CoreQ Academy4.2 Given a scenario, perform network attacks using the appropriate tools.
Network attacks exploit weak configuration and trust on the network. In scope and with authorisation, testers demonstrate them so defenders can fix the root cause.
Attack types
- Default credentials
- Logging in with factory or vendor default passwords.
- On-path attack
- Intercepting traffic between two parties (e.g. via ARP or DHCP spoofing). Defence: encryption, dynamic ARP inspection, DHCP snooping.
- Certificate services
- Abusing misconfigured certificate authorities (e.g. AD CS templates) to obtain certificates for privileged identities.
- Misconfigured services exploitation
- Abusing services set up insecurely, such as anonymous FTP or open databases.
- Virtual local area network (VLAN) hopping
- Reaching other VLANs via switch spoofing or double tagging. Defence: disable auto-trunking, change native VLAN.
- Multihomed hosts
- Hosts connected to multiple networks that can bridge segmentation.
- Relay attack
- Relaying captured authentication (e.g. NTLM) to another service. Defence: SMB signing, LDAP signing and channel binding.
- Share enumeration
- Finding accessible network shares containing sensitive data.
- Packet crafting
- Building custom packets to test filtering or trigger bugs.
Tools
- Metasploit
- Exploitation framework with modules for exploits, payloads and post-exploitation.
- Netcat
- Swiss-army knife for reading and writing network connections: banners, listeners, simple transfers.
- Nmap
- Scanning and NSE scripts for detecting and validating network issues.
- NSE
- Nmap scripts, some of which check for specific vulnerabilities.
- Impacket
- Python library and scripts for Windows network protocols (SMB, Kerberos, LDAP), used for relay and remote execution tests.
- CrackMapExec (CME)
- Swiss-army tool for assessing Windows/AD networks at scale (credential validation, share enumeration); continued as NetExec.
- Wireshark/tcpdump
- Capture and analyse traffic to confirm attacks and findings.
- msfvenom
- Metasploit payload generator.
- Responder
- Poisons LLMNR/NBT-NS/mDNS name resolution to capture hashes. Defence: disable LLMNR and NBT-NS.
- Hydra
- Online password-guessing tool for many protocols.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.2 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.