Hacking Tactic, Techniques, and Procedures (TTPs)

Explore the adversary mindset by defining threat and risk terms, distinguishing black hat, white hat, and gray hat hackers, and examining motivations, targets, resources, and capabilities that threaten organizations.

Identify assets and threats, such as data that can be stolen, altered, or deleted, and apply CIA triad: confidentiality, integrity, availability, to assess probability, impact, and guide defense in depth.

Know the adversary by analyzing threat actors' motivations, targets, and capabilities through threat modeling to identify risks and defend your organization against attacks.

Explore hacker ethics by contrasting white hat, gray hat, and black hat hackers, including legal bounds, ethical hacking, and the role of permission and penetration testing.

Explore adversaries’ characteristics, including hacker types, motivations, sponsorship, relationships, and resources, to anticipate attacks and strengthen defenses in depth and perimeter security.

Identify attacker motivations to predict attack approaches and resource investment. Explore drivers like curiosity, notoriety, revenge, financial gain, power, and hacktivist aims to enact change, plus internal threats shaping defenses.

Identify adversaries and their targets to design a defense in depth that balances cost with protecting assets, data, and people, considering attacker motivation and low hanging fruit.

Define adversary objectives and action on objectives using the Mitre ATT&CK framework, contrasting data exfiltration and impact, with examples from espionage, blackmail, and ransomware.

Explore how hackers shift from lone operators to sponsored teams funded by corporations, organized crime, nation-states, and terrorist groups, expanding cybercrime for competitive and political aims.

Learn how adversary capabilities depend on tools, knowledge, skills, and resources attackers bring. Cover script kiddies, advanced persistent threats, and access routes via supply chains and brokers.

Explore insider threats, distinguish internal and external threats, and mitigate shadow it to protect networks from misconfigurations and social engineering.

Explore how attackers systematically evaluate organizations, identify entry points, establish presence, and pursue objectives. Examine attack methodologies, tactics, techniques, procedures, mitre attack, kill chain, diamond model, and adversary signatures.

Analyze attack methodologies and the flow attackers follow, using tactics, techniques and procedures, mitre attack, the cyber kill chain, and the diamond model of intrusion analysis to defend networks.

Explore how attackers use tactics, techniques, and procedures to gain initial access and progress through a network, with examples like spear phishing, firewall bypass, and data exfiltration.

Discover MITRE ATT&CK, a comprehensive database of adversary tactics and techniques organized into enterprise, mobile, and ICS matrices, with subtechniques, descriptions, and examples of groups.

Explore Mitre attack tactics and the attack flow from reconnaissance to data exfiltration, including initial access, execution, persistence, privilege escalation, defense evasion, discovery, and lateral movement.

Explore the cyber kill chain from reconnaissance to data exfiltration, including weaponization, delivery, exploitation, installation, persistence, and command and control; compare it to the mitre attack.

Discover how the cyber kill chain guides defense from recon through delivery and exploitation, using phishing awareness, intrusion detection, firewalls, and traffic analysis to disrupt attacks.

Explore the diamond model of intrusion analysis to map single events, link adversaries, victims, capabilities, and infrastructure, and trace them along the cyber kill chain to uncover compromised data.

Identify adversary signatures by analyzing attack patterns and fingerprints, using the diamond model and the CPIC database to trace groups and techniques.

Explore reconnaissance and attack planning from an attacker's perspective, covering open source intelligence, DNS reconnaissance, website reconnaissance, social media scraping, dumpster diving, eavesdropping, and mapping attack surfaces and vectors ethically.

Learn how reconnaissance collects target data, from open source intelligence to enumeration. Explore passive and active reconnaissance, external and internal assets, and tools used to map networks and avoid detection.

Explore open source intelligence (osint) to gather, analyze, and disseminate publicly available information about a target company, using tools, Google searches, and websites for reconnaissance.

Explore how DNS reconnaissance uncovers a target's owned domains, IPs, A and MX records, and reverse DNS to map services and identify vulnerabilities.

Explore website reconnaissance to map company assets, enumerate urls, and scrape data from web pages, while examining dns lookups, server directories, and plugin vulnerabilities.

Use social media scraping to uncover company information and contacts, revealing security holes and opportunities for targeted research and social engineering through LinkedIn, blogs, and other sites.

Explore how dumpster diving reveals discarded documents and exposed data, and highlight legal considerations of reconnaissance as a prelude to researching a company.

Discover how eavesdropping and snooping evolve from informal overhearing to digital listening on networks, including attacks and the use of network sniffers.

Identify the attack surface as the full set of entry points into a network, from perimeter to internal layers, and explore physical, digital, and social avenues, including supply chain risks.

Map the attack surface to identify attack vectors and vulnerabilities across hardware, software, networks, and human factors, then develop an attack plan.

Explore the weaponization phase of the cyber kill chain, examining malware types and how brokers may supply access in ethical hacking education.

Arm teams for cyber attacks by weaponization: acquire or create malware, infrastructure, and access—domains, dns, web services, compromised accounts, and malvertising—ready to support operations in the cyber kill chain.

Explore how brokers enable cybercrime by buying, selling, and trading access, identities, vulnerabilities, exploits, and malware on the dark web, and how an access broker intermediates attacks.

Learn how malware, malicious software designed to disrupt or exfiltrate data, appears as ransomware, viruses, trojans, and more; explore vectors, payloads, and stealthy delivery in the cyber kill chain.

Differentiate between virus and malware, noting a virus is a type of malware. Describe how a virus replicates itself and inserts into code or files, spreading from host to host.

Explore boot sector viruses and how they reside in the drive's initial boot sector, gaining control as the first code to run, potentially bypassing the operating system and security measures.

Explore how a computer worm replicates itself as a standalone file, spreading across networks, consuming resources, and potentially delivering ransomware, data exfiltration, or command-and-control payloads.

Identify how a Trojan disguises itself as legitimate software to collect credentials and compromise a system, illustrating the Trojan horse deception.

Explore how ransomware encrypts data and holds it for ransom, requiring victims to pay attackers for a decryption key.

Explore command and control, a phase in the cyber kill chain and a MITRE attack tactic, involving malware or software that remotely controls a target computer on a network.

Learn how a remote access trojan provides covert remote control, masquerading as legitimate software, often running in the background, and acting as a C2 malware to control machines and networks.

Explore how a botnet, a network of bots, gives command and control over many machines to launch attacks like distributed denial of service and spam email campaigns.

Explore how spyware secretly collects information during an attack, from screen monitoring and webcam access to keyloggers that capture keystrokes and send data to the attacker.

Learn how keyloggers log keystrokes, whether software or hardware, and where data is stored. Compare local storage, file storage, and network transmission, along with the trade-offs of physical access.

Explore fileless malware that runs in RAM to evade disk scans, gaining stealth at the cost of persistence after reboot, and weighing its advantages and drawbacks.

Show how a logic bomb embeds in malware, delaying activation until a time-based condition triggers, enabling wide propagation before the attack launches.

Explore rootkits as a kit of software that grants root access and escalated privileges, not always malware, with legitimate uses and security risks.

Explore cryptojacking by examining how attackers misuse unconsenting devices to mine cryptocurrency for profit, draining resources and slowing systems.

Adware is software that shows ads, which can cause distracting pop-ups and degrade enterprise networks. It may deliver other malware, making adware a security concern for users and IT teams.

Explore scareware, a tactic that uses alarming popups claiming viruses to prompt users to download software, which instead installs malware and harms the computer.

Learn how bloatware consists of unnecessary software that fills hard drive space, drains bandwidth and processing power, and slows devices, with pre-installed programs and excessive features people don’t really use.

Identify enterprise level concerns from legitimate software, such as crypto mining draining resources, and recognize shadow IT and cowboying that disrupt unified communication and productivity.

Explore how attackers deliver malware into networks through social engineering, from high-level concepts to specific methods and tools, including artificial intelligence, all within an ethical hacking perspective.

Deliver weaponized malware into a network by exploiting attack surfaces through social engineering, attachments, and third-party vectors.

Explore how social engineering exploits human psychology to manipulate behavior and bypass security, using phishing emails, voice calls, in-person visits, and no-contact schemes.

Explore overt and covert social engineering methods, analyze emotional manipulation and urgency cues, and train users to slow down and think logically to prevent manipulation.

Explore how adversaries build trust through empathy, flattery, social proof, similarities, and partial truths to enable social engineering, including impersonation and Curly Spider's phishing tactics.

Learn how impersonation fuels social engineering by quickly gaining trust through authority figures, IT support, brands, or typosquatting sites, including vishing examples and real-world tactics.

Typosquatting is an impersonation attack using misspelled domains to mimic legitimate websites, with names like URL hijacking, sting site, cousin domain, fake URL, cybersquatting, and Brandjacking.

Learn how url obfuscation hides the true destination by manipulating uri components, such as the scheme, host, and encodings, to redirect users to a malicious site.

Discover domain shadowing, using a legitimate DNS server to covertly insert records that point to attacker resources and enable phishing, malware delivery, or data exfiltration while evading detection.

Explore how a 302 cushioning attack redirects users from a legitimate site to a malicious page that hosts malicious software, exploiting http 3xx responses like 301 and 302.

Explore business email compromise (BEC) and impersonation via email, as attackers spoof Susan from finance to deceive colleagues like Jane, sometimes using fake reply-to addresses.

Pretexting uses a fictitious plausible story to gain trust and extract money or information, often paired with impersonation to manipulate victims into divulging information or doing something.

Discover how watering hole attacks compromise websites that specific groups frequently visit, enabling attackers to gain access into the organization through users' visits.

Explore baiting as a social engineering tactic that entices users with offers, such as a free e-book, to lure them into scams and phishing emails.

Explore how spam constitutes unsolicited or unwanted emails, why it floods inboxes, and how it causes productivity loss by making legitimate messages harder to find.

Recognize phishing as a social engineering tactic that tricks victims into disclosing sensitive information via email or messages, including attachments, and use phishing buttons to identify phishing emails.

Learn how spearfishing targets a specific individual with a tailored email to exploit information disclosure, making phishing attacks more effective than broad, mass emails.

Target high-level executives through whaling, a form of spearfishing that aims at the CEO and other C-suite leaders to access critical information.

Explore smishing, the technique of using text messages to deceive victims into disclosing sensitive data or visiting a site, and learn how attackers leverage SMS to carry out targeted attacks.

Explore vishing, the voice phishing tactic that uses phone calls and voice messages to trick victims into disclosing sensitive data. See how attackers use voice services across phone lines.

Learn how shoulder surfing lets an adversary glimpse credentials by watching victims type at ATMs, point-of-sale terminals, or during IT support.

Tailgating follows an authorized person into a locked entry point without consent, while piggybacking uses consent to enter. Both exploit door practices in buildings and elevators to gain access.

Explore how a USB drop exploits curiosity by leaving infected drives in public spaces, prompting users to plug in and attackers to gain network access.

Learn to identify false information across misinformation, disinformation, and deepfakes, distinguishing unintentional errors from deliberate manipulation and understanding the potential harms.

Explore the quid pro quo concept in cybersecurity, from bribes and deals to social engineering that trades access or credentials for entry.

Blackmail involves an adversary threatening to leak compromising information unless the victim complies. It is an overt, illegal tactic demanding cash or access to systems.

Explore how social engineering relies on a range of tools, including the social engineering toolkit and AI, used by attackers and security professionals to test defenses within organizations.

Explore how artificial intelligence powers social engineering, from AI-generated phishing and deepfake videos to AI-facilitated interviews and fake LinkedIn profiles, and why defenders must counter with AI-driven defenses.

Explore the exploitation phase by examining vulnerabilities across networks, protocols, hardware, software, cloud virtualization, cryptographic, human, password, process, and physical weaknesses, and how attackers deliver weaponized malware.

Explore how vulnerabilities enable exploitation by malware during execution, and how the vulnerability lifecycle—from zero days to patches—is tracked and cataloged in CVS and the exploit database.

Identify common network vulnerabilities such as insecure wireless and wired networks, Bluetooth on devices, eavesdropping on traffic, open service ports, and misconfigurations, and understand how outdated firewall settings expose systems.

Examine protocol vulnerabilities across the OSI model, comparing IPv4 and IPv6 while noting insecure protocols like HTTP and FTP and risks such as spoofing and denial of service.

Explore common hardware vulnerabilities, such as insecure default credentials, open ports, and misconfigurations, and learn why firmware updates and patching matter for switches, IoT, and industrial control systems.

Explore common software vulnerabilities in business apps and in-house development, including misconfigurations, default credentials, patching, and zero-days. Note in-house risks like buffer overflows and injections.

Explore common vulnerabilities in virtualization and cloud environments, including misconfigurations, poor access controls, insecure APIs, VM escape, and risky memory reuse across shared resources.

Explore cryptographic vulnerabilities, including weak ciphers, insecure implementations, weak or default keys, poor key management, weak random number generation, hard coded keys or secrets, certificate errors, and cipher suite risks.

Highlight common human vulnerabilities in cybersecurity, examining social engineering, trust, emotions, knowledge gaps, and accident-prone or lazy behaviors that attackers exploit and organizations must guard against.

Identify common password vulnerabilities and attacker methods, including social engineering, phishing, shoulder surfing, eavesdropping, keyloggers, data breaches, rainbow tables, brute force, password spraying, credential stuffing, mask attacks, and password reuse.

Identify common process vulnerabilities and implement well-defined, documented security processes, including change management, encryption, logging, and monitoring, to minimize risks during staffing changes and shifts like mergers and acquisitions.

Identify physical vulnerabilities in servers, switches, routers, and firewalls, including access risks, environmental failures, and misconfigurations. See how these threats impact confidentiality, integrity, and especially availability.

Explore exploit chaining that combines multiple vulnerabilities to compromise a system, and distinguish vulnerability from exploitation with examples like proxy shell and service now attack chains.

Explore attacks, such as denial of service, eavesdropping, spoofing, and adversary in the middle, and map them to apex domains: software, hardware, communication, supply chain, social engineering, and physical security.

Explore how adversaries install and persist inside a network, then perform internal discovery, network reconnaissance, sniffing, wiretapping, Nmap scanning, credential harvesting and dumping, and vulnerability enumeration.

Explore network discovery and enumeration by detailing reconnaissance, staging component delivery, and installation to gain persistence, footholds, backdoors, and access to Active Directory environments.

Learn to map a network through discovery and enumeration, identify devices, services, shares, users, credentials, tokens, and vulnerabilities, and pivot across systems using tools like nmap and wireshark.

Explore network discovery and reconnaissance for wiretapping, balancing passive monitoring with active scanning to observe ARP traffic, hosts, services, and banner grabbing.

Explore wiretapping concepts by examining how unauthorized monitoring of electronic communications occurs, from traditional phone lines to modern network sniffing with Wireshark.

Explore how sniffing attacks listen to network traffic with Wireshark, revealing passive data like TCP, DHCP, IPv6, and spanning tree messages on a demo Cisco network, with ethical hacking emphasis.

Explore how attackers use nmap and zenmap to scan for live hosts, ip ranges, ports, and services in a 10.1.10.0/24 demo, revealing Cisco devices, a raspberry pi, and proxmox.

Explore wireless reconnaissance for wardriving and enumerate wireless networks, devices, users, and traffic to understand what attackers can observe across wireless links.

Drive around to locate insecure wireless networks by wardriving, using a laptop and software to scan networks and identify open wifi hotspots as easy targets.

Port scanning with nmap and zenmap demonstrates protocol, service, and port discovery, showing open ports 21, 80, 443, 3389 and running web services on Apache and Raspbian.

Explore operating system fingerprinting through network discovery: analyze port responses, TCP/IP stack details, and TLS service data to identify Windows or Linux targets, using nmap ethically.

Credential harvesting targets large-scale theft of usernames and passwords across networks, enabling credential dumping; attackers deploy malware, phishing, domain spoofing, or adversary in the middle tactics to collect information.

Identify network vulnerabilities through operating system fingerprinting and active scans, using tools like nmap and Nessus, and prioritize risks with CWE, CVE, CVSS, and EPS scoring.

Explore denial of service attacks and how attackers overwhelm targets with flooding techniques, including icmp floods, tcp syn floods, udp floods, and dns amplification in distributed scenarios.

Explore denial of service attacks that target availability within the CIA triad, examining volumetric floods, protocol weaknesses, application vulnerabilities, and even physical disruption across DNS, DHCP, web servers, and websites.

Jamming disrupts wireless signals by transmitting interference that degrades or disconnects connections between devices, turning any wave-based network—Wi-Fi, Bluetooth, cellular, GPS—into a denial of service attack.

Shows how a rogue DHCP server can cause a denial of service by spoofing DHCP and distributing incorrect IP configurations, disrupting network connectivity.

Explore how a DHCP starvation attack exhausts a scope by repeatedly requesting IPs for different MAC addresses, using Kali Linux and dhcp pig to deny service to legitimate users.

Explore how a buffer overflow exploits memory and RAM layouts, causing denial of service or arbitrary code execution, with heap and stack overflows, memory addressing, and return addresses.

Explore how ping of death uses oversized IP packets and fragmentation on legacy systems like Windows 95. Understand MTU limits, IP header values, and buffer overflow risks.

Learn how a tcp reset attack disconnects two devices by spoofing a switch and sending a reset flag, ending a session and potentially a denial of service.

Explore how a Wi-Fi deauthentication attack disrupts client and access point communication, exposing MAC addresses and enabling denial of service and evil twin and adversary-in-the-middle scenarios.

Demonstrates how flooding attacks overwhelm a device’s resources—memory, CPU, bandwidth, and storage—to deny service, using stress testing tools like Jmeter, Load Ninja, and Web load neo load.

Demonstrates an ICMP flood, or ping flood, overwhelming a target's resources with flood mode and random source addresses, while emphasizing ethical hacking and testing only on authorized equipment.

Explore how a tcp syn flood overwhelms a server by sending syn, syn-ack, and ack during the three-way handshake, tested ethically on kali linux within authorized networks.

Explore how a UDP flood attack overwhelms a server by flooding it with UDP packets that trigger ICMP destination unreachable replies, consuming bandwidth and resources.

Demonstrates how a DNS flood attack overwhelms a target by sending UDP packets to port 53, for ethical hacking on Kali Linux with varying source addresses.

Explore amplification attacks, where small requests produce large replies to exhaust the victim's resources. See how DNS and SNMP exemplify this effect, often with reflective amplification driving denial-of-service.

Learn how distributed denial of service attacks weaponize multiple machines to overwhelm a server, using botnets, command and control, and reflected ICMP requests to flood resources.

Demonstrates a reflected distributed denial of service attack, using address spoofing and ICMP to bounce traffic through multiple machines toward a victim, often with amplification, while emphasizing ethical testing.

Beneath the hood of a local area network, learn broadcasts, directed broadcasts like 192.168.1.255, and how spoofed directed broadcasts enable reflected attacks, plus how broadcast storms cripple networks.

Explore the Smurf attack, an ICMP flood and DDoS method that uses spoofed victim address and directed broadcasts to overwhelm a target with reflected ICMP replies.

Explore adversary in the middle and spoofing attacks, and learn how DHCP spoofing, ARP cache poisoning, DNS cache poisoning, evil twin, and replay attacks enable these techniques.

Explore the adversary-in-the-middle attack, also called man-in-the-middle or on-path attacks, where an attacker sits between client and server to relay, eavesdrop, alter, or delay messages, breaking confidentiality, integrity, and availability.

Explore replay attacks, where an adversary overhears and replays traffic or credentials, including hashed or encrypted data, to gain unauthorized access and threaten authentication.

Learn how spoofing imitates network identities to mislead devices, enabling ARP, MAC, IP, DHCP and DNS spoofing, evil-twin access points, and leading to DoS or MITM attacks.

Explore how DHCP spoofing tricks clients into accepting fake IP addresses, gateways, and DNS settings, enabling an adversary in the middle and traffic manipulation, demonstrated with Ettercap on Kali Linux.

Explore ARP cache poisoning in this demo, showing how an attacker poisons ARP cache entries to perform a man-in-the-middle attack, sometimes via gratuitous ARP, impersonating the gateway or DNS.

Explain how dns cache poisoning redirects users to spoofed sites by corrupting dns caches and explore vectors like arp cache poisoning and dhcp spoofing.

Learn how an evil twin spoofs a wireless access point to place an adversary in the middle between a victim and the network.