Cleartext protocols: FTP, Telnet, SMTP, POP/IMAP, SNMP, syslog
You learn how old but still living cleartext protocols look in traffic, what they leak and how to move to their secure counterparts.
Level 201 · 15 lessons · 12 practice labs
Lessons
File and remote access
- FTP control and data channels: active and passive mode
- Recovering a transferred file from FTP traffic
- Rebuilding a Telnet session keystroke by keystroke
- Short task: find the password and file leaked over FTP
Email
- The SMTP dialogue: HELO, MAIL FROM, RCPT TO, DATA
- STARTTLS and how the switch to encryption looks in traffic
- POP3 and IMAP: login and fetching messages
- Extracting an email attachment from traffic and hashing it
- Short task: identify the sending server and attachment of a phishing email
Management protocols
- SNMP v1/v2c: community strings and leaked device data
- Syslog over the network: UDP 514 and lost records
- Cleartext LDAP and simple bind: plaintext passwords in the directory
- HTTP Basic authentication: Base64 is not encryption
- Secure replacements: SFTP, SSH, SMTPS, SNMPv3, syslog over TLS
- Capstone: inventory every cleartext credential on a network and write a migration plan
Practice labs
- Read an FTP login: Extract the username, password and issued commands in order from the FTP control channel.
- Recover the file transferred over FTP: Find the passive mode data channel, rebuild the transferred file and take its SHA-256 hash.
- Rebuild a Telnet session key by key: From a Telnet session to Karaçam Mobilya's old switch, pull out the typed commands and backspaces to produce the real command list.
- Read an SMTP conversation step by step: Write the HELO, MAIL FROM, RCPT TO and DATA steps of an SMTP session with their values.
- Before and after STARTTLS: Compare two SMTP sessions, show which one switched to encryption and what was visible before the switch.
- Extract the attachment of a phishing email: From the cleartext email in a prepared capture identify the sending server, extract the Base64 attachment and report its hash.
- Find the SNMP community string: Extract the community string and the queried device's name from SNMP v2c traffic.
- HTTP Basic is not encryption: Decode the header of three requests using Basic authentication and list which accounts are exposed.
- Catch a cleartext LDAP bind: Find the accounts sent in clear in simple binds to the Demirsu Enerji lab directory and compare with LDAPS.
- Inventory cleartext protocols by port: List the servers speaking FTP, Telnet, POP3, IMAP, SNMP and syslog in a network capture with their ports.
- Read syslog passing over the network: From log messages in UDP 514 traffic work out which devices send what kind of events and show the sign of loss.
- Credential inventory and migration plan: Inventory every cleartext credential in the Turnalı Perakende store network capture and write a short plan proposing the secure replacement for each.
About this course
You learn how old but still living cleartext protocols look in traffic, what they leak and how to move to their secure counterparts.
What you will learn
- File and remote access
- Email
- Management protocols
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.