I85PREP
⌘ K
CFR-410 study materials
CFR-410 study resources

CFR-410: Attack: Reconnaissance, Exploitation, and Web Vectors

CFR-410 · Work through your exam, one topic at a time.

All guide sections

Attack: Reconnaissance, Exploitation, and Web Vectors

Domain 1 - Attack

The Attack domain checks whether you can recognize the fingerprints attackers leave during reconnaissance, exploitation, and web application abuse, and map them to the evidence a responder will later collect. Questions are artifact-driven: given a log line, packet pattern, or payload string, identify the tool, the technique, or the stage of the intrusion.

Reconnaissance

  • Passive recon never touches the target: OSINT, certificate transparency logs, internet-wide scan databases, and DNS enumeration through third-party resolvers. It leaves almost no local evidence.
  • Active recon does. TCP SYN scans produce many half-open connections (SYN, SYN/ACK, then RST from the scanner); full-connect scans complete the handshake and appear in application logs; UDP scans generate bursts of ICMP port-unreachable messages.
  • Direction matters. One source hitting hundreds of destination ports from a single high ephemeral port is a port scan. One destination port hit by many sources is a sweep or distributed brute force.
  • Banner grabbing and version probing usually precede an exploit by minutes to hours. That interval is your best correlation window when building a timeline.

Exploitation frameworks

Frameworks such as Metasploit split payloads into a stager (small, connects back and pulls the rest) and a stage (the full agent). Staged payloads explain a short outbound connection on an unusual port immediately before a larger download or beaconing pattern. Reverse shells invert the direction, so egress filtering - not inbound firewall rules - is the control that catches them. Default listener ports are a hint, never proof, because operators routinely change them. Jittered HTTPS beaconing is built to look normal, so detection shifts to behavior: new service creation, process injection, LSASS access, and persistence.

Web application vulnerabilities

  • SQL injection: UNION SELECT, ' OR 1=1--, time-based probes with sleep() or benchmark(), frequently URL- or hex-encoded (%27, 0x...).
  • Path traversal / LFI: ../, ..%2f, /etc/passwd, php://filter.
  • Command injection: ;id, |whoami, ${IFS}.
  • File upload: a .php, .jsp, or .aspx landing in an upload directory, immediately followed by requests to that exact path.
  • XSS leaves little server-side evidence but appears in WAF logs and in stored database content.

Worked example

A web log shows GET /product.php?id=1%27%20UNION%20SELECT... at 10:02, repeating with increasing offsets until 10:14; then POST /upload.php returning 200 at 10:19; then GET /uploads/img.php?cmd=whoami at 10:21; then outbound TCP 443 from the web server to an unfamiliar address for 40 minutes. Reasoning: the 200 on upload is the pivot point, not the failed SQLi attempts - a successful file write is the compromise event. The cmd= parameter proves the uploaded file is a webshell, and the outbound session is command-and-control or exfiltration. Scope the incident from 10:19 and treat the earlier probing as precursor context.

Traps that cost marks

Assuming every scan equals compromise; confusing the direction of a reverse shell; reading timestamps without confirming UTC versus local time; treating a nonstandard port as proof of a specific tool; and missing that an encoded parameter is often the same attack with obfuscation applied.