网络安全与蓝队工具速查指南

需积分: 0 55 浏览量更新于2024-07-15 收藏 13.18MB PDF 举报

"BTCSwGSEnotes.pdf" 是一份涵盖网络攻防和网络安全的综合笔记，主要包括蓝队工具、事件响应、网络基础知识以及操作系统相关的知识。这份文档提供了丰富的技术参考，包括但不限于常见端口、网络协议头、操作系统概念、网络安全控制、网络扫描工具、编程语言快速参考以及各种实用工具的介绍。在"NETWORKING/BLUETEAMTOOLS"部分，笔记首先介绍了常见的网络服务端口，这对于识别潜在的恶意活动至关重要。接着，详细讲解了IPv4和TCP/UDP/ICMP协议头结构，以及子网划分，这些都是网络通信的基础。此外，还有对IPv6和TCP头部的解析，帮助理解更现代的网络协议。OSI模型的概述则帮助理解不同层的功能。 "HTTP, FTP"部分涵盖了两个最常用的互联网协议，讲解了它们的工作原理和用途。同时，笔记还介绍了十进制到十六进制的转换，这是在网络中处理数据时经常遇到的计算问题。 "20CriticalSecurityControls"部分列出了20个关键的安全控制措施，这是组织保护自身免受网络攻击的重要指南。此外，"CiscoNetworkingAllinOneReference"提供了Cisco网络设备的相关参考资料。 "ARGUS/TCPDUMP/TSHARK/NGREP"部分涉及网络流量分析工具，如Argus、tcpdump、tshark（Wireshark的一部分）和ngrep，这些工具对于网络监控和故障排查非常有用。 "PythonQuickReference"和"RegularExpressions"部分则针对编程和数据分析，Python是网络分析中的常用语言，而正则表达式则是高效处理文本数据的关键技能。 "SNORT"和"rwfilter"是入侵检测系统，用于识别和防止网络攻击。"Scapy"和"Bro"是网络分析和安全研究的高级工具，可以进行深度包检查和网络流量分析。 "GoogleHacking"、"Netcat"、"Hping"和"Metasploit"则属于渗透测试和攻击工具，这部分内容帮助防御者理解攻击者的策略。 "WINDOWS"部分涵盖了Windows操作系统的安全性和管理，包括有用的命令、注册表操作、Netsh、Netstat以及PowerShell的使用。 "LINUX/UNIX"部分介绍了Linux加固、基础命令、SSH转发、iptables防火墙规则，以及搜索文件、Cron任务和VI编辑器的使用。同时，还提到了Remnux，这是一个用于恶意软件逆向工程的Linux发行版。 "INCIDENTRESPONSE/PICERLPERSITUATION"部分聚焦于事件响应流程，包括蠕虫感染这样的具体情景。这份笔记是网络防御者和安全专业人员的宝贵资源，包含了广泛且深入的网络安全和攻防知识。

FTP

Code Explanation

100 Series The requested action is being initiated, expect another reply before proceeding with a new command.

110 Restart marker replay . In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy =

mmmm where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").

120 Service ready in nnn minutes.

125 Data connection already open; transfer starting.

150 File status okay; about to open data connection.

200 Series The requested action has been successfully completed.

202 Command not implemented, superfluous at this site.

211 System status, or system help reply.

212 Directory status.

213 File status.

214 Help message.On how to use the server or the meaning of a particular non-standard command. This reply is useful only to the

human user.

215 NAME system type. Where NAME is an official system name from the registry kept by IANA.

220 Service ready for new user.

221 Service closing control connection.

225 Data connection open; no transfer in progress.

226 Closing data connection. Requested file action successful (for example, file transfer or file abort).

227 Entering Passive Mode (h1,h2,h3,h4,p1,p2).

228 Entering Long Passive Mode (long address, port).

229 Entering Extended Passive Mode (|||port|).

230 User logged in, proceed. Logged out if appropriate.

231 User logged out; service terminated.

232 Logout command noted, will complete when transfer done.

234 Specifies that the server accepts the authentication mechanism specified by the client, and the exchange of security data is

complete. A higher level nonstandard code created by Microsoft.

250 Requested file action okay, completed.

257 "PATHNAME" created.

300 Series The command has been accepted, but the requested action is on hold, pending receipt of further information.

331 User name okay, need password.

332 Need account for login.

350 Requested file action pending further information

400 Series The command was not accepted and the requested action did not take place, but the error condition is temporary and the action

may be requested again.

421 Service not available, closing control connection. This may be a reply to any command if the service knows it must shut down.

425 Can't open data connection.

426 Connection closed; transfer aborted.

430 Invalid username or password

434 Requested host unavailable.

450 Requested file action not taken.

451 Requested action aborted. Local error in processing.

452 Requested action not taken. Insufficient storage space in system.File unavailable (e.g., file busy).

500 Series Syntax error, command unrecognized and the requested action did not take place. This may include errors such as command line too

long.

501 Syntax error in parameters or arguments.

502 Command not implemented.

503 Bad sequence of commands.

504 Command not implemented for that parameter.

530 Not logged in.

532 Need account for storing files.

550 Requested action not taken. File unavailable (e.g., file not found, no access).

551 Requested action aborted. Page type unknown.

552 Requested file action aborted. Exceeded storage allocation (for current directory or dataset).

553 Requested action not taken. File name not allowed.

600 Series Replies regarding confidentiality and integrity

631 Integrity protected reply.

632 Confidentiality and integrity protected reply.

633 Confidentiality protected reply.

10000 Series Common Winsock Error Codes

10054 Connection reset by peer. The connection was forcibly closed by the remote host.

10060 Cannot connect to remote server.

10061 Cannot connect to remote server. The connection is actively refused by the server.

Decimal-Binary-Hexadecimal Conversion Chart

This chart shows all of the combinations of decimal, binary and hexadecimal from 0 to 25 5 decimal. When making a change in a CV this chart will show the conversion for different

numbering system s. Some deco ders sp lit the CV into two pa rts. When y ou mo dify a CV you need to write back all 8 bits. T his cha rt will help determine the co rrect bit va lue a CV.

Decimal Binary Hex Decimal Binary Hex Decimal Binary Hex Decimal Binary Hex

Bit N o.>

76543210 76543210 76543210 76543210

0 00000000 0 64 01000000 40 128 10000000 80 192 11000000 C0

1 00000001 1 65 01000001 41 129 10000001 81 193 11000001 C1

2 00000010 2 66 01000010 42 130 10000010 82 194 11000010 C2

3 00000011 3 67 01000011 43 131 10000011 83 195 11000011 C3

4 00000100 4 68 01000100 44 132 10000100 84 196 11000100 C4

5 00000101 5 69 01000101 45 133 10000101 85 197 11000101 C5

6 00000110 6 70 01000110 46 134 10000110 86 198 11000110 C6

7 00000111 7 71 01000111 47 135 10000111 87 199 11000111 C7

8 00001000 8 72 01001000 48 136 10001000 88 200 11001000 C8

9 00001001 9 73 01001001 49 137 10001001 89 201 11001001 C9

10 00001010 A 74 01001010 4A 138 10001010 8A 202 11001010 CA

11 00001011 B 75 01001011 4B 139 10001011 8B 203 11001011 CB

12 00001100 C 76 01001100 4C 140 10001100 8C 204 11001100 CC

13 00001101 D 77 01001101 4D 141 10001101 8D 205 11001101 CD

14 00001110 E 78 01001110 4E 142 10001110 8E 206 11001110 CE

15 00001111 F 79 01001111 4F 143 10001111 8F 207 11001111 CF

16 00010000 10 80 01010000 50 144 10010000 90 208 11010000 D0

17 00010001 11 81 01010001 51 145 10010001 91 209 11010001 D1

18 00010010 12 82 01010010 52 146 10010010 92 210 11010010 D2

19 00010011 13 83 01010011 53 147 10010011 93 211 11010011 D3

20 00010100 14 84 01010100 54 148 10010100 94 212 11010100 D4

21 00010101 15 85 01010101 55 149 10010101 95 213 11010101 D5

22 00010110 16 86 01010110 56 150 10010110 96 214 11010110 D6

23 00010111 17 87 01010111 57 151 10010111 97 215 11010111 D7

24 00011000 18 88 01011000 58 152 10011000 98 216 11011000 D8

25 00011001 19 89 01011001 59 153 10011001 99 217 11011001 D9

26 00011010 1A 90 01011010 5A 154 10011010 9A 218 11011010 DA

27 00011011 1B 91 01011011 5B 155 10011011 9B 219 11011011 DB

28 00011100 1C 92 01011100 5C 156 10011100 9C 220 11011100 DC

29 00011101 1D 93 01011101 5D 157 10011101 9D 221 11011101 DD

30 00011110 1E 94 01011110 5E 158 10011110 9E 222 11011110 DE

31 00011111 1F 95 01011111 5F 159 10011111 9F 223 11011111 DF

32 00100000 20 96 01100000 60 160 10100000 A0 224 11100000 E0

33 00100001 21 97 01100001 61 161 10100001 A1 225 11100001 E1

34 00100010 22 98 01100010 62 162 10100010 A2 226 11100010 E2

35 00100011 23 99 01100011 63 163 10100011 A3 227 11100011 E3

36 00100100 24 100 01100100 64 164 10100100 A4 228 11100100 E4

37 00100101 25 101 01100101 65 165 10100101 A5 229 11100101 E5

38 00100110 26 102 01100110 66 166 10100110 A6 230 11100110 E6

39 00100111 27 103 01100111 67 167 10100111 A7 231 11100111 E7

40 00101000 28 104 01101000 68 168 10101000 A8 232 11101000 E8

41 00101001 29 105 01101001 69 169 10101001 A9 233 11101001 E9

42 00101010 2A 106 01101010 6A 170 10101010 AA 234 11101010 EA

43 00101011 2B 107 01101011 6B 171 10101011 AB 235 11101011 EB

44 00101100 2C 108 01101100 6C 172 10101100 AC 236 11101100 EC

45 00101101 2D 109 01101101 6D 173 10101101 AD 237 11101101 ED

46 00101110 2E 110 01101110 6E 174 10101110 AE 238 11101110 EE

47 00101111 2F 111 01101111 6F 175 10101111 AF 239 11101111 EF

48 00110000 30 112 01110000 70 176 10110000 B0 240 11110000 F0

49 00110001 31 113 01110001 71 177 10110001 B1 241 11110001 F1

50 00110010 32 114 01110010 72 178 10110010 B2 242 11110010 F2

51 00110011 33 115 01110011 73 179 10110011 B3 243 11110011 F3

52 00110100 34 116 01110100 74 180 10110100 B4 244 11110100 F4

53 00110101 35 117 01110101 75 181 10110101 B5 245 11110101 F5

54 00110110 36 118 01110110 76 182 10110110 B6 246 11110110 F6

55 00110111 37 119 01110111 77 183 10110111 B7 247 11110111 F7

56 00111000 38 120 01111000 78 184 10111000 B8 248 11111000 F8

57 00111001 39 121 01111001 79 185 10111001 B9 249 11111001 F9

58 00111010 3A 122 01111010 7A 186 10111010 BA 250 11111010 FA

59 00111011 3B 123 01111011 7B 187 10111011 BB 251 11111011 FB

60 00111100 3C 124 01111100 7C 188 10111100 BC 252 11111100 FC

61 00111101 3D 125 01111101 7D 189 10111101 BD 253 11111101 FD

62 00111110 3E 126 01111110 7E 190 10111110 BE 254 11111110 FE

63 00111111 3F 127 01111111 7F 191 10111111 BF 255 11111111 FF

Binary Num ber System for one byte

Bit Number| 7| 6| 5| 4|3|2|1|0|

Bit Weight|128|64|32|16|8|4|2|1|

Some Commonly used CVs

CV-1 S hort Address CV-6 M id Point Voltage

CV-2 Start Voltage CV-7 Ver N umber

CV-3 Acceleration Rate CV-8 M aker ID

CV-4 Deceleration Rate CV -17/18 Long Address

CV-5 Maximum Voltage CV-19 Consist Address

CV-21 Advance Consist function control

CV-22 Advance Consist headlight control

CV-23 Adva nce Consist acceleration rate

CV-24 Adva nce Consist decelera tion rate

SEE YOUR DECODER MANUAL FOR

ALL OF THE CVs IT USES AND THE

RANGE OF VALUES.

CV-29 Configuration R egister

Bit 0= Direction of travel

Bit 1=Speed step 28

Bit 2=d.c. enable

Bit 3= Advance acknowledgment

Bit 4= A lternate speed table

Bit 5= Long a ddress.

CV-66 Forward T rim

CV-67 to 94 Speed Table

CV-95 Reverse Trim

DEF 24April02

The 20 Critical Controls

1 - Inventory of Authorised and Unauthorised Devices

Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized

devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining

access.

2 - Inventory of Authorised and Unauthorised Software

Actively manage (inventory, track, and correct) all

software on the network so that only authorized software is

installed and can execute, and that unauthorized and unmanaged software is found and prevented from

installation or execution.

3 - Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations and

Servers

Establish, implement, and actively manage (track, report on, correct) the security configuration of laptops,

servers, and workstations using a rigorous configuration management and change control process in order to

prevent attackers from exploiting vulnerable services and settings.

4 - Continuous Vulnerability Assessment and Remediation

Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate,

and minimize the window of opportunity for attackers.

5 - Malware Defences

Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while

optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.

6 - A

pplication Software Security

Manage the security lifecycle of all in-house developed and acquired software in order to prevent, detect, and

correct security weaknesses.

7 - Wireless Access Control

The processes and tools used to track/control/prevent/correct the security use of wireless local area networks

(LANS), access points, and wireless client systems.

8 - Data Recovery Capability

The processes and tools used to properly back up critical information with a proven methodology for timely

recovery of it.

9 - Security Skills Assessment and Appropriate Training to Fill Gaps

For all functional roles in the organization (prioritizing those mission-critical to the business and its security),

identify the specific knowledge, skills, and abilities needed to support defense of the enterprise; develop and

execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning,

training, and awareness programs.

10 - S

ecure Configurations for Network Devices such as Firewalls, Routers and Switches

Establish, implement, and actively manage (track, report on, correct) the security configuration of network

infrastructure devices using a rigorous configuration management and change control process in order to

prevent attackers from exploiting vulnerable services and settings.

11 - Limitation and Control of Network Ports, Protocols and Services

Manage (track/control/correct) the ongoing operational use of ports, protocols, and services on networked

devices in order to minimize windows of vulnerability available to attackers.

12 - Controlled Use of Administrative Privileges

The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of

administrative privileges on computers, networks, and applications.

13 - Boundary Defence

Detect/prevent/correct the flow of information trans

ferring networks of different trust levels with a focus on

security-damaging data.

14 - Maintenance, Monitoring and Analysis of Audit Logs

Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an

attack.

15 - Control Access Based on the Need to Know

The processes and tools used to track/control/prevent/correct secure access to critical assets (e.g.,

information, resources, and systems) according to the formal determination of which persons, computers, and

applications have a need and right to access these critical assets based on an approved classification.

16 - Account Monitoring and Control

Actively manage the life-cycle of system and application accounts - their creation, use, dormancy, deletion - in

order to minimize opportunities for attackers to leverage them.

17 - Data Protection

The processes and tools used to prevent data exfiltr

ation, mitigate the effects of exfiltrated data, and ensure

the privacy and integrity of sensitive information.

18 - Incident Response and Management

Protect the organization's information, as well as its reputation, by developing and implementing an incident

response infrastructure (e.g., plans, defined roles, training, communications, management oversight) for

quickly discovering an attack and then effectively containing the damage, eradicating the attacker's presence,

and restoring the integrity of the network and systems..

19 - Secure Network Engineering

Make security an inherent attribute of the enterprise by specifying, designing, and building-in features that

allow high confidence systems operations while denying or minimizing opportunities for attackers.

20 - Penetration Tests and Red Team Exercises

Test the overall strength of an organization's defenses (the technology, the processes, and the people) by

simulating the objectives and actions of an attacker.

剩余150页未读，继续阅读

Yvonn1

粉丝: 1
资源: 5

网络安全与蓝队工具速查指南

数学建模拟合与插值.ppt

[net毕业设计]ASP.NET教育报表管理系统-权限管理模块（源代码+论文）.zip

mysql相关资源.txt

利用HTML+CSS+JS的国漫分享网站(响应式)

Python爬虫爬取漫画

C++语言编程用模拟退火算法解决旅行商问题

传感器试题及答案.doc

[net毕业设计]ASP.NET网上书店（源代码+论文）.zip

MongoDB数据表基本操作中文最新版本

1-全国各省废气、废水排放二氧化硫、氮氧化物、烟尘、颗粒物排放量统计数据2011-2021年-社科数据.zip

最新资源