Module 1.2: Terminal commands, network scanning

Migration

9.1.26: terminal commands

Reference:

Unmigrated media: Take Control of the Mac Command Line with Terminal (3.4).pdf (application/pdf, 2.2 MB)

We will be using macbook air computers, with OS version 12.7.6 on the elab network wifi. IPNM was version 2.7.3 or 2.8c1

terms and commands to know:

• whoami
  
• last
  
• history
  
• ping
  
• traceroute
  
• ssh
  
• say (mac only)
  
• shutdown -r now
  
• sudo
  
• IPnet monitor
  
• TCPdump
  
• DOS and ddos
  
• flags
  
• ctrl-c and ctrl-z
  
• wifi pulldown on mac to determine network info and signal strength
  

• whoami: who are you logged in progressas. first step in detecting hacking incidents on your computer, the command who does the same thing
  
• last: the last users logged in
  
• history: the last commands that were issued on your computer, good for tracking invasion, but also for recording notes on your work
  
• ping: just like it sounds, sends a small packet (ICMP, more on this later) and records the time in milliseconds to return to you. useful for seeing if a machine at an IP address is active, hidden or far away
• traceroute: traces the path to the website or computer. boring if you are all in the same room, but exciting if you want to know why COD is so slow where you are. it records each step of the path in milliseconds 
• ssh: secure shell, how you get access to the terminal on another machine. in our lab, we all know the login for others' computers, so we can login and look around. this can be used multiple steps, e.g. you can login to John's computer then ssh over to Mary's computer, and Mary will think John is attacking her.
• say: loads of fun, makes the remote computer say what you type. use the -v flag (more on flags next) to change voices
• shutdown: tells the computer to shutdown. useful in the format shutdown -r now, meaning shut the computer down, restart, and do it now. one can also add time like shutdown -r +600 which is ten hours from now, to cover your tracks
• sudo: treat me as "root" or god on the computer for this command. used to do commands that are blocked. really not a good idea to login as root on any computer unless you know what you are doing. it is possible with root access to erase your entire computer, or to create hidden files, cover your tracks, install malware and so on. rootkits are software packages to gain root access on a remote computer, doing these things
• IPnetmonitor: an excellent GUI (graphical user interface) for many of these commands
• TCPdump: a "dump" of all traffic on the network, useful for diagnosing issues, or to see invasions
• DOS: denial of service, sending many pings at once, called a "ping flood attack" overwhelming the remote computer. a dDOS is a distributed attack using many computers at once
• flags: after a command, there is a space, then a hyphen (dash) where one can add a letter to make the command to special things, for example ping -f means run ping and "flood" the victims computer. shutdown -r means reboot after shutting down.
• ctrl-c (stop) and ctrl-z (halt): control-c is a common stop command, or cancel, to halt (less gentle) use ctrl-z
• wifi pulldown menu: shows connection strength (RSSI) and connection speed (RX and TX). useful for diagnosing wireless issues and network status (router, IP address, subnet mask)

---

Migrated from Apple WikiServer Wiki. Original page v94988R.ID: v94988R