Chapter 4 - Key Topics

Description Element Summary

Page

Passive Reconnaissance - researching the

victims public records, social media, DNS, &
Understanding
whois. Tools such as Shodan, Maltego, Recon-
passive vs.
Paragraph 154 ng, The Harvester, Spiderfoot Active
active
Reconnaissance - carried out by tools called
reconnaissance
scanners. Various application, port, &
vulnerability scanners exist.
A method of gathering publically available
Understanding
intelligence sources to collect and analyze
Open-Source
Tip 156 information about a target. Open-source
Intelligence
because collecting this info does not require any
OSINT
covert action.
Basic Port Scan - Scanning predetermined
TCP/UDP ports by sending specially crafted
packets TCP Connect Scan - Refers to Unix
connect() sys call. If port open victim completes
three-way handshake. TCP SYN Scan Half-
Open Scan) - Does not open full TCP
connection, the attacker sends SYN and if victim
Different types responds with SYN/ACK port is considered
of port-and open. TCP ACK Scan - Sends ACK to determine
network- List 157 if port is filtered or unfiltered. Used to determine
scanning if firewalls are deployed and their rule-sets. TCP
techniques FIN packets may be used to bypass legacy
firewalls. UDP Scan - Victim responds with ICMP
"Port Unreachable" messages to determine if
port is open. Affected by firewalls & ICMP rate
limiting. Strobe Scan - Attackers use this scan to
find ports they know how to exploit, execute on
a more confined level. Stealth Scan - Designed
to go undetected by network auditing tools

Chapter 4 - Key Topics 1

 Description Element Summary
Page

Phishing - The attacker presents a link that

looks like a valid, trusted resource to a user.
Spear Phishing - Targets specific individuals or
What are
companies. Pharming - Term used to describe a
phishing,
List 160 threat actor redirecting a victim from a valid
pharming, &
website or resource to a malicious one that
malvertising?
could appear as the valid site. Malvertising -
Act of incorporating malicious ads on trusted
websites.
Privilege
Process of taking some level of access and
Escalation Section 162
achieving an even greater level of access.
Attacks

Threat actors may install backdoors on

Backdoors Section 163 compromised systems to allow future access or
collect information.

Remote Code Execution RCE allows an

attacker to fully compromise the CIA of a
Buffer system. Buffer Overflows can lead to to RCE.
Overflow & Section 163 Stack-based BO relies on overflowing a fixed-
Code Execution length buffer. A heap overflow relies on
overwriting internal structures such as linked list
pointers.
Results when an attacker places themselves in
the middle of two devices communicating with
the intent of performing reconnaissance or
manipulating data. ARP Poisoning - attacker
spoofs Layer 2 MAC addresses to trick victim
device into believing attacker is the default
gateway. Rogue switches can be used to
Man-in-the-
Section 165 manipulate Spanning Tree Protocol STP to
Middle attacks
become the root switch. Rogue routers can be
used to manipulate network routers into
believing the attacker has a better route. Can
occur by installing malware on a victim machine
that can manipulate and send packets to an
attacker. Safeguard data in motion by using
encryption.

Chapter 4 - Key Topics 2

 Description Element Page Summary

Identifying the Direct DDoS - an attack where the source of the

different types attack generates the packets and sends them
List 166
of DDoS directly to the victim. Reflected DDoS,
attacks Amplification DDoS
A collection of compromised machines that an
What are
Paragraph 167 attacker can manipulate from a command and
botnets?
control C2 or CnC system.
The source of attack is sent spoofed packets
Reflected that appear to be from the victim and the source
Paragraph 167
DDoS attacks becomes attack pawns by sending response
traffic to the victim.

A type of reflected attack where response traffic

is made of packets that are much larger than
What are
those that were initially sent by the attacker. For
amplification Paragraph 168
example, DNS queries are sent and the DNS
attacks?
responses are much larger in packet size than
the initial query packets.
Many methods of data exfiltration of which DNS
Attack
tunneling is very popular. Examples, DNS2TCP,
Methods for
Section 168 DNScat-P, Iodine Protocol v5.00, Iodine Protocol
Data
v5.02, OzymanDNS, SplitBrain, TCPOver-DNS,
Exfiltration
YourFreedom
Attackers can attack systems on a subnet by
intercepting traffic intended for other systems
ARP Cache
Paragraph 169 on the subnet by spoofing the MAC address at
Poisoning
Layer 2. Dynamic ARP inspection validates IP-to-
MAC address bindings.

BGP hijacking attack - most popular route

Route manipulation attack, attacker use a rogue router
Manipulation Paragraph 171 to announce prefixes that have not been
Attacks assigned by the org, these contains routes to
the attacker.

Chapter 4 - Key Topics 3

 Description Element Page Summary

Password-guessing attack - Most common,

some methods are brute-force attack
(combinations of characters) & dictionary
attack (whole words). Tools include Hydra, John
the Ripper, Cain & Abel. Password-resetting
attack - Easier to simply reset the password,
most tools contain bootable version of Linux
Different types
that can mount NTFS volumes to help locate and
of password List 171
reset Admin password. Password Cracking -
attacks
Take a password hash and attempt to convert it
to it's plaintext. Possible hashes put in lookup
table called Rainbow Table, hashes can be
looked up in rainbow table. Password Sniffing -
Attacker sniffs authentication packets between
server and client to help in cracking. Password
Capturing - With keyloggers or Trojan horses.
Installing a rogue access point - Attacker
installs access point as a backdoor to obtain
network access. Jamming wireless signals and
causing interference - Create a DoS condition
within the wireless network. War Driving - Used
to find access points wherever they may be,
attackers can drive around and gather large
amounts of info. Bluejacking - Attacker sends
The most unsolicited messages to another device via
common Bluetooth. Evil twin attack - Done when creating
attacks against List 172 rogue access points, attacker configures the
wireless access point exactly the same as on the
networks network. IV attack - Attacker can cause
modification to the IV Initialization Vector) of an
encrypted wireless packet to ultimately
generate another key for use in decryption.
WEP/attack - WEP should never be used, WPA 3
is the latest version of WPA specification. WPA 1
& 2 vulnerable to KRACK. WPS attack - WPS
password-guessing tools used to gain WPS
passwords.

Chapter 4 - Key Topics 4

 Description Element Summary
Page
API-based vulnerabilities - aimed at flaws in
APIs Authentication & Authorization bypass
vulnerabilities - Used to bypass authentication
and authorization mechanisms of systems within
the network. Buffer Overflow - Occurs when a
program tries to write past the bounds of a
memory buffer. This corruption of memory can
lead to Code Execution. Cross-site scripting
XSS vulnerability - Malicious scripts are
injected into legitimate and trusted websites.
Successful exploitation may lead to the
execution of malicious code, account
compromise, session hijacking, redirection, &
modification of local files. Found in HTTP
Defining & headers, input fields that echo user data, hidden
understanding form fields, & error messages that return user
different types List 173 input. Cross-site request forgery CSRF
of security vulnerability - Forces users to execute malicious
vulnerabilities steps on a web application, exploiting trust
between a user and a web app. Cryptographic
vulnerability - Flaw in a cryptographic protocol
or its implementation. Deserialization of
untrusted data vulnerability - Uses or causes
malformed data or unexpected data to abuse
application logic. Double Free - Occurs in C,
C languages when free() is called more than
once with the same memory address.
Insufficient Entropy - When crypto applications
lack entropy. Pseudo-random Number
Generators PRNGs) are susceptible to
insufficient entropy vulnerabilities. SQL injection
vulnerabilities - Attackers can exploit vulnerable
web applications to interact with a database.

The Open Web

Application OWASP provides references to vulnerabilities as
Security Paragraph 174 well as mitigations, training, tools, and general
Project infosec material.
OWASP

Chapter 4 - Key Topics 5

 Description Element Summary
Page

Accessing
Omar's GitHub
Tip 174 [Link]
repository &
WebSploit labs
Untitled

Chapter 4 - Key Topics 6