Practical demonstrations of attack vectors, identification techniques, and defense strategies
Understanding the stages of a cyberattack from inception to recovery
Attacker gathers information about the target organization
Development of malware or attack vector
Transmission of the weapon to the target
Execution of malicious code on the target system
Establishment of persistence on the compromised system
Establishment of communication channel for remote control
Execution of the attacker's primary goals
Identification of the security incident
Limiting the impact of the security incident
Removal of the threat from the environment
Restoration of normal operations
Analysis and lessons learned from the incident
Comprehensive guide to attack types, targets, tools, and response strategies
| Attack Type | System Target | Attack Tools | Identify (Detection) | Defend (Prevention) | Remediate | Recover |
|---|---|---|---|---|---|---|
| Phishing | Users (Email, Browser, Identity) | Evilginx, Gophish, SET | Email gateways, SIEM, PhishTool | Email filtering (Proofpoint), MFA | Account reset, revoke access | User awareness, backup identity tokens |
| Ransomware | File System, Network Shares | LockBit, WannaCry, REvil | EDR (CrowdStrike), YARA, IDS/IPS | EDR, Anti-ransomware, backups | Quarantine, decrypt with key/tool | Restore from backups, forensic audit |
| DDoS | Network (Bandwidth, Availability) | LOIC, HOIC, Botnets | Traffic analyzers, NetFlow, Wireshark | WAF, Cloudflare, Rate limiting | Drop malicious IPs, scrub traffic | ISP rerouting, infrastructure scaling |
| SQL Injection | Web Application (DB Queries) | sqlmap, Burp Suite | Web scanners, WAF logs, SIEM | Input validation, parameterized queries | Patch app, block malicious IPs | DB snapshot recovery, pen testing |
| Cross-Site Scripting | Web App (User Browser/Session) | BeEF, XSSer | WAF, Code scan, Bug bounty | CSP, sanitization, input validation | Patch, alert affected users | Update app code, re-educate developers |
| Credential Stuffing | Auth Systems (Login endpoints) | Sentry MBA, Snipr | SIEM, Abnormal login alerts | MFA, rate-limiting, CAPTCHA | Block IPs, password resets | User comms, password hygiene campaigns |
| MITM (Man-in-the-Middle) | Network, Communications | Wireshark, ettercap, mitmproxy | TLS inspection tools, IDS | HTTPS, VPNs, HSTS | Revoke exposed sessions/keys | Renew certificates, network hardening |
| Privilege Escalation | OS/Kernel, Access Control | Mimikatz, WinPEAS, LinPEAS | EDR, UAC logs, LAPS auditing | Least privilege, patching, monitoring | Kill elevated sessions, change creds | Role review, GPO reinforcement |
| DNS Spoofing | DNS Servers, Caches | dnsspoof, Bettercap | DNS query logs, Wireshark, Zeek | DNSSEC, authenticated resolvers | Flush DNS cache, block spoofed IPs | Monitor logs, educate network admins |
| Zero-Day Exploits | Apps, OS, Firmware (Unknown flaws) | Metasploit (custom modules), Fuzzers | EDR, Threat intel feeds, anomaly detection | Patch mgmt., behavior-based detection | Disable affected systems, emergency patch | Vendor support, system rebuild |
Step-by-step demonstrations of common attack vectors and defense strategies
This walkthrough demonstrates a typical phishing attack targeting a financial institution, from initial reconnaissance to credential harvesting.
This walkthrough demonstrates how ransomware attacks infiltrate networks, encrypt files, and demand payment, along with effective defense strategies.
This walkthrough demonstrates how attackers exploit vulnerable web applications to access databases and extract sensitive information.
This walkthrough demonstrates common attack vectors targeting mobile money systems in Kenya, including SIM swapping and social engineering.
Practical guides for identifying and analyzing different types of cyber threats
This walkthrough demonstrates techniques for analyzing malware samples to understand their behavior, capabilities, and indicators of compromise.
This walkthrough demonstrates how to analyze network traffic to identify suspicious activities, data exfiltration, and command and control communications.
This walkthrough demonstrates techniques for analyzing various log sources to identify indicators of compromise and suspicious activities.
This walkthrough demonstrates techniques for identifying phishing emails, analyzing email headers, and recognizing social engineering tactics.
Effective approaches for defending against common attack vectors