Attacks and Exploits
Attacks and Exploits
This domain asks you to match a vulnerability to a working technique and to know the side effects. Group your knowledge by layer.
Network: ARP spoofing and DNS cache poisoning enable on-path (MITM) attacks; VLAN hopping via switch spoofing or double tagging; NAC bypass; rogue DHCP and LLMNR/NBT-NS/mDNS poisoning to capture NetNTLM hashes, often followed by relay. Wireless: deauthentication to force handshakes, evil twin and rogue access points, WPA/WPA2 PSK capture and offline cracking, captive portal abuse.
Applications: injection (SQL, command, LDAP), XSS (stored, reflected, DOM), CSRF, IDOR and broken object-level authorization, SSRF including reaching cloud metadata endpoints, insecure deserialization, file upload, and path traversal. Credentials: brute force is many guesses against one account; password spraying is a few common passwords against many accounts to stay under lockout thresholds; credential stuffing reuses breached username/password pairs. Offline cracking is a different problem from online guessing.
Social engineering: phishing, vishing, smishing, pretexting, tailgating - always confirm whether people are in scope and whether a target exclusion list exists. Cloud and supply chain: exposed storage buckets, over-permissive IAM roles, dependency confusion.
Traps: spraying versus brute force is a classic; watch lockout counters; recognize that some exploits (deauth, buffer overflows, aggressive fuzzing) can cause outages and may need a maintenance window; distinguish authentication bypass from privilege escalation; never assume a payload is non-destructive.
Rule of thumb: before firing any exploit, name the precondition it requires (reachability, version, credentials, user interaction) and the side effect it may cause. If either is unknown, get approval first.