Threats, Vulnerabilities, and Attacks · Topic 9 of 10

Network, Application and Credential Attacks

Security+ attacks: DDoS, downgrade, rogue devices, spoofing, on-path, DNS cache poisoning, injection, forgery, traversal, spraying and MFA bypass.

5 min
Includes a diagram

In a nutshell

DDoS harms availability. Amplified and reflected attacks use third parties to enlarge or hide traffic.
A downgrade forces a weaker protocol. Disable old versions.
Rogue devices include evil twin access points. Sniffing reads traffic, and spoofing fakes an identity.

What it is

Network attacks target the traffic and services that connect systems. Application attacks abuse how software handles input, sessions and permissions. Credential attacks target the logins that guard accounts.

You will be asked to name the attack from a short description or a log excerpt, and to choose the control that stops it.

How it works

Network attacks

Attacking systems send small requests to third party servers with the victim's address spoofed. The much larger replies are sent to the victim, which is flooded. Defenses include traffic filtering, rate limiting, a CDN and a scrubbing service.

Attack	Description	Key defense
Distributed denial of service (DDoS)	Many systems flood a target so real users cannot reach it	Filtering, rate limiting, a scrubbing service
Protocol downgrade	Forcing a connection to use an older, weaker protocol version	Disable old versions on servers and clients
Rogue	An unauthorized access point, server or device, such as an evil twin copying a real network name	Wireless scanning, network access control
Sniffing	Capturing traffic to read it	Encryption of traffic
Spoofing	Faking an address or identity, such as an IP or MAC address or an email sender	Authentication, filtering
On-path	Sitting between two parties to read or change traffic	Transport Layer Security (TLS) with certificate checks
Domain Name System (DNS) attacks	Abusing name resolution, such as hijacking a domain registration or hiding data in DNS queries	Registrar locks, DNS monitoring
Cache poisoning	Placing false entries in a DNS or ARP cache so traffic goes to the attacker	DNS Security Extensions (DNSSEC), dynamic ARP inspection

DDoS attacks are often amplified, where a small request triggers a much larger response, or reflected, where spoofed requests make third parties send replies to the victim. Both harm availability.

Cache poisoning is a common way to set up an on-path position. DNSSEC uses digital signatures so clients can check that DNS answers are genuine.

Application attacks

Two panels. In CSRF an attacker tricks a logged in user's browser into sending an unwanted request to a site that trusts it. In SSRF an attacker tricks a server into sending requests to internal resources on the attacker's behalf.

Attack	Description	Key defense
Injection	Input is treated as a command, as in Structured Query Language (SQL) or operating system command injection	Parameterized queries, input validation
Buffer overflow	Data written past a buffer corrupts memory and may run attacker code	Bounds checking, memory protections
Replay	Captured valid data, such as a session token, is sent again	Time stamps, one time values, short lived tokens
Privilege escalation	Gaining higher rights (vertical) or another user's rights at the same level (horizontal)	Least privilege, patching, access reviews
Forgery	Faked requests that appear to come from a trusted party	Anti forgery tokens, allow lists
Directory traversal	Path tricks such as ../ reach files outside the intended folder	Validate and normalize paths

Cross site request forgery (CSRF) tricks a logged in user's browser into sending an unwanted request. Server side request forgery (SSRF) tricks a server into requesting internal resources for the attacker.

GET /download?file=../../etc/passwd
GET /item?id=1' OR '1'='1

The first line is directory traversal and the second is SQL injection. Signs of privilege escalation include a standard user suddenly in an administrative group and new accounts that nobody requested.

Credential attacks

Attack	Description	Sign in the logs
Password spraying	A few common passwords tried against many accounts	Failures spread across many accounts, few per account
Brute force	Many guesses against one account	Many failures on one account, then lockout
User enumeration	Finding valid usernames from different error messages or responses	Many attempts with different usernames
Replay	Reusing captured authentication data, such as a hash or token	Valid session from a new device or location
MFA bypass	Getting past the second factor	Many push prompts, a SIM change, a session from a new location

MFA bypass methods include sending repeated push prompts until the user approves (MFA fatigue), taking over the phone number (SIM swapping), and phishing proxies that capture the session cookie after login. Phishing resistant MFA, such as security keys, and number matching on push prompts reduce these.

Online guessing is slowed by lockouts and rate limits. Giving the same error for a wrong username and a wrong password stops user enumeration.

What to remember for the exam

DDoS harms availability. Amplified and reflected attacks use third parties to enlarge or hide traffic.
A downgrade forces a weaker protocol. Disable old versions.
Rogue devices include evil twin access points. Sniffing reads traffic, and spoofing fakes an identity.
Cache poisoning plants false DNS or ARP entries, often to set up an on-path attack.
Injection is fixed with input validation and parameterized queries.
CSRF abuses a user's browser. SSRF abuses the server.
Spraying is few passwords across many accounts. Brute force is many guesses at one.
MFA fatigue, SIM swapping and session theft bypass MFA. Phishing resistant MFA resists them.

Exam tip

If many accounts fail to log in with the same one or two passwords and no single account is locked, think password spraying.

Common mistakes

Confusing spraying with brute force. Spraying spreads a few guesses across many accounts to avoid lockout.

Mixing up a rogue access point and an evil twin. A rogue access point is any unauthorized device. An evil twin specifically imitates a legitimate network.

Mixing up CSRF and SSRF. CSRF uses the victim's browser, SSRF uses the server.

Thinking MFA cannot be bypassed. Fatigue attacks and stolen session cookies get around many MFA methods.

Check yourself

What is the purpose of DNSSEC?
It adds digital signatures to DNS data so clients can check that answers are genuine.
What distinguishes password spraying from brute force?
Spraying tries a few common passwords against many accounts, while brute force tries many passwords against one account.
A user receives dozens of push prompts at night and finally approves one. Which attack is this?
An MFA fatigue attack, a form of MFA bypass.

Topic 9 of 10 in Threats, Vulnerabilities, and Attacks

Test yourself on Threats, Vulnerabilities, and Attacks

The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.