TryHackMe

Offensive Security
Offensive security focuses on one thing: breaking into systems. Breaking into systems
might be achieved through exploiting bugs, abusing insecure setups, and taking
advantage of unenforced access control policies, among other things. Red teams and
penetration testers specialize in offensive security.

Defensive Security

Defensive security is somewhat the opposite of offensive security, as it is concerned

with two main tasks:
1. Preventing intrusions from occurring
2. Detecting intrusions when they occur and responding properly
Blue teams are part of the defensive security landscape.

Some of the tasks that are related to defensive security include:

 User cyber security awareness: Training users about cyber security helps
protect against various attacks that target their systems.
 Documenting and managing assets: We need to know the types of systems
and devices that we have to manage and protect properly.
 Updating and patching systems: Ensuring that computers, servers, and
network devices are correctly updated and patched against any known
vulnerability (weakness).
 Setting up preventative security devices: firewall and intrusion prevention
systems (IPS) are critical components of preventative security. Firewalls
control what network traffic can go inside and what can leave the system or
network. IPS blocks any network traffic that matches present rules and attack
signatures.
 Setting up logging and monitoring devices: Without proper logging and
monitoring of the network, it won’t be possible to detect malicious activities
 and intrusions. If a new unauthorized device appears on our network, we
should be able to know.
In this task, we will cover two main topics related to defensive security:
 Security Operations Center (SOC), where we cover Threat Intelligence
 Digital Forensics and Incident Response (DFIR), where we also cover Malware
Analysis
Security Operations Center (SOC)
A Security Operations Center (SOC) is a team of cyber security professionals that
monitors the network and its systems to detect malicious cyber security events. Some
of the main areas of interest for a SOC are:
 Vulnerabilities: Whenever a system vulnerability (weakness) is discovered, it is
essential to fix it by installing a proper update or patch. When a fix is not
available, the necessary measures should be taken to prevent an attacker from
exploiting it. Although remediating vulnerabilities is of vital interest to a SOC,
it is not necessarily assigned to them.
 Policy violations: We can think of a security policy as a set of rules required for
the protection of the network and systems. For example, it might be a policy
violation if users start uploading confidential company data to an online
storage service.
 Unauthorized activity: Consider the case where a user’s login name and
password are stolen, and the attacker uses them to log into the network.
A SOC needs to detect such an event and block it as soon as possible before
further damage is done.
 Network intrusions: No matter how good your security is, there is always a
chance for an intrusion. An intrusion can occur when a user clicks on a
malicious link or when an attacker exploits a public server. Either way, when an
intrusion occurs, we must detect it as soon as possible to prevent further
damage.
Security operations cover various tasks to ensure protection; one such task is threat
intelligence.

Threat Intelligence
In this context, intelligence refers to information you gather about actual and potential
enemies. A threat is any action that can disrupt or adversely affect a system. Threat
intelligence aims to gather information to help the company better prepare against
potential adversaries. The purpose would be to achieve a threat-informed defense.
Different companies have different adversaries. Some adversaries might seek to steal
customer data from a mobile operator; however, other adversaries are interested in
halting the production in a petroleum refinery. Example adversaries include a nation-
state cyber army working for political reasons and a ransomware group acting for
financial purposes. Based on the company (target), we can expect adversaries.

Intelligence needs data. Data has to be collected, processed, and analyzed. Data
collection is done from local sources such as network logs and public sources such as
forums. Processing of data aims to arrange them into a format suitable for analysis.
The analysis phase seeks to find more information about the attackers and their
motives; moreover, it aims to create a list of recommendations and actionable steps.
Learning about your adversaries allows you to know their tactics, techniques, and
procedures. As a result of threat intelligence, we identify the threat actor (adversary),
predict their activity, and consequently, we will be able to mitigate their attacks and
prepare a response strategy.
Digital Forensics and Incident Response (DFIR)
This section is about Digital Forensics and Incident Response (DFIR), and we will cover:
 Digital Forensics
 Incident Response
 Malware Analysis
Digital Forensics
Forensics is the application of science to investigate crimes and establish facts. With
the use and spread of digital systems, such as computers and smartphones, a new
branch of forensics was born to investigate related crimes: computer forensics, which
later evolved into, digital forensics.
In defensive security, the focus of digital forensics shifts to analyzing evidence of an
attack and its perpetrators and other areas such as intellectual property theft, cyber
espionage, and possession of unauthorized content. Consequently, digital forensics
will focus on different areas such as:
 File System: Analyzing a digital forensics image (low-level copy) of a system’s
storage reveals much information, such as installed programs, created files,
partially overwritten files, and deleted files.
 System memory: If the attacker is running their malicious program in memory
without saving it to the disk, taking a forensic image (low-level copy) of the
system memory is the best way to analyze its contents and learn about the
attack.
 System logs: Each client and server computer maintains different log files
about what is happening. Log files provide plenty of information about what
 happened on a system. Some traces will be left even if the attacker tries to
clear their traces.
 Network logs: Logs of the network packets that have traversed a network
would help answer more questions about whether an attack is occurring and
what it entails.
Incident Response
An incident usually refers to a data breach or cyber attack; however, in some cases, it
can be something less critical, such as a misconfiguration, an intrusion attempt, or a
policy violation. Examples of a cyber attack include an attacker making our network or
systems inaccessible, defacing (changing) the public website, and data breach
(stealing company data). How would you respond to a cyber attack? Incident response
specifies the methodology that should be followed to handle such a case. The aim is to
reduce damage and recover in the shortest time possible. Ideally, you would develop a
plan ready for incident response.
The four major phases of the incident response process are:
1. Preparation: This requires a team trained and ready to handle incidents.
Ideally, various measures are put in place to prevent incidents from happening
in the first place.
2. Detection and Analysis: The team has the necessary resources to detect any
incident; moreover, it is essential to further analyze any detected incident to
learn about its severity.
3. Containment, Eradication, and Recovery: Once an incident is detected, it is
crucial to stop it from affecting other systems, eliminate it, and recover the
affected systems. For instance, when we notice that a system is infected with a
computer virus, we would like to stop (contain) the virus from spreading to
other systems, clean (eradicate) the virus, and ensure proper system recovery.
4. Post-Incident Activity: After successful recovery, a report is produced, and the
learned lesson is shared to prevent similar future incidents.

Malware Analysis
Malware stands for malicious software. Software refers to programs, documents, and
files that you can save on a disk or send over the network. Malware includes many
types, such as:
 Virus is a piece of code (part of a program) that attaches itself to a program. It
is designed to spread from one computer to another; moreover, it works by
altering, overwriting, and deleting files once it infects a computer. The result
ranges from the computer becoming slow to unusable.
  Trojan Horse is a program that shows one desirable function but hides a
malicious function underneath. For example, a victim might download a video
player from a shady website that gives the attacker complete control over their
system.
 Ransomware is a malicious program that encrypts the user’s files. Encryption
makes the files unreadable without knowing the encryption password. The
attacker offers the user the encryption password if the user is willing to pay a
“ransom.”

Malware analysis aims to learn about such malicious programs using various means:
1. Static analysis works by inspecting the malicious program without running it.
Usually, this requires solid knowledge of assembly language (processor’s
instruction set, i.e., computer’s fundamental instructions).
2. Dynamic analysis works by running the malware in a controlled environment
and monitoring its activities. It lets you observe how the malware behaves
when running.

What is Networking?

In computing, a network can be formed by anywhere from 2 devices to billions. These

devices include everything from your laptop and phone to security cameras, traffic
lights and even farming!
Networks are integrated into our everyday life. Be it gathering data for the weather,
delivering electricity to homes or even determining who has the right of way at a road.
Because networks are so embedded in the modern-day, networking is an essential
concept to grasp in cybersecurity.
In computing, a network can be formed by anywhere from 2 devices to billions. These
devices include everything from your laptop and phone to security cameras, traffic
lights and even farming!
Networks are integrated into our everyday life. Be it gathering data for the weather,
delivering electricity to homes or even determining who has the right of way at a road.
Because networks are so embedded in the modern-day, networking is an essential
concept to grasp in cybersecurity.

As previously stated, the Internet is made up of many small networks all joined
together. These small networks are called private networks, where networks
connecting these small networks are called public networks -- or the Internet! So, to
recap, a network can be one of two types:
 A private network

 A public network
Devices will use a set of labels to identify themselves on a network.

Identifying Devices on a Network

To communicate and maintain order, devices must be both identifying and
identifiable on a network. What use is it if you don't know whom you're talking to at
the end of the day?
Devices on a network are very similar to humans in the fact that we have two ways of
being identified:
 Our Name
 Our Fingerprints
Now we can change our name through deed poll, but we can't, however, change our
fingerprints. Every human has an individual set of fingerprints which means that even
if they change their name, there is still an identity behind it. Devices have the same
thing: two means of identification, with one being permeable. These are:
 An IP Address
 A Media Access Control (MAC) Address -- think of this as being similar to a
serial number.

IP Addresses
Briefly, an IP address (or Internet Protocol) address can be used as a way of identifying
a host on a network for a period of time, where that IP address can then be associated
with another device without the IP address changing. First, let's split up precisely what
an IP address is in the diagram below:

An IP address is a set of numbers that are divided into four octets. The value of each
octet will summarise to be the IP address of the device on the network. This number is
calculated through a technique known as IP addressing & subnetting, but that is for
another day. What's important to understand here is that IP addresses can change
from device to device but cannot be active simultaneously more than once within the
same network.
IP Addresses follow a set of standards known as protocols. These protocols are the
backbone of networking and force many devices to communicate in the same
language, which is something that we'll come onto another time. However, we should
recall that devices can be on both a private and public network. Depending on where
they are will determine what type of IP address they have: a public or private IP
address.
A public address is used to identify the device on the Internet, whereas a private
address is used to identify a device amongst other devices. Take the table &
screenshot below as an example. Here we have two devices on a private network:
Device Name IP Address IP Address Type

DESKTOP-KJE57FD [Link] Private

DESKTOP-KJE57FD [Link] Public

CMNatic-PC [Link] Private

CMNatic-PC [Link] Public

These two devices will be able to use their private IP addresses to communicate with
each other. However, any data sent to the Internet from either of these devices will be
identified by the same public IP address. Public IP addresses are given by
your Internet Service Provider (or ISP) at a monthly fee (your bill!)

As more and more devices become connected, it is becoming increasingly harder to

get a public address that isn't already in use. For example, Cisco, an industry giant in
the world of networking, estimated that there would be approximately 50 billion
devices connected on the Internet by the end of 2021. (Cisco., 2021). Enter IP address
versions. So far, we have only discussed one version of the Internet Protocol
addressing scheme known as IPv4, which uses a numbering system of 2^32 IP
addresses (4.29 billion) -- so you can see why there is such a shortage!
IPv6 is a new iteration of the Internet Protocol addressing scheme to help tackle this
issue. Although it is seemingly more daunting, it boasts a few benefits:
 Supports up to 2^128 of IP addresses (340 trillion-plus), resolving the issues
faced with IPv4
  More efficient due to new methodologies
The screenshot below compares both an IPv6 and IPv4 address.

MAC Addresses
Devices on a network will all have a physical network interface, which is a microchip
board found on the device's motherboard. This network interface is assigned a unique
address at the factory it was built at, called a MAC (Media Access Control ) address.
The MAC address is a twelve-character hexadecimal number (a base sixteen
numbering system used in computing to represent numbers) split into two's and
separated by a colon. These colons are considered separators. For
example, a4:c3:f0:85:ac:2d. The first six characters represent the company that made
the network interface, and the last six is a unique number.

However, an interesting thing with MAC addresses is that they can be faked or
"spoofed" in a process known as spoofing. This spoofing occurs when a networked
device pretends to identify as another using its MAC address. When this occurs, it can
often break poorly implemented security designs that assume that devices talking on
a network are trustworthy. Take the following scenario: A firewall is configured to
allow any communication going to and from the MAC address of the administrator. If
a device were to pretend or "spoof" this MAC address, the firewall would now think
that it is receiving communication from the administrator when it isn't.
Places such as cafes, coffee shops, and hotels alike often use MAC address control
when using their "Guest "or "Public" Wi-Fi. This configuration could offer better
services, i.e. a faster connection for a price if you are willing to pay the fee per device.

Ping is one of the most fundamental network tools available to us. Ping
uses ICMP (Internet Control Message Protocol) packets to determine the
performance of a connection between devices, for example, if the connection exists or
is reliable.

Ping (ICMP)
The time taken for ICMP packets travelling between devices is measured by ping, such
as in the screenshot below. This measuring is done using ICMP's echo packet and then
ICMP's echo reply from the target device.

Pings can be performed against devices on a network, such as your home network or
resources like websites. This tool can be easily used and comes installed on Operating
Systems (OSs) such as Linux and Windows. The syntax to do a simple ping is ping IP
address or website URL. Let's see this in action in the screenshot below.

Here we are pinging a device that has the private address of [Link]. Ping
informs us that we have sent six ICMP packets, all of which were received with an
average time of 5.3 seconds.
 Intro to LAN
Introducing LAN Topologies

Star Topology
The main premise of a star topology is that devices are individually connected via a
central networking device such as a switch or hub. This topology is the most
commonly found today because of its reliability and scalability - despite the cost.
Any information sent to a device in this topology is sent via the central device to which
it connects. Let's explore some of these advantages and disadvantages of this
topology below:
Because more cabling & the purchase of dedicated networking equipment is required
for this topology, it is more expensive than any of the other topologies. However,
despite the added cost, this does provide some significant advantages. For example,
this topology is much more scalable in nature, which means that it is very easy to add
more devices as the demand for the network increases.
Unfortunately, the more the network scales, the more maintenance is required to
keep the network functional. This increased dependence on maintenance can also
make troubleshooting faults much harder. Furthermore, the star topology is still
prone to failure - albeit reduced. For example, if the centralised hardware that
connects devices fails, these devices will no longer be able to send or receive data.
Thankfully, these centralised hardware devices are often robust.
Bus Topology
This type of connection relies upon a single connection which is known as a backbone
cable. This type of topology is similar to the leaf off of a tree in the sense that devices
(leaves) stem from where the branches are on this cable.
Because all data destined for each device travels along the same cable, it is very
quickly prone to becoming slow and bottlenecked if devices within the topology are
simultaneously requesting data. This bottleneck also results in very difficult
troubleshooting because it quickly becomes difficult to identify which device is
experiencing issues with data all travelling along the same route.
However, with this said, bus topologies are one of the easier and more cost-efficient
topologies to set up because of their expenses, such as cabling or dedicated
networking equipment used to connect these devices.
Lastly, another disadvantage of the bus topology is that there is little redundancy in
place in case of failures. This disadvantage is because there is a single point of failure
along the backbone cable. If this cable were to break, devices can no longer receive or
transmit data along the bus.
Ring Topology
The ring topology (also known as token topology) boasts some similarities. Devices
such as computers are connected directly to each other to form a loop, meaning that
there is little cabling required and less dependence on dedicated hardware such as
within a star topology.
A ring topology works by sending data across the loop until it reaches the destined
device, using other devices along the loop to forward the data. Interestingly, a device
will only send received data from another device in this topology if it does not have
any to send itself. If the device happens to have data to send, it will send its own data
first before sending data from another device.
Because there is only one direction for data to travel across this topology, it is fairly
easy to troubleshoot any faults that arise. However, this is a double-edged sword
because it isn't an efficient way of data travelling across a network, as it may have to
visit many multiple devices first before reaching the intended device.
Lastly, ring topologies are less prone to bottlenecks, such as within a bus topology, as
large amounts of traffic are not travelling across the network at any one time. The
design of this topology does, however, mean that a fault such as cut cable, or broken
device will result in the entire networking breaking.
What is a Switch?
Switches are dedicated devices within a network that are designed to aggregate
multiple other devices such as computers, printers, or any other networking-capable
device using ethernet. These various devices plug into a switch's port. Switches are
usually found in larger networks such as businesses, schools, or similar-sized
networks, where there are many devices to connect to the network. Switches can
connect a large number of devices by having ports of 4, 8, 16, 24, 32, and 64 for
devices to plug into.
Switches are much more efficient than their lesser counterpart (hubs/repeaters).
Switches keep track of what device is connected to which port. This way, when they
receive a packet, instead of repeating that packet to every port like a hub would do, it
just sends it to the intended target, thus reducing network traffic.
Both Switches and Routers can be connected to one another. The ability to do this
increases the redundancy (the reliability) of a network by adding multiple paths for
data to take. If one path goes down, another can be used. Whilst this may reduce the
overall performance of a network because packets have to take longer to travel, there
is no downtime -- a small price to pay considering the alternative.

What is a Router?
It's a router's job to connect networks and pass data between them. It does this by
using routing (hence the name router!).
Routing is the label given to the process of data travelling across networks. Routing
involves creating a path between networks so that this data can be successfully
delivered.
Routing is useful when devices are connected by many paths, such as in the example
diagram below.

A Primer on Subnetting

As we've previously discussed throughout the module so far, Networks can be found
in all shapes and sizes - ranging from small to large. Subnetting is the term given to
splitting up a network into smaller, miniature networks within itself. Think of it as
slicing up a cake for your friends. There's only a certain amount of cake to go around,
but everybody wants a piece. Subnetting is you deciding who gets what slice &
reserving such a slice of this metaphorical cake.
Take a business, for example; You will have different departments such as:
 Accounting
 Finance
 Human Resources
Whilst you know where to send information in real life to the correct department,
networks need to know as well. Network administrators use subnetting to categorise
and assign specific parts of a network to reflect this.
Subnetting is achieved by splitting up the number of hosts that can fit within the
network, represented by a number called a subnet mask. Let's refer back to our
diagram from the first room in this module:

As we can recall, an IP address is made up of four sections called octets. The same
goes for a subnet mask which is also represented as a number of four bytes (32 bits),
ranging from 0 to 255 (0-255).
Subnets use IP addresses in three different ways:
 Identify the network address
 Identify the host address
  Identify the default gateway
Let's split these three up to understand their purposes into the table below:

Type Purpose Explanation Example

This address identifies the

For example, a device with the IP address
Network start of the actual network
of [Link] will be on the network [Link]
Address and is used to identify a
identified by [Link]
network's existence.

An IP address here is used to

Host For example, a device will have the
identify a device on the [Link]
Address network address of [Link]
subnet

The default gateway Any data that needs to go to a device that

address is a special address isn't on the same network (i.e. isn't on
Default assigned to a device on the [Link]) will be sent to this device.
[Link]
Gateway network that is capable of These devices can use any host address
sending information to but usually use either the first or last host
another network address in a network (.1 or .254)

Now, in small networks such as at home, you will be on one subnet as there is an
unlikely chance that you need more than 254 devices connected at one time.
However, places such as businesses and offices will have much more of these devices
(PCs, printers, cameras and sensors), where subnetting takes place.
Subnetting provides a range of benefits, including:
 Efficiency
 Security
 Full control
We'll come on to explore exactly how subnetting provides these benefits at a later
date; however, for now, all we need to understand is the security element to it. Let's
take the typical café on the street. This cafe will have two networks:
1. One for employees, cash registers, and other devices for the facility
2. One for the general public to use as a hotspot
Subnetting allows you to separate these two use cases from each other whilst having
the benefits of a connection to larger networks such as the Internet.

The ARP Protocol

Recalling from our previous tasks that devices can have two identifiers:
A MAC address and an IP address, the ARP protocol or Address Resolution Protocol
for short, is the technology that is responsible for allowing devices to identify
themselves on a network.
Simply, the ARP protocol allows a device to associate its MAC address with an IP
address on the network. Each device on a network will keep a log of the MAC
addresses associated with other devices.
When devices wish to communicate with another, they will send a broadcast to the
entire network searching for the specific device. Devices can use the ARP protocol to
find the MAC address (and therefore the physical identifier) of a device for
communication.
How does ARP Work?
Each device within a network has a ledger to store information on, which is called a
cache. In the context of the ARP protocol, this cache stores the identifiers of other
devices on the network.
In order to map these two identifiers together (IP address and MAC address), the ARP
protocol sends two types of messages:
1. ARP Request
2. ARP Reply
When an ARP request is sent, a message is broadcasted to every other device found
on a network by the device, asking whether or not the device's MAC address matches
the requested IP address. If the device does have the requested IP address,
an ARP reply is returned to the initial device to acknowledge this. The initial device
will now remember this and store it within its cache (an ARP entry).
This process is illustrated in the diagram below:
The DHCP Protocol

IP addresses can be assigned either manually, by entering them physically into a

device, or automatically and most commonly by using
a DHCP (Dynamic Host Configuration Protocol) server. When a device connects to a
network, if it has not already been manually assigned an IP address, it sends out a
request (DHCP Discover) to see if any DHCP servers are on the network. The DHCP
server then replies back with an IP address the device could use (DHCP Offer). The
device then sends a reply confirming it wants the offered IP Address (DHCP Request),
and then lastly, the DHCP server sends a reply acknowledging this has been
completed, and the device can start using the IP Address (DHCP ACK).
OSI Model
 The OSI model (or Open Systems Interconnection Model) is an absolute
fundamental model used in networking. This critical model provides a framework
dictating how all networked devices will send, receive and interpret data.
One of the main benefits of the OSI model is that devices can have different functions
and designs on a network while communicating with other devices. Data sent across a
network that follows the uniformity of the OSI model can be understood by other
devices.
The OSI model consists of seven layers which are illustrated in the diagram below.
Each layer has a different set of responsibilities and is arranged from Layer 7 to Layer
1.
At every individual layer that data travels through, specific processes take place, and
pieces of information are added to this data, which is what we’ll come to discuss in the
upcoming tasks within this room. However, for now, we only need to understand that
this process is called encapsulation and what the OSI model looks like in the diagram
below:

The OSI model is a 7 layer network structure and is contrasted with the TCP/IP model,
which has only 4 layers.
The top layer in the TCP/IP model (called application) includes the top three layers of
the OSI Model (session, presentation, and application). Traditionally,
the physical layer is not included in the TCP/IP model but is often included in 5 layer
hybrid models.
In the OSI model, data from one layer is encapsulated and sent to the next layer down.
For example, an Ethernet frame operates on the Level 2 – Data Link layer and contains
an IP datagram used on Level 3 – Network layer. This IP datagram also contains a TCP
segment which is used on Level 4 – Transport layer.
Thus each layer contains all of the higher layers that it ‘supports’. Like a Russian doll,
each layer encapsulates all of the upper layers. This structure is broken down when a
packet is being read and built back up when a new packet is formed.

Layer 7 – Application

The application layer of the OSI model is the layer that you will be most familiar with.
This familiarity is because the application layer is the layer in which protocols and rules
are in place to determine how the user should interact with data sent or received.
Everyday applications such as email clients, browsers, or file server browsing software
such as FileZilla provide a friendly, Graphical User Interface (GUI) for users to interact
with data sent or received. Other protocols include DNS (Domain Name System),
which is how website addresses are translated into IP addresses.

Layer 6 – Presentation

Layer 6 of the OSI model is the layer in which standardisation starts to take place.
Because software developers can develop any software such as an email client
differently, the data still needs to be handled in the same way — no matter how the
software works.
This layer acts as a translator for data to and from the application layer (layer 7). The
receiving computer will also understand data sent to a computer in one format
destined for in another format. For example, when you send an email, the other user
may have another email client to you, but the contents of the email will still need to
display the same.
Security features such as data encryption (like HTTPS when visiting a secure site)
occur at this layer.

Layer 5 – Session

Once data has been correctly translated or formatted from the presentation layer
(layer 6), the session layer (layer 5) will begin to create a connection to the other
computer that the data is destined for. When a connection is established, a session is
created. Whilst this connection is active, so is the session.
The session layer (layer 5) synchronises the two computers to ensure that they are on
the same page before data is sent and received. Once these checks are in place, the
session layer will begin to divide up the data sent into smaller chunks of data and
begin to send these chunks (packets) one at a time. This dividing up is beneficial
because if the connection is lost, only the chunks that weren’t yet sent will have to be
sent again — not the entire piece of the data (think of it as loading a save file in a video
game).
What is worthy of noting is that sessions are unique — meaning that data cannot
travel over different sessions, but in fact, only across each session instead.
This layer focuses on the connection between two synchronized computers. You can
think of this connection as a kind of conversation; you don’t just launch into the
middle of a conversation without saying hello (and establishing a common focus on
the conversation) first, and you don’t abruptly leave a conversation without saying
goodbye.
Packages
Data is sent in these small chunks across a network, or between networks. These
chunks are normally made of two parts: Part (1) is a sequence of headers that allow
data to be sent from one place to another (i.e. they contain data about the sender and
receiver and other critical information). Part (2) is the actual data, which is called the
payload.
If you need help in jogging your memory for the correct answer, think
about packages. A package contains address information for the sender and receiver
as well as the package contents.

Layer 4 – Transport

Layer 4 of the OSI model plays a vital part in transmitting data across a network and
can be a little bit difficult to grasp. When data is sent between devices, it follows one
of two different protocols that are decided based upon several factors:
 TCP
 UDP
Let’s begin with TCP. The Transmission Control Protocol (TCP). Potentially hinted by
the name, this protocol is designed with reliability and guarantee in mind. This
protocol reserves a constant connection between the two devices for the amount of
time it takes for the data to be sent and received.
Not only this, but TCP incorporates error checking into its design. Error checking is
how TCP can guarantee that data sent from the small chunks in the session layer
(layer 5) has then been received and reassembled in the same order.
Let’s summarise the advantages and disadvantages of TCP in the table below:

Advantages of TCP Disadvantages of TCP

Requires a reliable connection between the two devices. If

Guarantees the accuracy of data. one small chunk of data is not received, then the entire chunk
of data cannot be used.

Capable of synchronising two devices to A slow connection can bottleneck another device as the
prevent each other from being flooded connection will be reserved on the receiving computer the
with data. whole time.

Performs a lot more processes for TCP is significantly slower than UDP because more work has
reliability. to be done by the devices using this protocol.

TCP is used for situations such as file sharing, internet browsing or sending an email.
This usage is because these services require the data to be accurate and complete (no
good having half a file!).
In the diagram below, we can see how a picture of a dog is broken down into small
pieces of data (known as packets) from the “webserver”, where the “computer” re-
constructs the picture of the dog into the correct order.

Now let’s move onto the User Datagram Protocol (or UDP for short). This protocol is
not nearly as advanced as its brother – the TCP protocol. It doesn’t boast the many
features offered by TCP, such as error checking and reliability. In fact, any data that
gets sent via UDP is sent to the computer whether it gets there or not. There is no
synchronisation between the two devices or guarantee; just hope for the best, and
fingers crossed.
Whilst this sounds disadvantageous, it does have its merits, which we’ll layout in the
table below:

Advantages of UDP Disadvantages of UDP

UDP is much faster than TCP. UDP doesn’t care if the data is received.

UDP leaves the application layer (user software) to

It is quite flexible to software developers
decide if there is any control over how quickly
in this sense.
packets are sent.

This means that unstable connections

UDP does not reserve a continuous connection on a
result in a terrible experience for the
device as TCP does.
user.

Using the same example as before, we can now see that only Packets #1 and #3 have
been received by the “Computer”, meaning that half of the image is missing.

UDP is useful in situations where there are small pieces of data being sent. For
example, protocols used for discovering devices (ARP and DHCP that we discussed
in Room 2 – Intro to LAN) or larger files such as video streaming (where it is okay if
some part of the video is pixelated. Pixels are just lost pieces of data!)

Layer 3 – Network

The third layer of the OSI model (network layer) is where the magic of routing & re-
assembly of data takes place (from these small chunks to the larger chunk). Firstly,
routing simply determines the most optimal path in which these chunks of data
should be sent.
Whilst some protocols at this layer determine exactly what is the “optimal” path that
data should take to reach a device, we should only know about their existence at this
stage of the networking module. Briefly, these protocols
include OSPF (Open Shortest Path First) and RIP (Routing Information Protocol). The
factors that decide what route is taken is decided by the following:
 What path is the shortest? I.e. has the least amount of devices that the packet
needs to travel across.
 What path is the most reliable? I.e. have packets been lost on that path before?
 Which path has the faster physical connection? I.e. is one path using a copper
connection (slower) or a fibre (considerably faster)?
At this layer, everything is dealt with via IP addresses such as [Link]. Devices
such as routers capable of delivering packets using IP addresses are known as Layer 3
devices — because they are capable of working at the third layer of the OSI model.

Layer 2 – Data Link

The data link layer focuses on the physical addressing of the transmission. It receives a
packet from the network layer (including the IP address for the remote computer) and
adds in the physical MAC (Media Access Control) address of the receiving endpoint.
Inside every network-enabled computer is a Network Interface Card (NIC) which
comes with a unique MAC address to identify it.
MAC addresses are set by the manufacturer and literally burnt into the card; they can’t
be changed — although they can be spoofed. When information is sent across a
network, it’s actually the physical address that is used to identify where exactly to
send the information.
Additionally, it’s also the job of the data link layer to present the data in a format
suitable for transmission.
This layer provides the link for data that is transmitted on a network. Importantly, this
layer uses the Ethernet protocol

Layer 1 – Physical

This layer is one of the easiest layers to grasp. Put simply, this layer references the
physical components of the hardware used in networking and is the lowest layer that
you will find. Devices use electrical signals to transfer data between each other in a
binary numbering system (1’s and 0’s).
For example, ethernet cables connecting devices, such as in the diagram below:

El modelo Osi

El modelo OSI (Open System interconnection) es un modelo estandarizado que

utilizamos para demostrar la teoría detrás de el networking de computadoras. En la
práctica es de hecho el modelo TCP/ IP, más compacto, en el cual el networking real
está basado. Aún así el modelo OSI en muchas maneras es más fácil para tener un
acercamiento inicial. El modelo OSI consiste de siete capas: Aplicación, Presentación,
Sesión, Transporte, Redes, Transmisión De Datos, Física.
Capa 7 Aplicación
La capa de aplicación del modelo OSI realmente provee opciones de networking para
los programas en una computadora. Trabaja casi exclusivamente con aplicaciones
proveyendo una interfaz para que ellas transmitan información. cuando la
información es dada a la capa de aplicación se la pasa a la capa de presentación
Capa 6 Presentación
La capa de presentación recibe los datos de la capa de aplicación. esta información
tiende a estar en un formato que la aplicación entiende pero no es necesariamente un
formato estandarizado que pudiera ser entendido por la capa de aplicación en la
computadora que la recibe. la capa de presentación traduce la información a un
formato estandarizado así como maneja la encriptación y otras transformaciones de la
información. una vez que esto es completado, la data se pasa a sesión.
Capa 5 Sesión
Cuando la capa de sesión recibe la información correctamente formateada de la capa
de presentación intenta ver si puede Iniciar una conexión con la otra computadora del
otro lado de la red. si no puede, se envía un mensaje de error y el proceso no continúa.
si la sesión puede ser establecida, Entonces es el trabajo de la capa de sesión
mantenerla así como cooperar con la capa de sesión de la computadora remota para
sincronizar la comunicación. la capa de sesión es particularmente importante, ya que
la sesión que crea es única para la comunicación en cuestión. Esto es lo que te permite
hacer múltiples solicitudes a diferentes puntos finales simultáneamente sin que la
Data sea mezclada. piensa en varias pestañas web al mismo tiempo. Cuando la capa
de sesión Ha logrado exitosamente una conexión entre el Host y la computadora
remota, la data se pasa a la capa de transporte

Capa 4 Transporte
La capa de transporte sirve numerosas importantes funciones. Su primer propósito es
elegir el protocolo con el cual la información va a ser transmitida. Los dos protocolos
más comunes en la capa de transporte son TCP (transmisión control protocol) y UDP
(user datagram protocol). Con TCP la transmisión es basada en la conexión, lo que
significa que la conexión entre las computadoras es establecida y mantenida por la
duración de la solicitud. Esto permite una transmisión confiable, ya que la conexión
puede ser usada para asegurar que todos los paquetes llegan al lugar correcto. Una
conexión TCP permite que dos computadoras se mantengan en comunicación
constante para asegurar que la información es enviada a una velocidad aceptable, y
que cualquier información perdida sea reenviada. Con UDP, sucede lo opuesto, los
packets de Data son esencialmente liberados a la computadora que los recibe, si no
puede seguir el paso entonces es su propio problema. Es por esto que una transmisión
de video por streaming puedes llegar pixelada si la conexión es mala. Lo que esto
significa es que TCP normalmente sería elegida para situaciones dónde la precisión se
prefiere antes que la velocidad y UDP se usaría en casos donde la velocidad es más
importante.
Con el protocolo seleccionado la capa de transporte divide la transmisión en trozos
pequeños. en TCP estos son llamados segmentos, en UDP llamados datagramas, lo
que hace más fácil la transmisión del mensaje exitosamente.

Capa 3 Red
La capa de red es responsable de localizar el destino de nuestra solicitud. Por ejemplo
el internet es una gigantesca red, cuando quieres pedir información de una página
web, la capa de red la que toma la dirección IP de la página y planea la mejor ruta a
tomar. En esta etapa estamos trabajando con lo que nos referimos como dirección
lógica, por ejemplo dirección IP, las cuales son controladas por software. Las
direcciones lógicas son usadas para poner orden a las redes, para categorizarlas y
permitirnos cruzarlas apropiadamente.
La forma más común dirección lógica es el formato IPV4, con el cual probablemente
estamos familiarizados.
Capa 2 Enlace De Datos
La capa de enlace de datos se enfoca en el direccionamiento físico de la transmisión.
Recibe los paquetes de la capa de red, Eso incluye la dirección IP de la computadora
remota, y agrega la dirección física MAC del punto que lo recibe. Dentro de cada
computadora en una red hay una NIC (Network Interface Card) que viene con una
dirección MAC única (Media Access Control) para identificarla.
Direcciones MAC son programadas por el fabricante y literalmente quemadas en la
tarjeta. no pueden ser cambiadas, Aunque sí pueden ser spooffed. Cuando la
información se envía a través de una red, de hecho es la dirección física la que es
utilizada para identificar exactamente dónde enviar la información.
Adicionalmente es el trabajo de la capa de enlace de datos presentar la información de
una forma apropiada para la transmisión.
La capa de transmisión de datos también tiene una función importante para recibir
información, ya chequea la información recibida para asegurarse de que no ha sido
corrompida durante la transmisión, lo cual podría suceder cuando la Data es
transmitida por la capa 1 (la capa física).
Capa 1 Física
La capa física está justo en el Hardware de la computadora. Aquí es donde los pulsos
eléctricos que construyen la información se transfieren a través de una red y son
enviados y recibidos. Es el trabajo de la capa física convertir los datos binarios
transmisión en señales y transmitirlos a través de la red, así como recibir señales de
entrada y convertirlas en información binaria.

Encapsulación
A medida que la información pasa a través de cada capa del modelo se agrega más
información conteniendo detalles específicos de la capa en cuestión al inicio de la
transmisión. Por ejemplo, el encabezado agregado por la capa de red incluiría cosas
como la dirección IP del origen y el destino y el encabezado agregado por la capa de
transporte incluiría entre otras cosas formación específica del protocolo que se utiliza.
La capa de enlace de datos también agrega una pieza al final de la transmisión, que es
utilizada para verificar que la información no se ha corrompido durante la transmisión;
esto tiene el bonus de agregar seguridad, ya que la Data no puede ser interceptada y
modificada sin romper el tráiler. Todo este proceso llamado encapsulación es el
proceso por el cual la Data es enviada de una computadora a otra.
Nota que la Data encapsulada se le da un nombre diferente en diferentes pasos del
proceso. En las capas 7, 6 y 5 la Data se llama simplemente Data. En la capa de
transporte la Data encapsulada es referida como segmento o un datagrama
dependiendo si se usa TCP o UDP como protocolo de transmisión. En la capa de red,
nos referimos a la Data como un paquete. Cuando el packet pasa a la capa de enlace
de datos convierte en un frame, y para el momento que se transmite a través de la red
el frame ha sido segmentado en bits.
Cuando el mensaje es recibido por la segunda computadora el proceso se revierte:
inicia en la capa física y termina en la capa de aplicación, quitando la información
agregada a medida que avanza. A esto nos referimos con desencapsulación. De esta
manera puedes pensar en las capas del modelo OSI existente dentro de cada
computadora con capacidades de conexión. Aunque no es perfectamente Claro en la
práctica, todas las computadoras siguen el mismo proceso de encapsulación para
enviar Data y desencapsulación para recibirla. El proceso de encapsulación y
desencapsulación es muy importante no solo por su uso práctico, sino Además porque
nos da un método estandarizado para enviar Data. Esto significa que todas las
transmisiones seguirán consistentemente la misma metodología, permitiendo que
cualquier dispositivo habilitado la conexión una solicitud a cualquier otro dispositivo
alcanzable y estar seguros de que será entendido, sin importar si están fabricados por
el mismo fabricante, Usan el mismo sistema operativo o cualquier otro factor.

El modelo TCP/IP
El modelo TCP/IP es en muchas maneras muy similar al modelo OSI. Es unos cuantos
años más viejo y sirve como la base de las conexiones en el mundo real. El modelo
TCP/IP consiste de cuatro capas: Aplicación, Transporte, Internet Y Red. Entre ellas
cubren el mismo rango de funciones que las siete capas del modelo OSI.
Nota:
Algunas fuentes recientes dividen el modelo TCP/IP en cinco capas, separando la
interfaz de red en enlace de datos y capa física como en el modelo OSI. Esto es
aceptado y conocido, sin embargo no está oficialmente definido.
Los procesos de encapsulación y desencapsulación funcionan exactamente de la
misma manera que con el modelo OSI. Al inicio de cada capa del modelo TCP IP llega
un encabezado durante la encapsulación se remueve durante la desencapsulación.

Ahora vamos al lado práctico de las cosas.

Un modelo en capas es una buena ayuda visual, nos muestra el proceso general de
cómo la información puede ser encapsulada y enviada a través de la red. ¿Pero cómo
sucede exactamente?
Cuando hablamos de TCP/IP está bien pensar en una tabla con cuatro capas, pero en
realidad estamos hablando de un suite de protocolos, es decir una serie de reglas que
definen cómo se llevará a cabo una acción. TCP/IP toma su nombre de los dos más
importantes: Transmission Control Protocol, que controla el flujo de información
entre dos puntos y el Internet Protocol, que controla cómo los paquetes son
direccionados y enviados. Hay muchos más protocolos que forman parte del Suite
TCP/IP, algunos de ellos cubriremos En tareas posteriores.
Como mencionamos antes, TCP es un protocolo basado en conexión. En otras
palabras antes de enviar cualquier información a través de TCP, primero debe formar
una conexión estable entre dos computadoras. El proceso de formar esta conexión se
llama el saludo de tres vías (Three three Way handshake).
Cuando intentas hacer una conexión tu computadora primero envía un pedido
especial al servidor remoto indicando que quiere Iniciar una conexión. Este pedido
contiene un syn (abreviatura de sincronización) bit, el cual hace el primer contacto
iniciar el proceso de conexión. El servidor responderá con un paquete que contiene el
syn bit así como un bit de admisión llamado ACK. Finalmente tu computadora enviará
un paquete que contiene el bit ACK ella misma, confirmando que la conexión se ha
establecida exitosamente. Con el apretón de tres vías completado, la información
puede ser transmitida de manera confiable entre las dos computadoras. Cualquier
información que sea perdida o corrompida en la transmisión se reenvía,
consiguiéndose una conexión que pareciera no perderse nunca.
El apretón de tres vías debe ser establecido antes de que una conexión pueda iniciarse
utilizando TCP.
 DNS in Detail

What is DNS?
DNS (Domain Name System) provides a simple way for us to communicate with
devices on the internet without remembering complex numbers. Much like every
house has a unique address for sending mail directly to it, every computer on the
internet has its own unique address to communicate with it called an IP address. An IP
address looks like the following [Link], 4 sets of digits ranging from 0 - 255
separated by a period. When you want to visit a website, it's not exactly convenient to
remember this complicated set of numbers, and that's where DNS can help. So
instead of remembering [Link], you can remember [Link] instead.

Domain Hierarchy
TLD (Top-Level Domain)

A TLD is the most righthand part of a domain name. So, for example, the
[Link] TLD is .com. There are two types of TLD, gTLD (Generic Top Level)
and ccTLD (Country Code Top Level Domain). Historically a gTLD was meant to tell
the user the domain name's purpose; for example, a .com would be for
commercial purposes, .org for an organisation, .edu for education and .gov for
government. And a ccTLD was used for geographical purposes, for example, .ca for
sites based in Canada, .[Link] for sites based in the United Kingdom and so on. Due to
such demand, there is an influx of new gTLDs ranging
from .online , .club , .website , .biz and so many more. For a full list of over 2000
TLDs click here.

Second-Level Domain

Taking [Link] as an example, the .com part is the TLD, and tryhackme is the
Second Level Domain. When registering a domain name, the second-level domain is
limited to 63 characters + the TLD and can only use a-z 0-9 and hyphens (cannot start
or end with hyphens or have consecutive hyphens).
Subdomain

A subdomain sits on the left-hand side of the Second-Level Domain using a period to
separate it; for example, in the name [Link] the admin part is the
subdomain. A subdomain name has the same creation restrictions as a Second-Level
Domain, being limited to 63 characters and can only use a-z 0-9 and hyphens (cannot
start or end with hyphens or have consecutive hyphens). You can use multiple
subdomains split with periods to create longer names, such as
[Link]. But the length must be kept to 253 characters or less.
There is no limit to the number of subdomains you can create for your domain name.

Record Types

DNS Record Types

DNS isn't just for websites though, and multiple types of DNS record exist. We'll go
over some of the most common ones that you're likely to come across.

A Record
These records resolve to IPv4 addresses, for example [Link]
AAAA Record
These records resolve to IPv6 addresses, for example 2606:4700:20::681a:be5

CNAME Record
These records resolve to another domain name, for example, TryHackMe's online
shop has the subdomain name [Link] which returns a CNAME record
[Link]. Another DNS request would then be made to [Link]
to work out the IP address.

MX Record
These records resolve to the address of the servers that handle the email for the
domain you are querying, for example an MX record response for [Link]
would look something like [Link]. These records also come with a
priority flag. This tells the client in which order to try the servers, this is perfect for if
the main server goes down and email needs to be sent to a backup server.
TXT Record
TXT records are free text fields where any text-based data can be stored. TXT records
have multiple uses, but some common ones can be to list servers that have the
authority to send an email on behalf of the domain (this can help in the battle against
spam and spoofed email). They can also be used to verify ownership of the domain
name when signing up for third party services.

DNS request
What happens when you make a DNS request

1. When you request a domain name, your computer first checks its local cache to
see if you've previously looked up the address recently; if not, a request to your
Recursive DNS Server will be made.
2. A Recursive DNS Server is usually provided by your ISP, but you can also
choose your own. This server also has a local cache of recently looked up
domain names. If a result is found locally, this is sent back to your computer,
and your request ends here (this is common for popular and heavily requested

services such as Google, Facebook, Twitter). If the request cannot be found

locally, a journey begins to find the correct answer, starting with the internet's
root DNS servers.
3. The root servers act as the DNS backbone of the internet; their job is to
redirect you to the correct Top Level Domain Server, depending on your
request. If, for example, you request [Link], the root server will
recognise the Top Level Domain of .com and refer you to the correct TLD
server that deals with .com addresses.
4. The TLD server holds records for where to find the authoritative server to
answer the DNS request. The authoritative server is often also known as the
nameserver for the domain. For example, the name server
for [Link] is [Link] and [Link]. You'll
often find multiple nameservers for a domain name to act as a backup in case
one goes down.
5. An authoritative DNS server is the server that is responsible for storing the
DNS records for a particular domain name and where any updates to your
domain name DNS records would be made. Depending on the record type, the
DNS record is then sent back to the Recursive DNS Server, where a local copy
will be cached for future requests and then relayed back to the original client
that made the request. DNS records all come with a TTL (Time To Live) value.
This value is a number represented in seconds that the response should be
saved for locally until you have to look it up again. Caching saves on having to
make a DNS request every time you communicate with a server.