Bluejacking vs Bluesnarfing

🔹 Bluejacking is the act of sending unsolicited messages to nearby Bluetooth-enabled devices. It’s usually done for fun or pranks—like sending a message that says “You’ve been bluejacked!” to a stranger’s phone. It doesn’t involve accessing or stealing any data. The victim sees the message, but nothing is compromised.

🔹 Bluesnarfing, on the other hand, is a serious security breach. It involves exploiting vulnerabilities in Bluetooth to secretly access data from another device—like contacts, messages, calendar entries, or even files. The victim typically has no idea it’s happening. This is illegal and considered a form of cyberattack.

🧠 Quick memory tip:  

- Bluejacking = hijack attention (just messages)  

- Bluesnarfing = snarf secrets (steals data)

If you're studying Bluetooth attack vectors for pentesting or defense, Bluesnarfing is the one to analyze deeply—it involves protocol-level exploitation and can be mitigated with secure pairing, updated firmware, and disabling Bluetooth when not in use.

Hacking Types

🦠 Malware-Based Attacks

Keywords: infect, spread, disguise, demand, spy, log, hide  

- Virus (infect file): Attaches to files and spreads when opened — like a tainted Word doc.  

- Worm (spread network): Self-replicates across systems — clogs bandwidth.  

- Trojan Horse (disguise legit): Pretends to be useful software — opens a backdoor.  

- Ransomware (demand payment): Encrypts files and demands money — often in crypto.  

- Spyware (spy silently): Monitors user activity — steals browsing data.  

- Keylogger (log keystrokes): Records everything typed — captures passwords.  

- Rootkit (hide deeply): Burrows into the OS — hides attacker’s presence.

---

🌐 Network-Based Attacks

Keywords: intercept, steal, redirect, impersonate, flood, infect site  

- Man-in-the-Middle (MitM) (intercept traffic): Eavesdrops on communication — steals credentials.  

- Session Hijacking (steal session): Takes over a user’s active session — impersonates them.  

- DNS Poisoning (redirect domain): Sends users to fake websites — alters DNS records.  

- ARP Spoofing (impersonate MAC): Tricks devices into sending data to attacker — LAN-based.  

- DoS/DDoS (flood system): Overloads servers with traffic — causes downtime.  

- Watering Hole Attack (infect trusted site): Compromises a site frequented by targets — infects visitors silently.

---

🧬 Web Application Attacks

Keywords: inject, script, trick, traverse  

- SQL Injection (inject query): Inserts malicious SQL — exposes or manipulates databases.  

- Cross-Site Scripting (XSS) (script steal): Injects JavaScript — steals cookies or session data.  

- Cross-Site Request Forgery (CSRF) (trick action): Tricks logged-in users into unintended actions.  

- Directory Traversal (traverse path): Accesses restricted files — manipulates file paths.

---

🔓 Privilege Escalation

Keywords: climb, cross  

- Vertical Escalation (climb access): Gains higher privileges — user becomes admin.  

- Horizontal Escalation (cross account): Accesses peer-level accounts — user A sees user B’s data.

---

🧍 Physical & Wireless Attacks

Keywords: trash, peek, fake, bait  

- Dumpster Diving (trash info): Searches discarded items — finds sensitive data.  

- Shoulder Surfing (peek password): Watches someone enter credentials — at ATMs or workstations.  

- Evil Twin (fake Wi-Fi): Sets up rogue hotspot — captures user traffic.  

- USB Drop Attack (bait device): Leaves infected USBs — curious users plug them in.

Hacking and Phishing

Attacker lifecycle (high-level — memorize these stages)

• Reconnaissance: passive (OSINT) and active (network probes) info gathering.
• Scanning & enumeration: port scans, banner grabbing, probing services to find weaknesses.
• Exploitation: using a vulnerability or misconfiguration to gain access (exploit code, social engineering).
• Privilege escalation: moving from low privilege to admin/root.
• Persistence: backdoors, scheduled tasks, registry autoruns to survive reboots.
• Lateral movement & discovery: hopping to other systems and mapping internal resources.
• Exfiltration & cover tracks: stealing data and deleting logs or using encryption/tunneling to hide activity.

Common categories of attacks (know examples + defensive controls)

• Malware — ransomware, trojans, worms, rootkits, spyware. Controls: EDR/antivirus, application whitelisting, backups, least privilege.
• Credential attacks — brute force, credential stuffing, password spraying, keylogging. Controls: MFA, account lockout, password complexity, monitoring for anomalous logins.
• Network attacks — MITM, ARP poisoning, DNS spoofing/poisoning. Controls: mutual TLS, network segmentation, DHCP snooping, ARP inspection, DNSSEC where applicable.
• Web application attacks — SQL injection, XSS, CSRF, SSRF. Controls: input validation, prepared statements/parameterized queries, WAF, secure session management.
• Supply chain attacks — compromised libraries or service providers. Controls: software bill of materials (SBOM), code signing, patch management, vet vendors.
• Physical attacks & insider threats — tailgating, theft, malicious insider. Controls: access controls, CCTV, separation of duties, monitoring, DLP.

Phishing & social engineering (types and exam-worthy details)

• Phishing (generic email) — mass emails aiming for credentials or malware. Indicators: generic greeting, urgency, mismatched URLs, poor grammar. Defenses: email filters, SPF/DKIM/DMARC, user training, URL rewriting/sandboxing.
• Spear phishing — targeted to a person/organization using personalized details. Higher success rate — requires targeted defense and user awareness.
• Whaling — high-value targets (C-suite). Often blends social engineering + business context (e.g., fake wire requests). Use high verification on financial requests.
• Vishing — phishing over voice calls. Controls: phone-based verification procedures, caller ID validation, staff training.
• Smishing — phishing via SMS. Controls: block suspicious links, user awareness.
• Pharming — DNS or hosts file manipulated to redirect victims. Controls: DNSSEC, monitoring, proper patching, DNS filtering.
• Quid pro quo / baiting — offer something for action (e.g., “install this tool”). Controls: policy, training, app whitelisting.

Indicators of Compromise (IoCs) — what to spot

• Unexpected outbound network traffic or connections to strange domains/IPs.
• Sudden increases in failed logons or logon from odd geolocations.
• New or altered accounts, unexpected scheduled tasks, strange services.
• Unusual file encryption, ransomware notes, or mass file renames.
• Disabled security tools or cleared logs.
  These are things to memorize as “red flags.”

Detection & monitoring (what Security+ expects you to know)

• SIEM for centralized log collection and correlation.
• EDR for endpoint detection and response.
• IDS/IPS for network anomaly/signature detection. Know difference: IDS alerts, IPS blocks (inline).
• UEBA (user & entity behavior analytics) for spotting abnormal behavior.
• Network taps / port mirroring for passive monitoring.
• Threat intelligence / IOC feeds to match indicators.

Prevention & hardening (practical controls to memorize)

• MFA — single most effective control vs credential reuse/phishing.
• Least privilege and role-based access control (RBAC).
• Patch management and vulnerability scanning.
• Network segmentation and microsegmentation.
• Application control / whitelisting and sandboxing.
• Email security: spam filters, sandboxing attachments, SPF/DKIM/DMARC.
• Backups & recovery: air-gapped/offline copies, tested restores.
• User training & simulated phishing tests — measure click rates and remediate.

Incident response basics (chain to remember)

• Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.
• Keep forensic images, preserve logs, document actions. Know when to involve legal/regulatory teams.

Legal/ethical note (important for exam & practice)

• Don’t perform offensive hacking on networks you don’t own/authorize. For labs, use isolated environments (VMs, CTF platforms). Security+ expects defensive knowledge, not how to perform real-world attacks.

Exam mnemonics & high-value facts to memorize

• IDS vs IPS behavior (IDS alert-only; IPS inline & can block).
• SPF/DKIM/DMARC purpose order: SPF (sender IP auth), DKIM (signed email), DMARC (policy + reporting).
• Common social-engineering types: phishing, spear, whaling, vishing, smishing, baiting, tailgating.
• Ransomware defenses: offline backups, segmentation, patching, EDR.
• Privilege escalation common signs: new admin accounts, use of tools like mimikatz (know the concept, not how to run it).

Study actions (what to do next — high ROI)

• Do simulated phishing drills and review results / remediation steps.
• Practice identifying IoCs in mock logs (SIEM labs).
• Memorize acronyms: MFA, RBAC, WAF, EDR, SIEM, IDS/IPS, UEBA, SPF/DKIM/DMARC.
• Use lab platforms (e.g., virtual labs/CTFs) for safe hands-on practice with detection tools (not offensive operations on real networks).
• Create flashcards for attack signs, controls, and the incident response steps.

Network Topology

Network Topology

🌐 What Is Network Topology?

Network topology refers to the physical or logical layout of devices and connections in a network. It’s how computers, switches, routers, and cables are arranged and interact.

There are two types:

- Physical topology: actual layout of cables and devices.

- Logical topology: how data flows across the network.

---

🧩 Common Topologies You Need to Know

1. Bus Topology

All devices share a single backbone cable. Data travels in both directions, and terminators are needed at each end.

> 🔑 Remember: Simple, cheap, but one break can bring down the whole network. Rarely used today.

---

2. Star Topology

All devices connect to a central hub or switch. If one device fails, others stay online.

> 🔑 Remember: Most common today. Easy to manage. But if the central device fails, the whole network goes down.

---

3. Ring Topology

Devices form a closed loop. Data travels in one direction (or both in dual ring). Each device acts as a repeater.

> 🔑 Remember: Used in older token ring networks. One break can disrupt the loop unless it's dual ring.

---

4. Mesh Topology

Every device connects to every other device. Can be full mesh (all connected) or partial mesh.

> 🔑 Remember: High redundancy and fault tolerance. Used in WANs and backbone networks. Expensive and complex.

---

5. Hybrid Topology

Combines two or more topologies (e.g., star-bus, star-ring). Common in large enterprise networks.

> 🔑 Remember: Flexible and scalable. Real-world networks are often hybrids.

---

🛡️ Security+ Focus Points

- Star topology is dominant in LANs—know how switches and hubs behave.

- Mesh topology is key in WANs and disaster recovery—think of BGP and redundant paths.

- Bus and ring are mostly historical—understand them for legacy systems and exam questions.

- Hybrid is the reality—expect mixed environments in enterprise setups.

7 Layer OSI

7 Layer OSI

Open Systems Interconnection (OSI) model is a conceptual framework that divides network communications functions into seven layers

🧠 Think of OSI as a layered cake of communication, from user-facing apps down to electrical signals.

1. Physical Layer (Layer 1)

This is the foundation. It deals with raw bits transmitted over cables, fiber optics, or wireless. Think: voltage levels, connectors, pinouts, and physical media.

> 🔑 Remember: It's about hardware and transmission. Cables, NICs, and hubs live here.

---

2. Data Link Layer (Layer 2)

This layer handles MAC addresses and frames. It ensures error detection and correction between directly connected devices.

> 🔑 Remember: MAC address = Layer 2. Switches operate here. It’s the “local delivery” layer.

---

3. Network Layer (Layer 3)

Responsible for routing and logical addressing. IP addresses are the star here. It decides the best path to send data across networks.

> 🔑 Remember: IP = Layer 3. Routers work here. It’s the “global delivery” layer.

---

4. Transport Layer (Layer 4)

Ensures reliable data transfer with error recovery and flow control. TCP and UDP are key protocols.

> 🔑 Remember: TCP/UDP = Layer 4. Ports (like 80, 443) are used here. It’s about end-to-end reliability.

---

5. Session Layer (Layer 5)

Manages sessions between applications—starting, maintaining, and ending them. Think of it as a conversation manager.

> 🔑 Remember: It keeps sessions alive. Used in things like remote procedure calls or SQL sessions.

---

6. Presentation Layer (Layer 6)

Translates data formats, handles encryption and compression. It ensures that data is readable by the receiving system.

> 🔑 Remember: Encryption happens here. SSL/TLS, JPEG, and MP3 are examples.

---

7. Application Layer (Layer 7)

Closest to the user. It provides services like email, file transfer, and web browsing.

> 🔑 Remember: User-facing protocols like HTTP, FTP, SMTP live here.

---

🧩 Mnemonic (Bottom-Up):

Please Do Not Throw Sausage Pizza Away

---

🎯 For Security+ Focus:

- Know that firewalls often operate at Layer 3 and 4.

- MAC spoofing targets Layer 2.

- IP spoofing targets Layer 3.

- SSL/TLS encryption is Layer 6.

- Web attacks (like XSS or SQLi) hit Layer 7.