Network Configuration

Network configuration enumeration is one of the most important phases in Linux pentesting because the network defines how the system communicates, what services are reachable, which interfaces are exposed, and how traffic flows internally and externally. Misconfigured network settings can lead to lateral movement, privilege escalation, man-in-the-middle attacks, service hijacking, and full system compromise. This chapter provides fully practical, command-driven techniques to enumerate, understand, and exploit Linux network configurations.

Identifying Network Interfaces

The first step is discovering all active network interfaces and their IP addresses.

List interfaces and IPs:

ip a

Typical output snippet:

2: eth0: <BROADCAST,MULTICAST,UP> 
    inet 192.168.1.10/24
3: wlan0: <BROADCAST,MULTICAST,UP>
    inet 10.0.0.5/24

Interpretation:

• Multiple interfaces indicate multi-homed systems (potential pivot points).

• inet lines show IPv4; inet6 lines show IPv6.

• Unexpected interfaces (e.g., docker0, virbr0) reveal container or VM environments.

List interface details:

ip link show

Check MAC addresses and interface state (useful for fingerprinting and spoofing attacks).

Checking Routing Table

The routing table controls how packets leave the system.

View routing table:

ip route

Example:

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel

Key observations:

• A default route points to the gateway.

• Additional routes may reveal internal networks reachable through the host.

• Misconfigured routes may expose internal subnets unintentionally.

View IPv6 routes:

ip -6 route

IPv6 often exposes interfaces administrators forgot to secure.

Checking DNS Configuration

DNS misconfigurations lead to spoofing, hijacking, and interception attacks.

Check DNS servers:

cat /etc/resolv.conf

Example:

nameserver 8.8.8.8
nameserver 10.20.30.1

Look for:

• Internal DNS servers (high-value pivot targets).

• Search domains that reveal corporate structure.

Enumerating Default Gateways & ARP Cache

The ARP table shows directly reachable hosts and active devices on the local network.

View ARP:

ip neigh

Example:

192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE

Uses:

• Identifying routers and important hosts.

• Detecting other active devices for lateral movement.

• MAC address fingerprinting for OS detection.

Checking Network Services Listened On

List all listening services:

ss -tulpn

Example:

LISTEN 0 128 0.0.0.0:22    users:(("sshd",pid=727))
LISTEN 0 128 0.0.0.0:80    users:(("apache2",pid=1143))

Interpretation:

• 0.0.0.0 means the service is exposed on all interfaces.

• Services listening on public interfaces may be vulnerable to remote exploitation.

• Services running on localhost-only (127.0.0.1) may still expose internal vulnerabilities.

Check UNIX sockets (common for privilege escalation):

ss -lx

Check raw sockets (privileged):

ss -w

Checking Firewall Configuration

Firewalls control network exposure. Pentesters must confirm what traffic is allowed.

Check iptables:

sudo iptables -L -n -v

Check nftables (modern systems):

sudo nft list ruleset

Check firewalld:

sudo firewall-cmd --list-all

Practical observations:

• Allow-all rules expose services globally.

• Missing outbound restrictions allow easy data exfiltration.

• Misconfigured NAT rules can expose internal addresses.

Identifying Open Ports from the Host Itself

Test local ports:

netstat -tulpn

or:

nc -zv localhost 1-1024

Practical use:

• Identify services that system-wide tools may hide.

• Confirm privilege-specific ports.

Checking Network Manager Configuration

On desktop distributions:

nmcli con show
nmcli device show

Look for:

• VPN connections

• Bonded interfaces

• Wi-Fi credentials stored in plain text

VPN configurations often reveal internal networks.

Checking Hosts File

Inspect static host mappings:

cat /etc/hosts

Look for:

• Internal hostnames

• Developer/testing servers

• Redirects to malicious or unexpected IPs

Misconfigured hosts files may indicate hijacking or redirection attacks.

Discovering Active Connections

List active TCP and UDP sessions:

ss -tunp

Find outbound connections:

ss -tp

Look for:

• Unknown remote servers

• Connections to suspicious IPs

• Reverse shells

• Malware communicating outward

Example suspicious entry:

ESTAB 0 0 192.168.1.10:4444 45.90.11.30:12345 users:(("bash",pid=900))

Detecting Proxy or Tunneling Settings

Check environment variables:

env | grep -i proxy

Check SSH tunnels:

ps aux | grep ssh

Check open ports used by tunnels:

ss -tunnel

Proxies and tunnels may indicate:

• Malware

• Backdoors

• Developer access

• Covert channels

Enumerating Wireless Network Information

Check Wi-Fi interfaces:

iwconfig

List wireless networks:

sudo iwlist wlan0 scan

Look for hidden networks or corporate SSIDs.

Checking Network Interface Permissions

Writable interface configs are a major risk.

Inspect configs:

ls -la /etc/network/interfaces
ls -la /etc/sysconfig/network-scripts/

If writable by normal users, attackers can hijack DNS, gateways, or IPs.

Finding VPN, SSH, or Proxy Configurations

Scan for stored configs:

find / -name "*.ovpn" 2>/dev/null
find / -name "ssh_config" 2>/dev/null

Inspect SSH known hosts:

cat /home/*/.ssh/known_hosts

These reveal:

• Other reachable systems

• Lateral movement targets

• Internal infrastructure

Discovering Container & Virtual Network Interfaces

Look for Docker or container bridges:

ip a | grep docker
ip a | grep veth

Common indicators:

• docker0

• cni0

• virbr0

These often give access to internal container networks.

Practical Exploitation Scenarios

Scenario 1: Service Listening on 0.0.0.0

ss -tulpn | grep 8080

If a development server binds to all interfaces:

• Remote attackers can access it

• Often bypassing authentication

• Use for RCE or sensitive data exposure

Scenario 2: Outbound Connection Leak

ss -tp | grep ESTAB

A reverse shell or malware beacon is immediately visible.

Scenario 3: Writable Network Config

ls -la /etc/network/interfaces

If writable:

• Insert malicious DNS

• Redirect traffic

• Create backdoors

Scenario 4: Internal Networks Revealed by ARP

ip neigh

If multiple internal IPs appear:

• System may act as a pivot point

• Internal servers can be scanned

Scenario 5: VPN Profiles Exposed

find / -name "*.ovpn"

This gives attackers access to internal corporate networks.

Intel Dump

• ip a shows interfaces and IPs

• ip route reveals gateways and internal routes

• ss -tulpn shows listening network services

• ARP cache reveals active local devices

• /etc/resolv.conf shows DNS servers

• iptables and nft show firewall rules

• NetworkManager reveals VPNs and Wi-Fi profiles

• /etc/hosts exposes internal hostnames

• Active connections reveal malware or reverse shells

• Writable network configs enable hijacking

• Container interfaces indicate potential pivot networks

• VPN, SSH, and proxy files reveal internal infrastructure

Provide the next chapter title when you're ready.