Lab 8.1: Identifying Indicators of a Network Attack

CompTIA Security+ Module 08

Overview

This lab strengthened my ability to recognize how real attacks look across wireless, DNS, denial-of-service, and malicious script execution scenarios. I learned to connect symptoms, tools, and attacker behavior so I can better identify threats, explain them clearly, and think like a security analyst when reviewing suspicious activity.

What I Learned

Wireless Threats

Evil twin attacks, rogue access points, Bluetooth abuse, jamming, RFID/NFC attacks, and how each one changes the way users connect or trust a network.

DNS & Reputation

How DNS poisoning, spoofing, hijacking, and URL redirection alter trust, plus how domain reputation tools help validate suspicious infrastructure.

Flooding Attacks

MAC flooding, SYN flooding, ICMP flooding, and Ping of Death behavior, including how these attacks affect availability and system resources.

Malicious Scripts

How PowerShell, Python, Bash, and VBA macros can be used for fileless execution, automation abuse, and user-driven malware delivery.

Tools, Websites, and Methods I Used

Websites and Online Checks

  • Cisco Talos Intelligence Reputation Center
  • Domain reputation lookup for google.com
  • Cloudflare challenge page before reputation results loaded

Network Tools

  • Yersinia for CDP MAC flooding
  • hping3 for SYN and ICMP flooding
  • Wireshark and Ettercap for packet capture and ARP poisoning analysis

Scripts and Command-Line Work

  • PowerShell fileless execution concepts
  • Python and Bash as attacker automation languages
  • VBA macros and malicious script triggers inside Office documents

Exercise Summary

Exercise 1: Wireless Attacks

I learned how attackers exploit trust in wireless environments using evil twins, rogue APs, Bluetooth threats, jamming, RFID, NFC, and IV-based attacks.

Exercise 2: DNS Abuse

I practiced assessing domain reputation and studied how poisoning, spoofing, hijacking, and URL redirection can divert users to attacker-controlled destinations.

Exercise 3: Flooding and MITM

I used attack simulations to understand DoS, DDoS, MITM, MAC spoofing, and ARP poisoning from both attacker and defender perspectives.

Exercise 4: Malicious Scripts

I studied how short scripts can still be dangerous and how PowerShell, Python, Bash, and VBA macros can be used for fileless malware, automation abuse, and delivery through documents or web pages.

How This Advanced My Cybersecurity Learning

Threat Recognition

I learned to connect attack symptoms with the tools and techniques behind them, which is valuable when analyzing logs, traffic, or suspicious user behavior.

Hands-On Validation

Using real tools like Wireshark, Ettercap, Yersinia, and hping3 made the concepts concrete and improved my confidence in reading live attack indicators.

Defensive Mindset

The lab reinforced how attackers abuse trust, availability, and execution paths, helping me think more clearly about prevention, monitoring, and response.

Professional Value

  • Recruiter-friendly range: This project shows that I can move between wireless, DNS, network traffic, and script-based threats without losing the bigger security picture.
  • Tool fluency: I worked with domain reputation services, packet analysis, attack simulation tools, and Windows/Linux command-line utilities.
  • Analytical communication: I can summarize technical attacks in a way that is easy to scan, explain, and present to a team or hiring manager.
  • Practical security awareness: The lab improved my understanding of how everyday technologies like DNS, Wi-Fi, and Office macros can become attack vectors.

Security+ Alignment

This lab supports Security+ Objective 1.4 by reinforcing the indicators associated with network attacks and malicious execution paths.

Wireless and Access

  • Evil twin and rogue AP behavior
  • Bluetooth, RFID, NFC, and jamming
  • IV weakness in wireless traffic

Availability Attacks

  • SYN, ICMP, and Ping of Death floods
  • MAC flooding and ARP poisoning
  • DDoS and MITM concepts

Malicious Execution

  • PowerShell fileless execution
  • Python and Bash malware concepts
  • VBA macro-based delivery
← Back to Portfolio ← Back to Resume