Common Network Attacks - Full Notes

Common Network Attacks

Network attacks are attempts to:

  • Steal information

  • Disrupt services

  • Gain unauthorized access

🧠 Think:

Attack = Someone trying to break, trick, or access a system

Reconnaissance & Scanning

Reconnaissance

Reconnaissance is gathering information about a target before an attack.

Examples:

  • Finding IP addresses

  • Identifying systems

  • Learning about services

🧠 Think:

Recon = Research Before Attack

Port Scanning

Port scanning checks a system for:

  • Open ports

  • Running services

Example:

Using:

✅ Nmap

Purpose:

Finding possible entry points.

🧠 Think:

Port Scan = Checking Open Doors

Denial of Service Attacks

DoS (Denial of Service)

A DoS attack overwhelms a system with traffic from one source.

Goal:

Make a service unavailable to normal users.

Example:

Attacker
   ↓
Server

🧠 Think:

DoS = One Attacker

DDoS (Distributed Denial of Service)

A DDoS attack overwhelms a system using many sources.

Usually uses:

✅ Botnet

Example:

Many Computers
      ↓
    Server

Harder to stop because traffic comes from many locations.

🧠 Think:

DDoS = Distributed = Many Attackers

DoS vs DDoS

DoS

DDoS

One source

Many sources

Easier to block

Harder to stop

On-Path & Spoofing Attacks

On-Path Attack

An attacker secretly sits between two devices and intercepts traffic.

They may:

  • Read information

  • Modify traffic

Formerly called:

Man-in-the-Middle (MITM)

Example:

User
 ↓
Attacker
 ↓
Website

🧠 Think:

On-Path = Attacker in the Middle

ARP Spoofing / Poisoning

An attacker sends fake ARP messages to associate their MAC address with another device's IP address.

Result:

Traffic gets redirected to the attacker.

Used for:

  • On-path attacks

🧠 Think:

ARP Spoofing = Fake MAC Mapping

DNS Spoofing / Poisoning

An attacker changes DNS information so a website name points to a malicious IP.

Example:

Normal:

bank.com → Real Website

Attack:

bank.com → Fake Website

🧠 Think:

DNS Poisoning = Fake Name → Fake IP

MAC Spoofing

An attacker changes their MAC address to pretend to be another device.

🧠 Think:

MAC Spoofing = Fake Device Identity

IP Spoofing

An attacker changes the source IP address to hide their identity or pretend to be another system.

🧠 Think:

IP Spoofing = Fake IP Address

Password Attacks

Brute Force Attack

Trying every possible password combination until one works.

Example:

aaaa
aaab
aaac
...

🧠 Think:

Brute Force = Try Everything

Dictionary Attack

Uses a list of common passwords.

Example:

password123
welcome
admin
football

Faster than brute force.

🧠 Think:

Dictionary = Password List

Credential Stuffing

Uses stolen username/password combinations from one breach to try logging into other websites.

🧠 Think:

Credential Stuffing = Reusing Stolen Passwords

Social Engineering Attacks

Social engineering attacks target people instead of technology.

🧠 Think:

Social Engineering = Hacking Humans

Phishing

Fake emails designed to trick users.

Goal:

  • Steal information

  • Get users to click malicious links

🧠 Think:

Phishing = Fake Email

Spear Phishing

A targeted phishing attack against a specific person.

Example:

An email specifically created for a company employee.

🧠 Think:

Spear = Specific Target

Vishing

Voice phishing.

Uses:

  • Phone calls

  • Voice messages

🧠 Think:

Vishing = Voice Phishing

Tailgating

Following an authorized person into a secure area.

Example:

Someone holds the door open for an attacker.

🧠 Think:

Tailgating = Following Someone In

VLAN Hopping

An attacker gains access to a VLAN they should not have access to.

Usually caused by:

  • Switch misconfiguration

🧠 Think:

VLAN Hopping = Jumping Between VLANs

Rogue DHCP Server

An unauthorized DHCP server gives devices incorrect network settings.

Can redirect traffic or disrupt the network.

🧠 Think:

Rogue DHCP = Fake Network Configuration

Rogue Access Point / Evil Twin

Rogue Access Point

An unauthorized wireless access point connected to a network.

🧠 Think:

Rogue AP = Unauthorized Wi-Fi

Evil Twin

A fake Wi-Fi network pretending to be a legitimate one.

Goal:

  • Trick users into connecting

  • Capture traffic

Example:

Real:

CoffeeShop WiFi

Fake:

CoffeeShop_Free_WiFi

🧠 Think:

Evil Twin = Fake Copy of Wi-Fi

Deauthentication Attack

Forces devices off a Wi-Fi network.

Often used to make users reconnect to an evil twin.

🧠 Think:

Deauth = Kick Devices Off Wi-Fi

⭐ Network+ Must Memorize

✅ Recon = Gathering information
✅ Port Scan = Finding open ports
✅ DoS = One attacker flooding a target
✅ DDoS = Many attackers flooding a target
✅ On-Path = Attacker intercepts traffic
✅ ARP Spoofing = Fake MAC/IP mapping
✅ DNS Spoofing = Fake name-to-IP mapping
✅ Brute Force = Every password combination
✅ Dictionary = Common password list
✅ Phishing = Fake email
✅ Spear Phishing = Targeted phishing
✅ Vishing = Voice phishing
✅ VLAN Hopping = Unauthorized VLAN access
✅ Rogue DHCP = Fake DHCP server
✅ Evil Twin = Fake Wi-Fi network