Common Attack Vectors and Techniques

#How Attackers Break In: Common Attack Vectors#link

You now understand the threat landscape, core security principles, and network fundamentals. It's time to get into the specifics of how attacks actually work. This lesson covers the most common attack vectors and techniques used by real-world adversaries. Understanding these methods is not about becoming an attacker — it's about understanding what you're defending against so you can build better protections. All techniques discussed here should only be practiced in authorized lab environments, CTF competitions, or with explicit written permission.

Social Engineering and Phishing

Social engineering exploits human psychology rather than technical vulnerabilities. It remains the most effective attack vector because humans are often the weakest link in any security system. Phishing — sending fraudulent communications that appear to come from trusted sources — accounts for over 90% of successful cyberattacks.

• ▪Email Phishing — Mass emails impersonating banks, services, or colleagues to steal credentials or deliver malware
• ▪Spear Phishing — Highly targeted attacks against specific individuals, using personal information to increase credibility
• ▪Vishing (Voice Phishing) — Phone calls impersonating tech support, banks, or government agencies
• ▪Smishing (SMS Phishing) — Text messages with malicious links or requests for information
• ▪Pretexting — Creating a fabricated scenario to trick someone into divulging information or granting access
• ▪Baiting — Leaving infected USB drives in parking lots or common areas, hoping someone will plug them in

Password Attacks

Passwords remain the most common form of authentication, and attackers have developed numerous techniques to compromise them. Understanding these methods helps you implement stronger authentication controls.

Malware Types

Malware (malicious software) is any program designed to cause harm, gain unauthorized access, or perform other malicious actions. Here are the major categories you need to recognize.

• ▪Virus — Attaches itself to legitimate programs and spreads when the host program runs. Requires human action to propagate.
• ▪Worm — Self-replicating malware that spreads across networks without human interaction. The 2017 WannaCry worm infected 200,000+ computers in 150 countries.
• ▪Trojan — Disguised as legitimate software but contains malicious functionality. Often delivered via phishing emails or fake downloads.
• ▪Ransomware — Encrypts victim's files and demands payment for decryption. Modern variants also exfiltrate data for double extortion.
• ▪Spyware — Secretly monitors user activity, capturing keystrokes, screenshots, browsing history, and credentials.
• ▪Rootkit — Deeply embedded malware that modifies the operating system to hide its presence. Extremely difficult to detect and remove.
• ▪Botnet — A network of compromised computers (bots/zombies) controlled by an attacker, used for DDoS, spam, or crypto mining.

Web Application Attacks

Web applications are among the most targeted attack surfaces. The OWASP Top 10 is the standard awareness document for web application security and represents the most critical security risks.

# Example: SQL Injection vulnerability (DO NOT use in production)
# This shows WHY input validation is critical

# VULNERABLE CODE - Never do this:
def get_user_unsafe(username, password):
    query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
    # If attacker inputs: username = "admin' --"
    # The query becomes:
    # SELECT * FROM users WHERE username='admin' --' AND password=''
    # The -- comments out the password check, bypassing authentication!
    return database.execute(query)

# SECURE CODE - Use parameterized queries:
def get_user_safe(username, password):
    query = "SELECT * FROM users WHERE username=%s AND password=%s"
    # The database treats inputs as data, never as SQL code
    return database.execute(query, (username, password))

Man-in-the-Middle (MitM) Attacks

In a MitM attack, the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other. Common techniques include ARP spoofing (on local networks), DNS spoofing (redirecting domain lookups), and SSL stripping (downgrading HTTPS to HTTP).