Domain 2 Security +

SO MUCH INFORMATION

MitM

Man-in-the-Middle

ARP Poisoning & On-Path Attacks

• Definition: An attack where a malicious actor sends fake ARP messages onto a local network to link their own MAC address with the IP address of a legitimate target (like the default gateway), routing all traffic through the attacker first.

• Example: An attacker sitting in a coffee shop runs a tool that tricks your laptop into thinking their phone is the Wi-Fi router. Now, every website you visit routes through their device first, allowing them to steal unencrypted data.

EOSL

• Definition: The final phase of a product's lifecycle where the manufacturer stops selling it, stops providing standard support, and entirely stops releasing security patches (unless a company pays a massive premium).

• Example: A company uses an old firewall model that hits EOSL. Two months later, a major security flaw is discovered, but the vendor refuses to release a public patch, leaving the company completely exposed unless they buy brand new hardware.

End of Service Life DONESO

EOL

END OF LIFE. AGREEMENT SENT

EDR

• Definition: Advanced endpoint security software that goes beyond basic signature-based antivirus by using machine learning and continuous process monitoring to detect live anomalies.

• Example: A corporate laptop gets infected with a brand-new fileless virus. Traditional antivirus misses it, but the EDR agent notices the device is suddenly making strange, automated database connections at 3:00 AM, isolates the laptop from the network, and alerts the security team.

(Endpoint Detection and Response)

IOC

• Definition: Forensic evidence or clues showing a system was breached.

• Example: Finding an unauthorized, unusual application running in system memory or a massive spike in outbound network traffic at 3:00 AM.

(Indicator of Compromise)

CSRF / XSRF

• Definition: An attack that forces an authenticated user's browser to send forged requests to a website that already trusts them.

• Example: While logged into your banking app in one tab, you click a malicious link in another tab that silently sends a command to your banking tab saying "Transfer $1,000 to Account X."

(Sea Surf)

Pretexting

• Definition: Creating a fabricated scenario (a lie) to trick a victim into revealing sensitive information.

• Example: A scammer calls an employee pretending to be an external corporate auditor conducting a routine compliance check to get them to reveal system configurations.

APT

(Advanced Persistent Threat)

• Definition: State-sponsored, highly funded hackers focused on long-term stealth and data exfiltration.

• Example: A foreign military intelligence unit spends 6 months quietly mapping an electrical grid's network to steal blueprints without shutting anything down.

Non-Persistent Threat Actor

• Definition: An opportunistic attacker who strikes quickly and moves on, without attempting to maintain long-term, hidden network access.

• Example: A script kiddie runs an automated scanner against random websites to deface the homepages of any unpatched server they find.

Shadow IT

• Definition: Employees using unauthorized outside applications or hardware to do corporate work without IT's permission.

• Example: A marketing team thinks the corporate file-sharing app is too slow, so they upload sensitive client contract PDFs to a personal Dropbox account.

Whaling

• Definition: A highly targeted phishing attack aimed exclusively at high-level executives (CFO/CEO).

• Example: The CFO receives an urgent email looking like it's from the CEO, demanding an immediate wire transfer to a secret vendor for an acquisition.

Typosquatting / URL Hijacking

• Definition: Registering a domain name misspelled slightly to look like a legitimate site to trick users.

• Example: An attacker buys ://goolge.com and hosts a fake Google login page there to harvest passwords from typos.

Watering Hole Attack

• Definition: Infecting a third-party website that the target victims frequently visit.

• Example: An attacker hacks the website of a popular sandwich shop across the street from a major defense contractor, embedding a script that infects employees' laptops when they order lunch.

Buffer Overflow

• Definition: Injecting more data into memory than a system can handle to overwrite unauthorized memory spaces or crash the system.

• Example: An application expects a 10-character password, but an attacker inputs a 5,000-character string containing malicious system commands that spill into adjacent memory zones and execute.

SQL Injection (SQLi)

• Definition: Injecting database commands into user input fields to manipulate backend application database structures.

• Example: Instead of entering a username, an attacker types ' OR 1=1; -- into a login box, tricking the backend database into logging them in without a password.

Stored (Persistent) XSS

• Definition: Injecting malicious JavaScript permanently into a target server (like a comment section) that executes on any user's browser who views the page.

• Example: An attacker leaves a comment on a popular Facebook post containing hidden JavaScript code; every single user who scrolls past that comment automatically runs the script, stealing their active cookies.

Reflected (Non-persistent) XSS

• Definition: Bouncing a malicious script off a web server immediately via a customized, fraudulent web link.

• Example: An attacker sends a victim a link that reads http://bank.com<script>badcode</script>. When clicked, the bank's website repeats the search query on the screen, causing the browser to execute the script.

HIPS

• Definition: A software application installed on a single host (like a server or PC) that actively monitors system activity, logs alerts, and actively blocks malicious behavior or unauthorized system changes in real time.

• Example: A user accidentally clicks a malicious link that attempts to rewrite a critical Windows registry file. HIPS immediately intercepts the action, stops the file from being modified, and flags the event.

(Host Intrusion Prevention System)

Nmap

• Definition: A powerful command-line tool used by both defenders and attackers to scan networks, discover active hosts, and identify which ports are open, closed, or filtered.

• The Scan Trick: On the exam, if you see a prompt asking you to identify a command that looks like nmap -sV -p 1-1000 192.168.1.1, look for the -p flag. That stands for "ports" and tells Nmap exactly which port range to scan.

• Example: A security analyst runs an Nmap scan against a new web server and discovers that Port 23 (Telnet) is accidentally left wide open, allowing them to remediate it before an attacker exploits it.

Network Mapper

(802.1X)

• Definition: A port-based network access control protocol that forces a device to provide valid enterprise credentials (like a username/password or certificate) before the network switch or Wi-Fi router will allow any traffic to pass.

• Example: When you plug your laptop into a wall jack at a high-security bank, your computer pops up asking for your corporate domain login. If you don't have one, the wall port completely cuts you off from the internet.

Wireless Network Authentication

ACLs

• Definition: A text-based rule list used by routers and firewalls to permit or deny traffic based on attributes like source IP, destination IP, or port number.

• Example: A firewall rule that says: DENY all traffic coming from the internet on Port 80 going to the Internal Accounting Server

(Access Control Lists)

ARP

Address Resolution Protocol (BASICALLY IP and MAC Address)

TOCTOU

Race Condition
An exploit that abuses the timing window between when a security check occurs and when the system executes the task.