| –Protocol– | –Port– | –Transport– | Expanded Description |
| HTTP | 80 | TCP | Used for unencrypted transmission of web pages and data across the internet. |
| ————— | |||
| HTTPS | 443 | TCP | A secure version of HTTP that encrypts traffic using TLS/SSL to protect data. |
| ————— | |||
| FTP (Data) | 20 | TCP | Specifically used for the actual transfer of data files between a client and server. |
| ————— | |||
| FTP (Control) | 21 | TCP | Used for establishing the connection and sending commands between the client and server. |
| ————— | |||
| SFTP | 22 | TCP | A secure file transfer protocol that operates over an SSH connection to ensure data privacy. Note: If you were curios about why SFTP and SSH use the same port like I was.. SFTP is an extension of SSH and SFTP (SSH File Transfer Protocol) is not technically “FTP” at all. |
| ————— | |||
| SSH | 22 | TCP | Provides a secure, encrypted way to remotely log into and manage network devices and servers. |
| ————— | |||
| Telnet | 23 | TCP | An older protocol for remote login that sends data in plaintext, making it insecure for modern use. |
| ————— | |||
| SMTP | 25 | TCP | The standard protocol used for pushing or sending emails from a client to a server or between servers. |
| ————— | |||
| POP3 | 110 | TCP | Used for downloading emails from a server to a local client, typically deleting them from the server afterward. |
| ————— | |||
| IMAP | 143 | TCP | A more advanced email retrieval protocol that keeps messages synced across multiple devices and the server. |
| ————— | |||
| LDAP | 389 | TCP/UDP | A protocol used for accessing and maintaining distributed directory information services over a network. |
| ————— | |||
| LDAPS | 636 | TCP | The secure version of LDAP, which encrypts directory service traffic to protect authentication data. |
| ————— | |||
| DNS | 53 | TCP/UDP | Translates human-readable domain names (e.g., example.com) into numerical IP addresses. |
| ————— | |||
| DHCP (Server) | 67 | UDP | The server-side component that manages and assigns IP addresses to clients on a network. |
| ————— | |||
| DHCP (Client) | 68 | UDP | The client-side component used to request and receive IP configuration from a DHCP server. |
| ————— | |||
| TFTP | 69 | UDP | A simplified, low-overhead file transfer protocol often used for booting diskless workstations or config transfers. |
| ————— | |||
| SNMP (Request) | 161 | UDP | Used for collecting and organizing information about managed devices on IP networks for network management. |
| ————— | |||
| SQL Server (MSSQL) | 1433 | TCP | The default port for communication between client applications and Microsoft SQL Server databases. |
| ————— | |||
| Oracle Database | 1521 | TCP | The standard listener port used by Oracle Database to accept incoming client connection requests. |
Blog
-

Networking Protocols and Ports
-

Linux Commands Security Professionals Should Know

User and Group Management
- passwd – Changes the password of a user account.
- Example: sudo passwd username
- useradd – Creates a new user account.
- Example: sudo useradd -m newuser
- userdel – Deletes a user account.
- Example: sudo userdel username
- usermod – Modifies a user account, such as changing the username or group.
- Example: sudo usermod -aG sudo username
- groupadd – Creates a new group.
- Example: sudo groupadd newgroup
- groupdel – Deletes a group.
- Example: sudo groupdel oldgroup
- groups – Displays the groups a user is a member of.
- Example: groups username
- id – Displays user and group information for a specified user.
- Example: id username
Package Manager
- apt-get – A command-line tool to handle packages on Debian-based systems, used to install, remove, or upgrade packages.
- Example: sudo apt-get install curl
- apt – A newer, simpler front-end for the apt-get tool for package management on Debian-based systems.
- Example: sudo apt update
- yum – Package management tool for RPM-based Linux distributions (like CentOS, Red Hat), used to install, update, or remove packages.
- Example: sudo yum install curl
- dnf – A newer package manager for RPM-based systems, replacing yum in many distributions (like Fedora).
- Example: sudo dnf install curl
- rpm – Command-line tool to install, remove, and query RPM packages.
- Example: sudo rpm -ivh package.rpm
- dpkg – The low-level package manager for Debian-based systems that installs and manages .deb packages.
- Example: sudo dpkg -i package.deb
- snap – A package management system for installing snaps (self-contained applications) across various Linux distributions.
- Example: sudo snap install vlc
- zypper – Package manager for openSUSE, used to install, update, and manage packages.
- Example: sudo zypper install curl
Network Configuration & Monitoring
- ifconfig – Displays and configures network interfaces (deprecated in favor of ip).
- Example: ifconfig eth0
- ip add – Displays IP addresses of network interfaces (part of the ip tool suite).
- Example: ip addr show
- ping – Sends ICMP echo requests to test network connectivity.
- Example: ping 8.8.8.8
- netstat – Displays network connections, routing tables, and interface statistics (deprecated in favor of ss).
- Example: netstat -tuln
- ss – A utility to investigate sockets and network connections, replacing netstat.
- Example: ss -tuln
- traceroute – Traces the route packets take to a network host, showing each hop along the way.
- Example: traceroute google.com
- ssh – Securely connects to a remote system using the SSH protocol.
- Example: ssh user@hostname
- nc – Netcat, a utility for reading/writing network connections, useful for port scanning, listening, and sending data.
- Example: nc -zv 192.168.1.1 1-1000
Process Management
- ps – Displays a snapshot of current running processes.
- Example: ps aux
- top – Displays dynamic real-time information about processes.
- Example: top
- kill – Sends a signal to terminate a process by its PID (process ID).
- Example: kill 1337
- killall – Sends a signal to terminate processes by name.
- Example: killall firefox
- pstree – Displays processes in a tree-like format, showing their hierarchy.
- Example: pstree
- htop – Interactive version of top, providing a more user-friendly, color-coded view of processes.
- Example: htop
File and Directory Management
- ls – Lists the contents of a directory.
- Example: ls -l /home/user
- pwd – Displays the current working directory.
- Example: pwd
- cd – Changes the current directory.
- Example: cd /home/user/Documents
- mkdir – Creates a new directory.
- Example: mkdir newdir
- mdir – Similar to mkdir, but used for creating directories on remote systems (e.g., with FTP).
- Example: mdir /mnt/remote/dir
- touch – Creates an empty file or updates the timestamp of an existing file.
- Example: touch newfile.txt
- cp – Copies files or directories.
- Example: cp file1.txt file2.txt
- mv – Moves or renames files or directories.
- Example: mv oldname.txt newname.txt
- rm – Removes files or directories. There are several options for the rm command as well (ie -force (-f), -recursive (-r), -verbose (-v), -interactive (-i))
- Example: rm file.txt
File Viewing and Editing
- cat – Concatenates and displays file content.
- Example: cat file.txt
- less – Displays file content one screen at a time, allowing scrolling backward and forward.
- Example: less file.txt
- more – Similar to less, but less feature-rich (only allows forward scrolling).
- Example: more file.txt
- nano – A simple, text-based text editor.
- Example: nano file.txt
- vim – A powerful text editor with advanced features for editing files.
- Example: vim file.txt
- gedit – A graphical text editor for GNOME-based systems.
- Example: gedit file.txt
System Information
- uname – Displays system information, such as the kernel version and architecture.
- Example: uname -a
- df – Displays disk space usage for all mounted filesystems.
- Example: df -h
- du – Displays disk usage for files and directories.
- Example: du -sh /home/user
- free – Displays memory usage, including free and used memory.
- Example: free -h
- lscpu – Displays detailed information about the CPU architecture.
- Example: lscpu
- lshw – Displays detailed hardware configuration information.
- Example: sudo lshw -short
- lsblk – Lists information about block devices (e.g., hard drives and partitions).
- Example: lsblk
Permission Commands
- chmod – Changes the file or directory permissions.
- Example: chmod u+x file.txt
- chown – Changes the owner and/or group of a file or directory.
- Example: sudo chown user:group file.txt
- chgrp – Changes the group ownership of a file or directory.
- Example: sudo chgrp admin file.txt
- umask – Sets default file creation permissions.
- Example: umask 022
- setfacl – Sets file access control lists for more granular permission control.
- Example: setfacl -m u:username:rwx file.txt
- getfacl – Displays the access control list (ACL) of a file or directory.
- Example: getfacl file.txt
- chattr – Changes file attributes for advanced file protection (e.g., immutability).
- Example: sudo chattr +i file.txt
- ls -l – Lists files and directories with detailed information, including permissions.
- Example: ls -l file.txt
Side note for chmod (Click the Arrow)
The chmod command changes the file’s permissions for the user, group, and others. Permissions can be set using symbolic mode or numeric mode.
Symbolic Mode: Uses letters to represent file permissions.
r (read)
w (write)
x (execute)
Numeric Mode: Uses numbers to represent permissions.
4 = read (r)
2 = write (w)
1 = execute (x)
Sum of numbers for the user, group, and others.
In numeric mode, you represent permissions using numbers. Each permission is assigned a number:
4 = read (r)
2 = write (w)
1 = execute (x)
To calculate the numeric value for each permission group (user, group, others), you add the numbers:
rwx = 4 + 2 + 1 = 7
rw- = 4 + 2 = 6
r– = 4
-wx = 2 + 1 = 3
–x = 1 - passwd – Changes the password of a user account.
-

A Few Cybersecurity Linux Tools to Explore
Information Gathering & Reconnaissance
- Nmap: A network scanning tool for identifying hosts, open ports, and services. Commonly used for vulnerability assessments.
Website: nmap.org - Recon-NG: A reconnaissance framework for gathering and processing OSINT data. Modules can automate recon tasks.
Website: Recon-NG GitHub - theHarvester: Collects emails, subdomains, and hosts using sources like Google, Bing, and Shodan.
Website: GitHub - DNSRecon: DNS enumeration tool for zone transfers and DNS record collection (MX, SPF, SRV).
Website: GitHub - Netdiscover: A network scanning tool to identify active IPs in networks, particularly wireless networks.
Website: Netdiscover SourceForge - Unicornscan: A high-performance asynchronous port scanner capable of scanning large networks.
Website: Unicornscan GitHub - Masscan: Ultra-fast port scanner that can scan the entire internet within minutes.
Website: masscan GitHub - P0f: A passive fingerprinting tool to infer OS, uptime, and device information by analyzing traffic.
Website: P0f GitHub
Vulnerability Analysis & Exploitation
- Nikto: Web server vulnerability scanner that identifies misconfigurations, outdated software, and potential exploits.
Website: CIRT.net - OpenVAS: Open-source vulnerability scanner for automated network security assessments.
Website: openvas.org - Metasploit: A penetration testing framework for exploit development and vulnerability validation.
Website: Rapid7 - jSQL Injection: A Java-based SQL injection exploitation tool.
Website: GitHub - OWASP ZAP: An intercepting proxy for web app security testing and identifying vulnerabilities.
Website: OWASP ZAP - Burp Suite: A web vulnerability scanner and exploitation platform with intercepting proxy capabilities.
Website: PortSwigger - SQL Ninja: An SQL injection tool for exploiting database vulnerabilities.
Website: GitHub - Sqlmap: An open-source tool for automating the detection and exploitation of SQL injection vulnerabilities.
Website: sqlmap.org
Wireless & Network Attacks
- Aircrack-ng: A suite of tools for Wi-Fi network security assessment, focusing on cracking WEP and WPA-PSK keys.
Website: aircrack-ng.org - Kismet: Wireless network detector and packet sniffer, useful for Wi-Fi reconnaissance.
Website: kismetwireless.net - Reaver: Exploits vulnerabilities in WPS to retrieve WPA/WPA2 passwords.
Website: Reaver GitHub - Wireshark: A powerful packet analyzer for network troubleshooting and analysis.
Website: wireshark.org - Ettercap: A suite for network sniffing and man-in-the-middle attacks, particularly for ARP poisoning.
Website: ettercap GitHub - PixieWPS: A tool to exploit WPS vulnerabilities via offline brute-force attacks.
Website: PixieWPS GitHub - Wifite: Automates attacks on Wi-Fi networks, including cracking WPA/2 and WEP keys.
Website: GitHub - Netcat: A versatile networking utility for debugging, backdoors, and transferring files.
Website: Netcat Guide
Forensics & Post-Exploitation
- Autopsy: A digital forensics platform for analyzing and recovering deleted files, email parsing, and more.
Website: Autopsy.com - Foremost: A file recovery tool for carving out files from disk images and raw data.
Website: Foremost GitHub - Mimikatz: A tool for credential dumping and Windows security testing.
Website: GitHub - PowerShell Empire: A post-exploitation framework leveraging PowerShell for remote access and persistence.
Website: Empire Project - Shellter: A tool for obfuscating and injecting payloads into Windows executables.
Website: Shellter GitHub - PowerSploit: A post-exploitation toolkit for executing PowerShell scripts on compromised systems.
Website: PowerSploit GitHub - Memdump: Captures live memory for forensic analysis.
Website: GitHub
Password & Hash Attacks
- Hydra: A parallelized login cracker supporting numerous protocols.
Website: Hydra GitHub - Rainbowcrack: Cracks hashes using precomputed rainbow tables.
Website: Project - John the Ripper: A fast password cracker supporting many hash types.
Website: John the Ripper - Crunch: A wordlist generator for brute-force attacks.
Website: Crunch GitHub - Hashcat: A GPU-accelerated password recovery tool.
Website: hashcat.net - Medusa: A parallelized, modular brute-forcer for password cracking.
Website: GitHub - Patator: A brute-forcing tool supporting many protocols and methods.
Website: GitHub - CeWL: Generates custom wordlists for brute-force attacks based on target website content.
Website: CeWL GitHub
Malware Analysis, Vulnerability Research, & Incident Response
- Ghidra: Reverse engineering tool for analyzing binaries and decompiling code.
Website: ghidra-sre.org - Radare2: An open-source framework for binary analysis and reverse engineering.
Website: radare.org - OllyDbg: A debugger for analyzing and manipulating executables.
Website: OllyDbg - DynamoRIO: A dynamic binary instrumentation framework.
Website: dynamorio.org - Cuckoo Sandbox: An automated malware analysis platform.
Website: cuckoosandbox.org - Volatility: A memory forensics tool for analyzing RAM dumps.
Website: Volatility Foundation - Binwalk: Firmware analysis tool for Website: Binwalk
- Nmap: A network scanning tool for identifying hosts, open ports, and services. Commonly used for vulnerability assessments.
-

WINGET – Updating Installed Software on Windows
Let’s ensure your installed software stays up-to-date! We’ll use the Windows Package Manager to quickly find and apply any available updates. Follow the steps below to run the necessary commands using an elevated Command Prompt.
Open Command Prompt as Administrator
- Search for CMD in the Start Menu.
- Right-click on Command Prompt and select Run as Administrator.
List Available Software Updates
- In the Command Prompt, type the following command:
winget upgrade- Press Enter.
- This will display all software on your system with available updates.
Install All Available Updates
- To update everything, enter the following command:
winget upgrade --all- Press Enter
- This will begin the installation of all updates.
-

Network Adapters in Windows – A Shortcut Story
Microsoft’s constantly evolving layouts can be a bit frustrating, making it tricky to locate settings at times. One of these pesky settings, now requiring a bit of a runaround, is accessing Network Adapters in both Windows 10 and 11.
But fear not! Here’s a quick tip to swiftly navigate to the network adapters and put an end to the annoyance:
- Open the ‘Run’ prompt (press Win+R).
- Type in ‘NCPA.cpl’ and hit enter.
And just like that, you’ll be whisked away directly to the network adapters (without all the annoyance)!
Thanks for coming to my TED talk 🙂
-

Adobe Acrobat Is Scanning Your Documents
The generative AI features in Adobe Acrobat are scanning your documents! This could possible lead to sensitive data leakage.
You can turn this feature off through the windows registry.
“Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown create a new dword key under feature lockdown, bEnableGentech
1 will enable the feature, 0 will disable the feature and remove all entry points”
You can also disable the generative AI features in Adobe Acrobat with PowerShell.
“New-ItemProperty -Path ‘HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown’ -Name “bEnableGentech” -PropertyType DWord -Value 0″
References:
-

Starting a Journey through Cybersecurity: A Roadmap
Embark on your cybersecurity journey with this well-rounded curriculum. These courses and learning paths equip you with fundamental knowledge and hands-on skills essential in the cybersecurity landscape. By completing these certifications, you’ll be well on your way to becoming a capable and well-rounded cybersecurity professional. Remember, continuous learning and practical application are key in this dynamic field. Good luck, and enjoy your learning experience!
Introduction to Cybersecurity and Blue Teaming (TryHackMe):
- Explore the fundamentals of cybersecurity and blue teaming.
- Gain insights into defensive strategies and techniques.
- Link: Blue Team Learning Path
SOC (Security Operations Center) Level 1 (TryHackMe):
- Deepen your understanding of Security Operations Center operations.
- Learn about threat detection, incident response, and more.
- Link: SOC Level 1 Learning Path
Windows Event Logs: Finding Evil (Hack The Box Academy):
- Explore the importance of Windows Event Logs in cybersecurity.
- Learn how to identify and analyze potential threats within logs.
- Link: Windows Event Logs Course
Introduction to Active Directory (Hack The Box Academy):
- Get acquainted with Active Directory and its significance.
- Dive into the structure, functions, and security considerations.
- Link: Active Directory Course
Introduction to Network Traffic Analysis (Hack The Box Academy):
- Explore the world of network traffic analysis.
- Learn how to identify and respond to network-based threats.
- Link: Network Traffic Analysis Course
Wireshark for Beginners: Capture Packets (Coursera):
- Gain hands-on experience with Wireshark for packet analysis.
- Learn how to capture and analyze network traffic.
- Link: Wireshark for Beginners Course
Analyze Network Traffic with Tcpdump (Coursera):
- Dive deeper into network traffic analysis using tcpdump.
- Learn how to capture and interpret network data using command-line tools.
- Link: Analyze Network Traffic with Tcpdump Course
Microsoft Windows Defender and Firewall for Beginners (Coursera):
- Explore the basics of Windows Defender and Firewall.
- Learn how to enhance the security of your Windows environment.
- Link: Windows Defender and Firewall Course
Mastering SQL Injection: The Ultimate Hands-On Course (Udemy):
- Gain proficiency in understanding and preventing SQL injection attacks.
- Learn how to secure databases from this common vulnerability.
- Link: SQL Injection Course
Google IT Automation Professional Certificate (Coursera):
- Enroll in a comprehensive program covering IT automation.
- Gain skills in using Python, Git, and automation tools.
- Link: Google IT Automation Professional Certificate
-

Two Free Cybersecurity Training Platforms
Empowering Cybersecurity Enthusiasts
In the dynamic landscape of cybersecurity, knowledge and skills are the armor that shields against digital threats. SecurityBlue Team and AntiSyphon Training, both dedicated to bolstering cyber defense proficiency, offer an invaluable opportunity to harness expertise in this critical field. Let’s dive into a comprehensive exploration of these two remarkable platforms that provide free cybersecurity courses.
SecurityBlue Team: Uniting Learning and Practice
Introduction: SecurityBlue Team stands as a beacon for those seeking to immerse themselves in the realm of cybersecurity. By seamlessly blending theoretical knowledge with practical application, this platform transcends traditional training approaches.
Course Offerings: The array of free cybersecurity courses offered by SecurityBlue Team covers an extensive spectrum of topics. From beginner-friendly introductions to advanced penetration testing, each course is meticulously crafted to cater to diverse skill levels.
Notable Features:
Hands-On Labs: One of SecurityBlue Team’s standout features is its emphasis on practical experience. The inclusion of hands-on labs enables learners to apply theoretical concepts in real-world scenarios, enhancing their problem-solving skills.
Community Interaction: A sense of community is fostered through SecurityBlue Team’s interactive platform. Learners can engage in discussions, seek guidance, and collaborate with like-minded individuals, further enriching the learning experience.
Structured Pathways: The platform offers structured pathways for different cybersecurity career tracks, helping learners navigate their journey and achieve their professional goals systematically.
AntiSyphon Training: Knowledge at Your Own Pace
Introduction: AntiSyphon Training stands as a testament to the belief that quality cybersecurity education should be accessible to all, regardless of financial constraints. By offering a “pay what you can” model, it opens doors for individuals eager to fortify their cybersecurity expertise.
Course Offerings: AntiSyphon Training’s courses span a wide range of cybersecurity domains, including ethical hacking, network defense, and incident response. Each course is designed to accommodate diverse learning styles and skill levels.
Notable Features:
Flexibility: The “pay what you can” approach grants learners the freedom to access high-quality cybersecurity training without the burden of financial limitations.
Self-Paced Learning: AntiSyphon Training recognizes that learners have varying commitments. The self-paced nature of the courses allows participants to tailor their learning experience according to their schedules.
Practical Focus: Much like SecurityBlue Team, AntiSyphon Training prioritizes hands-on experience. Practical exercises and simulations enable learners to grasp complex concepts through immersive application.
Elevating Cybersecurity Competence for All
SecurityBlue Team and AntiSyphon Training exemplify the democratization of cybersecurity education. By providing free courses that blend theory and practicality, these platforms empower individuals to cultivate skills vital to protecting digital landscapes. Whether you’re a beginner dipping your toes into the realm of cybersecurity or a seasoned professional seeking to enhance your expertise, these platforms are poised to be your partners on this transformative journey. Embrace the opportunities they offer, and embark on a voyage to fortify digital defenses and shape the future of cybersecurity.
Sources:
-

Streamlining Windows Image Preparation
Streamlining Windows Image Preparation with the Power of PowerShell: An In-depth Look at the Remarkable Windows10Debloater Script
Windows image preparation can be tedious, requiring the removal of unnecessary apps and settings. The Windows10Debloater script by Sycnex simplifies this process, offering automation, precision, and customization. Here’s how this tool makes image preparation more efficient and effective for IT professionals and tech enthusiasts.
Why Use Windows10Debloater?
- Efficient Debloating:
Removes unnecessary apps and components to optimize system performance, creating leaner and faster Windows images. - Customizable Options:
Adjust settings to meet specific needs—whether removing specific apps or adjusting privacy settings. - User-Friendly Interface:
Offers both a PowerShell script for advanced users and an intuitive GUI for beginners. - Safety Measures:
Creates system backups with a restoration option, ensuring any changes are reversible. - Scalable Efficiency:
Ideal for managing multiple machines, saving time while ensuring consistency across devices.
Key Benefits for IT Professionals
- Time Savings: Streamlines image preparation with minimal manual effort.
- Consistency: Enables uniform system setups for large-scale deployments.
- Reliability: Provides clear documentation and failsafe features for peace of mind.
Getting Started
Download Windows10Debloater from its GitHub repository, run the script, and choose between default or customized settings. The documentation is straightforward, making it easy to use regardless of experience level.
Conclusion
Windows10Debloater redefines Windows image preparation, blending automation and flexibility to improve efficiency. Whether you’re a tech enthusiast or an IT professional, this tool simplifies the process and ensures consistent, optimized results.
Source:
- Efficient Debloating:
-

Rejoin to Azure Domain Command
When you’re dealing with an Azure Domain and you end up needing to rejoin a computer to the domain, things can get a bit tricky, especially if you’ve renamed the PC after it joined the domain. Here’s the deal: sometimes, even after you’ve changed the computer name, the old one still shows up when you look up the user. Not the most convenient thing, right?
But hey, there’s a couple of cool commands that can save the day in this situation:
- dsregcmd /forcerecovery: Alright, imagine this command as a superhero move. It’s like doing a leave-and-join combo in one swift action. First, the computer says “I’m outta here” and leaves the Azure Domain. Then, it immediately rejoins with the new name. This makes sure you don’t end up locked out of the domain without any admin access. But, here’s the kicker: you’ll need to sign in again after this. Think of it as a reset button that sorts out the PC name issue while also ensuring you’ve got the right credentials to hop back in.
- dsregcmd /UpdateDevice: Now, this command is like the quick fix in comparison. Instead of the whole leave-and-join drama, it just does a smart update. It’s like changing the sign on a door to match the new room inside. This command directly tells Azure to freshen up its memory about the PC’s identity and its shiny new name.The coolest part? No need to sign in again with this command. It’s a simple, straightforward way to get the new PC name properly registered in Azure. It’s like telling Azure, “Hey, just a heads-up, we’ve got a new name in town.”
So there you have it! These commands are your go-to solutions when the PC name isn’t playing nice in your Azure Domain, especially if renaming was involved. The first command, dsregcmd /forcerecovery, is your all-in-one reset button with a leave-and-join twist. The second one, dsregcmd /UpdateDevice, is your quick update without the fuss. Just pick the one that fits your situation best!