SYO-601 Tools and Utilities

Netcat (the nc command) is a tool available on both Linux and Windows machines that can provide multiple facets of information on a network.

port scanning/listening
banner grabbing
creation of a local or remote shell for file transfers
raw connections
web interactions.

Type: Diagnostic tool.

route-tracing commands that provide the executor of the command the path the traffic takes through a system, including the IP addresses of each hop in a path.

The ‘tracert’ command is used on Windows machines and sends Internet Control Message Protocol (ICMP) packets to each stop along the path, reporting results.

The traceroute command is used with Linux machines and uses User Datagram Protocol (UDP) packets to perform the same function.

Domain Information Groper (Linux).
Nslooup (windows...but also linux).

Type: DNS utility.

Function: Queries DNS servers for domain information.

Usage: DNS troubleshooting, obtaining IP addresses.

Example: dig example.com to query DNS information for example.com.

Type: Network scanning tool.

Function: Scans networks to discover hosts and services.

Usage: Port scanning, vulnerability assessment.

Example: nmap -sS <target> for TCP SYN scan.

Type: Network protocol analyzer.

Function: Captures and analyzes network packets.

Usage: Troubleshooting network issues, analyzing network traffic.

Example: Analyzing captured packets for protocol errors.

Linux and Windows

network statistics and state for TCP.

routing tables

state of local and remote address of the connection.

Type: Penetration testing framework.

Function: Exploits security vulnerabilities in systems.

Usage: Security testing, vulnerability assessment.

Example: Using Metasploit modules to exploit known vulnerabilities.

Type: Logging protocol.

Function: Collects and forwards log messages.

Usage: Centralized logging, security event monitoring.

Example: Configuring devices to send syslog messages to a central server.

Ping and pathping commands identify whether a system is on and the latency of the system response.

Ping command sends an ICMP echo request packet to the target systems and records response time.

Pathping command also uses ICMP echo request packets, but it sends multiple packets of a duration of time to gather additional information on the system’s response.

Ping = Windows and Linux machines
Pathping = Windows

Windows and Linux

The hping command is a TCP/IP packet analyzer tool.

Custom packet.
Spoof sender IP.

Windows and Linux

Used for modifying and displaying information about a system’s routing tables.

TheHarvester is an open-source information-gathering tool that can be used on both Linux and Windows machines.

TheHarvester gathers information on a target, such as email addresses, domains, subdomains, and open ports, from public sources like search engines, public servers, and social media sites.

It's an information-gathering tool.

Combines multiple tools into one platform.

Reconnaissance tools, port scanning, network mapping.

Automates penetration testing.

Efficient and comprehensive security assessments.

Windows and Linux

Designed to leverage outside port scanners for network information.

Similar to Nmap but from an outside-the-network perspective.

DNSenum is used for finding DNS servers and domain entries.

DNSenum has the added functionality of being able to target a specific DNS server and is used primarily on Linux machines.

Windows and Linux

Performs tasks similar to Nmap and more.

Identifies open ports, protocols, and vulnerabilities.

Provides detailed vulnerability assessments (unlike nmap).

Offers recommendations for addressing vulnerabilities.

Windows and Linux

Cuckoo (or Cuckoo Sandbox) is a tool used for the automation of malware analysis in a contained environment.

Once malware is identified on a Cuckoo-enabled system, Cuckoo automatically analyzes the threat and reports its findings.

Windows and Linux.

Used to search for a specified pattern, such as text or expressions, within files.

The grep command can be combined with flags to pull specific information from files as well as a set amount of lines surrounding the text string.

Windows and Linux.

Adds information to syslog

Linux

replay collected packet captures.

commonly used to test security devices to see if security triggers are activated.

Linux

Creates (copies) images of data.

Combined with if for input location and of for output location.

Ensures data integrity by adding a hash to the dd command.

Linux

Captures the physical Linux memory via the command line and dumps it into the standard output stream (outputs on the display).

Windows

Disk editing tool that provides the ability to view disk data in hexadecimal format as well as search, view, and edit the pulled data.

WinHex can also provide cloning capabilities and secure wipes.

Third-party forensic image creation tool that is compatible with multiple forensic formats, such as raw (DD) formats, to allow for that information to be used across multiple forensic platforms for analysis.

FTK Imager supports physical and logical drives, image files, folders, and CD/DVD volumes, among others.

Windows and Linux.

A digital forensics tool that provides information on data contained in a storage device or image file through a GUI.

Autopsy also has the ability to recover and view data