Cybersecurity Fundamentals and Attack Techniques

Introduction to Cybersecurity Fundamentals

In today’s interconnected world, understanding the basics of cybersecurity is essential for anyone working with computers, networks, or data. This course breaks down core concepts that appear frequently in security assessments, penetration testing, and defensive operations. By the end of the module, you will be able to explain key tools, attack techniques, and best‑practice processes that protect modern IT environments.

Network Scanning with Nmap

Service Version Discovery

Nmap is the go‑to utility for discovering hosts, open ports, and the services running on them. To retrieve service version information, the -sV option is used. This flag instructs Nmap to probe each open port and attempt to identify the exact software version, which is crucial for vulnerability assessment.

• -sV – Enables service version detection.
• -sn – Host discovery only (no port scan).
• -SX – Not a valid Nmap flag.
• -SF – Not a valid Nmap flag.

Stealth SYN Scanning

A stealth SYN scan (also known as a half‑open scan) sends a SYN packet and waits for a response without completing the TCP handshake. This technique is less likely to be logged by intrusion detection systems. The correct flag is -sS.

• -sS – Performs a stealth SYN scan.
• -sU – UDP scan.
• -sM – Maimon scan (rarely used).
• -sT – Full‑connect TCP scan.

Discovering Hosts When ICMP Is Blocked

Many networks disable ICMP echo requests to hide live hosts. Nmap can still discover devices using the ARP ping scan. ARP operates at Layer 2 and is not filtered by typical firewalls, making it reliable for LAN discovery.

• ARP ping scan – Sends ARP requests to resolve MAC addresses, revealing active hosts.
• UDP port 53 scan – Useful for DNS services but not for basic host discovery.
• TCP ACK scan on port 22 – Primarily used for firewall rule testing.
• TCP SYN scan on port 80 – Requires the target to have port 80 open.

Understanding Web Application Vulnerabilities

Insecure Direct Object Reference (IDOR)

An IDOR vulnerability occurs when an application uses user‑supplied input to directly access objects (files, database records, etc.) without proper authorization checks. Attackers manipulate the URL path segment after a protected endpoint, such as /restricted/123, to retrieve unauthorized data like /restricted/456.

Think of a locker system: if the lock is weak, you can simply try a different number and open another locker. Changing the URL path is the equivalent of trying a new locker number.

• Correct manipulation: URL path after /restricted/
• Incorrect options: Host header, request method, HTTP version.

Which part of a request would you change to try an IDOR attack? A) Host header, B) Request method, C) URL path after /restricted/

Cyber Kill Chain: Delivery Phase

The cyber kill chain models the stages an attacker follows to achieve their objective. The Delivery step involves transmitting the malicious payload to the target, often via email attachments, malicious links, or compromised websites. Recognizing the delivery method helps defenders implement appropriate email filtering and user awareness training.

• Reconnaissance – Information gathering.
• Delivery – Sending malicious attachment or link.
• Command and Control – Establishing a remote channel.
• Installation – Deploying malware on the victim.

Advanced Network Attack Techniques

DNS Tunneling

DNS tunneling exploits the fact that DNS traffic is often allowed through firewalls. By embedding data in DNS queries and responses, an attacker can create a covert channel to exfiltrate data or command a remote system. This method bypasses many perimeter defenses because DNS is considered a trusted protocol.

• Correct description: Embedding data in DNS queries and responses.
• Incorrect options: Spoofing responses, enumerating zones, caching attacks.

Wi‑Fi SSID Broadcast Misconception

Disabling SSID broadcast is a common but ineffective security measure. Even when the SSID is hidden, attackers can still capture the SSID from association frames during the authentication process. Therefore, the correct answer is that attackers can sniff the SSID from captured frames.

• Correct: SSID can be sniffed from association frames.
• Incorrect: SSID becomes a static key, clients cannot connect, or WPA2 is disabled.

Vulnerability Management Lifecycle

Effective vulnerability management follows a repeatable process that starts with asset identification and ends with continuous monitoring. The proper sequence is:

1. Identify – Catalog all assets and their configurations.
2. Scan – Run automated tools to discover vulnerabilities.
3. Risk assessment – Prioritize findings based on impact and exploitability.
4. Remediation – Apply patches, configuration changes, or mitigations.
5. Verify – Re‑scan to confirm that remediation was successful.
6. Monitor – Continuously watch for new threats and changes.

Following this workflow ensures that organizations address the most critical risks first and maintain a strong security posture over time.

Conclusion and Next Steps

Mastering the concepts covered in this module—Nmap scanning techniques, IDOR exploitation, the cyber kill chain, DNS tunneling, Wi‑Fi security myths, and the vulnerability management lifecycle—provides a solid foundation for both defensive and offensive cybersecurity roles. To reinforce learning, practice using Nmap in a controlled lab, experiment with crafting URL variations for IDOR testing, and simulate DNS tunneling with open‑source tools.

Remember, security is a continuous journey. Keep your knowledge up‑to‑date, stay curious, and always apply the principles of least privilege and defense in depth.