Listen to this Post
Introduction:
In the relentless arms race of cybersecurity, proactive defense is no longer a luxury but a necessity. Mastering the foundational tools for system reconnaissance, network analysis, and vulnerability assessment is critical for every security professional. This guide provides a hands-on arsenal of verified commands to harden your defenses and understand your digital terrain before an attacker does.
Learning Objectives:
- Master fundamental Linux and Windows commands for system and network reconnaissance.
- Utilize built-in tools for real-time network analysis and connection monitoring.
- Implement basic hardening techniques and script automated security checks.
You Should Know:
1. System Reconnaissance and Asset Discovery
Understanding your environment is the first step in defending it. These commands help you map your systems and identify critical assets.
Linux:
– `uname -a` – Displays all system information including kernel version and hardware architecture.
– `hostnamectl` – Shows the current hostname and related settings (useful in systemd-based distributions).
– `cat /etc/os-release` – Prints the operating system identification data.
– `lscpu` – Lists detailed information about the CPU architecture.
– `lsblk` – Displays information about block devices (disks, partitions).
– `df -h` – Shows disk space usage in a human-readable format.
Windows:
– `systeminfo | findstr /B /C:”OS Name” /C:”OS Version”` – Filters system information to show only OS details.
– `wmic computersystem get model,name,manufacturer,systemtype` – Uses WMIC to get detailed system model and manufacturer.
– `wmic diskdrive get size,model` – Lists all physical disks and their sizes.
Step-by-Step Guide:
Begin your security assessment by running `uname -a` on Linux or `systeminfo` on Windows. This gives you a baseline understanding of the operating system and kernel, which is crucial for identifying potential vulnerabilities specific to that version. Follow up with `lscpu` or `lsblk` on Linux to understand the hardware landscape, which can influence security policy decisions.
2. Network Analysis and Connection Monitoring
Monitoring network interfaces and active connections is vital for detecting unauthorized services or suspicious traffic.
Linux:
– `ip addr show` or `ifconfig` – Displays all network interfaces and their assigned IP addresses.
– `netstat -tulpn` – Lists all listening ports and the associated processes (requires `sudo` for process names).
– `ss -tulpn` – A modern replacement for netstat, showing socket statistics.
– `lsof -i -P -n` – Lists all open Internet and network files, showing which processes are using which ports.
Windows:
– `ipconfig /all` – Displays full TCP/IP configuration for all adapters.
– `netstat -ano` – Shows all active connections and listening ports, with the Process ID (PID).
– `Get-NetTCPConnection | where {$_.State -eq “Listen”}` – PowerShell command to filter for listening ports.
Step-by-Step Guide:
To quickly identify all services listening for connections, run `sudo netstat -tulpn` on Linux. The `-t` shows TCP, `-u` shows UDP, `-l` shows only listening sockets, `-p` shows the process, and `-n` prevents DNS resolution for speed. On Windows, `netstat -ano` combined with the Task Manager (to look up the PID) achieves a similar result, helping you spot rogue services.
3. User and Process Management for Security Audits
Knowing who is logged in and what is running on a system is fundamental for incident response and auditing.
Linux:
– `who` or `w` – Shows users currently logged into the system.
– `ps aux` – Displays a snapshot of all running processes.
– `ps -ef | grep
– `sudo last` – Shows a log of recent user logins and system reboots.
Windows:
– `query user` – Displays users logged on to the system.
– `tasklist /svc` – Lists all running processes and their associated services.
– `Get-Process` – PowerShell cmdlet to get processes on the local computer.
Step-by-Step Guide:
If you suspect unauthorized access, run the `last` command on Linux to review the login history. To investigate a potentially malicious process, use `ps aux | grep
` to find its PID and details. In Windows, `tasklist /svc` can help you correlate a suspicious process with a Windows service, which is a common persistence mechanism for malware. <h2 style="color: yellow;">4. File System Integrity and Permissions Hardening</h2> Incorrect file permissions are a common vector for privilege escalation. Regularly auditing key files and directories is crucial. <h2 style="color: yellow;">Linux:</h2> - `ls -lah <file_or_directory>` - Lists file permissions, ownership, and size in a human-readable format. - `find / -perm -4000 2>/dev/null` - Finds all SUID files, which can be potential privilege escalation vectors. - `find / -type f -perm -o=w -user root 2>/dev/null` - Finds world-writable files owned by root. - `chmod 600 <filename>` - Changes file permissions to read/write for owner only. - `chown root:root <filename>` - Changes the ownership of a file to root user and root group. <h2 style="color: yellow;">Windows (PowerShell):</h2> - `Get-Acl <file_path> | Format-List` - Gets the security descriptor (permissions) for a file or directory. - `icacls <file_path>` - A command-line tool to display or modify Access Control Lists. <h2 style="color: yellow;">Step-by-Step Guide:</h2> To hunt for dangerous SUID binaries, execute <code>find / -perm -4000 2>/dev/null</code>. SUID binaries run with the permissions of the file owner, often root. If an SUID binary is vulnerable or writable by a low-privilege user, it can be exploited. Review the output carefully and remove the SUID bit (<code>chmod u-s /path/to/file</code>) from any non-essential application. <h2 style="color: yellow;">5. Active Directory Enumeration for Penetration Testers</h2> For security professionals testing Windows environments, enumerating Active Directory is a key phase of the assessment. <h2 style="color: yellow;">Windows (PowerShell with RSAT Tools):</h2> - `Get-ADDomain` - Gets information about the Active Directory domain. - `Get-ADComputer -Filter ` - Lists all computers joined to the domain. - `Get-ADUser -Filter -Properties ` - Retrieves all properties for all users (use with caution on large domains). - `net group "Domain Admins" /domain` - Legacy `net` command to list members of the Domain Admins group. <h2 style="color: yellow;">Step-by-Step Guide:</h2> After gaining an initial foothold in a Windows domain, a penetration tester can use PowerShell to map the attack surface. Running `Get-ADDomain` provides the domain name and forest functional level. Following up with `Get-ADUser -Filter 'AdminCount -eq 1'` is a more targeted approach to find privileged users without pulling all user data, helping to identify high-value targets. <h2 style="color: yellow;">6. Automating Security Checks with Simple Scripts</h2> Automation is key to consistent security monitoring. A simple bash script can regularly check for critical changes. <h2 style="color: yellow;">Linux Bash Script Snippet:</h2> [bash] !/bin/bash Basic System Integrity Checker LOG_FILE="/var/log/security_checks.log" echo "$(date) - Starting Security Checks" >> $LOG_FILE Check for new SUID files find / -perm -4000 2>/dev/null > /tmp/current_suid.txt if [ ! -f /var/log/baseline_suid.txt ]; then echo "Creating SUID baseline..." cp /tmp/current_suid.txt /var/log/baseline_suid.txt else echo "Checking for new SUID files..." diff /var/log/baseline_suid.txt /tmp/current_suid.txt >> $LOG_FILE fi Check listening ports netstat -tulpn | grep LISTEN >> $LOG_FILE echo "$(date) - Checks Completed" >> $LOG_FILE
Step-by-Step Guide:
This script creates a baseline of SUID files and listening ports, then logs any changes on subsequent runs. To use it, save the code to a file (e.g., security_check.sh), make it executable with chmod +x security_check.sh, and run it via a cron job. Regularly review the log file (/var/log/security_checks.log) for unexpected changes, which could indicate a compromise.
What Undercode Say:
- Foundational Proficiency is Non-Negotiable: While advanced security tools are powerful, the inability to effectively use built-in OS diagnostics like
netstat,ss, or PowerShell is a critical skills gap. These tools provide the ground truth about a system’s state. - Automation Transforms Reactive Checks into Proactive Defense: Manual checks are inconsistent and slow. The simple act of scripting basic reconnaissance and integrity checks, as demonstrated, can significantly reduce the time to detect unauthorized changes, moving an organization’s security posture from reactive to proactively monitored.
The core insight is that modern cybersecurity is not solely about deploying sophisticated platforms but about mastering the foundational layers of the technology stack. An over-reliance on graphical interfaces without understanding the underlying commands can create blind spots. The future of defense lies in the deep, scriptable control of endpoints and networks, where security teams can programmatically validate their state and configuration against a known-good baseline, making manual, slow-moving attacks increasingly difficult to succeed.
Prediction:
The increasing complexity of hybrid cloud environments and the proliferation of IoT devices will make manual security monitoring obsolete. The future of proactive defense will be dominated by AI-driven agents that continuously execute and analyze the output of these fundamental commands at a massive scale. These agents will autonomously baseline normal behavior, detect subtle anomalies indicative of zero-day attacks, and auto-remediate common misconfigurations, fundamentally shifting the human role from continuous monitoring to strategic oversight and complex incident response. The commands outlined here will form the foundational “sensor network” for these next-generation autonomous defense systems.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Benediktus Sava – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
