Tapping the Network:
An Introduction to
Linux for
Cybersecurity
By: Derek Lamiroult
Craven Community College
August 5, 2025
The Agenda - Our Mission
• What is Reconnaissance? The Art of Information Gathering
• The Scenario: Our Authorized Target
• The Toolbox: Our Key Linux Commands
• ping : Is anyone home?
• nmap : What doors are open?
• grep : Finding the needle in the haystack
• searchsploit : Are there any known weaknesses?
• Putting it All Together: The Attacker’s Workflow
• Key Takeaways: The Defender’s Perspective
What is Reconnaissance?
The Art of Information Gathering
Reconnaissance (or "Recon") is the first phase of an ethical
hack. The goal is to gather as much information as possible
about a target before launching any attacks.
Think of it as casing a bank before a heist... but legally, and
to help the bank improve its security.
We ask questions like:
• What IP addresses does the target use?
• What services are running (e.g., a website, email server)?
• What Software versions are they using?
The Scenario – Our Target
Mission: Test Craven CC’s New Server
• Our Job: We have just been hired by Craven CC to
perform a security test on a new server before it
goes live.
• Rules of Engagement: We are only authorized to test
this specific machine.
• Our IP Address: 192.168.1.10
• Target IP Address: 10.10.10.5
Tool 1: ping – Is the Target
Online?
ping : The Digital Knock on the Door
• Purpose: Sends a small packet to the target to see
if it responds.
• The Command: $ ping –c 4 10.10.10.5
• The “-c 4” modifier ensures exactly 4 packets are sent,
otherwise it will run forever.
Tool 1: ping (cont.)
The Result: “0% packet loss” means
the target is online and
responding. Our test can begin.
Tool 2: nmap – What Doors Are
Open?
nmap : The Network Cartographer
• Purpose: nmap scans the target to discover open
ports and the services running on them. Think of it
as checking every door and window on a building.
• The Command: $ nmap –sV 10.10.10.5
• The “-sV” modifier tells nmap to figure out the exact
version of any software it finds.
Tool 2: nmap (cont.)
The Result: nmap found 2 open
ports.
• Port 22: SSH for remote admin
• Port 80: HTTP for a webserver
Tool 3: grep – Finding the
Needle
grep : The Ultimate Filter
• Purpose: grep searches through text to find lines
that match a specific pattern. It helps isolate the
important information from “noisy” command outputs.
• The Command: $ nmap –sV 10.10.10.5 | grep “open”
• Why? A full nmap scan can produce hundreds of lines.
grep allows us to instantly see only the results
that matter most to us – the open ports.
Tool 4: searchsploit – Checking
for Weaknesses
searchsploit : The Vulnerability Database
• Purpose: Now that we have software versions from
nmap, we can use searchsploit to check for any
publicly known vulnerabilities.
• The Commands: $ searchsploit Apache 2.4.41
$ searchsploit OpenSSH 8.2p1
Tool 4: searchsploit (cont.)
Putting It All Together: The
Attacker’s Workflow
• Is the target online?
• $ ping –c 4 10.10.10.5
• Result: Yes, it is.
• What services are running?
• $ nmap –sV 10.10.10.5 | grep “open”
• Result: SSH (OpenSSH 8.2p1) and HTTP (Apache 2.4.41) are running
• Are there known weaknesses in that software?
• $ searchsploit Apache 2.4.1
• Result: Yes, multiple known vulnerabilities exist.
Key Takeaways: The Defender’s
Perspective
• Minimize Attack Surface: If a service isn’t needed, turn
it off. Don’t leave unnecessary “doors” open.
• Patch and Update: The attacker is looking for known
weaknesses. Keep software updated to patch these
vulnerabilities.
• Firewalls: Configure firewalls to block unwanted probes
and access to sensitive ports.
• Know Thyself: Perform these same scans on your own
systems to find weaknesses before an attacker does.
Conclusions and Key Learnings
• Reconnaissance is the foundation of any security
assessment. You must first understand a target
before you can effectively test or defend it.
• Linux is a powerful tool for cybersecurity,
providing a suite of utilities to gather information
and analyze systems.
• The defender has the advantage: Simple steps like
disabling unused services and keeping software
patched can neutralize the vast majority of
automated attacks that rely on known exploits.