16.3 Types of Attacks

Denial of Service

A denial of service (DoS) attack makes a system unavailable — an availability violation in CIA terms — by exhausting bandwidth, connections, CPU, or memory. A distributed denial of service (DDoS) uses many compromised machines (a botnet) at once. Kali includes tools like hping3 for crafting floods of TCP/UDP/ICMP packets, but here is the exam-relevant professional point: DoS is almost always out of scope in real engagements. Rules of engagement typically forbid it because even a "test" outage costs the client real money and can knock over fragile legacy systems. You should know what DoS is, and know to refuse it unless explicitly authorized in writing.

Phishing and Social Engineering

Social engineering attacks the human layer, which no patch can fix. Phishing — fraudulent emails or sites that harvest credentials or deliver malware — is the most common vector and the most common initial foothold in real breaches. Variants worth knowing: spear phishing (targeted at a specific person), whaling (targeting executives), vishing (voice/phone), and smishing (SMS). Kali ships the Social-Engineer Toolkit (SET), which clones websites and runs credential-harvesting campaigns, and many testers use Gophish for managing authorized phishing simulations with open/click/credential-capture metrics. Physical social engineering — tailgating through badge doors, dropping malicious USB drives — belongs to the same family. In assessments, phishing is how testers most often turn an external foothold into internal access.

Password Attacks

Password attacks split first into online attacks — passwords tried against a running service, which is noisy and slow and trips account lockouts — and offline attacks, where captured hashes are cracked locally and the only real limit is compute (hence GPUs and the kali-tools-gpu metapackage). Kali's Password Attacks menu is organized along exactly that line. Within them, three techniques you must not blur:

Kali's password-attack arsenal is deep. Hydra (hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target) attacks live network services like SSH, FTP, and HTTP forms. Offline, John the Ripper and hashcat crack captured hashes — hashcat leans on GPU power for enormous speed. The legendary rockyou.txt wordlist ships in Kali as /usr/share/wordlists/rockyou.txt.gz (gunzip it to get rockyou.txt) and contains roughly 14 million real leaked passwords. Exam trap: brute forcing is the slowest technique; spraying and stuffing exist precisely to defeat lockout policies.

Network Attacks

Sniffing is passive capture of network traffic. Any unencrypted protocol — HTTP, FTP, Telnet, SMTP without TLS — exposes credentials and content to anyone who can see the wire. Wireshark (GUI) and tcpdump (CLI) are the Kali standards.

A man-in-the-middle (MITM) attack is active: the attacker inserts themselves between two parties so traffic flows through them. On a LAN the classic technique is ARP spoofing/poisoning — sending forged ARP replies so victim machines send their traffic to the attacker's MAC address. Kali tools: arpspoof, ettercap, and the more modern bettercap, often combined with sslstrip-style downgrade attempts. Defenses are HTTPS everywhere (ideally with HSTS), encrypted management protocols (SSH instead of Telnet), and switch features like dynamic ARP inspection.

DoS attacks themselves come in three layers worth naming: volumetric attacks saturate bandwidth with sheer traffic volume, protocol attacks exhaust connection state (the SYN flood is the classic example), and application-layer attacks like Slowloris tie up a web server with many slow, half-finished requests while using very little bandwidth. The same layering idea runs through this whole section: real compromises chain categories together — a phishing email delivers malware, the malware harvests credentials, the credentials grant network access, and sniffing on that network exposes the web session the attacker ultimately abuses. That is why defenses are layered too (defense in depth), and why a penetration test that demonstrates a complete chain carries far more weight with a client than any single isolated finding.

Web Application Attacks

Web attacks exploit improper handling of user input:

• SQL injection (SQLi): attacker input is concatenated into a database query, letting them read or modify the database. ' OR '1'='1 is the textbook probe; sqlmap (sqlmap -u "http://target/item.php?id=1" --dbs) automates detection and full database extraction. The fix is parameterized queries (prepared statements).
• Cross-site scripting (XSS): attacker input is rendered as script in other users' browsers — stored XSS persists in a page (a forum post), reflected XSS bounces off a URL parameter. XSS steals session cookies and defaces pages; output encoding and Content Security Policy mitigate it.
• Related categories: command injection, path traversal, file inclusion (LFI/RFI), and server-side request forgery (SSRF).

Burp Suite (preinstalled in Kali) and OWASP ZAP intercept and manipulate requests, making them the workhorses of web testing; the OWASP Top 10 is the standard taxonomy of these risks.

Memory Corruption

Memory corruption happens when a location inside a process's memory is modified unintentionally because of a programming mistake. Usually that just crashes the program — but when an attacker can steer which memory is overwritten, the program's execution flow becomes attacker-controlled. These bugs are loosely called "buffer overflows," which the book calls an over-simplification, because the four common families are quite different:

• Stack buffer overflow — more data is written to a stack buffer than it holds, corrupting adjacent memory including saved return addresses.
• Heap corruption — run-time-allocated memory is manipulated to overwrite heap-management pointers.
• Integer overflow — a numeric value is created that cannot fit its allocated storage, producing wrong sizes and bad allocations.
• Format string — user input reaches a formatting function unchecked, letting format tokens read or write arbitrary memory.

Modern platforms fight back with DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), which is why exploit development is hard. Note the book's warning, though: the absence of a public exploit does not mean none exists, so treat every memory-corruption vulnerability as potentially exploitable.

Client-Side Attacks

As internet-facing servers got harder to attack, attackers moved to the softer target: the applications on an employee's workstation. Client-side attacks target the browser, document reader, or runtime rather than a listening service. Flash, Acrobat Reader and Java were the classic vectors in the early 2000s; HTML Application (HTA) files are a current favourite. The pattern is always the same — lure the user into opening a page or file, then either exploit the client application or simply trick the user into running code. Kali groups this tooling under the Social Engineering Tools menu category (kali-tools-social-engineering). These are hard to prevent: mitigation needs user education, relentless application patching, and network controls together.

Malware

Malware is software designed to harm or control systems: viruses (need a host file and user action), worms (self-propagating, like WannaCry), trojans (disguised as legitimate software), ransomware (encrypts for extortion), spyware, and rootkits (hide deep in the system). In sanctioned testing, Kali's Metasploit msfvenom generates payloads — for example, a Meterpreter reverse shell — to demonstrate what happens if a user executes an attachment. The professional rule: malware in an assessment is a demonstration under strict authorization, never deployment outside the lab of the client who signed for it. Understanding how malware behaves also informs defense — recognizing command-and-control traffic and persistence mechanisms is what turns an attacker mindset into a defender's skill.