Talking to protocols by hand: nc, telnet, openssl
You connect to HTTP, SMTP, POP3, IMAP, FTP and DNS without a client program, typing line by line, and see what services really say.
Level 101 · 15 lessons · 12 practice labs
Lessons
Text-based protocols
- The client–server dialogue: request, response, status code
- Opening TCP and UDP connections with nc
- Writing HTTP by hand: GET, the Host header, the response
- Looking at an encrypted connection with openssl s_client
- Short task: download a page using nothing but nc
Mail protocols
- SMTP: sending a message from HELO to DATA
- Reading a mailbox with POP3 and IMAP
- Mail headers: the Received chain and the sender
- Short task: send a test message, read it and decode its headers
File, name and time services
- FTP: control and data connections, active and passive mode
- TFTP: fetching a configuration file
- A DNS query on the wire: dig +trace, UDP and TCP
- NTP: querying the time and seeing the offset
- Short task: match a server’s services to their protocols
Wrap-up
- Capstone: document every protocol a server speaks
Practice labs
- Collect status codes by hand: Send HTTP requests to four different paths on the server with nc, and write down each status code and its key header.
- Same IP, a hidden second site: Change the Host header by hand to find the second virtual site on the same address, and read the note it serves.
- Why is the certificate rejected?: Inspect the server’s certificate chain with openssl s_client and write down, with evidence, why it is rejected (expiry, name mismatch or missing intermediate).
- Send an email by hand: Connect to the SMTP server with nc or telnet, send a message with a subject line to the given recipient and record the server’s reply codes.
- A lost invoice in the mailbox: Walk the folders with IMAP commands, find the message carrying the given invoice and read its reference code.
- A fake manager email: decode the headers: Examine the Received chain and sender headers to prove which server the message really came from and which header was forged.
- Pull the printer config over TFTP: Download the given configuration file from the TFTP server and find the management address inside it.
- FTP logs in but no listing arrives: Try active and passive mode to find why the directory listing never arrives, download the file and explain which port the data connection used.
- Is the FTP password in the clear?: Capture an FTP session in your own lab with tcpdump to show credentials travel in clear text, then repeat the transfer over an encrypted method and document the difference.
- The server with a drifting clock: Measure each lab server’s offset from the NTP server and write down which machine’s clock has drifted and by how much.
- A large DNS answer falls back to TCP: Capture with tcpdump a query for a large record switching from UDP to TCP, and point out the truncation (TC) flag.
- Unlabelled services on unusual ports: Work out which protocol each of three services on non-standard ports speaks from their replies to requests you send by hand, and write down your reasoning.
About this course
You connect to HTTP, SMTP, POP3, IMAP, FTP and DNS without a client program, typing line by line, and see what services really say.
What you will learn
- Text-based protocols
- Mail protocols
- File, name and time services
- Wrap-up
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.