Hey everybody.
Welcome to the next set of videos.
So in these next few videos we're gonna be going over just a few common protocols so you can kind of
get a better idea of what's out there.
Now the first we're going to be talking about as ICMP now ICMP stands for Internet control message protocol.
This protocol is used mainly to report errors to nodes for some reason.
Now this contains a fair amount of error messages so we're gonna we're going to only hit two of the
main ones but I'm going to give you a list of the rest of them.
This is commonly used for ping which is what we used before.
Ping just identifies whether a host is alive or not.
Now some of these common responses are so we can send something called an echo reply and echo request.
So there's a reply request for most.
There is no destination unreachable so when a host the router can't find a destination for the actual
IP or the IP just doesn't exist on that network as an example.
So if it's a private IP space of like 1 9 2 1 6 8 dot 1 dot 5 is your router and you're trying to reach
a 1 to 1 6 8 9 dot to that that network to DOT doesn't actually match on the network at all you'll get
a destination unreachable.
Then we have our redirect messages our router advertisements times exceeded and then a timestamp timestamp
reply and a trace route we're going to be going over ping and trace route in this particular video but
I want you to feel free to grab a few of these and look in how they work.
So for example destination unreachable is another important one.
So I want you to take a second here and go look and see how.
Destination unreachable works in ICMP now.
Ping is commonly used a test of an IP address is live.
So does it respond in some way shape or form.
A client will send an echo request over ICMP and the server not client they're sorry the server or the
end node will reply with an echo reply.
Now what's interesting is what I want you to do is look up how ping works and figure out what traffic
is actually sent because there is data sent even though it's an ICMP packet.
Data is sent across the wire to the remote host.
When you issue ping.
So I want you to look up and find out what that is.
It might be pretty interesting to you to see what actually is sent now a router will display destination
unreachable the IP is not alive which we've already spoken about.
Now the ping utility the ping software application is what actually will interpret this for you and
presented to you in a better format.
Now for further command Windows and Linux use ping and then whatever the IP addresses.
So in this case you can use the gateway to test it out.
Just remember that on Linux when you use ping on something it will ping indefinitely on Windows I believe
it stops at four or five for Linux.
You have to uses a separate flag to tell it how many pings you want to send because Linux will just
consistently ping a host indefinitely so keep that in mind when you're using when you're attacking a
machine and you're trying to inject some sort of command into a web application.
If if it's a Linux command you do not want to just send it a ping.
Otherwise your pagers just sit there forever.
Now trace route trace route is commonly used to track the hops which we've talked about before through
the net the packets traversal through some sort of network.
Now from the time that you send a packet out to the time you send it to the time it receives it's being
received.
It hits certain hops of certain switches routers firewalls.
Now a client will send an outdated ICMP tracer out packet to its destination because of that.
It will then it does it based on hops.
So for example a little send it outdated in terms of it will send if if there is more than one hop it
will it will kick back.
So when it hits the first hop It'll kick back and then it'll send again with two hops and then are two
available hops.
So it can only hop twice before it kicks back so that it will just keep doing that more and more and
more until it eventually hits its end destination which will then print out and show you all of the
hops that or all this all the endpoints that it has reached before it got to its final destination.
Now when you're running this utility whether it's trace Artie or trace route on Linux as the commands
show below you may you may see when you try to trace route for example red tube nation or Google or
anything like that you're going to see some sort of blank.
It's going to start showing you all of the it's going to show your router first and then it's going
to show your ISP and then it might show a few more ISP is that it might be showing my ISP.
And then it's blank.
Normally that indicates by stars when I say blank so you'll know what I'm talking about when you see
it however understand that that happens when a firewall is in the way.
So the the packets still is traversing.
However it's not sure how far it made it or what host it made it to because the firewall isn't going.
In most cases firewall isn't going to a firewall isn't going to let any ICMP traffic at all through
it.
So there's no reason somebody from the outside should be pinging an internal host.
So keep that in mind.
These are just a few examples of ICMP responses.
Take a few minutes.
Check out ping.
Use it understand what it does and then do the same thing with trace route with Google.
Red team nation whatever whatever domain you want to use it for.
Give it a try see what.
See what the outcome is and you'll you'll start seeing how things build up on each other.