Cybersecurity - Offensive Security Flashcards
(16 cards)
Offensive Security
Offensive security means attacking systems to find vulnerabilities before hackers do. So the workers or employess are trying to “attack” their own to find vulnberbalties. It includes ethical hacking, penetration testing, and bug hunting.
📌 Example: A security team tries to hack their own company’s website to check for weak spots.
Cyber Kill Chain
A model that describes the steps of a cyberattack from reconnaissance to stealing data. It has seven stages:
1️⃣ Reconnaissance – Collecting information about the target.
2️⃣ Weaponization – Creating a hacking tool (e.g., malware).
3️⃣ Delivery – Sending the tool to the target (e.g., phishing email).
4️⃣ Exploitation – Running the attack on the system.
5️⃣ Installation – Making the malware persistent.
6️⃣ Command & Control – Taking control of the system.
7️⃣ Actions on Objective – Stealing, modifying, or damaging data.
📌 Example: A hacker sends a phishing email that installs malware on a company’s computer.
APT
Advanced Persistent Threat
An APT is a secret, long-term cyber attack where hackers break into a system, stay hidden, and steal important data. These attacks are usually done by governments or big hacker groups to spy or cause harm. 🚀
📌 Example: APT29 (Cozy Bear), a Russian-backed group, is suspected of hacking the US government.
Threat Analysis Frameworks
These frameworks help analyze cyber threats and plan defenses. The most common ones are:
MITRE ATT&CK – A database of known hacking techniques.
STRIDE – A model for categorizing cyber threats.
📌 Example: A security team uses MITRE ATT&CK to check how hackers might attack their network.
CVE
Common Vulnerabilities and Exposures
A public database of known cybersecurity weaknesses. Each vulnerability gets a unique CVE ID (e.g., CVE-2023-12345).
📌 Example: A security researcher finds a new Windows bug and reports it as CVE-2024-56789.
So bassicly a list of common cybersecurity weaknesses, that are named with a unique name. And it reports it
CVSS
Common Vulnerability Scoring System
A rating system (0-10) that shows how dangerous a vulnerability is:
0.0-3.9 → Low risk
4.0-6.9 → Medium risk
7.0-8.9 → High risk
9.0-10.0 → Critical risk
📌 Example: A banking app bug rated 9.5 (critical) must be fixed immediately.
Vulnerability Scanners
These tools scan networks and websites for security weaknesses.
📌 Example:
Nmap – Scans for open ports on a system.
Nessus – Scans for known vulnerabilities in software.
Metasploit
Metasploit is a hacking tool used for testing security by finding and exploiting system weaknesses.
What It Does:
✅ Helps ethical hackers test for vulnerabilities.
✅ Can launch real cyber attacks (for testing).
✅ Used for penetration testing & cybersecurity training.
Example:
📌 A company uses Metasploit to test its network and fix weak spots before hackers attack.
✅ Think of Metasploit like a security scanner—it helps find and fix problems before real hackers do! 🚀
Types of Delivery (Attack Methods)
Hackers use different ways to deliver malware or gain access to a system. Here are the main attack methods:
1️⃣ Phishing 📩 – Fake emails trick users into clicking bad links or giving passwords.
2️⃣ Malicious Attachments 📎 – Infected files (PDFs, Word docs) that install malware.
3️⃣ Drive-By Downloads 🌍 – Malware downloads automatically when visiting a hacked website.
4️⃣ USB Drop Attack 💾 – A hacker leaves an infected USB for someone to plug in.
5️⃣ Exploiting Weak Software 🔄 – Hackers use security holes in outdated programs.
6️⃣ Social Engineering 🎭 – Tricking people into revealing passwords or sensitive info.
7️⃣ Malvertising 🖥️ – Fake ads on websites that spread malware.
✅ Hackers use these methods to deliver malware, so staying alert and using security tools helps prevent attacks! 🚀
Bug Bounty Programs
A Bug Bounty Program is when companies pay ethical hackers to find and report security flaws in their systems before real hackers do.
How It Works:
✅ Hackers search for bugs in websites, apps, or software.
✅ If they find a bug, they report it to the company.
✅ The company rewards them with money or recognition.
Example:
📌 Google and Facebook pay hackers thousands of dollars for finding security flaws in their systems.
✅ Bug bounties help companies stay safe by fixing weaknesses before attackers can exploit them! 🚀
Responsible Disclosure
Responsible Disclosure is when a hacker finds a security flaw and privately reports it to the company instead of sharing it publicly.
How It Works:
✅ Hacker finds a bug in a system.
✅ Reports it to the company (instead of leaking it online).
✅ The company fixes the problem before hackers can exploit it.
Example:
📌 A hacker finds a vulnerability in a bank’s website and reports it instead of using it for harm.
✅ Responsible Disclosure helps keep systems safe by fixing security flaws before bad actors can use them! 🚀
Zero-Day Vulnerabilities
A Zero-Day Vulnerability is a security flaw that hackers find before the company knows about it. Since there’s no fix available, it’s very dangerous.
How It Works:
✅ A hacker discovers a new security flaw in software or hardware.
✅ The company has “zero days” to fix it before it can be exploited.
✅ Hackers can use it for attacks (until a patch is made).
Example:
📌 A hacker finds a weakness in Windows that lets them take control of computers before Microsoft knows about it.
✅ Zero-Day Vulnerabilities are dangerous because no one is prepared for them—companies must fix them fast!
Zero-Day Brokers
These are black-market dealers who buy and sell zero-day vulnerabilities.
📌 Example: A broker sells a new Windows exploit to a hacking group for cyberespionage.
Penetration Testing (Pentesting)
Simulating real cyberattacks to find and fix vulnerabilities before real hackers do.
📌 Example: A pentester tests a bank’s security by attempting to hack into its system.
Ethical Hacking vs. Black Hat Hacking
Ethical hacking → Legal, with permission.
Black hat hacking → Illegal, criminal activity.
📌 Example: Ethical hackers work for companies; black hat hackers steal money.
Physical vs. Remote Exploitation
Physical exploitation – The hacker needs direct access to the device.
Remote exploitation – The hacker attacks over the internet.
📌 Example: A hacker installs malware on a USB stick (physical) vs. sends a phishing email (remote).
