdir, touch, nano, mv, rm
create hidden file
ssh challenge: find the file
navigation: wildcards, up, back, ctrl-c ctrl-z
extended commands: nslookup, dig
DNS and DHCP, test with IPNM
python scripts: http server
setup apache2
setup network: router, inbound port mapping, AP
security: MAC filtering
security: client monitoring
defense: MAC spoofing, arp cache poisoning
defense: tcpdump
defense: wireshark intro-packets
defend your home project: http, ssh, ftp servers
firewalls-intro static rules
SPI firewalls-dynamic rules
IP addresses → MAC addresses → ports → services → scanning → attack surface
TCP/IP conversations
capture, decoding PCAP
locate, watch, attack
simple: DDOS
encryption of traffic
VPN-truly safe?
LAN VPN?
secure web traffic: http vs. https
content filtering: ad blocking (simple)
linux tools: Kali linux
passwords
hashing
parrot OS and Kali
MIM wireless attacks-aircrack-ng
malware-clam AV EICAR
log analysis with parrot os
privacy: VPNs and TOR
social engineering: internal vs. external vulnerabilities
social engineering a scammer: https://www.youtube.com/watch?v=ec57eDghdvM
privacy
SIM swapping: https://www.youtube.com/watch?v=64p_WkYc9d0

Case studies:

physical vulnerability: wifi, ethernet, KB, screenlocks, drives, backups
LAN security: firewalls, SPI, DPI, uPNP internal holes
physical hacking: stuxnet, SCADA
prevention: firewall, air gap, defense in depth
human: Snowden USB, stuxnet
personal: spoofed email, password entropy
OSINT: what is available to whom and why
LLL analysis of three levels: personal, small shop, enterprise
most common attacks: internal vs. external
attack detection: log analysis
cyberlaw: now and future TGC
coding and scripts
setup an ad blocker on rPI
deep fakes: PBS Hany Farid, C2PA certification
cryptocurrency-attacks
iot devices-vulnerabilities
AI enabled attacks

cybersecurity notes 2026 page

cybesecurity is about protecting your house in a dangerous neighborhood

network: cyber

wifi: cyber

pass: goat8grass*

(only works on project room east U6lite AP)

Download and install homebrew:

xcode-select --install

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Download and install IPNetMonitor:

IPNetMonitorX_2.8c1.dmg

install code:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">

<dict>

<key>IPNetMonitorX_key</key>

<key>licensedCopies</key>

<string>Bill Wiecking</string>

<key>notice</key>

<key>organization</key>

</dict>

</plist>

Your neighborhood:

IP address=house address on a street

subnet mask=zip code (segments part of the area geographically)

gateway/router=street to highway

DNS (domain name server)=address directory (inside version and outside version)

ports=doors into your house

Who is in your neighborhood?

join the cyberwifi (goat8grass*)
arp -a (note the space and the “flag”)

http://localhost:1313/documents/cybersecurity-notes-2026/cybersecurity-notes-2026/

class: 8.19.26

quiz:

look at your notes, what was your IP, MAC address, subnet mask, dns server and gateway?
SCADA is both control and data-why?

finish cables-test

1. continuity pass/fail

2. speed

iperf test-speed

repeat to wifi clients-laptops why slower? duplex or simplex?

cyber neighborhood

macs with wifi: join cyber wifi (goat8grass*)
find your IP address (option wifi icon)
terminal
install xcode, homebrew
install IPNM
who is in my neighborhood? arp -a
MAC address and OUI lookup (wireshark page)
nmap -sn 192.168.4.0/24 (flags again, scope notation)
find a random machine, ID by MAC address (mac? pc? vendor?)
nmap 192.168.4.x
look for ports (doors) on the machine

Homework 8.19.26

Look up your IP address and use IP net monitor to run an address scan on your home network

example: IP address is 192.168.1.12

network scan would be 192.168.1.0/24

this scans 254 machines on your net

Repeat using nmap

example: my IP address is 192.168.1.12

nmap -sn 192.168.1./24

You may have to install homebrew on your mac

We will be using your data next week, so let me know if you have issues with this

Follow these up using arp -a and bonjour scan on IP net monitor

email all of your results before our next class

IPNM (phase one)

address scan of the wifi network
bonjour scan (like looking at your neighborhood from a drone)
DHCP test (leads to network setup)
DNS test (leads to nslookup and dig)

pick a pi: This is your server. Keep it alive.

every week we will learn a new attack

This is where you start:

username: pi password: pal82

SSH enabled

HTTP enabled

MQTT enabled

unnecessary service enabled

no firewall

poor permissions

no monitoring

challenge one: who is on my network? (macs: homebrew)

prep: wifi off, LAN on separate network

network scans arp -a nmap -sN 10.14.254.0/16

find host, then nmap host, look for ports

id ports, is it a web server?

can you ssh in?

python script?

IP addresses → MAC addresses → ports → services → scanning → attack surface

hw: scan home wifi using nmap

challenge two: Id the suspect

next: getting out and around

ping, traceroute

wildcards, up, back

ctrl-c ctrl-z

create file: sudo nano, ctrl-o, ctrl-x (exit)

network chuck video?

parts: router-switch-LAN cable, wLAN AP, client

later: DNS-dig and nslookup

syslogd

dhcp

nat

inbound port mapping

Defense:

MAC spoofing

arp cache poisoning

head first networking-pdf