CFR-410 cheat sheet

Reconnaissance split: passive (OSINT, DNS records, certificate transparency, WHOIS, search engines) leaves no direct contact with the target; active (port scanning, banner grabbing, service probing) does and is detectable by IDS and logs.

TCP connect scan completes the three-way handshake and is logged by the target application; SYN half-open scan sends SYN and resets before the handshake completes, so it is less likely to appear in application logs but is still visible to network sensors.

Nmap service/version detection uses -sV; OS fingerprinting uses -O; the NSE scripting engine (-sC or --script) runs discovery and vulnerability scripts. A port reported open|filtered means no response was received, not that the port is closed.

Metasploit workflow: search, use, show options, set RHOSTS/LHOST/LPORT, set PAYLOAD, run (or exploit). A reverse shell has the target connect back to the attacker and bypasses inbound firewall rules; a bind shell listens on the target and requires inbound reachability.

Meterpreter runs in memory as a reflective DLL and offers post-exploitation modules (hashdump, kiwi, portfwd, getsystem). Sessions are managed with sessions -i ; backgrounding uses background or Ctrl-Z.

Searchsploit queries a local Exploit-DB copy; msfvenom generates standalone payloads (msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=... LPORT=... -f exe).

SQL injection: union-based requires matching column counts and types; boolean-based infers data from true/false page differences; time-based uses deliberate delays (e.g., SLEEP, pg_sleep) as the signal; error-based relies on database error messages.

Cross-site scripting types: reflected (payload in the immediate request), stored (payload persisted server-side), DOM-based (sink in client-side JavaScript). Output encoding by context and a Content-Security-Policy are the primary controls.

Web access-control failures: IDOR exposes objects by predictable identifier and is fixed by server-side authorization checks; CSRF is mitigated with anti-CSRF tokens and SameSite cookies; SSRF is mitigated by allowlisting outbound destinations.

Log source map: Windows Security log (4624 logon, 4625 failed logon, 4672 special privileges, 4688 process creation, 4720 account created); Sysmon for process, network, and file telemetry; Linux auth.log/secure for SSH and sudo; web server access logs for method, URI, status, and user agent.

Logon type codes: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 remote interactive (RDP), 11 cached interactive. A 4624 type 3 followed by type 10 from an unusual source is a common lateral-movement pattern.

Log integrity and completeness: NTP-synchronized clocks across sources, centralized collection (syslog, agent forwarding) so an attacker cannot delete local evidence, and retention long enough to cover the detection and investigation window.

Forensic order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Acquire the most volatile first; memory capture preserves encryption keys and injected code that a disk image misses.

Evidence handling: hash at acquisition (SHA-256) and re-hash after analysis, maintain a documented chain of custody, and work from verified copies with write blockers on the original media.

File-system timestamps: MACE (modified, accessed, changed/metadata, entry-created) on NTFS; $MFT records file entries; $UsnJrnl records changes; $LogFile records metadata transactions. Timestomping shows as a modified timestamp earlier than the entry-created timestamp.

Windows artifacts: prefetch (program execution), Amcache and SRUM (execution and resource usage), ShimCache/AppCompatCache (presence, not proof of execution), event logs, registry hives, and user shellbags for folder access.

Threat-intelligence formats and confidence: STIX/TAXII for structured sharing, YARA for file and memory pattern matching, Sigma for portable detection rules. Indicator types differ in durability: hashes are precise but short-lived, domains and IPs decay, TTPs are most durable.

Detection engineering: a rule with high false positives raises analyst load; tune by adding context (parent process, signer, user, time window) rather than removing the detection, and validate changes against known-good and known-bad samples.

Data states: at rest (full-disk or database encryption, key management), in transit (TLS 1.2+/1.3, HSTS, certificate validation), in use (memory protection, confidential computing). Classification and labeling drive which controls apply.

Access control models: DAC (owner discretion), MAC (labels and clearances), RBAC (roles), ABAC (attributes and policy). Least privilege, separation of duties, and just-in-time elevation reduce standing access.

Authentication factors: something you know, have, are; MFA requires two different categories. Phishing-resistant factors are FIDO2/WebAuthn security keys and passkeys; SMS OTP is the weakest common second factor because of SIM-swap and interception.

Privileged access: unique named accounts, vaulted credentials, session recording, and removal of shared administrator accounts. On Windows, Protected Users and tiered admin models limit credential exposure.

Patch and configuration management: vulnerability scanning, risk-based prioritization (exploitability and exposure, not CVSS alone), tested deployment rings, and rollback plans. CIS Benchmarks and DISA STIGs provide baseline configurations.

Network segmentation and filtering: VLANs and subnets, internal firewalls, deny-by-default egress, and DMZ placement for internet-facing services. Zero trust replaces implicit network trust with per-request verification.

Endpoint and system hardening: application allowlisting, EDR, disabling unnecessary services and protocols (SMBv1, LLMNR, NBT-NS), host firewalls, and secure boot.

Software supply chain: signed artifacts, SBOMs, dependency scanning, and pinned, verified build inputs. Code signing plus verification at install blocks tampered binaries.

Monitoring and response controls: centralized logging with integrity protection, alerting on privileged and authentication events, tested backups (3-2-1), and rehearsed incident response and recovery procedures.