Protocols Category

blog
45+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit

Protocols blog

Filters

  • Networking
    Recon & mapping

    Networking

    Port by port, service by service: what to expect, what to try, and which exploits to remember for each protocol.

    Discover more Discover more
  • WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN
    networking

    WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN

    WAN penetration testing guide: Analyze VPN, IPsec, MPLS, and SD-WAN, identify tunnel vulnerabilities, and verify WAN infrastructure security.

    Discover more Discover more
  • FTP Bounce Attack: What It Is, How It Works, and How to Prevent It
    networking

    FTP Bounce Attack: What It Is, How It Works, and How to Prevent It

    FTP Bounce Attack: What it is, how the PORT command works, why it can enable indirect port scanning, and how to detect and prevent it.

    Discover more Discover more
  • Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing
    networking

    Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing

    Learn Scapy with Python to create and parse TCP, UDP, ICMP, and ARP packets, perform SYN scans, sniffing, ARP spoofing, and test firewalls and IDSs.

    Discover more Discover more
  • SIP and RTP Pentesting: VoIP Security, Attacks, and Tools
    networking

    SIP and RTP Pentesting: VoIP Security, Attacks, and Tools

    A practical guide to SIP and RTP pentesting: VoIP enumeration, authentication, traffic analysis, RTP injection, operational tools, and defenses with TLS and SRTP.

    Discover more Discover more
  • Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD
    networking

    Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD

    Port 135 open? Enumerate users with null sessions and RID cycling, run commands via WMI/DCOM with Impacket, and reach Domain Admin in 42 minutes. Complete AD pentest guide.

    Discover more Discover more
  • Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161
    networking

    Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161

    Learn what the SNMP Trap port 162 is used for, how the notification channel works compared to port 161, what risks it introduces with SNMPv1/v2c, and how to exploit it for reconnaissance, sniffing, and passive intelligence gathering.

    Discover more Discover more
  • Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests
    networking

    Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests

    Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests

    Discover more Discover more
  • VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec)
    networking

    VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec)

    How VPNs work and what they are at a technical level: IPSec, OpenVPN, WireGuard, L2TP, and PPTP. Tunnel architecture, real-world attacks, misconfigurations, and pentest analysis.

    Discover more Discover more
  • Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter
    networking

    Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter

    Complete guide to Blind XSS: out-of-band detection, server callbacks, XSS Hunter, stealth payloads, admin injection points, and internal panel trigger analysis.

    Discover more Discover more
  • STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover
    networking

    STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover

    Learn how STP and RSTP work, what the Root Bridge, Spanning Tree Protocol, and how BPDU election occurs, and what real risks exist in pentesting: takeover, TCN floods, and layer 2 attacks.

    Discover more Discover more
  • TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest
    networking

    TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest

    Complete guide to TCP: three-way handshake, flags, sequence number, windowing, port scanning with Nmap, session hijacking, SYN flood and traffic analysis.

    Discover more Discover more
  • TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities
    networking

    TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities

    TLS/SSL Pentesting Guide 2026: Handshakes, Weak Cipher Suites, ECH, Post-Quantum, Heartbleed, POODLE, and 15+ Vulnerabilities to Test with testssl.sh.

    Discover more Discover more
  • VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest
    networking

    VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest

    Learn how VLANs and 802.1Q work, the difference between access and trunk, native VLANs, inter-VLAN routing, DTP, double tagging, and VLAN hopping techniques in pentests.

    Discover more Discover more
  • VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks
    networking

    VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks

    Learn how VRRP, HSRP, and CARP work, how gateway failover occurs, and why takeover, priority abuse, and MITM are real risks in network pentesting.

    Discover more Discover more
  • Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks
    networking

    Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks

    The Complete Guide to 802.11 Wi-Fi: Wireless Frames, Monitor Mode, WPA2/WPA3, Four-Way Handshake, PMKID, Deauthentication, Evil Twin, and Real-World Pentesting Risks.

    Discover more Discover more
  • PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters
    networking

    PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters

    PPP Explained Well: How the Point-to-Point Protocol Works, the Differences Between PAP and CHAP, PPPoE, PPTP, MS-CHAPv2, Real-World Attacks, and Their Impact on Modern Pentesting.

    Discover more Discover more
  • QUIC What is HTTP/3, 0-RTT and blind spot in pentesting
    networking

    QUIC What is HTTP/3, 0-RTT and blind spot in pentesting

    QUIC explained clearly: what it is, how it works with HTTP/3, 0-RTT risks, UDP 443 inspection gap, logging bypass, and real-world implications for pentesting.

    Discover more Discover more
  • RARP What is it: Reverse ARP that reveals legacy and OT networks
    windows

    RARP What is it: Reverse ARP that reveals legacy and OT networks

    RARP: what it is, how it works, and why it still matters in pentests on legacy networks, OT/ICS, and PXE boot: request/reply, spoofing, boot hijacking, and the differences with ARP and DHCP.

    Discover more Discover more
  • SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces
    networking

    SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces

    SCTP What is it: how it works, four-way handshake, multi-streaming, multi-homing, scanning with Nmap, risks on SIGTRAN, Diameter and 4G/5G networks.

    Discover more Discover more
  • SNMP and Community Strings: How to Read Half the Network in a Pentest
    networking

    SNMP and Community Strings: How to Read Half the Network in a Pentest

    SNMP: what it is, how it works, OID, public/private community string, snmpwalk, brute force, write access, and real risks in an enterprise pentest.

    Discover more Discover more
  • UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest.
    networking

    UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest.

    UDP explained clearly: headers, differences with TCP, UDP scanning with Nmap, critical services like DNS, SNMP and NTP, amplification attacks and real risks in pentesting.

    Discover more Discover more
  • GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting
    networking

    GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting

    Learn what GRE is, how Generic Routing Encapsulation tunneling works, why it's risky in enterprise environments, and how to exploit or defend against it in a pentest.

    Discover more Discover more
  • IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit
    networking

    IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit

    Learn how IPSec works and why it is crucial in enterprise VPN pentesting: IKEv1/IKEv2, ESP, tunnel mode, aggressive mode, weak PSK, ike-scan, and defenses.

    Discover more Discover more
  • IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting
    networking

    IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting

    Learn the differences between IPv4 and IPv6 and why they matter in pentesting: SLAAC, NDP, RA spoofing, IPv6 scanning, dual-stack, control bypass, and defenses.

    Discover more Discover more
  • LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology
    networking

    LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology

    Learn what LLDP is, how it works, and why it's useful in pentesting: passive discovery, neighbor tables, VLANs, IP management, LLDP-MED, spoofing, and defenses.

    Discover more Discover more
  • NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network
    networking

    NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network

    Learn what NTP is, how it works, and why it's critical in pentesting: monlists, DDoS amplification, rogue NTP servers, time skew, Kerberos, TLS, logs, and defenses.

    Discover more Discover more
  • OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests
    networking

    OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests

    A complete guide to OSPF, EIGRP, BGP, and RIP: how they work, their differences, route injection, BGP hijacking, fake LSAs, MITMs, and defenses for dynamic routing protocols.

    Discover more Discover more
  • Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest
    networking

    Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest

    Learn what Ethernet is, how an 802.3 frame works, and why it's essential in pentesting: MAC address, switches, CAM table overflow, sniffing, spoofing, and defenses.

    Discover more Discover more
  • HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest
    networking

    HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest

    Learn what HTTP is, how HTTPS works, and why it's essential in web pentesting: methods, headers, cookies, status codes, fingerprinting, enumeration, and real-world attacks.

    Discover more Discover more
  • ICMP: What It Is, How It Works, and How to Use It in a Pentest
    networking

    ICMP: What It Is, How It Works, and How to Use It in a Pentest

    Learn what ICMP is, how ping and traceroute work, and why it's crucial in pentesting: host discovery, ICMP tunneling, redirection, fingerprinting, detection, and defenses.

    Discover more Discover more
  • IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting
    networking

    IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting

    Learn what IGMP is, how multicast works, and why it's useful in pentesting: host discovery, membership reporting, IGMP snooping, reconnaissance, DoS, and security.

    Discover more Discover more
  • IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting
    networking

    IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting

    Learn what IP is, how headers, TTLs, routing, and fragmentation work, and why it's essential in pentesting: IP spoofing, evasion, reconnaissance, and defenses.

    Discover more Discover more
  • ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest
    networking

    ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest

    Learn what ARP is, how it actually works, and how it's exploited in pentesting: ARP cache, gratuitous ARP, spoofing, MITM, detection, defenses, and practical tools.

    Discover more Discover more
  • DHCP: What It Is, How It Works, and How to Use It in a Pentest
    networking

    DHCP: What It Is, How It Works, and How to Use It in a Pentest

    Learn what DHCP is, how the DORA process works, and how to exploit it in a pentest: starvation, rogue DHCP servers, WPAD injection, option 121, and real-world defenses.

    Discover more Discover more
  • DNS: What It Is, How It Works, and How to Use It in a Pentest
    networking

    DNS: What It Is, How It Works, and How to Use It in a Pentest

    Learn what DNS is, how name resolution works, and how to leverage it in a pentest: zone transfer, subdomain enumeration, cache poisoning, tunneling, and defenses.

    Discover more Discover more
  • Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting
    networking

    Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting

    Socat for advanced networking: relay, port forwarding, reverse shell, and encrypted tunnels. The Swiss Army Knife for network connections in pentesting.

    Discover more Discover more
  • RSH: Clear Text Remote Shell on Unix Systems
    networking

    RSH: Clear Text Remote Shell on Unix Systems

    RSH: Clear Text Remote Shell on Unix Systems

    Discover more Discover more
  • RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access
    networking

    RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access

    RevSocks creates a reverse SOCKS proxy between the attacker and the compromised target, allowing pivoting and access to internal networks in authorized pentests.

    Discover more Discover more
  • NBTSscan: Fast NetBIOS Enumeration on Windows Networks
    networking

    NBTSscan: Fast NetBIOS Enumeration on Windows Networks

    NBTSscan is a lightweight NetBIOS enumeration tool for Windows networks. It identifies hostnames, domains, and MAC addresses via NetBIOS queries.

    Discover more Discover more
  • NC: The Swiss Army Knife of TCP/UDP Connections
    networking

    NC: The Swiss Army Knife of TCP/UDP Connections

    NC is a versatile tool for TCP/UDP connections, port scanning, banner grabbing and reverse shell in authorized penetration testing.

    Discover more Discover more
  • ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting
    networking

    ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting

    ProxyChains: A practical guide to anonymizing traffic and chaining proxies in penetration testing. Configuration, SOCKS5, and tool integration.

    Discover more Discover more
  • SSHuttle: VPN over SSH for Pivoting in Penetration Testing
    networking

    SSHuttle: VPN over SSH for Pivoting in Penetration Testing

    SSHuttle: A complete guide to creating VPNs over SSH for penetration testing. Pivoting, tunneling, and accessing internal networks without configuration.

    Discover more Discover more
  • Rsync Port 873: Enumeration, Anonymous Access and Exploitation
    networking

    Rsync Port 873: Enumeration, Anonymous Access and Exploitation

    Pentest Rsync on port 873: enumerates rsyncd and modules, verifies anonymous and write access, analyzes exposed files and possible attack paths.

    Discover more Discover more
  • Telnet Door 23: Exploitation, Credential Abuse and Pivoting
    networking

    Telnet Door 23: Exploitation, Credential Abuse and Pivoting

    Learn how to exploit Telnet on port 23 during a pentest: enumeration, banner grabbing, credentials, privilege escalation, pivoting, and lateral movement.

    Discover more Discover more