Hacks

networkscans

ping target.com

list ip + macadresses in network
arp -a

for ping 256 last ip in your network
nmap -sP 192.168.1.0/24 
nmap -T4 -F 192.168.2.0/24

list ip-adresses
netstat -r

hostname / computername ?
nslookup 192.168.2.119
dig -x 192.168.2.119

mein computername
host `uname -n`

wireshark

passwordsniff
http.request.method == "POST"

Um zu ermitteln, ob ein User im Netz unverschlüsselte E-Mail-Kommunikation betreibt, reicht ein einfacher Capture-Filter:
tcp port 110 or tcp port 25 or tcp port 143

http://www.thegeekstuff.com/2012/07/wireshark-filter/

displays all TCP resets
tcp.flags.reset==1 

displays all HTTP GET requests
http.request 

displays all TCP packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID
tcp contains traffic 

Sets a filter for any packet with 10.0.0.1, as either the source or dest
ip.addr == 10.0.0.1 

sets a conversation filter between the two defined IP addresses
ip.addr==10.0.0.1  && ip.addr==10.0.0.2 

Match destination: ip.dst == x.x.x.x
Match source: ip.src == x.x.x.x
Match either: ip.addr == x.x.x.x

---

ping target.com
arp -a
In the list returned by the arp command, search for the IP address you found with the ping command. Once you have the MAC address – say, "AA:BB:CC:DD:EE:FF" – type in the filter box:
eth.addr == AA:BB:CC:DD:EE:FF

Now suppose you want to capture all traffic using specific protocols generated by a host, such as pop3, ftp, http, or messenger. In the filter box, enter:
ip.addr == 192.168.0.1 and (http or ftp or messenger or pop)
This says show all the traffic generated or directed to the IP address 192.168.0.1 and display only http or ftp or pop or messenger packets.
You can capture all such traffic that runs over your network with a specific address or from multiple clients:
ip.addr == 192.168.0 and (http or ftp or messenger or pop)

---

ip.addr==192.168.0.1 --- Show all traffic from and to 192.168.0.1

tcp.port==80 --- Show all the traffic with 80 as a source or destination port

ip.src==192.168.0.1 and ip.dst==10.100.1.1 --- Show all the traffic that starts from 192.168.0.1 and has as target 10.100.1.1

ftp --- Show only the traffic for the ftp protocol

http --- Show only the traffic for the http protocol

dns --- Show only the traffic for the dns protocol

Show all http traffic where the url contains the word "string."
http.request.uri contains string