Cybersecurity Intermediate: Offense & Defense

The OSI model splits networking into seven layers, from physical cables to the application. TCP/IP condenses these into four practical layers. Security teams map every attack to a layer — ARP spoofing hits layer 2, DDoS floods layer 3, SYN attacks layer 4, and SQL injection layer 7. Knowing which layer an attack targets tells you which defense to place there. A few commands reveal the network state instantly.

ip addr show                    # interfaces and IPs
ip route show                   # routing table
ss -tulpn                       # listening sockets
nslookup example.com           # DNS lookup
ping -c 4 8.8.8.8              # connectivity test

Layer 2 (Data Link) — ARP maps IP to MAC addresses.

Wireshark captures and dissects raw network packets. Each TCP connection starts with a three-way handshake: SYN, SYN-ACK, ACK. Analysts look for anomalies — unusual ports, repeated SYN without completion (scanning), or large data exfiltration. Filters like 'tcp.port == 443' or 'http.request' narrow millions of packets to the few that matter. Packet analysis is the microscope of network security, turning invisible traffic into readable evidence.

# Wireshark capture filters (type into the capture bar)
tcp.port == 443       # only HTTPS traffic
http.request          # only HTTP requests
ip.addr == 10.0.0.5   # only one host
# tshark (CLI) equivalent
tshark -i eth0 -Y 'dns' -c 50

SYN, SYN-ACK, ACK.

Nmap is the standard port scanner, but it is far more than that. SYN scans (-sS) are stealthier than full connects; version detection (-sV) identifies services; scripts (-sC) run vulnerability probes; and OS detection (-O) guesses the target system. Timing templates (-T0 to -T5) trade speed for stealth. Understanding scan output — open, closed, filtered — tells you both what is exposed and whether a firewall is in the way.

# SYN scan (stealth, default)
nmap -sS 192.168.1.10
# Version + default scripts + OS detection
nmap -sV -sC -O 192.168.1.10
# Scan a whole subnet for port 22
nmap -p 22 192.168.1.0/24

A firewall is dropping the packets — the port state cannot be determined.

Vulnerability scanners automate the search for known weaknesses — missing patches, default credentials, misconfigurations. OpenVAS is free; Nessus is the commercial standard. Unlike manual pentesting, scanners cover thousands of checks quickly but produce false positives. The skill is triage: filter results by severity (CVSS score), verify the critical ones manually, and patch the real issues. A scanner is a flashlight, not a verdict.

# Start OpenVAS and run a scan (simplified)
gvm-start
# Typical scan targets
# 1. Discovery scan — what is alive
# 2. Full scan — all ports, all checks
# 3. Compliance scan — policy-specific checks

CVSS — Common Vulnerability Scoring System.

Before attacking, testers gather open-source intelligence (OSINT) — everything publicly available about a target. This includes DNS records, subdomains, employee emails, leaked credentials, and exposed services. Tools like theHarvester, Shodan, and Google dorking turn public data into an attack map. Defenders use the same techniques to see their own exposure and take down risky information before attackers find it.

# Google dork examples
site:example.com filetype:pdf
intitle:'index of' 'backup'
# TheHarvester (email/subdomain gathering)
theHarvester -d example.com -b google,linkedin
# Shodan (exposed services)
shodan search 'default password port:23'

Open Source Intelligence — publicly available information gathering.

SQL injection happens when user input is concatenated directly into a SQL query, letting attackers rewrite the query. Classic attacks include bypassing login with ' OR '1'='1, extracting data with UNION SELECT, and even writing files. The defense is definitive and simple: parameterized queries (prepared statements) separate code from data so input can never become SQL. This one flaw has caused some of the largest breaches in history, which is why it has topped the OWASP list for years.

# Vulnerable (never do this)
# query = f"SELECT * FROM users WHERE name = '{user_input}'"

# Safe: parameterized query
cur.execute('SELECT * FROM users WHERE name = %s', (user_input,))

Parameterized queries (prepared statements) that separate code from data.

XSS injects JavaScript into a page that runs in another user's browser. Reflected XSS bounces off a request; stored XSS persists in a database and hits every visitor; DOM-based XSS runs purely client-side. Consequences range from session theft to full account takeover. The defense is output encoding — render user data as text, never as HTML, in the exact context where it appears. Content Security Policy adds a powerful second layer.

<!-- Vulnerable (never do this) -->
<!-- <div>{user_input}</div> -->

<!-- Basic payload to prove the bug -->
<script>alert(document.domain)</script>

<!-- Safe: escape output before rendering -->
{% raw %}{{ user_input }}{% endraw %}  <!-- Jinja auto-escapes -->

Stored (persistent) XSS.

Cross-Site Request Forgery (CSRF) tricks a logged-in user's browser into making unwanted requests — like transferring money — without their knowledge. Broken access control is even more common: Insecure Direct Object References (IDOR) let users access other users' records by changing an ID in the URL. Defenses: CSRF tokens on state-changing requests, server-side authorization checks on every endpoint, and never trusting IDs blindly.

# IDOR example
# /profile/123  -> your profile
# /profile/124  -> someone else's (if not checked = bug)

# Server-side check (concept)
if session.user_id != requested_id:
    abort(403)  # Forbidden

A CSRF token — a unique secret tied to the user's session.

File upload features are a common entry point. If a server accepts user files without validation, an attacker can upload a web shell — a script that gives remote command execution. Even image uploads can hide code if the server trusts the extension or MIME type. Defenses: validate file type by content, store uploads outside the web root, rename files with random names, and serve them with a safe Content-Type. Never let user input decide where files are written.

# PHP web shell (simplified, for education)
# <?php echo shell_exec($_GET['cmd']); ?>

# Defense: validate extension AND MIME type
ALLOWED = {'.jpg', '.png'}
if ext not in ALLOWED:
    abort(400)

An uploaded script that gives the attacker remote command execution.

Command injection occurs when user input is passed to a system shell, letting attackers append their own commands. Classic tricks use ;, &&, |, or backticks to chain commands after the intended one. Even a simple 'ping' form becomes dangerous if the input reaches a shell. The defense: avoid shelling out entirely; if you must, use safe APIs that accept arguments as a list and never concatenate user input into a command string.

# Vulnerable (never do this)
# os.system(f"ping {user_input}")
# Attacker input: 8.8.8.8; rm -rf /

# Safe: pass args as a list (no shell)
import subprocess
subprocess.run(['ping', '-c', '4', user_input])

Semicolon (;), pipe (|), and ampersands (&&).

Password crackers test guesses against a captured hash. Dictionary attacks try common passwords; brute force tries every combination; rule-based attacks mutate words (adding numbers, swapping letters). Hashcat runs on GPUs and can try billions of guesses per second. This is why password strength and slow hashing algorithms matter — bcrypt and Argon2 deliberately slow down each guess, making cracking impractical even for fast hardware.

# Crack an MD5 hash with a wordlist
hashcat -m 0 hash.txt rockyou.txt
# Brute-force 8-char lowercase (slow, educational)
hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l
# Defend: use bcrypt/Argon2 (slow by design)

They are deliberately slow, making each guess expensive and cracking impractical.

Privilege escalation turns a limited user into root. Common vectors: SUID binaries with dangerous permissions, world-writable files, cron jobs running as root, and kernel exploits. The process is systematic — enumerate the system, find misconfigurations, exploit the weakest one. Defenders close these paths by enforcing least privilege, auditing SUID binaries, and patching the kernel. Linux hardening is the mirror image of Linux escalation.

# Enumerate escalation paths
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
sudo -l                                   # sudo rights
cat /etc/crontab                          # cron jobs
# Check kernel version for known exploits
uname -a

Programs that run with the file owner's privileges — a root-owned SUID binary can be exploited.

Windows escalation often abuses service misconfigurations: unquoted service paths, weak service permissions, and always-install-elevated settings. Token impersonation (SeImpersonatePrivilege) enables attacks like Potato exploits to gain SYSTEM. The process is the same as Linux — enumerate, find the weakness, exploit, then document. Defenders apply least privilege, lock down service ACLs, and patch promptly. Windows hardening closes the doors escalation techniques walk through.

# Enumerate (PowerShell)
whoami /priv
Get-Service | Where-Object {$_.Status -eq 'Running'}
# Check unquoted service paths
wmic service get name,pathname | findstr /i /v 'C:\Windows\'

It lets a process impersonate a higher-privilege token, enabling Potato-style SYSTEM escalation.

Once inside a network, attackers move sideways to reach valuable targets. Techniques include Pass-the-Hash (reusing password hashes without knowing passwords), PsExec (remote command execution), and RDP hopping. Pivoting routes traffic through a compromised host to reach otherwise-isolated segments. Defense is network segmentation, strong credential hygiene, and monitoring for lateral movement patterns — the quiet middle of an attack is where the real damage happens.

# Pass-the-Hash with Impacket (educational)
psexec.py -hashes <LM:NT> domain/admin@target cmd
# Detect unusual RDP/logon patterns in logs
# Look for the same account logging into many hosts quickly

The password hash — attackers authenticate with the hash instead of the plaintext password.

Persistence keeps attacker access alive across reboots and password changes. On Linux: cron jobs, SSH authorized keys, and systemd services. On Windows: registry Run keys, scheduled tasks, and services. Detection requires hunting for unusual auto-start entries and new users. Eradication is not just deleting the backdoor — you must find every persistence point, or the attacker simply re-enters through a hidden door.

# Linux persistence checks
crontab -l
cat ~/.ssh/authorized_keys
systemctl list-units --type=service
# Windows registry Run keys (PowerShell)
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'

Cron jobs, SSH authorized keys, or systemd services.

Linux hardening layers defenses to make compromise harder. Steps: remove unnecessary services, enforce least privilege with sudo, configure a default-deny firewall, enable SELinux or AppArmor (mandatory access control), enforce strong SSH (disable root login, use keys), and audit logs. Tools like Lynis automate the audit. Hardening is not a one-time task — it is continuous, because new vulnerabilities and misconfigurations appear constantly.

# SSH hardening (/etc/ssh/sshd_config)
# PermitRootLogin no
# PasswordAuthentication no

# Enable UFW
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

# Audit with Lynis
sudo lynis audit system

Mandatory access control that restricts what processes can do even if compromised.

A SIEM (Security Information and Event Management) collects and correlates logs from across the environment, alerting on patterns that single systems miss — a failed login here, a file access there, together forming an attack. Analysts write detection rules and hunt for indicators of compromise. Tools range from Splunk and Elastic to open-source Wazuh. The skill is querying logs to answer 'who did what, when, and from where.'

# Splunk query: failed logins by source IP
index=auth sourcetype=linux_secure "Failed password"
| stats count by src_ip
| sort - count
# Alert when one IP has 10+ failures in 5 minutes

Security Information and Event Management.

An Intrusion Detection System (IDS) watches traffic and alerts; an Intrusion Prevention System (IPS) blocks it. Snort and Suricata are the open-source standards, using signature rules to detect known attack patterns. A basic rule matches source, destination, ports, and content. Deploy them at network chokepoints to see attacks in flight. The key skill is writing and tuning rules so they catch real threats without drowning you in false alarms.

# Basic Snort rule (alert on suspicious user-agent)
alert tcp any any -> any 80 (msg:"Bad UA"; content:"nmap"; sid:1001;)
# Run Suricata on an interface
sudo suricata -i eth0 -c /etc/suricata/suricata.yaml

IDS only alerts on threats; IPS actively blocks them.

Threat intelligence is information about attackers — their tools, tactics, and infrastructure. Indicators of Compromise (IOCs) include malicious IPs, domains, file hashes, and patterns. Intel sources range from free feeds (AlienVault OTX) to commercial platforms, plus frameworks like MITRE ATT&CK that describe adversary techniques. Defenders use intel to block known bad infrastructure and to prioritize which techniques to defend against first. Intel turns reactive defense into proactive hunting.

# Check an IP/domain against AlienVault OTX (concept)
# OTX API returns pulses (reports) about an IOC
# Blocklist a bad IP
sudo ufw deny from 185.220.101.4
# MITRE technique lookup: T1059 (command execution)

Indicator of Compromise — evidence like malicious IPs, domains, or file hashes.

Digital forensics investigates what happened on a system while preserving evidence for legal use. The golden rule is order of volatility — capture memory before disk, and never alter the original. Investigators image disks with write-blockers, analyze file systems, recover deleted files, and reconstruct timelines. Tools include dd, Autopsy, and Volatility for memory. Forensics is as much about process and chain-of-custody as it is about tools.

# Create a forensic disk image (read-only)
dd if=/dev/sdb of=evidence.img bs=4M status=progress
# Verify integrity with a hash
sha256sum evidence.img
# Analyze memory with Volatility
volatility -f memory.dmp imageinfo

Capture the most volatile data first — memory, then disk.

Malware analysis asks: what does this binary do? Static analysis inspects the file without running it — strings, imports, hashes. Dynamic analysis runs it in an isolated sandbox and watches its behavior. Both are complementary: static reveals the code's structure, dynamic reveals its actions. Safety is paramount — analyze in a VM or disposable sandbox. The goal is IOCs — the hashes, domains, and registry keys that let you detect and block the malware everywhere.

# Static: strings and hashes
strings suspicious.exe | grep -i 'http\|cmd\|registry'
sha256sum suspicious.exe
# Dynamic (sandbox only): watch file and network activity
strace -f ./suspicious.exe 2>&1 | head -100

Static inspects without running; dynamic runs it in a sandbox to observe behavior.

Reverse engineering recovers the logic of a compiled program. Disassemblers (Ghidra, IDA) convert machine code to assembly; decompilers approximate the original source. Even basic x86 understanding — registers, calls, comparisons — reveals what a binary does. Reverse engineers find hidden functionality, understand exploits, and patch flaws. It is a deep skill but starts small: open a binary in Ghidra, follow main, and trace the logic.

# Open a binary in Ghidra (GUI)
# Key x86 concepts:
#   mov eax, 5    ; put 5 in register eax
#   cmp eax, 0    ; compare eax to 0
#   je  label     ; jump if equal
#   call func     ; call a function

It converts machine code into human-readable assembly instructions.

Burp Suite is the standard toolkit for testing web apps. Its proxy intercepts requests so you can modify parameters before they reach the server. The repeater resends modified requests; the intruder automates attacks like fuzzing and brute force; the scanner finds common vulnerabilities. Testing web apps is systematic — map the app, understand each function, then probe inputs. Burp turns the browser into a precise attack tool.

# Burp workflow
# 1. Configure browser to use Burp proxy (127.0.0.1:8080)
# 2. Browse the app, watch requests in Proxy > History
# 3. Send a request to Repeater, modify a parameter
# 4. Use Intruder to fuzz an input with payloads

It resends modified HTTP requests so you can test parameter changes precisely.

APIs are the new attack surface — modern apps are mostly APIs behind the UI. The OWASP API Top 10 highlights broken object-level authorization (BOLA), broken authentication, and excessive data exposure. Attackers enumerate IDs, abuse weak tokens, and discover hidden endpoints. Defenses: strict server-side authorization, rate limiting, input validation, and strong API keys. Since APIs expose data directly, securing them is securing the application itself.

# BOLA example
# GET /api/users/123  -> your data
# GET /api/users/124  -> other user (if not checked)

# Defense: check ownership
if request.user_id != resource.owner_id:
    return 403

Broken Object Level Authorization — accessing other users' objects by changing IDs.

Wireless attacks target the air interface. The Aircrack-ng suite puts a Wi-Fi card into monitor mode, captures packets, and cracks WPA/WPA2 passwords from the four-way handshake. Attacks include deauthentication (kicking a client off to force a re-handshake) and evil twin access points. These attacks only work on your own networks legally. Defenders use WPA3, long passphrases, and disable legacy protocols.

# Put card in monitor mode
airmon-ng start wlan0
# Capture a handshake
aireplay-ng --deauth 10 -a <BSSID> wlan0mon
airodump-ng -c <channel> --bssid <BSSID> -w cap wlan0mon
# Crack with a wordlist
aircrack-ng -w rockyou.txt cap-01.cap

It kicks a client off so it reconnects, allowing capture of the WPA handshake.

The Social Engineering Toolkit (SET) automates attacks that target humans — cloned websites, credential harvesters, and USB payloads. It demonstrates why people are the weakest link: even perfect technical defenses fail when a user hands over their password. Defenders counter with awareness training, simulated phishing tests, and technical controls like MFA. Understanding the attacker's playbook is the best way to teach users to spot it.

# SET menu (educational)
setoolkit
# 1 = Social-Engineering Attacks
# 2 = Website Attack Vectors
# 3 = Credential Harvester (clone a login page)

MFA — even stolen credentials cannot be used without the second factor.

A penetration test follows a clear methodology: scoping, reconnaissance, enumeration, exploitation, post-exploitation, and reporting. Frameworks like PTES and standards like OWASP define each phase. The deliverable is a report — findings ranked by severity, with reproduction steps and remediation advice. A great pentest is not about the most exploits; it is about clearly communicating risk so the organization can fix the right things first.

# PTES phases (checklist)
# 1. Pre-engagement: scope, rules, authorization
# 2. Intelligence gathering: OSINT, DNS
# 3. Threat modeling: what matters most
# 4. Vulnerability analysis: scan + verify
# 5. Exploitation: prove impact
# 6. Post-exploitation: pivot, persistence
# 7. Reporting: findings + remediation

Reporting — documenting findings, impact, and remediation.

Red teams attack (offensively) to find weaknesses; blue teams defend (detect and respond). Purple teaming brings them together — red shares how they attack, blue tunes detections, and the cycle repeats. This continuous feedback loop is how security programs mature. Neither side wins alone: red finds gaps, blue closes them, and the organization's resilience grows with every iteration.

# Purple team loop
# 1. Red: execute an attack (e.g., lateral movement)
# 2. Blue: did your tools detect it?
# 3. Gap analysis: why or why not
# 4. Tune detections, update playbooks
# 5. Repeat with the next technique

Blue teams defend — detecting, responding to, and mitigating attacks.

A home lab is where you practice safely. Set up VirtualBox or VMware with isolated VMs — an attacker machine (Kali), targets (Metasploitable, vulnerable VMs), and a monitoring host. Keep it on an isolated network so your testing never touches your real devices. A lab lets you run every tool and technique legally and without fear. Start small: one Kali, one Metasploitable, and grow from there.

# Lab setup checklist
# 1. Install VirtualBox
# 2. Create isolated network (Host-only)
# 3. Kali VM (attack) -> kali.org downloads
# 4. Metasploitable 2 VM (target)
# 5. Snapshot before every test

So testing traffic and exploits never reach your real devices or the internet.

Your capstone: run a complete penetration test against a deliberately vulnerable lab target. Execute every phase — scope, recon, enumeration, exploitation, privilege escalation, and reporting. Document each finding with severity, reproduction, and remediation. The deliverable is a professional report that proves you can think like an attacker and communicate like a consultant. This is the portfolio piece that demonstrates your readiness for a real security role.

# Capstone execution plan
# 1. Recon: nmap -sV -sC -O target
# 2. Web enum: dirb, Burp, OWASP checks
# 3. Exploit a found vulnerability
# 4. Escalate: find SUID/cron/service flaws
# 5. Document: severity + reproduction + fix
# 6. Write the final report

Clear findings ranked by severity, with reproduction steps and remediation advice.