01 Addresses: finding the right machine
Every device on a network has an IP address, which is simply its number. Without one, nothing can find it.
The familiar form looks like 192.168.1.42. Four numbers, each from 0 to 255. And you already know why the ceiling is 255: each part is one byte, which is lesson 00.1 showing up again.
Private and public addresses
There are not enough addresses in the world for every device, so networks reuse a reserved set internally. If an address starts with any of these, it is private and exists only inside a local network:
| Range | Where you see it |
|---|---|
| 192.168.x.x | Home routers, almost universally |
| 10.x.x.x | Large company networks |
| 172.16–31.x.x | Corporate networks and Docker |
| 127.0.0.1 | Your own machine, always. Called localhost |
When an attacker lands inside a network and starts finding 10.x.x.x addresses, they are discovering internal machines that were never meant to be reachable from outside. Mapping those is the first step of moving deeper, which you will learn in Phase 02.3.
02 Ports: finding the right service
An IP address gets you to the machine. But one machine runs many services at once, so each conversation also needs a port number.
The analogy that actually works: the IP address is the street address of an apartment building, and the port is the apartment number.
Some port numbers are agreed by convention, and knowing them is genuinely essential.
| Port | Service | Security note |
|---|---|---|
| 22 | SSH, remote login | Constantly brute-forced. A top target |
| 80 | HTTP, web | Unencrypted, anyone on the path can read it |
| 443 | HTTPS, encrypted web | What you want to see instead of 80 |
| 53 | DNS, name lookups | Often abused to smuggle data out |
| 3389 | Windows remote desktop | Should never face the internet |
| 3306 | MySQL database | Exposing this publicly is a serious flaw |
An open port is a door that answers when knocked. Scanning a machine means asking every port whether anything is listening. Each open port is a service, each service is software, and any software may have a vulnerability. That is why attack surface means "how many doors exist", and why closing unused ports is basic defence.
Check yourself
You scan a company server and find port 3306 open to the public internet. Why is that a serious finding?
Try it. This is a simulated scan of a lab host, and reading the output is the skill.
03 DNS: turning names into numbers
Nobody memorises IP addresses, so we use names. DNS is the phone book that converts a name like example.com into an address like 93.184.215.14.
Your browser cannot connect until this lookup finishes. It happens before every single connection you make, invisibly, thousands of times a day.
If someone can lie to you during that lookup, they can send you to their server while your address bar still shows the real name. That is DNS spoofing. Attackers also abuse DNS in the other direction, smuggling stolen data out inside lookup requests, because almost every firewall allows DNS traffic through without inspection.
04 TCP: the reliable conversation
Data does not travel as one lump. It is chopped into packets that cross the network separately and get reassembled at the far end.
TCP is the protocol that makes this reliable. It confirms every packet arrived, puts them back in order, and re-sends anything lost. Web pages, email and file transfers all use it.
UDP is the opposite. It fires packets off and never checks. That makes it faster but unreliable, which suits video calls and DNS lookups where speed beats perfection.
The three-way handshake
Before TCP sends anything real, both sides greet each other in a fixed three-step ritual.
This tiny ritual matters more than it looks. A port scanner works by starting the handshake and watching what comes back. A closed port refuses, an open port answers, and a firewall often stays silent. Those three different reactions are exactly how a scanner maps a machine.
Check yourself
Why does a port scanner care about the TCP handshake?
Step through the handshake yourself, then see what a scanner learns from each outcome.
05 Following one request end to end
Here is everything above, assembled. You type an address and press Enter.
- DNS lookup. Your Mac asks for the IP address behind the name and gets a number back.
- TCP handshake. Your Mac and the server exchange SYN, SYN-ACK, ACK on port 443.
- TLS handshake. Because it is HTTPS, both sides agree on encryption keys. This is lesson 00.5's asymmetric encryption doing its job.
- HTTP request. Your browser finally asks for the page it wants.
- Response. The server replies with a status code and the content.
- Render. Your browser draws the page and fetches whatever else it references.
The request itself is just text, which is why the web is so approachable for security work:
GET /index.html HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Cookie: session=a3f9b2c8
Notice that last line. The cookie is what proves who you are. The server does not remember you between requests, so your browser presents this token every time.
If an attacker obtains that session value, they can paste it into their own browser and the server will treat them as you. No password needed. This single fact drives an enormous amount of web security, and it is why session handling gets its own deep treatment in Phase 02.4.
Status codes worth knowing
| Code | Meaning | Why a tester cares |
|---|---|---|
| 200 | OK | It worked |
| 301 / 302 | Redirect | Can sometimes be abused to send users elsewhere |
| 401 / 403 | Unauthorised / Forbidden | Something exists but is protected. Interesting |
| 404 | Not found | Used to map which pages exist |
| 500 | Server error | Very interesting. Errors leak internal detail |
06 Do it on your real machine
Every command here only observes. Nothing is modified, and all of these targets are public services intended for exactly this.
See your own machine's addresses:
ifconfig | grep "inet "
Look up the IP address behind a name, which is DNS in action:
dig +short example.com
Watch every hop your traffic crosses on its way to a server:
traceroute example.com
Make a raw HTTP request and read the reply headers, exactly as the browser would:
curl -I https://example.com
See the full conversation, including the TLS handshake:
curl -v https://example.com -o /dev/null
List which ports are open and listening on your own Mac:
lsof -i -P | grep LISTEN
Looking up a name and requesting a public web page is normal internet use. Port scanning a machine you do not own is different, and in many countries it is illegal. Scan your own devices, deliberately vulnerable practice targets, or systems you have written permission to test. Nothing else. This distinction is not a formality, and people have been prosecuted over it.
Your checklist
- Can explain the difference between an IP address and a port
- Recognise a private address range on sight
- Know what ports 22, 80, 443 and 3306 are for
- Can describe the three-way handshake in your own words
- Understand why a stolen session cookie is as good as a password
- Ran dig, curl and traceroute on your own machine
- Can state when scanning is legal and when it is not
07 Final check
Question 1 of 3
A site loads over port 80 instead of 443. What is the risk?
Question 2 of 3
Why is data being smuggled out over port 53 hard to catch?
Question 3 of 3
Your friend asks you to scan their company's server to check it is secure. What is the correct response?
IP addresses find machines, ports find services, DNS turns names into numbers. TCP builds a reliable conversation with a three-step handshake that scanners exploit to map a target. And a single web request carries a cookie that is worth as much as a password.
✓ Key takeaways
The things from this lesson worth carrying into the next one. If you remember nothing else, remember these.
★ Carry these forward
- The IP address finds the machine, like a building. The port finds the service inside it, such as 22 SSH, 80 HTTP, 443 HTTPS, 53 DNS or 3306 MySQL.
- SYN, SYN-ACK, ACK. A scanner sends step one and reads the reply: an answer means open, a refusal means closed, and silence usually means filtered.
- It converts a name into an IP address before any connection. Lying during that lookup is DNS spoofing, and firewalls rarely inspect port 53, so data is smuggled out over it.
- After login the token is the identity. Anyone who presents it is treated as you by the server, with no password and usually no second factor required.
⚑ Keep going
You have read it and tried it in the lesson. Now cement it. These three do more for retention than re-reading ever will.