-: Another great passive reconnaissance tool is Netstat.
And the great thing about netstat,
is it's a command-line tool that's on Windows,
Linux, and Unix systems, including OSx,
which is Macintosh.
So what is netstat?
Well, it's gonna provide you
with active TCP and UDP connections from that machine.
And this is useful to determine
if there's a bad guy in your network
that's trying to get data out,
or there's a persistent connection.
This is gonna help you identify processes
that are using that connection as well,
and provide you statistics on sent and received data,
as well as route table information.
So how do you use netstat?
Well, like I said, it's a command-line tool.
So on Linux, you could type man, M-A-N,
space, netstat, and get the manual.
On Windows, type in netstat, and then a question mark,
and you'll get the Help file for it.
But, we're gonna go through a couple of the key commands
that you should know here in this lesson.
Netstat -a.
This is gonna provide you all of the active,
a for active, TCP and UDP connections,
filtered out by TCP, UDP, ICMP, IP, IPv6, and more.
So here's an example from my machine.
You can see Jason's MacBook here,
and I typed in netstat -a,
and just saw on September 20th, at 8 pm,
what was I connected to?
Well, you can see there my local address of where it was,
and the foreign address.
And the foreign address shows you what connections
I currently had available.
Now a lot of those were because I had Avast.
I was running a file scan with viruses.
I had Adobe, because I had Adobe Premier open,
and it has a callback to Adobe
to make sure my registration was valid.
And you can see here all the things that it's talking to.
And you can look at that, and start looking and going,
"Hmm, what is that 17.173.65.216?
"Is that malicious?"
And I can Google that and figure that out,
based on the indicators.
And you'll see, TCP flow is a protocol,
because these were IPv4 things that were being found.
The next one, netstat -0.
And this is gonna identify the processes
that are using the connection.
And so, as you can see here, when I did that,
you'll see the local address and my workstation,
192.68.66.129,
and you'll see where it was connecting to.
It was going to msnbot.
Hmm, that doesn't sound good.
We might wanna investigate that.
And that is on process 1336, for instance.
Why is it important to know the process?
Well, if we see malicious activity,
we wanna be able to stop that program from operating.
One of the ways you can do that,
is by killing the process using that process ID
in the far right column.
So again, just another way to find out
where that information is going, and what is using it.
Now the next one we're gonna talk about,
is netstat -e.
And netstat -e is gonna be ethernet statistics,
hence the e, on sent and received data.
This is gonna tell you volume,
kinda like netflow did, right, at any given time.
So when you do netstat -e, it's gonna say,
"From the time you bought this computer up,
"how much has been sent, how much has been received,
"how much of that unicast, how much of that was non-unicast,
"or broadcast traffic?"
And this is gonna just tell you flow.
If you know on a daily basis,
you usually use three billions bytes of data,
and today, you used 10 billion bytes,
and you weren't home all day,
why was that?
Maybe somebody is stealing your data.
This'll tell you that information.
The next one, netstat -r.
R stands for route,
and this is gonna display the routing table information.
So again, this is a really helpful tool, right?
We found our processes, we found the amount of volume,
we found where the IPs are going,
and now we find the routes.
And so with these routes,
it'll actually dump the routing table to you.
And you can see an example here on the screen
from my MacBook.
You'll see that my 10.40.8.blah,
which is what my component was on,
on that network,
and where those things are,
and all the routes I know.
In my case,
all the routes are actually private routes, right?
There are 10 networks.
They're 192, 168 networks,
and 172.16 networks.
So, nothing that's scary out there,
and you can see I have a couple of virtual networks there,
as well, vmnet2, vmnet1, vmnet8, et cetera, right?
This just gives you an idea
of what routes you have out there,
so you could see,
do I have a route to someplace that shouldn't have?
Because sometimes, an attacker, an APT, for instance,
will go in, and set a route back into their network,
so they have a backdoor into you.
You wanna make sure you can see that here.
And that's the idea of using netstat.
Again, just a couple of tools,
the -a, the -0, the -r, the -e,
different commands from netstat,
to give you that passive reconnaissance information.
(funky jingle)