Hacking Types

🦠 Malware-Based Attacks

Keywords: infect, spread, disguise, demand, spy, log, hide  

- Virus (infect file): Attaches to files and spreads when opened — like a tainted Word doc.  

- Worm (spread network): Self-replicates across systems — clogs bandwidth.  

- Trojan Horse (disguise legit): Pretends to be useful software — opens a backdoor.  

- Ransomware (demand payment): Encrypts files and demands money — often in crypto.  

- Spyware (spy silently): Monitors user activity — steals browsing data.  

- Keylogger (log keystrokes): Records everything typed — captures passwords.  

- Rootkit (hide deeply): Burrows into the OS — hides attacker’s presence.

---

🌐 Network-Based Attacks

Keywords: intercept, steal, redirect, impersonate, flood, infect site  

- Man-in-the-Middle (MitM) (intercept traffic): Eavesdrops on communication — steals credentials.  

- Session Hijacking (steal session): Takes over a user’s active session — impersonates them.  

- DNS Poisoning (redirect domain): Sends users to fake websites — alters DNS records.  

- ARP Spoofing (impersonate MAC): Tricks devices into sending data to attacker — LAN-based.  

- DoS/DDoS (flood system): Overloads servers with traffic — causes downtime.  

- Watering Hole Attack (infect trusted site): Compromises a site frequented by targets — infects visitors silently.

---

🧬 Web Application Attacks

Keywords: inject, script, trick, traverse  

- SQL Injection (inject query): Inserts malicious SQL — exposes or manipulates databases.  

- Cross-Site Scripting (XSS) (script steal): Injects JavaScript — steals cookies or session data.  

- Cross-Site Request Forgery (CSRF) (trick action): Tricks logged-in users into unintended actions.  

- Directory Traversal (traverse path): Accesses restricted files — manipulates file paths.

---

🔓 Privilege Escalation

Keywords: climb, cross  

- Vertical Escalation (climb access): Gains higher privileges — user becomes admin.  

- Horizontal Escalation (cross account): Accesses peer-level accounts — user A sees user B’s data.

---

🧍 Physical & Wireless Attacks

Keywords: trash, peek, fake, bait  

- Dumpster Diving (trash info): Searches discarded items — finds sensitive data.  

- Shoulder Surfing (peek password): Watches someone enter credentials — at ATMs or workstations.  

- Evil Twin (fake Wi-Fi): Sets up rogue hotspot — captures user traffic.  

- USB Drop Attack (bait device): Leaves infected USBs — curious users plug them in.

Hacking and Phishing

Attacker lifecycle (high-level — memorize these stages)

• Reconnaissance: passive (OSINT) and active (network probes) info gathering.
• Scanning & enumeration: port scans, banner grabbing, probing services to find weaknesses.
• Exploitation: using a vulnerability or misconfiguration to gain access (exploit code, social engineering).
• Privilege escalation: moving from low privilege to admin/root.
• Persistence: backdoors, scheduled tasks, registry autoruns to survive reboots.
• Lateral movement & discovery: hopping to other systems and mapping internal resources.
• Exfiltration & cover tracks: stealing data and deleting logs or using encryption/tunneling to hide activity.

Common categories of attacks (know examples + defensive controls)

• Malware — ransomware, trojans, worms, rootkits, spyware. Controls: EDR/antivirus, application whitelisting, backups, least privilege.
• Credential attacks — brute force, credential stuffing, password spraying, keylogging. Controls: MFA, account lockout, password complexity, monitoring for anomalous logins.
• Network attacks — MITM, ARP poisoning, DNS spoofing/poisoning. Controls: mutual TLS, network segmentation, DHCP snooping, ARP inspection, DNSSEC where applicable.
• Web application attacks — SQL injection, XSS, CSRF, SSRF. Controls: input validation, prepared statements/parameterized queries, WAF, secure session management.
• Supply chain attacks — compromised libraries or service providers. Controls: software bill of materials (SBOM), code signing, patch management, vet vendors.
• Physical attacks & insider threats — tailgating, theft, malicious insider. Controls: access controls, CCTV, separation of duties, monitoring, DLP.

Phishing & social engineering (types and exam-worthy details)

• Phishing (generic email) — mass emails aiming for credentials or malware. Indicators: generic greeting, urgency, mismatched URLs, poor grammar. Defenses: email filters, SPF/DKIM/DMARC, user training, URL rewriting/sandboxing.
• Spear phishing — targeted to a person/organization using personalized details. Higher success rate — requires targeted defense and user awareness.
• Whaling — high-value targets (C-suite). Often blends social engineering + business context (e.g., fake wire requests). Use high verification on financial requests.
• Vishing — phishing over voice calls. Controls: phone-based verification procedures, caller ID validation, staff training.
• Smishing — phishing via SMS. Controls: block suspicious links, user awareness.
• Pharming — DNS or hosts file manipulated to redirect victims. Controls: DNSSEC, monitoring, proper patching, DNS filtering.
• Quid pro quo / baiting — offer something for action (e.g., “install this tool”). Controls: policy, training, app whitelisting.

Indicators of Compromise (IoCs) — what to spot

• Unexpected outbound network traffic or connections to strange domains/IPs.
• Sudden increases in failed logons or logon from odd geolocations.
• New or altered accounts, unexpected scheduled tasks, strange services.
• Unusual file encryption, ransomware notes, or mass file renames.
• Disabled security tools or cleared logs.
  These are things to memorize as “red flags.”

Detection & monitoring (what Security+ expects you to know)

• SIEM for centralized log collection and correlation.
• EDR for endpoint detection and response.
• IDS/IPS for network anomaly/signature detection. Know difference: IDS alerts, IPS blocks (inline).
• UEBA (user & entity behavior analytics) for spotting abnormal behavior.
• Network taps / port mirroring for passive monitoring.
• Threat intelligence / IOC feeds to match indicators.

Prevention & hardening (practical controls to memorize)

• MFA — single most effective control vs credential reuse/phishing.
• Least privilege and role-based access control (RBAC).
• Patch management and vulnerability scanning.
• Network segmentation and microsegmentation.
• Application control / whitelisting and sandboxing.
• Email security: spam filters, sandboxing attachments, SPF/DKIM/DMARC.
• Backups & recovery: air-gapped/offline copies, tested restores.
• User training & simulated phishing tests — measure click rates and remediate.

Incident response basics (chain to remember)

• Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.
• Keep forensic images, preserve logs, document actions. Know when to involve legal/regulatory teams.

Legal/ethical note (important for exam & practice)

• Don’t perform offensive hacking on networks you don’t own/authorize. For labs, use isolated environments (VMs, CTF platforms). Security+ expects defensive knowledge, not how to perform real-world attacks.

Exam mnemonics & high-value facts to memorize

• IDS vs IPS behavior (IDS alert-only; IPS inline & can block).
• SPF/DKIM/DMARC purpose order: SPF (sender IP auth), DKIM (signed email), DMARC (policy + reporting).
• Common social-engineering types: phishing, spear, whaling, vishing, smishing, baiting, tailgating.
• Ransomware defenses: offline backups, segmentation, patching, EDR.
• Privilege escalation common signs: new admin accounts, use of tools like mimikatz (know the concept, not how to run it).

Study actions (what to do next — high ROI)

• Do simulated phishing drills and review results / remediation steps.
• Practice identifying IoCs in mock logs (SIEM labs).
• Memorize acronyms: MFA, RBAC, WAF, EDR, SIEM, IDS/IPS, UEBA, SPF/DKIM/DMARC.
• Use lab platforms (e.g., virtual labs/CTFs) for safe hands-on practice with detection tools (not offensive operations on real networks).
• Create flashcards for attack signs, controls, and the incident response steps.

Network Topology

Network Topology

🌐 What Is Network Topology?

Network topology refers to the physical or logical layout of devices and connections in a network. It’s how computers, switches, routers, and cables are arranged and interact.

There are two types:

- Physical topology: actual layout of cables and devices.

- Logical topology: how data flows across the network.

---

🧩 Common Topologies You Need to Know

1. Bus Topology

All devices share a single backbone cable. Data travels in both directions, and terminators are needed at each end.

> 🔑 Remember: Simple, cheap, but one break can bring down the whole network. Rarely used today.

---

2. Star Topology

All devices connect to a central hub or switch. If one device fails, others stay online.

> 🔑 Remember: Most common today. Easy to manage. But if the central device fails, the whole network goes down.

---

3. Ring Topology

Devices form a closed loop. Data travels in one direction (or both in dual ring). Each device acts as a repeater.

> 🔑 Remember: Used in older token ring networks. One break can disrupt the loop unless it's dual ring.

---

4. Mesh Topology

Every device connects to every other device. Can be full mesh (all connected) or partial mesh.

> 🔑 Remember: High redundancy and fault tolerance. Used in WANs and backbone networks. Expensive and complex.

---

5. Hybrid Topology

Combines two or more topologies (e.g., star-bus, star-ring). Common in large enterprise networks.

> 🔑 Remember: Flexible and scalable. Real-world networks are often hybrids.

---

🛡️ Security+ Focus Points

- Star topology is dominant in LANs—know how switches and hubs behave.

- Mesh topology is key in WANs and disaster recovery—think of BGP and redundant paths.

- Bus and ring are mostly historical—understand them for legacy systems and exam questions.

- Hybrid is the reality—expect mixed environments in enterprise setups.

7 Layer OSI

7 Layer OSI

Open Systems Interconnection (OSI) model is a conceptual framework that divides network communications functions into seven layers

🧠 Think of OSI as a layered cake of communication, from user-facing apps down to electrical signals.

1. Physical Layer (Layer 1)

This is the foundation. It deals with raw bits transmitted over cables, fiber optics, or wireless. Think: voltage levels, connectors, pinouts, and physical media.

> 🔑 Remember: It's about hardware and transmission. Cables, NICs, and hubs live here.

---

2. Data Link Layer (Layer 2)

This layer handles MAC addresses and frames. It ensures error detection and correction between directly connected devices.

> 🔑 Remember: MAC address = Layer 2. Switches operate here. It’s the “local delivery” layer.

---

3. Network Layer (Layer 3)

Responsible for routing and logical addressing. IP addresses are the star here. It decides the best path to send data across networks.

> 🔑 Remember: IP = Layer 3. Routers work here. It’s the “global delivery” layer.

---

4. Transport Layer (Layer 4)

Ensures reliable data transfer with error recovery and flow control. TCP and UDP are key protocols.

> 🔑 Remember: TCP/UDP = Layer 4. Ports (like 80, 443) are used here. It’s about end-to-end reliability.

---

5. Session Layer (Layer 5)

Manages sessions between applications—starting, maintaining, and ending them. Think of it as a conversation manager.

> 🔑 Remember: It keeps sessions alive. Used in things like remote procedure calls or SQL sessions.

---

6. Presentation Layer (Layer 6)

Translates data formats, handles encryption and compression. It ensures that data is readable by the receiving system.

> 🔑 Remember: Encryption happens here. SSL/TLS, JPEG, and MP3 are examples.

---

7. Application Layer (Layer 7)

Closest to the user. It provides services like email, file transfer, and web browsing.

> 🔑 Remember: User-facing protocols like HTTP, FTP, SMTP live here.

---

🧩 Mnemonic (Bottom-Up):

Please Do Not Throw Sausage Pizza Away

---

🎯 For Security+ Focus:

- Know that firewalls often operate at Layer 3 and 4.

- MAC spoofing targets Layer 2.

- IP spoofing targets Layer 3.

- SSL/TLS encryption is Layer 6.

- Web attacks (like XSS or SQLi) hit Layer 7.