Crossover cable or router : hacking lab

[coVert]

I am debating about using a crossover cable for my hacking lab or to use a router or switch.
I was wondering what will I be able to do or not do with a crossover or a router. I have a router right now but will that change anything I can or can't do if I had a switch for my lab. Also should I have these lab machines connected to the internet while using these tools or have them offline? Lastly, any advice on some basic tests to conduct first after the lab is setup. I was thinking about testing out-of-the box security, netbios, various scanning techniques. If someone could list some attacks I could try with the skill level that is required i.e. beginner, intermediate, advanced, I will be sure to look up info on them and give em a try. Thanks

[HTRegz]

For the future you should prolly refer to it as a test lab ....

Anyways do you mean a real router or a home router? Because that makes a difference. If you mean the home router style that is really more of a switch anyways. If you mean a real router you'll probably want a switch anyways (unless it has two ethernet connections and even then, I'd prolly want a switch between each one). Also are we talking managed switch or dumb switch? If you have a third computer, I'd actually suggest a hub if you are just starting to learn. Then you could use a one-way cable (described in other threads on this site), or a regular straight-through and set-up the third computer with a packet sniffer running. You could see everything that's happening on the wire from a third party and none one of the involved machines. After that move on to a switch and you can start testing out programs like ettercap. Then after you have the experience with both of them, if you can afford to... drop a couple hundred bucks and pick up a cheap lowend cisco router.. like a 2501 or something similar. That's how I'd do it anyways....

peace

[coVert]

Yes it is a home router. What excactly is the difference between a one way cable and crossover. I didn't know if my current dlink router would make it harder to do security audits as opposed to a hub or switch. Would you suggest starting with the computers connected straight to one another without a router before putting the router/switch in the loop?

[BioHazzard]

personally I don't know that it really matters. The object is to obtain access to what ever information you are looking for and it basically starts with connecting to the other box. If it is crossover or switch I think just depends on whether or not you have more than one computer and whether or not you want to have 2 nic cards or no internet access.

I use a switch so that i can still have internet access without having to replug in cables when I am looking up info or checking email. This is solely a decision I made because of the way my computers are situated in my room. (pain in the rear to change cables all the time)

[VictorKaum]

BioHazzard, perhaps cause with a simple hub or cross connection you can easily capture packets and learn does tcpdump or ethereal rings a bell?

coVert, your home router has several ports to connect your boxes, right? So basicly you have a router that connects you to the outer world (your Dlink) and it has a built in switch or hub that makes it possible to share your connection trough NAT and to run a small LAN. This means that you can experiment on your side of the router without problems, but it's perhaps easier to start with the 'attack' and 'victim' box on a cross connection or separate hub in order to make things easier, e.g. see what happens... on the other hand... you can learn a lot from more 'complex' environements, not that your little network is complex...

[journy101]

What excactly is the difference between a one way cable and crossover.

A crossover cable has the send and recieve wires at one end swaped. This is so the data sent out of computer A goes to the recieve on computer B, you don't want a send and send tied together. If you have a hub, router or switch this is taken care of, thats why you would usualy use a straight through.

I could not aford a hub so I elected to use a crossover. I only have two computers but have been made aware three computers can still be networked without a hub, using two ethernet cables where the middle computer is set in the registry to act as a router. I have not tried this since I have only two computers.

[coVert]

Thanks guys for all the help. I think I will try both options starting with the crossover and then moving on to the router. BTW, what are some attacks/exploits on windows to windows other than netbios? Later

[smirc]

Originally posted here by journy101
A crossover cable has the send and recieve wires at one end swaped. This is so the data sent out of computer A goes to the recieve on computer B, you don't want a send and send tied together. If you have a hub, router or switch this is taken care of, thats why you would usualy use a straight through.

Just to clarify, the general rule is:

Swtich to Switch (or Router to Router) = use a cross over
NIC to NIC = use a cross over
NIC to Switch (or NIC to Router) = use a straight through

It's easy to tell the difference between the two types. Just hold the two RJ45s at each end next to each other. If the coloured wires are in the same order, its a straight through. If two pairs of the coloured wires are swapped (ie. so they cross over), it's a cross over.

Also, the above definitions of routers vs switches are off the mark. A router is a layer 3 device that routes (usually IP) traffic between two or more networks. A switch is a layer 2 device that is used to minimise collisions on an ethernet network by only passing on frames intended for the MAC client connected to that port. Yes, there are Layer 3 switches which make switching decisions based on network layer data but it's still essentially a data link layer device i.e. it doesn't do any routing.

I don't see the point of placing your hacking lab behind a router unless you intend to use it for basic packet filtering. Placing it behind a switch might give you better throughput if other devices are competing for the same link.

[foxyloxley]

To smirc
When you say layer 3, are you using the 7 layer A-P-S-T-N-D-P model? or the 4 layer model?
only asking as I am studying this at the moment, and it isn't sticking to the grey cells as easy as it could.
As for the rest of you, me going green <envy> multiple computers !!
stuck with the one at present, and for the foreseeable future .

[Relyt]

Good Evening,

smirc is referring to the OSI (7-layer) Model.

Layer 3: Is the Network Layer and it provides connectivity & path selection between two host systems. Remember path, selection, routing, and addressing and this will help you remember Layer 3. As smirc stated, routers are layer three.

Layer 2: Is the Data Link Layer and provides reliable transit of data across a physical link. This layer is concerned with physical (as opposed to logical) addressing, network topology, network access, error notification, orderly delivery of frames and flow control. Remember frames & media access and this will help you remember Layer 2. Switches are layer two.

And that's paraphrased from my notebook when I was in Cisco.....lol

BTW you'll definitely need to learn the difference between OSI Model and the TCP/IP Model.

Use the search at this site and www.google.com to help you. Sometimes we need a lot of repetition and to have folks explain this stuff to us before it sticks. I know I did anyway!

Good Luck.