Attack types Flashcards
Steals data from Bluetooth-enabled devices
Bluesnarfing
Takes over a user’s session by obtaining or predicting a valid session token
Session Hijack
Sends unsolicited messages over Bluetooth to nearby devices
Bluejacking
Chains multiple SQL commands with a delimiter to execute them sequentially
Stacked Queries
Increases the volume of an attack by using network resources to magnify traffic
Amplification Attack
Intercepts network handshakes to crack wireless encryption keys
Handshake capture
Intercepts data on a network by linking an attacker’s MAC to a legitimate IP address
ARP Poisoning
Fakes a login or splash page to capture user credentials
Captive PortalS
Sets up a rogue WiFi access point to intercept wireless communications
Evil Twin
Impersonates devices by mimicking their MAC addresses
MAC Spoofing
Deceives a user into submitting a malicious request via image tags, hidden forms, etc
CSRF
Bypasses network segmentation by sending packets to a switch that forwards them to other VLANs
VLAN Hopping
Reflects a malicious script off of a web application to the user’s browser
XSS - Reflected
Masquerades as a legitimate entity by falsifying data to gain an advantage
Spoofing
Reuses valid data transmission to fraudulently or maliciously repeat or delay operations
Session Replay
Exploits Windows network protocols to intercept traffic and gain credentials
LLMNR/NBT-NS Poisoning
Forcibly disconnects devices from a network
Deauthentication
Exploits vulnerable web applications to force them to make requests to unintended locations
SSRF
Attempts to access a large number of accounts with commonly used passwords
Password Spraying
Captures authentication session to access a network resource without credentials
NTLM Relay Attacks
Denies service to valid users by overwhelming a system with requests
DoS
Captures and retransmits signals, such as from a key fob, to gain unauthorized access
Relay Attacks
exploits Kerberos authentication to crack passwords of service accounts
Kerberoasting
Systematically tries every possible password combination
Brute Force
Intercepts data between two parties to steal or modify it
On-path Attack
Stores malicious script in server databases to execute whenever the stored data is viewed
XSS-Persistent
Triggers malicious actions on a web application where a user is authenticated
XSRF
Uses a pre-arranged list of likely passwords
Dictionary Attack
Copies RFID tags for unauthorized access to secure areas
RFID Cloning
Inserts false information into DNS cache to redirect users to malicious sites
DNS Cache Poisoning
