Network Defense Management · Topic 1 of 5
Attack Terminology and Network, Host and Application Attacks
Learn core attack terms such as threat, vulnerability and exploit, then recognize network, host and application level attacks and the counter to each.
- 5 min
- Threat plus vulnerability gives risk, and an exploit uses a vulnerability.
- Sniffing is passive. DoS, spoofing and session hijacking are active.
- ARP poisoning and DNS poisoning are spoofing style attacks on name and address resolution.
What it is
Before you can defend a network you need exact words for what is being attacked and how. A threat is a potential cause of harm. A vulnerability is a weakness the threat can use, and risk is the likelihood and impact of that happening.
Attacks are grouped by where they hit: the network, a single host, or an application. The exam asks you to name the attack from a short description and to pick the control that counters it.
How it works
Essential terms
| Term | Meaning |
|---|---|
| Threat | Anything that could harm an asset |
| Vulnerability | A flaw or weakness in a system, process or person |
| Exploit | Code or a technique that uses a vulnerability |
| Zero day | A flaw with no patch yet available, or one the vendor does not know about |
| Attack vector | The path an attacker uses, such as email, USB or an open port |
| Payload | The part of an attack that does the damage, after delivery |
| Hacking | Gaining access beyond what was granted |
| Indicator of compromise (IoC) | Evidence of an attack, such as a file hash, IP address or odd log entry |
| Confidentiality, integrity, availability (CIA) | The three goals an attack tries to break |
An active attack changes data or disrupts a service. A passive attack only observes, for example sniffing. An insider attack comes from a trusted person, and a close in attack needs physical closeness.
Network level attacks
| Attack | What it does | Defender's counter |
|---|---|---|
| Sniffing | Captures traffic on the wire or air | Encryption, switched networks, port security |
| Spoofing | Fakes an address (IP, MAC, ARP) | Ingress filtering, DHCP snooping, dynamic ARP inspection |
| Man in the middle | Sits between two parties and reads or alters traffic | TLS, certificate checks, VPN |
| Session hijacking | Takes over an established session | Random session IDs, encryption, short timeouts |
| Denial of service (DoS) | Exhausts a resource so users are refused | Rate limiting, filtering, upstream scrubbing |
| Distributed DoS (DDoS) | The same attack from many bots | Anycast, scrubbing service, capacity |
| DNS poisoning | Plants false DNS answers | DNSSEC, patched resolvers |
| Password attacks on network services | Guessing or cracking credentials | Lockout, strong passwords, multifactor |
A SYN flood is a typical DoS: the attacker sends many SYN packets and never completes the TCP handshake, filling the server's connection table. ARP poisoning sends false ARP replies so that traffic passes through the attacker's machine.
Host level attacks
Host attacks target an operating system or the machine itself.
- Malware: viruses, worms, trojans, ransomware, spyware, rootkits and fileless malware.
- Privilege escalation: moving from a low account to administrator or root.
- Password cracking: brute force, dictionary and rainbow table attacks on stored hashes.
- Buffer overflow: writing past a memory buffer to run attacker code.
- Unpatched software: known flaws left open.
- Physical access: booting another system, stealing a disk or inserting a rogue USB device.
- Backdoors and rootkits: hidden access that survives reboots and hides itself.
The main defenses are patching, least privilege, endpoint protection, host firewalls, hardening and encryption of stored data.
Application level attacks
These abuse how an application handles input, sessions and logic.
| Attack | Description | Counter |
|---|---|---|
| SQL injection | Attacker input changes the database query | Parameterized queries, input validation |
| Cross site scripting (XSS) | Script is injected into a page seen by other users | Output encoding, content security policy |
| Cross site request forgery (CSRF) | A logged in user is tricked into sending a request | Anti forgery tokens, SameSite cookies |
| Directory traversal | ../ sequences reach files outside the web root | Path validation, least privilege |
| Command injection | Input is passed to an OS shell | Avoid shell calls, validate input |
| Broken authentication or session flaws | Weak login or session handling | Strong session management, multifactor |
| Buffer overflow | Oversized input overwrites memory | Safe languages, bounds checks, ASLR |
| Parameter tampering | Hidden fields or URL values are changed | Server side validation |
The OWASP Top 10 is the common reference list of web application risks.
A worked example
A help desk user reports that the company site shows a pop up when a product review is opened. An analyst finds that a review contains a script tag that was stored by the application and is run by every visitor's browser.
This is stored cross site scripting, an application level attack. The fix is output encoding and input validation in the code, with a web application firewall as extra cover. Blocking a port on the network firewall would not help, because the traffic is normal HTTPS.
How the exam asks about this
- "An attacker sends a stream of SYN packets and never completes the handshake. What is this?" → A SYN flood, a denial of service attack.
- "Which attack inserts malicious database commands through a login field?" → SQL injection.
- "Which term describes a vulnerability for which no patch exists?" → A zero day.
What to remember for the exam
- Threat plus vulnerability gives risk, and an exploit uses a vulnerability.
- Sniffing is passive. DoS, spoofing and session hijacking are active.
- ARP poisoning and DNS poisoning are spoofing style attacks on name and address resolution.
- SQL injection, XSS and CSRF are application level attacks fixed mainly in code.
- Patching, least privilege and input validation counter most host and application attacks.
Do not mix XSS and CSRF. XSS runs attacker script in a victim's browser, while CSRF makes the victim's browser send an unwanted request using their login.
Common mistakes
Calling every outage a DDoS. DoS is one source and DDoS is many. A hardware failure or misconfiguration is not an attack at all.
Putting application flaws at the network firewall. A network firewall that allows port 443 will not stop SQL injection. The fix is in the application and the web application firewall.
Treating a vulnerability as a threat. A weak password policy is a vulnerability. The person trying to guess passwords is the threat.
Check yourself
What is the difference between a threat and a vulnerability?
A threat is something that can cause harm, and a vulnerability is the weakness it can use.
Which attack redirects traffic by sending forged ARP replies?
ARP poisoning, a spoofing based man in the middle attack.
Which control best stops SQL injection?
Parameterized queries with input validation in the application.
Topic 1 of 5 in Network Defense Management
Test yourself on Network Defense Management
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.