CompTIA Security+ Threats Attacks and Vulnerabilities

Password attack types: (A) Brute Force — systematically tries every possible combination; effective against short/simple passwords but computationally expensive; (B) Dictionary Attack — uses wordlists (common passwords, dictionary words, variations); extremely effective against common passwords; (C) Credential Stuffing — takes breached credentials from one site and automates login attempts on others; effective because ~65% of users reuse passwords. Mitigations: strong unique passwords, MFA, account lockout policies, password managers. VLAN hopping and DNS poisoning are network attacks, not password attacks.

Reflected XSS occurs when malicious script is embedded in a request (typically URL parameter) and the server reflects it back in the HTML response without sanitizing — executing in the victim's browser. It requires tricking the victim into clicking a crafted URL (via phishing). The script is NOT stored server-side. Stored XSS: malicious script saved in the database (comments, forum posts) — affects all visitors. DOM-Based XSS: client-side JavaScript processes attacker-controlled data without server involvement. Blind XSS: payload executes in a context the attacker can't directly observe (admin panels). Mitigations: output encoding, Content Security Policy (CSP), input validation, HTTPOnly cookies.

Pass-the-Hash exploits a fundamental weakness in Windows NTLM authentication: NTLM accepts the password hash as proof of identity, not just the plaintext password. Attack process: (1) Attacker obtains NTLM hash from memory (using Mimikatz, secretsdump.py), SAM database, or network capture; (2) Uses the hash directly in authentication protocols without ever knowing the plaintext password. This enables lateral movement across the network. Mitigations: Credential Guard (Windows 10+, protects LSA secrets in virtualized container), disable NTLM where possible (use Kerberos), Protected Users security group, privileged account separation. PtH does not require the plaintext password.

Penetration testing knowledge levels: Black-box — tester has NO prior knowledge of the target environment (simulates an external attacker with no insider information); most realistic simulation of real-world attack. White-box — tester has full knowledge (network diagrams, source code, credentials); most thorough coverage, tests defenses with complete information. Gray-box — tester has partial knowledge (some network info, maybe a low-privilege account); balances realism with efficiency. Red team — extended adversarial simulation covering physical, social engineering, and technical attack vectors; tests detection and response capabilities, not just defenses. Scope is defined in the Rules of Engagement (ROE)/Statement of Work.

APT threat actors are highly sophisticated, well-funded organizations (often nation-states or state-sponsored groups) that conduct targeted, long-term cyberattacks. Characteristics: custom malware/exploits, patient multi-stage attacks, persistence mechanisms, espionage or sabotage goals, zero-day exploitation. Examples: APT28 (Fancy Bear/Russia), APT41 (China), Lazarus Group (North Korea). Script kiddies use existing tools without deep knowledge. Hacktivists are motivated by ideology (Anonymous). Insider threats involve current/former employees, contractors. APTs represent the most sophisticated and persistent threat category.