CNAB Extended

Kerberos

Port 88 TCP/UDP

POP3

TCP 110

used to retrieve mail from the mail server

dual stacking

Loading both IPv4 and IPv6 on network nodes. Allows a machine to utilize either protocol

egrep

Searches a file or files for lines that contain strings of a certain pattern

netstat

provides information and statistics about protocols in use and current TCP/IP network connections

netstat -a

All connections and listening ports

netstat -b

executable associated with creating each connection

netstat -e

Displays Ethernet statistics

netstat -f

Displays fully qualified domain names (FQDNs) for foreign addresses

netstat -n

Displays addresses and port numbers in numerical form.

Windows Registry

read during: boor, application startup, user login

NAT

network address translation, connecting multiple computers to the internet using one or multiple IP addresses

static NAT

Allows for one to one translation of local to global addresses

dynamic NAT

Maps an unregistered IP address to a registered IP address from a group of registered

IP addresses.

PAT

Port Address Translation (Overloading) translates multiple local addresses to a single global address by keeping track of port assignments

Secondary memory/storage

long-term, non volatile storage media e.g. hard disk

Hardware

The physical components of a computer.

Software

the programs and other operating information used by a computer.

Firmware

computer software that is installed into devices such as printers, print servers, and various types of communication devices

Windows page file

C:\pagefile.sys

Bit bucket

a logical place where lost, deleted, or unavailable data goes

tasklist /s

specifies the name or IP address of a remote computer.

tasklist /u

runs command with the account perssoion of the user who is specified.

tasklist /p

specifies the password of the user account.

tasklist /m

lists all tasks with DLL modules loaded that match the given pattern.

tasklist /v

displays verbose task information in output.

TTL for Windows

128

TTL for linux

64

IPv6 Bit Length

128 bits (d eight segments of 16-bit hexadecimal numbers)

IPv4 Bit Length

32 bits = 4 bytes

Kerebros client side .dll

kerebros.dll

Kerebros server side .dll

kdcsvc.dll

kerebros key distribution center (KDC)

domain controllers act as KDCs, LSA uses kdcsvc.dll

kerebros- realm

the collection of computers/accounts secured by the KDC

authentication service

issues the Ticket Granting Ticket (TGT) which serves as proof of authentication

Ticket-Granting Ticket (TGT)

user's proof that they provided the correct credentials during initial logon

ticket granting service (TGS)

responsible for issuing Service Tickets which allow the user access to resources on the network

service ticket

verified by a resource provider to allow user access to specific resources

session key

initial session key is the password hash of the user attempting to logon

1st authentication service exchange step

client sends a clear text request to authenticate message to the AS

2nd authentication service exchange step

AS checks for user in AD, AS sends back encrypted SK and TGT

1st step of TGS exchange

client sends encrypted TGT, the identity of requested service and authentication

HKEY_USERS (HKU)

contains a SID sub-key for all loaded user profiles.

HKEY_LOCAL_MACHINE (HKLM)

contains specific information about the hardware, software, and preferences for all users who log into the system.

HKEY_CLASSES_ROOT (HKCR)

is used to associate file types with programs that are used to open them.

HKEY_CURRENT_USER (HKCU)

contains user profile environment settings of the interactively logged on user.

HKEY_CURRENT_CONFIG (HKCC)

used to establish the current hardware configuration profile

FTP (Data)

TCP 20

FTP (Control)

TCP 21

SSH

TCP 22

Telnet

TCP 23

SMTP

TCP 25

DNS (Queries)

UDP 53

DNS (Zone Transfers)

TCP 53

DHCP

UDP 67/68

used by host to obtain an IP address from a DHCP server

DORA

Discovery, Offereing, Request, Acknowledge = DHCP sessions four step process

TFTP

UDP 69

HTTP

TCP 80

IMAP4

TCP 143

enables search

SNMP

UDP 161/162

LDAP

TCP 389

HTTPS

TCP 443

RLOGIN

TCP 513

NETBIOS (name service)

UDP 137

NETBIOS (datagram service)

UDP 138

NETBIOS (session service)

UDP 139

RPC

TCP 135

SMB

TCP 445

RDP

TCP & UDP 3389

WinRM

TCP 5985/5986

runlevel 0

Halt mode All processes terminated

runlevel 1

Single-user mode Used to perform administrative tasks to this system.

runlevel 2

Multi-user mode Allows users to access the system

runlevel 3

Full multi-use mode Same as multi-user, but includes network services.

runlevel 4

User-defined mode Not specified by system. Universally defined and customizable.

runlevel 5

X11 Default; multi-user, network services and X-windows display manager (X11).

runlevel 6

Reboot mode All processes terminated; system is gracefully rebooted.

ASCII null

0

ASCII space

32

ASCII 0-9

48-57

ASCII A-Z

65-90

ASCII a-z

97-122

ASCII del

127

compiled language

converts permanently into machine code

scripting languages

convert source code into machine code on the fly

symbolic link

file containing the pathname of another file

inode

contains the metadata for each file and directory

DNS resolver file Windows

C:\WINDOWS\system32\DNS

DNS resolver file Unix

/etc/resolv.conf

layer 7

application

layer 6

presentation

layer 5

session

layer 4

transport (TCP, UDP)

layer 3

network, router (IP)

layer 2

data link, (switch, network adapter, bridges, (ethernet, 802.11))