HTB CJCA cheat sheet

CIA triad: Confidentiality (only authorized read), Integrity (only authorized change), Availability (timely access); a control is mapped to whichever leg it primarily protects.

AAA separates Authentication (verify identity), Authorization (grant permissions), and Accounting/Auditing (record actions); identity proof alone grants no access.

Threat vs. vulnerability vs. risk: threat = actor or event with potential to cause harm; vulnerability = weakness; risk = likelihood x impact of a threat exploiting a vulnerability.

Defense in depth layers preventive, detective, and corrective controls so a single control failure does not expose the asset; no single layer is assumed sufficient.

Least privilege grants the minimum rights needed for a task and for the minimum duration (just-in-time access); separation of duties splits a sensitive action across two identities.

Fail-safe defaults: a failed control should deny access (fail closed) for confidentiality-critical systems; availability-critical systems may fail open only with compensating monitoring.

Non-repudiation requires cryptographic evidence binding an action to a key holder, typically a digital signature plus trusted timestamping and audit logs.

Data classification (public, internal, confidential, restricted) drives handling rules; labeling without enforcement of controls is not a security measure.

Zero Trust removes implicit trust from network location: every request is authenticated and authorized per session using identity, device posture, and context.

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps Application (5-7), Transport (4), Internet (3), Link (1-2).

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK) and flags FIN/RST/PSH/URG; UDP is connectionless with no delivery guarantee and lower overhead.

Well-known ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 389 LDAP, 443 HTTPS, 445 SMB, 3389 RDP, 3306 MySQL.

Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA) and indicates a failed DHCP lease.

Subnetting: usable hosts = 2^(host bits) - 2; /24 = 254 hosts, /25 = 126, /26 = 62, /30 = 2; CIDR /n leaves 32-n host bits.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), TXT (SPF/DKIM/verification), NS (delegation), PTR (reverse lookup).

A stateful firewall tracks connection state; a stateless ACL filters per packet. NAT rewrites addresses, not a security boundary by itself.

TLS handshake authenticates the server via certificate chain and negotiates a session key; the certificate's CN/SAN must match the requested hostname.

Windows access control uses SIDs, access tokens, and ACLs of DACLs (allow/deny) and SACLs (auditing); a token carries the user SID plus group SIDs and integrity level.

Windows integrity levels run Low, Medium, High, System; a lower-integrity process cannot write to a higher-integrity object (mandatory integrity control).

Linux permissions: rwx = 4/2/1 for owner, group, other; special bits setuid (4), setgid (2), sticky (1); setuid root binaries are privilege-escalation candidates.

Linux/Unix privilege escalation checks: sudo -l, SUID/SGID files, writable cron jobs or systemd units, world-writable PATH directories, and kernel version versus known CVEs.

Windows hardening baselines: disable LLMNR/NetBIOS-NS, enforce SMB signing, restrict NTLM, enable Credential Guard/LSA protection, apply AppLocker or WDAC.

Endpoint protection layers: EDR (behavioral telemetry and response), antivirus (signature/heuristic), application allowlisting, host firewall, and disk encryption (BitLocker/LUKS).

Patch management decides exposure: track CVE, CVSS, and vendor advisories; CVSS base score is not a substitute for environmental impact assessment.

Logging sources on hosts: Windows Security log (4624 logon, 4625 failure, 4672 special privileges, 4688 process creation), Sysmon, Linux auth.log and auditd.

Authentication factors: something you know (password), have (token, certificate), are (biometrics); MFA requires factors from at least two distinct categories.

Password storage must use a slow salted hash (bcrypt, scrypt, Argon2, PBKDF2); fast hashes like MD5/SHA-1 are unsuitable for passwords.

Kerberos flow: AS-REQ/AS-REP obtains a TGT; TGS-REQ/TGS-REP obtains a service ticket; the ticket is encrypted with the service account key.

Kerberoasting requests service tickets for SPN accounts and cracks them offline; defense is long random service-account passwords and managed service accounts.

OAuth 2.0 delegates authorization via access tokens; OpenID Connect adds an identity layer with an ID token (JWT). Neither replaces session security.

SAML assertions are signed XML; validate signature, audience, recipient, and NotBefore/NotOnOrAfter conditions to prevent assertion replay or injection.

RBAC assigns permissions to roles and roles to users; ABAC evaluates attributes (user, resource, environment) as policy - more granular, harder to audit.

Session security: HttpOnly and Secure cookie flags, short idle timeouts, rotation of session ID at login, and revocation on logout or risk signal.

MITRE ATT&CK organizes adversary behavior into tactics (why) and techniques (how); map detections to technique IDs such as T1059 command execution.

Injection (SQLi, command injection) occurs when untrusted input is interpreted as code; parameterized queries and input allowlisting are the structural fixes.

XSS types: reflected (payload in request), stored (persisted), DOM-based (client-side sink); CSP and output encoding mitigate, input filtering alone does not.

Phishing variants: credential harvesting, spear phishing (targeted), whaling (executives), business email compromise (invoice/CEO fraud), and QR-code quishing.

Ransomware kill chain: initial access, credential theft, lateral movement, data exfiltration (double extortion), encryption; offline immutable backups are the recovery control.

Credential attacks: password spraying (few passwords, many accounts, avoids lockout), credential stuffing (reused breached pairs), and pass-the-hash (NTLM hash reuse).

Vulnerability scoring: CVSS base metrics (AV, AC, PR, UI, S, C, I, A) yield 0.0-10.0; EPSS estimates exploitation probability; KEV lists known exploited issues.

Social engineering exploits authority, urgency, and familiarity; verification through an independent channel is the reliable countermeasure.

NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity - containment precedes eradication, not the reverse.

Severity triage uses impact x likelihood plus data sensitivity; a confirmed active exfiltration outranks a blocked scan even if the scan generates more alerts.

Evidence handling: preserve order of volatility (memory, network state, disk), hash images (SHA-256), maintain chain of custody, and work on copies.

Containment options: host isolation, account disable, network ACL block, credential reset; choose based on blast radius versus operational impact.

Recovery criteria: root cause removed, persistence mechanisms eliminated, credentials rotated, and monitoring confirms no renewed adversary activity.

Post-incident review produces timeline, root cause, detection gaps, and tracked corrective actions; blameless framing increases reporting accuracy.

SOC metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/resolve), and false positive rate; alert volume alone is not effectiveness.

Playbooks codify repeatable response for common scenarios (phishing, malware, lost device); escalation paths and legal/PR notification triggers are pre-agreed.

Windows 4624 logon types: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 10 RDP, 11 cached credentials.

Windows Event IDs: 4625 failed logon, 4648 explicit credentials, 4672 admin logon, 4688 process creation, 4720 account created, 4728 group member added, 1102 log cleared.

Sysmon events: 1 process create, 3 network connect, 7 image load, 8 remote thread, 11 file create, 12/13/14 registry, 22 DNS query.

Linux: /var/log/auth.log or secure for sudo/SSH events, last/lastb for logins, auditd for syscall auditing, journalctl for systemd units.

Detection logic tiers: signature/IOC matching (fast, brittle), behavioral rules (process parent-child anomalies), and anomaly baselining (noisy, needs tuning).

Sigma is a vendor-neutral rule format; SIEM correlation joins events across sources, and tuning reduces false positives by adding context and exclusions.

Log integrity: forward logs off-host in near real time, restrict write access, use NTP-synchronized clocks, and alert on log clearing or forwarding gaps.

Network telemetry sources: firewall session logs, proxy/HTTP logs, DNS query logs, NetFlow, and IDS/IPS alerts; DNS beaconing shows periodic low-volume lookups.

Risk treatment options: mitigate (control), transfer (insurance), avoid (stop activity), accept (documented tolerance); residual risk remains after controls.

Quantitative risk = asset value x exposure factor x annualized rate of occurrence (ALE = SLE x ARO; SLE = AV x EF).

Frameworks: ISO/IEC 27001 (ISMS requirements), NIST CSF (Identify, Protect, Detect, Respond, Recover), NIST 800-53 (control catalog), CIS Controls (prioritized safeguards).

Regulations and standards: GDPR (EU personal data, breach notification), HIPAA (US health data), PCI DSS (cardholder data), SOX (financial controls).

Policy hierarchy: policy (intent, mandatory), standard (specific requirements), procedure (steps), guideline (recommendation); audits test against standards.

Third-party risk: due diligence, contractual security requirements, right-to-audit clauses, and periodic reassessment proportional to data access.

Business continuity: RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss; BIA identifies critical processes and dependencies.

Awareness is a control only when measured: phishing simulation click and report rates, training completion, and repeat-offender tracking provide evidence.