Attacks and Exploits
This chapter surveys the major categories of attack at a conceptual, defensive level. You will learn common application, network, social-engineering, and credential attacks, along with the tools testers use and the defenses that mitigate each.
Application attacks
Web applications are frequent targets. SQL injection occurs when untrusted input is placed into a database query without parameterization, letting an attacker alter the query's logic; parameterized queries and input validation defend against it. Cross-site scripting (XSS) injects script that runs in other users' browsers and is mitigated by proper output encoding. Related issues such as cross-site request forgery and server-side request forgery abuse trust in different ways, and each has specific defenses.
Network attacks
On the network, an on-path (man-in-the-middle) attack places the tester between two parties to intercept or alter unencrypted traffic, which strong encryption and certificate validation prevent. Other network techniques target weak protocols and services. Understanding these attacks helps organizations segment networks, encrypt traffic, and harden services against interception and abuse.
Social engineering
Social engineering manipulates people rather than technology. Phishing emails impersonate trusted parties to trick users into revealing credentials or running malicious content, and related techniques include pretexting and baiting. Because these attacks target human behavior, the primary defenses are security-awareness training, verification procedures, and technical email controls.
Credential attacks, tools, and privilege escalation
Attackers seek credentials through techniques such as password spraying and offline cracking, where candidate guesses are hashed and compared to captured hashes, which is why strong, unique passwords and slow hashing algorithms matter. Frameworks such as Metasploit and proxies such as Burp Suite support authorized testing. After initial access, privilege escalation abuses misconfigurations to gain higher permissions, setting up deeper post-exploitation activity.