# Module 1.2: Terminal commands, network scanning

9.1.26: terminal commands

Reference:

[Download Take Control of the Mac Command Line with Terminal (3.4).pdf (application/pdf, 2.2 MB)](https://bookstack.kamuela.org/attachments/329)

We will be using macbook air computers, with OS version 12.7.6 on the elab network wifi. IPNM was version 2.7.3 or 2.8c1

terms and commands to know:

- <span style="font-size: 13px;">whoami</span>
- <span style="font-size: 13px;">last</span>
- <span style="font-size: 13px;">history</span>
- <span style="font-size: 13px;">ping</span>
- <span style="font-size: 13px;">traceroute</span>
- <span style="font-size: 13px;">ssh</span>
- <span style="font-size: 13px;">say (mac only)</span>
- <span style="font-size: 13px;">shutdown -r now</span>
- <span style="font-size: 13px;">sudo</span>
- <span style="font-size: 13px;">IPnet monitor</span>
- <span style="font-size: 13px;">TCPdump</span>
- <span style="font-size: 13px;">DOS and ddos</span>
- <span style="font-size: 13px;">flags</span>
- <span style="font-size: 13px;">ctrl-c and ctrl-z</span>
- <span style="font-size: 13px;">wifi pulldown on mac to determine network info and signal strength</span>

- whoami: who are you logged in as. first step in detecting hacking incidents on your computer, the command who does the same thing
- last: the last users logged in
- history: the last commands that were issued on your computer, good for tracking invasion, but also for recording notes on your work
- ping: just like it sounds, sends a small packet (ICMP, more on this later) and records the time in milliseconds to return to you. useful for seeing if a machine at an IP address is active, hidden or far away
- traceroute: traces the path to the website or computer. boring if you are all in the same room, but exciting if you want to know why COD is so slow where you are. it records each step of the path in milliseconds
- ssh: secure shell, how you get access to the terminal on another machine. in our lab, we all know the login for others' computers, so we can login and look around. this can be used multiple steps, e.g. you can login to John's computer then ssh over to Mary's computer, and Mary will think John is attacking her.
- say: loads of fun, makes the remote computer say what you type. use the -v flag (more on flags next) to change voices
- shutdown: tells the computer to shutdown. useful in the format shutdown -r now, meaning shut the computer down, restart, and do it now. one can also add time like shutdown -r +600 which is ten hours from now, to cover your tracks
- sudo: treat me as "root" or god on the computer for this command. used to do commands that are blocked. really not a good idea to login as root on any computer unless you know what you are doing. it is possible with root access to erase your entire computer, or to create hidden files, cover your tracks, install malware and so on. rootkits are software packages to gain root access on a remote computer, doing these things
- IPnetmonitor: an excellent GUI (graphical user interface) for many of these commands
- TCPdump: a "dump" of all traffic on the network, useful for diagnosing issues, or to see invasions
- DOS: denial of service, sending many pings at once, called a "ping flood attack" overwhelming the remote computer. a dDOS is a distributed attack using many computers at once
- flags: after a command, there is a space, then a hyphen (dash) where one can add a letter to make the command to special things, for example ping -f means run ping and "flood" the victims computer. shutdown -r means reboot after shutting down.
- ctrl-c (stop) and ctrl-z (halt): control-c is a common stop command, or cancel, to halt (less gentle) use ctrl-z
- wifi pulldown menu: shows connection strength (RSSI) and connection speed (RX and TX). useful for diagnosing wireless issues and network status (router, IP address, subnet mask)

<div id="bkmrk--4">  
</div><div id="bkmrk-next%3A%C2%A0"><span style="font-weight: bold;">Next</span>: </div><div id="bkmrk-netstat">netstat</div><div id="bkmrk-nmap">nmap</div><div id="bkmrk-lsof">lsof</div><div id="bkmrk-port-mapping">port mapping</div><div id="bkmrk-network-scanning%C2%A0">network scanning </div><div id="bkmrk-protocols-%28icmp%2C-tcp">protocols (ICMP, TCP and IP) </div><div id="bkmrk-rootkits">rootkits</div><div id="bkmrk-file-structure-%28ls%2C-"><span style="font-size: 13px;">file structure (ls, cd, pwd)</span></div><div id="bkmrk-brew"><span style="font-size: 13px;">brew</span></div><div id="bkmrk-wild-cards"><span style="font-size: 13px;">wild cards</span></div><div id="bkmrk-man-pages%C2%A0"><span style="font-size: 13px;">man pages </span></div><div id="bkmrk-top%C2%A0"><span style="font-size: 13px;">top </span></div><div id="bkmrk-ls--la"><span style="font-size: 13px;">ls -la</span></div><div id="bkmrk-hidden-files"><span style="font-size: 13px;">hidden files</span></div><div id="bkmrk-cd-..%2C-mkdir"><span style="font-size: 13px;">cd .., mkdir</span></div><div id="bkmrk-chmod"><span style="font-size: 13px;">chmod</span></div><div id="bkmrk-finding-files"><span style="font-size: 13px;">finding files</span></div><div id="bkmrk-networks"><span style="font-size: 13px;">networks</span></div><div id="bkmrk-html"><span style="font-size: 13px;">html</span></div><div id="bkmrk-open-and-closed-web-"><span style="font-size: 13px;">open and closed web pages ssl</span></div><div id="bkmrk-ifconfig"><span style="font-size: 13px;">ifconfig</span></div><div id="bkmrk-routers-and-gateways"><span style="font-size: 13px;">routers and gateways</span></div><div id="bkmrk-wifi-sniffing"><span style="font-size: 13px;">wifi sniffing</span></div><div id="bkmrk-wired-sniffing"><span style="font-size: 13px;">wired sniffing</span></div><div id="bkmrk-mim-attacks"><span style="font-size: 13px;">MiM attacks</span></div><div id="bkmrk-nslookup-and-dns"><span style="font-size: 13px;">nslookup and dns</span></div><div id="bkmrk-pi-setup-attack-defe"><span style="font-size: 13px;">pi setup attack-defend</span>  
</div><div id="bkmrk-kali-linux"><span style="font-size: 13px;">Kali linux</span></div><div id="bkmrk-pentesting"><span style="font-size: 13px;">pentesting</span></div><div id="bkmrk-wireshark"><span style="font-size: 13px;">wireshark</span>  
</div><div id="bkmrk--5">  
</div><div id="bkmrk-network-scanning%3A-nm">Network scanning: nmap arp-scan and IPNM (GUI)</div><div id="bkmrk-may-need-to-install-">May need to install homebrew to run some of these</div><div id="bkmrk-%2Fbin%2Fbash--c-%22%24%28curl">/bin/bash -c "$(curl -fsSL [https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh](https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh))"  
</div><div id="bkmrk-nmap--v--sn-10.14.25">nmap -v -sn 10.14.253.0/24</div><div id="bkmrk-arp-scan-10.14.253.0">arp-scan 10.14.253.0/24  (use sudo)</div><div id="bkmrk--6">  
</div><div id="bkmrk-advanced-tools%3A"><span style="font-weight: bold;">Advanced tools:</span></div><div id="bkmrk-netstat%2C-tcpdump%2C-if">netstat, tcpdump, iftop, netcat, dig, nslookup, hping3, lsof, wireshark (GUI)</div><div id="bkmrk--7">  
</div><div id="bkmrk-fun-challenges%3A1.-sc"><div>Fun challenges:  
1. scan our local network, find one of our laptops, remote login  
2. make the laptop say something  
3. show that you are logged into the computer from their terminal</div><div>4. remotely reboot their computer (with permission)</div><div>  
</div><div>8.19.25:

- resources, icloud, apps
- nmap and arp-scan from terminal (using brew)
- wireshark demo
- FTP password demo using tcpdump -i en0 port 21 (setup server on victim machine)
- wireshark demo using web traffic
- nslookup demo
- subnets and IP addresses
- 10.14.253.0/24 network
- NAT for internal servers (e.g. home)
- DNS and dig

<div>8.21.25:</div><div>port scan</div><div>service ports: </div><div>21 FTP (file transfer protocol)</div><div>22 ssh (secure shell)</div><div>80 http (web)</div><div>138 smb (windows file sharing)</div><div>443 https (secure web)</div><div>82 (web alternate)</div><div>8080 (web proxy)</div><div>  
</div><div>ARIN.net and nslookup</div><div>stealth mode on macs</div><div>ping proof</div><div>email headers-find sender</div><div>browser tracking-disable</div><div>  
</div><div>8.26.25</div><div>pwd: where am I?</div><div>ls: list the files where I am</div><div>cd: change my directory</div><div>  
</div><div><span style="font-weight: bold;">IP Net monitor:</span></div><div>address scan: 10.14.253.0/24 in the elab</div><div>bonjour scan: printers</div><div>connections: watch what your computer is connecting to</div><div>DHCP lease: when you got an address, when it expires</div><div>DHCP test: test the local server for speed, and if there is a rogue server present (2 will show up)</div><div>DNS lookup: names to numbers, you can specify which server is answering, internal or external </div><div>Interface info: useful for detecting errors or collisions</div><div>Link rate: test link speed to a server</div><div>Ping: like it sounds, link to a device</div><div>Port scan: scanning for ports or "doors" on a host</div><div>Subnet calc: really useful in setting up addresses on a network</div><div>TCPdump: dumps entire conversation into your computer</div><div>TCP info: useful for setting up your web servers</div><div>Traceroute: traces the path to a server</div></div></div><div id="bkmrk-cb52f155-5158-5158-1">  
<div class="block-placeholder">cb52f155-5158-5158-1f64-f762f81e63a3</div></div>---

<small>Migrated from Apple Server Wiki. Original page ID: v94988R</small>