Port forwarding. One of the many tools that we have in our arsenal to be able to help us evade
IDS and IPS protection, whether it be on the host or the network itself.
And it's starting to get into the actual point where we're pivoting through the actual network
itself. Now, our practice in this skill is going to be a little limited based on the number of
virtual machines, but I'm pretty confident that we can get the concepts and practice down enough
to where not only in this lab, but on your own, you can also go through and do some of these
in test environments. So long as you have the proper permissions, but first let's review a
couple of things. Now I have a link below that is the actual IANA site. And the reason that I have
this on there is because that's the list of common ports and common ports are usually those that are
identified already with numbers to the actual protocol that's being used. Like for example,
port 80 is always going to be HTTP on the worldwide web. All web servers are basically
going to use port 80 for that common port of communication. And we have these common ports
signed because we know that standard types of traffic. Otherwise you'd have to go into your
web browser, type in HTTP, www.google.com, 80443, whatever port they're using for that actual
protocol. So to make things simple, we have common ports. Now these common ports are listed on the
link that I have for you, along with a few others. And generally from what I'm looking at here, and
I'll kind of show you what I'm looking at here, right here are the actual common ports that are
assigned here on port number. Like for example, we can zoom in and we can see
that let's say port TCP 13 is a daytime or port 7 on TCP is echo. And the more that we go through
this and take a look at it, we can see like we get the ones that are more common to us.
There we go. SSH port 22. And we're going to be using that a little bit more frequently
in this course, this particular skill to be able to do what's called tunneling. And tunneling
allows us to be able to go from one device to another using a different port or protocol,
or even through another system. Usually when we use the term tunneling, we're talking about going
from one site to another in through some sort of encapsulation, think like network world.
And if you're curious, definitely check out some of the Cisco courses here on CBT Nuggets.
Tunneling in our sense is going to be in the same vein, but being able to use another workstation
or system within our target network as a pivot point. Now, there are a few reasons why we would
want to do this. For example, let's say that we are able to make it to a system inside the
organization from our Kali system that's in a remote network somewhere. And that's the only
system that we can access on the internal network. It's a system that has a public and
a private IP address on it. Well, everything else on the inside network with those private IPs
is what we're really going after. See, we just tapped a web server, for instance. And we want
to be able to use that web server to pivot inside the network using trusted IPs from that private IP
range. Because we can't ping from our workstation that we're pentesting from, if we're remote,
anything that's in a private IP address, 10.192.168.172.16. Yeah. So that's why we would
actually start pivoting and using tunneling as one of our methods to do so. Now, we could very
well go in and remote shell like we've done with some of the fake files and reverse shell techniques
we've used already. But we can also use tunneling to help us do evasion tactics. And the reason for
this is, is because for tunneling from point A to point C inside the network through point B,
IDS and IPS systems out there will look at the actual packets themselves, and we'll have
examples of this. And they're going to see that it's coming from something on the trusted IP
list of their inside network, not our IP address. Think of this as a way to VPN inside of a network
and make us think that we're a part of that private network. And the ports that we were looking at on
that common ports list are those that are normally used for different types of traffic. So what if we
want to use that tunneling technique through a port that's already common? A reason that we might do
this is because we know that those common ports 99.9999% of the time are going to be open to be
able to traverse in and out of a network, even if it's a private IP address network. I mean, who's
going to stop port 80 from going in and out, right? So what if we go into our target system that sits
on that private public balance, and then tunnel through a port that we know that's going to have
access into the actual private network? Because if they're good network technicians on the inside
of that organization, they're going to block all unused ports. So something like in the old IRC
range of 6664, all the way to seven would normally be blocked off, but port 80, port 443, and etc,
etc, port 25. These are ports that are generally going to be open, and we would be able to do our
in-map sweep to be able to find out what ports are open on that target system. And then we could
use those open ports to be able to tunnel from one to the other. Now there's other reasons to tunnel
as well too, and also to be able to send traffic in not so common methods, which are some things
that we'll start talking on as this skill unfolds, because tunneling is not the, in the
traditional sense, is not what the only thing we're going to be looking at. These are just
things to consider and understand before we start going into our actual exercise
in the next portion of this skill. So let's do it to it.