Q. What are the different types of cyber Q.

Describe various hacking techniques and

attacks? password cracking methods.
Ans: A cyber-attack is an exploitation of Ans:
computer systems and networks. It uses
malicious code to alter computer code, logic or
data and lead to cybercrimes, such as
Hacking Techniques:
information and identity theft.
Cyber-attacks can be classified into the 1. Social Engineering & Phishing: 1.
following categories: 1) Web-based attacks Phishing: Attackers send deceptive emails or
2) System-based attacks messages masquerading as trusted entities
(like banks) to steal sensitive login credentials.
1. Web-based attacks: These are the 2. Spear Phishing: A highly targeted form of
attacks which occur on a website or web phishing aimed at a specific individual or
applications. Some of the organization. 3. Baiting & Pretexting:
important web-based attacks are as follows:1. Manipulating victims into revealing information
Injection attacks: It is the attack in which or handing over control by fabricating scenarios
some data will be injected into a web (e.g., posing as IT support).
application to manipulate the application and
fetch the required information. Example- SQL
2. Network & Interception Attacks: 1. Man-
Injection, code Injection, log Injection, XML
in-the-Middle (MitM): Attackers secretly
Injection etc. 2. DNS Spoofing: DNS Spoofing
intercept and alter communication between two
is a type of computer security hacking.
unsuspecting parties, typically on unsecured
Whereby a data is introduced into a DNS
public Wi-Fi. 2. Sniffing: Using software to
resolver's cache causing the name server to
capture and analyze network packets to extract
return an incorrect IP address, diverting traffic
passwords and sensitive data
to the attackers computer or any other
computer. The DNS spoofing attacks can go on 3. Software & Application Exploits: 1. SQL
for a long period of time without being detected Injection (SQLi): Inserting malicious SQL
and can cause serious security issues. 3. statements into backend database entry fields
Session Hijacking: It is a security attack on a to access, modify, or steal unauthorized data.
user session over a protected network. Web 2. Cross-Site Scripting (XSS): Injecting
applications create cookies to store the state malicious scripts into trusted websites, allowing
and user sessions. By stealing the cookies, an the attacker to steal session cookies or user
attacker can have access to all of the user data. 3. Zero-Day Exploit: Attacking a
data. 4. Phishing: Phishing is a type of attack previously unknown software or hardware flaw,
which attempts to steal sensitive information leaving developers no time to implement a fix.
like user login credentials and credit card
number. It occurs when an attacker is 4. Malware & Ransomware: 1. Ransomware:
masquerading as a trustworthy entity in Malicious software that encrypts a victim’s files,
electronic communication. 5. Brute force: It is rendering them inaccessible until a ransom is
a type of attack which uses a trial and error paid. 2. Trojans & Spyware: Programs that
method. This attack generates a large number disguise themselves as legitimate software to
of guesses and validates them to obtain actual secretly monitor user activity and steal
data like user password and personal keystrokes (keylogging).
identification number. This attack may be used
by criminals to crack encrypted data, or by 5. Credential & Password Attacks: 1. Brute
security, analysts to test an organization's Force: Systematically trying every possible
network security. combination of letters, numbers, and symbols
6. Denial of Service: It is an attack which until the correct password is found. 2.
meant to make a server or network resource Dictionary Attack: Using a pre-defined list of
unavailable to the users. It accomplishes this likely passwords to guess user credentials.
by flooding the target with traffic or sending it
information that triggers a crash. It uses the 6. Availability Attacks: 1. DDoS (Distributed
single system and single internet connection to Denial-of-Service): Flooding a server or
attack a server. It can be classified into the network with illegitimate traffic from multiple
following Volume-based attacks: Its goal is to compromised systems, causing it to crash or
saturate the bandwidth of the attacked site, and become unavailable to legitimate users.
is measured in bit per second.
Protocol attacks: It consumes actual server Password cracking methods: These
resources, and is measured in a packet. are systematic techniques used to recover or
Application layer attacks: Its goal is to crash bypass passwords for unauthorized access.
the web server and is measured in request per They fall into two main categories: Online
second Attacks (guessing live on a login screen) and
7. Dictionary attacks: This type of attack Offline Attacks (extracting and decoding
stored the list of a commonly used password stored password hashes).
and validated them to get original password. 8.
URL Interpretation It is a type of attack where 1. Brute Force Attacks: This is an exhaustive,
we can change the certain parts of a URL, and trial-and-error method where automated
one can make a web server to deliver web software tries every possible combination of
pages for which he is not authorized to browse. letters, numbers, and symbols until the correct
9. File Inclusion attacks It is a type of attack one is found How it works: Software
that allows an attacker to access unauthorized algorithms cycle through the entire character
or essential files which is available on the web keyspace sequentially. Effectiveness:
server or to execute malicious files on the web Guaranteed to work eventually, but highly
server by making use of the include resource-intensive and impractical for long,
functionality. 10. Man in the middle attacks It is complex passwords.
a type of attack that allows an attacker to
intercepts the connection between client and
server and acts as a bridge between them.
Due to this, an attacker will be able to read, 2. Dictionary Attacks: This method
insert And modify the data in the tests a predefined list of words, phrases,
intercepted connection. 8. URL and common passwords (such as
Interpretation: It is a type of attack where we "password123" or "admin") rather than
can change the certain parts of a URL, and random characters. How it works:
one can make a web server to deliver web Crackers use wordlists often compiled
pages for which he is not authorized to browse. from previously leaked data breaches and
9. File Inclusion attacks: It is a type of attack predictable human behavior.
that allows an attacker to access unauthorized Effectiveness: Very fast and highly
or essential files which is available on the web successful against users who rely on
server or to execute malicious files on the web simple, dictionary-based passwords.
server by making use of the include
functionality. 10. Man in the middle attacks: 3. Hybrid Attacks: A combination of
It is a type of attack that allows an attacker to dictionary and brute-force methods,
intercepts the connection between client and designed to crack passwords that follow
server and acts as a bridge between them. common modification patterns. How it
Due to this, an attacker will be able to read, works: It takes a standard dictionary
insert and modify the data in the intercepted word and tests variations, such as
connection prepending/appending numbers or
swapping letters for symbols (e.g., \
2. System-based attacks: These are the (P@ssw0rd\) instead of Password).
attacks which are intended to compromise a Effectiveness: Extremely effective
computer or a computer network. Some of the against users who update old passwords
important system-based attacks are as follows by adding digits or special characters at
[Link]: It is a type of malicious software the end
program that spread throughout the computer
files without the knowledge of a user. It is a 4. Rainbow Table Attacks: An offline
self-replicating malicious computer program attack that bypasses the need to guess
that replicates by inserting copies of itself into characters by targeting the mathematical
other computer programs when executed. It algorithms (hashes) used to store
can also execute instructions that cause harm passwords How it works: Attackers use
to the system. 2. Worm: It is a type of malware pre-computed, massive databases of
whose primary function is to replicate itself to known plaintext passwords and their
spread to uninfected computers. It works same corresponding hash values to instantly
as the computer virus. Worms often originate reverse-lookup the password.
from email attachments that appear to be from Effectiveness: Devastating against
trusted senders. systems that do not use a "salt" (random
data added to the password before
3. Trojan horse: It is a malicious program that hashing)
occurs unexpected changes to computer
setting and unusual activity, even when the 5. Social Engineering & Phishing: Non-
computer should be idle. It misleads the user technical methods that rely on human
of its true intent. It appears to be a normal manipulation rather than computing
application but when opened/executed some power to acquire [Link] it
malicious code will run in the background works: Attackers trick victims into
voluntarily handing over their passwords
4. Backdoors: It is a method that bypasses by impersonating a trusted entity (e.g.,
the normal authentication process. A developer via fake emails or login pages).
may create a backdoor so that an application Effectiveness: Highly critical risk, as
or operating system can be accessed for human error remains one of the easiest
troubleshooting or other purposes. ways to bypass even the strongest digital
security systems.
5. Bots: A bot (short for "robot") is an
automated process that interacts with other 6. Credential Stuffing & Password
network services. Some bots program run Spraying: Techniques that exploit the
automatically, while others only execute human habit of reusing the same
commands when they receive specific input. password across multiple platforms
Common examples of bots program are the
crawler, chatroom bots, and malicious bots.