Appendix E: Quick Reference Cards
Port Numbers Reference
Well-Known Ports (0-1023)
| Port | Protocol | Service |
|---|
| 20 | TCP | FTP Data |
| 21 | TCP | FTP Control |
| 22 | TCP | SSH |
| 23 | TCP | Telnet |
| 25 | TCP | SMTP |
| 53 | TCP/UDP | DNS |
| 67 | UDP | DHCP Server |
| 68 | UDP | DHCP Client |
| 69 | UDP | TFTP |
| 80 | TCP | HTTP |
| 110 | TCP | POP3 |
| 119 | TCP | NNTP |
| 123 | UDP | NTP |
| 143 | TCP | IMAP |
| 161 | UDP | SNMP |
| 162 | UDP | SNMP Trap |
| 389 | TCP | LDAP |
| 443 | TCP | HTTPS |
| 445 | TCP | SMB |
| 465 | TCP | SMTPS |
| 514 | UDP | Syslog |
| 587 | TCP | SMTP Submission |
| 636 | TCP | LDAPS |
| 993 | TCP | IMAPS |
| 995 | TCP | POP3S |
Common High Ports
| Port | Protocol | Service |
|---|
| 1433 | TCP | MS SQL |
| 1521 | TCP | Oracle |
| 3306 | TCP | MySQL |
| 3389 | TCP | RDP |
| 5432 | TCP | PostgreSQL |
| 5900 | TCP | VNC |
| 6379 | TCP | Redis |
| 8080 | TCP | HTTP Proxy |
| 8443 | TCP | HTTPS Alt |
| 9200 | TCP | Elasticsearch |
| 27017 | TCP | MongoDB |
Nmap Cheat Sheet
Basic Scans
# Host discovery
nmap -sn 192.168.1.0/24
# TCP SYN scan (default)
nmap -sS 192.168.1.100
# TCP connect scan
nmap -sT 192.168.1.100
# UDP scan
nmap -sU 192.168.1.100
# Version detection
nmap -sV 192.168.1.100
# OS detection
nmap -O 192.168.1.100
# Aggressive scan
nmap -A 192.168.1.100
Port Selection
# Specific ports
nmap -p 22,80,443 target
# Port range
nmap -p 1-1000 target
# All ports
nmap -p- target
# Top ports
nmap --top-ports 100 target
Output
# Normal output
nmap -oN output.txt target
# XML output
nmap -oX output.xml target
# All formats
nmap -oA output target
Wireshark Filters
Display Filters
# IP address
ip.addr == 192.168.1.100
ip.src == 192.168.1.100
ip.dst == 192.168.1.100
# Protocol
tcp
udp
icmp
dns
http
tls
# Port
tcp.port == 80
tcp.dstport == 443
udp.port == 53
# TCP Flags
tcp.flags.syn == 1
tcp.flags.ack == 1
tcp.flags.fin == 1
tcp.flags.rst == 1
# Combinations
ip.addr == 192.168.1.100 and tcp.port == 80
http or dns
tcp.flags.syn == 1 and tcp.flags.ack == 0
Capture Filters (BPF)
# Host
host 192.168.1.100
# Network
net 192.168.1.0/24
# Port
port 80
tcp port 443
# Protocol
icmp
tcp
udp
Linux Network Commands
Interface Configuration
# Show interfaces
ip addr
ifconfig -a
# Show routes
ip route
route -n
# Show ARP
ip neigh
arp -a
# Enable interface
ip link set eth0 up
# Set IP address
ip addr add 192.168.1.100/24 dev eth0
Traffic Analysis
# Capture packets
tcpdump -i eth0 -w capture.pcap
# Read capture
tcpdump -r capture.pcap
# Show connections
netstat -ant
ss -ant
# Monitor bandwidth
iftop -i eth0
Firewall (iptables)
# List rules
iptables -L -v -n
# Allow incoming SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Block IP
iptables -A INPUT -s 10.10.10.10 -j DROP
# Allow established
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Save rules
iptables-save > /etc/iptables.rules
0 1 2 3
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |C|E|U|A|P|R|S|F| |
| Offset| Res |W|C|R|C|S|S|Y|I| Window |
| | |R|E|G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Attack Quick Reference
Layer 2
| Attack | Tool | Defense |
|---|
| ARP Spoof | arpspoof, bettercap | DAI |
| MAC Flood | macof | Port Security |
| VLAN Hop | yersinia | Disable DTP |
Layer 3
| Attack | Tool | Defense |
|---|
| IP Spoof | scapy, hping3 | uRPF, BCP38 |
| ICMP Flood | hping3 | Rate limiting |
Layer 4
| Attack | Tool | Defense |
|---|
| SYN Flood | hping3 | SYN cookies |
| Port Scan | nmap | IDS, firewall |
Layer 7
| Attack | Tool | Defense |
|---|
| DNS Poison | scapy | DNSSEC |
| HTTP Flood | slowloris | WAF, rate limit |
MITRE ATT&CK Quick Reference
Network Techniques
| ID | Technique | Description |
|---|
| T1046 | Network Service Discovery | Port scanning |
| T1040 | Network Sniffing | Packet capture |
| T1557 | Adversary-in-the-Middle | MITM attacks |
| T1498 | Network DoS | DDoS attacks |
| T1071 | Application Layer Protocol | C2 over HTTP/DNS |
| T1572 | Protocol Tunneling | DNS/ICMP tunneling |