Attacks and Exploits
Attacks and exploits
This is the largest domain: network, wireless, application, credential and human attacks, plus the mechanics of delivering a payload and holding a session. Exam items give you an observed condition and expect the correct attack, with its safety and legal constraints.
Network and wireless
On-path attacks via ARP spoofing, DNS spoofing and DHCP starvation; VLAN hopping through switch spoofing or double tagging; NAC bypass. Wireless: capture a WPA2 four-way handshake or PMKID for offline cracking, stand up an evil twin with a captive portal, deauthenticate clients to force reconnection, or attack WPS. WPA3 removes offline handshake cracking, so look at transition-mode and downgrade weaknesses instead.
Application
Injection (SQL, command, LDAP), XSS in reflected, stored and DOM forms, CSRF, SSRF, XXE, insecure deserialization, IDOR/BOLA, unrestricted file upload, directory traversal and business logic flaws. Confirm injection with arithmetic or time-based probes before attempting to dump data - a response that changes between ' AND 1=1 and ' AND 1=2 is sufficient proof of concept.
Credential attacks
Online attacks are bounded by lockout policy: brute force a single account, spray one password across many accounts, or replay breached credentials. Offline attacks run hashcat or John with rule sets against captured NTLM, NetNTLMv2 or Kerberos material; pass-the-hash reuses NTLM without cracking it.
Delivery
Metasploit modules, msfvenom payloads, staged versus stageless, bind versus reverse shells, and encoding or obfuscation to slip past signature-based AV. Exploits crash services; validate in a lab and get explicit permission before touching production.
Worked example
A login form on an in-scope application. Compare error messages and response timing to test for username enumeration. The app locks accounts after five failures, so a wordlist run would lock out the entire user base - a self-inflicted denial of service. Instead, spray a single likely password across the harvested user list, one attempt per account, spaced out, inside the agreed window. Report the successes and stop before the threshold is approached.
Traps
Running a memory-corruption exploit on production without permission. Ignoring lockout thresholds. Confusing XSS (executes in the victim's browser) with CSRF (forges a state-changing request). Choosing a reverse shell when egress is filtered - plan the channel or use a bind shell on an internal pivot.