Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss • Hacker News Board

Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#1

Post by opsdisk » Sat, May 18, 2019, 12:03 PM UTC

Looking to get some feedback from the Hacker News community.

I wrote the book with a focus on penetration testers and red teamers, but there are great examples for network admins, developers, and blue team defenders as well.

You can pick up a copy for free here through May 19, 2019: https://gumroad.com/l/the_cyber_plumbers_handbook/hackernews...

Please note, because it's hosted on Gumroad, it does require an email. If you don't want to give out your actual email, check out an anonymous email service. I give it away to students for free, so if you know of one that might like it, send them here to get instructions: https://cph.opsdisk.com

About The Cyber Plumber's Handbook...

This book is packed with practical and real world examples of SSH tunneling and port redirection in multiple realistic scenarios. It walks you through the basics of SSH tunneling (both local and remote port forwards), SOCKS proxies, port redirection, and how to utilize them with other tools like proxychains, nmap, Metasploit, and web browsers.

Advanced topics included SSHing through 4 jump boxes, throwing exploits through SSH tunnels, scanning assets using proxychains and Metasploit's Meterpreter, browsing the Internet through a SOCKS proxy, utilizing proxychains and nmap to scan targets, and leveraging Metasploit's Meterpreter portfwd command.

Let me know if you have any questions! Looking forward to your comments/feedback.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#2

Post by emptysongglass » Sat, May 18, 2019, 3:54 PM UTC

I'd really appreciate an epub. I read anything across a variable range of display sizes and PDFs just don't cut it anymore.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#3

Post by leetbulb » Sat, May 18, 2019, 3:58 PM UTC

This is great, thank you. I'm a big fan of socat for plumbing in pentesting environments, it's an amazing tool. Never had much luck with meterpreter's port forwarding as it seems to always eventually bug out.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#4

Post by 171243 » Sat, May 18, 2019, 4:05 PM UTC

Good topic and looks like some good examples. The formatting is nice, easy on the eyes but there is excessive whitespace in the book. Having large screenshots means when they don't fit on the page they get bumped to the next and a huge gapping whitespace appears. I can tell this is stretching out the length of the book. I'd peg it at really only about 50 pages of content instead of the 76. For an example just look at page 75/76 and how the content is distributed.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#5

Post by Bucephalus355 » Sat, May 18, 2019, 4:48 PM UTC

I am somewhat in tears now seeing this. I spent weeks at work trying to backwards analyze GCP IAP, which apparently uses this in the background (invoked via the gcloud CLI).

Almost like a lost art, it was impossible to find serious tutorials other than Michael W. Lucas’s book of a couple of years ago or the O’Reilly book from 2006.

Very much appreciated. Thank you for documentation on these very important systems that many of us sysadmins who came into the field later in life missed (other than when we connect to our cloud servers). Soon, even the cloud part I mentioned will be gone mostly to because of ‘kubectl’, as Kelsey Hightower has said.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#6

Post by jmakov » Sat, May 18, 2019, 5:27 PM UTC

Cool writeup. Thanks for sharing!

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#7

Post by cjcampbell » Sat, May 18, 2019, 5:43 PM UTC

I am pumped to see this right now, as it will be a great resource for my intro networking students (at the perfect moment in the quarter).

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#8

Post by indigodaddy » Sat, May 18, 2019, 6:01 PM UTC

Bucephalus355 wrote: post #5

I am somewhat in tears now seeing this. I spent weeks at work trying to backwards analyze GCP IAP, which apparently uses this in the background (invoked via the gcloud CLI). Almost like a lost art, it was impossible to find serious tutorials other than Michael W. Lucas’s book of a couple of years ago or the O’Reilly book from 2006. Very much appreciated. Thank you for documentation on these very important systems tha…

Exactly, and hopefully fundamental sysadmin/nix/networking/DNS/basic troubleshooting (that we take for granted) skills won't get lost by the wayside. But I do feel that at some point this will happen, and those of us with those skills that remain in say 10-15 years will be as outdated/deprecated as say an AIX admin is today.

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#9

Post by canphaz » Sat, May 18, 2019, 6:03 PM UTC

Hi! Sounds great! However i get he message that the discount code is not valid anymore and it is $19.99 again. Am i doing something wrong?

Re: Show HN: The Cyber Plumber's Handbook – SSH Tunnel Like a Boss

#10

Post by xoa » Sat, May 18, 2019, 6:29 PM UTC

Thanks for sharing and the effort put in so far. After a quick glance over I think you should consider giving at least a glancing mention in your intro section to the importance of hardening SSH itself vs the typical default install. It doesn't need to be much since it's somewhat out of scope of your specific focus here, but it'd be worth a few sentences mentioning the value of keys over passwords (and disabling passwords entirely), that keys can be kept on tokens as well (YubiKeys/NitroKeys for example), value of disabling ancient ciphers, that sort of thing. You say the book assumes "some experience with SSH", but given your stated audience includes admins/devs/blue team as well (and in another comment I see someone talking about using it with students) and I've seen a ton of really bad SSH setups used there, I think even a sentence or two about assuming hardening as well to get people into search engines (if you don't feel like more) would be valuable in the context of intrusion response.