Introduction In Cyber Attack For Beginners

This lecture explains the cyber kill chain and its seven stages, focusing on reconnaissance. It compares passive reconnaissance, like whois lookups and Google dork techniques, with active reconnaissance.

Explore active reconnaissance by showing how attackers interact with targets through ping sweeps, port scanning, and OS fingerprinting using nmap.

Explore open source intelligence (osint) as a reconnaissance tool, using domains, whois, nmap, burp suite, email harvesting, social networks, and public data to profile targets.

Differentiate malware, exploitation, and payload. See how ransomware like WannaCry encrypts files and how a keylogger steals data, while exploits deliver payloads via vulnerabilities to enable backdoors and unauthorized access.

Explore the weaponization phase, where malware blends with exploits to create a deliverable payload delivered via phishing, USB, or links, using tools like Metasploit.

Explore the delivery phase, where attackers use phishing emails, infected USB drives, and watering hole attacks to deliver malicious payloads.

Explain the exploitation phase: define vulnerability and exploit, and show how attackers execute malicious payloads through phishing links and macro attachments to gain unauthorized access.

Explore how hackers escalate privileges, move laterally, and exploit vulnerabilities—such as dll injection, binary hijacking, and zero day attacks—after infiltrating a system.

Learn how attackers establish a persistent foothold in the installation phase by using registry modifications, rootkits, trojanized software, scheduled tasks, backdoors, and web shells to maintain access and evade defenses.

Describe the command and control phase, enabling remote attacker control after exploitation through phishing, host metadata, and encrypted ransom instructions, including botnets and zombies.

Explore actions on objectives phase of the cyber kill chain, where attackers gather credentials, bypass hash, perform reconnaissance, exfiltrate data, delete backups, and use ransomware or keyloggers to corrupt data.

Learn indicator of compromise concepts and how to analyze pcap files to simulate attacks. Use VirusTotal and abuse Ibdb to verify IPs and inspect suspicious domains and traffic with Wireshark.

Analyze a pcap file to identify indicators of compromise on a web server, mapping attacker port scanning, enumeration, and IOCs, using GoBuster to enumerate directories.

Analyze a pcap to identify a brute-force attack using go-buster, track the hacker’s IP and credentials in http post requests, and verify malware upload through Wireshark filters.

Explore hands-on cyber defense basics by solving SOC analyst tier one labs and analyzing a backup file on the Bhakts website, viewing http and dns packets and credentials on Tomcat.