CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

 Secure Erase When you “delete” a file or format a drive, you might assume your data is gone forever. Unfortunately, that’s not how most storage systems work. In reality, data can often be recovered, even after deletion, unless a process called secure erase is used. This blog post walks you through everything you need to know about secure erase: what it is, how it works, the different methods, and why it’s essential for protecting sensitive data. What Is Secure Erase? Secure erase is a method of permanently deleting data from a storage device so that it cannot be recovered by any means, including forensic tools. Unlike normal deletion, secure erase: Overwrites the actual data on the storage medium Eliminates recoverable remnants Works at a deeper level than operating system commands Why Normal Deletion Isn’t Enough When you delete a file: The operating system removes the file reference, not the data itself The storage space is marked as “free.” The actual data remains intact until ...

 MITRE ATT&CK 14 Stages The "stages" of the MITRE ATT&CK Framework are officially called Tactics. In the widely used Enterprise Matrix, there are 14 Tactics that capture the tactical goals of a cyber-adversary.  Unlike linear models like the Lockheed Martin Cyber Kill Chain, the MITRE ATT&CK framework is non-linear. Attackers can skip stages, repeat them, or run them simultaneously.  The 14 distinct stages are broken down chronologically below into Pre-Attacking, Initial Compromise, Internal Operations, and Ultimate Objectives phases. _______________________________________ Phase 1: Pre-Attacking  These steps occur outside the victim's network before the actual compromise takes place.  1. Reconnaissance: The adversary gathers data to plan future attacks. They use techniques like active port scanning, tracking public social media accounts, or leveraging Open Source Intelligence (OSINT). 2. Resource Development: The adversary builds or purchases infras...

 War Driving War driving is one of those cybersecurity concepts that sounds dramatic, but at its core it’s simply about mapping wireless networks, and understanding it is important because it shows how attackers gather information long before they ever try to break in. Here’s the clear, structured breakdown you asked for. What War Driving Is (Core Idea) War driving is the practice of driving around with a Wi‑Fi–capable device to detect and record wireless networks in an area. It doesn’t automatically mean hacking, the act itself is just scanning. Think of it as “Wi‑Fi mapping from a moving vehicle.” How War Driving Works A typical war‑driving setup includes: A laptop, tablet, or smartphone A wireless network card capable of monitor mode A GPS receiver Software such as: Kismet NetStumbler WiGLE app Airodump‑ng (part of Aircrack‑ng suite) The device continuously scans for: SSID (network name) BSSID (MAC address of the access point) Channel Signal strength Encryption type (WEP, W...

 Evilginx Evilginx is a well-known adversary-in-the-middle (AiTM) phishing framework primarily used in cybersecurity testing and, unfortunately, by attackers to bypass modern authentication protections such as multi-factor authentication (MFA). Below is a detailed but safe, high-level explanation of how it works, why it’s dangerous, and how to defend against it. What Evilginx Is Evilginx is an open-source tool that serves as a reverse-proxy phishing framework. Instead of just tricking users into entering credentials on a fake page, it: Sits between the victim and the real login site Transparently relays data back and forth Captures credentials and session cookies in real time Because of this, it’s far more advanced than traditional phishing pages. How Evilginx Works (Conceptual Overview) 1. Reverse Proxy Setup Evilginx creates a phishing domain that appears to be a legitimate site (e.g., a fake Microsoft, Google, or bank login page). The victim visits the attacker-controlled domain...

 Process Hollowing Process hollowing (also called RunPE) is a technique used in malware and offensive security in which a legitimate process is created in a suspended state, its memory is replaced (or “hollowed out”) with malicious code, and execution is then resumed so the malicious code runs under the guise of a trusted process. Below is a detailed but safe, high-level explanation of how it works, why attackers use it, and how it’s detected. What Process Hollowing is Process hollowing is a code injection/evasion technique that allows attackers to: Run malicious code inside a legitimate process Avoid detection by antivirus and behavioral monitoring Blend into normal system activity Instead of launching a suspicious executable directly, malware makes it appear as though a trusted application (e.g., explorer.exe, svchost.exe) is running normally, while its actual code has been replaced. Conceptual Workflow (High-Level) Here’s a simplified conceptual flow of how process hollowing wor...

 ntlmrelayx ntlmrelayx is a well-known tool from the Impacket suite used in cybersecurity, primarily for penetration testing and red-team exercises. It exploits weaknesses in Microsoft’s NTLM (NT LAN Manager) authentication protocol to perform what’s called an NTLM relay attack. 1. Background: NTLM Authentication Before understanding ntlmrelayx, you need to know how NTLM works. NTLM basics NTLM is a challenge-response authentication protocol used in Windows environments when Kerberos isn’t available. Simplified flow: 1. Client requests authentication to a server 2. Server sends a challenge (random value) 3. Client encrypts the challenge using its password hash → sends response 4. Server verifies response Important property: The password is never sent directly, but the response can still be reused in certain contexts. 2. What Is an NTLM Relay Attack? An NTLM relay attack takes advantage of: NTLM’s lack of binding between authentication and the target service The ability to reuse aut...

DCShadow DCShadow is an advanced Active Directory (AD) attack technique used by adversaries to stealthily modify directory data by impersonating a domain controller (DC). It is considered highly dangerous because it bypasses many traditional security controls and blends in with legitimate replication traffic. What is DCShadow? DCShadow is a post-exploitation technique (introduced publicly by researchers at Black Hat 2018) that allows attackers to: Register a rogue machine as a fake domain controller Push malicious changes into Active Directory via replication Avoid detection by traditional logging mechanisms Instead of modifying AD objects via standard administrative APIs (which generate logs), DCShadow injects changes as if they originated from a legitimate DC replication process. Key Concept: Active Directory Replication Active Directory uses a multi-master replication model, meaning: All domain controllers can make changes Changes are synchronized using replication protocols (DRSUAP...

 BlueCrack Bluetooth Attack A BlueCrack attack is a Bluetooth brute-force attack that attempts to guess the PIN (passkey) of a Bluetooth device, enabling unauthorized access. It is typically considered an older Bluetooth attack, but it is important for understanding wireless security weaknesses in legacy systems. How BlueCrack Works Bluetooth devices pair using a PIN code (passkey). In older Bluetooth versions: The PIN is used to generate a link key for encryption If the PIN is weak (e.g., 0000, 1234), it can be guessed Attack Process (Simplified) 1. Capture pairing process Attacker monitors Bluetooth communication during pairing Tools like sniffers capture authentication exchanges 2. Brute-force the PIN Try every possible PIN combination Compare generated keys against captured data 3. Recover the correct PIN Once matched, the attacker knows the valid PIN 4. Gain access Connect to the device Access services like: File transfers Contacts Audio channels Tools Historically Used BlueCr...

URL Spidering? URL spidering (also called web crawling) is an automated technique used in penetration testing, reconnaissance, and security assessment to discover all accessible pages, directories, endpoints, and resources on a web application. Think of it like a bot that starts at a website and systematically follows every link it finds, just like how search engines index the web. How URL Spidering Works A spider typically follows this process: 1. Start with a target URL Example: https://target.comptia.org 2. Fetch the page content HTML is downloaded and parsed 3. Extract links and resources `` links Forms (``) JavaScript-generated URLs (advanced spiders) Images, scripts, APIs, etc. 4. Visit discovered URLs Each new link is added to a queue The spider continues recursively 5. Record findings URLs Parameters Status codes Inputs (GET/POST parameters) Why URL Spidering is Important in Pen Testing URL spidering helps testers: 1. Map the attack surface Identify: Hidden pages Admin panels (...

 What is Trivy? Trivy is an open-source security scanner developed by Aqua Security that identifies vulnerabilities, misconfigurations, secrets, and compliance issues in modern environments, especially containers and cloud-native systems. It is widely used in penetration testing, DevSecOps, and cloud security because it is: Fast Easy to use Lightweight Highly versatile What Trivy Scans Trivy is not limited to one type of target; it supports multiple layers of modern infrastructure: 1. Container Images Scans Docker/OCI images for: Known vulnerabilities (CVEs) Outdated packages OS-level issues (Alpine, Ubuntu, Debian, etc.) Example: trivy image nginx: latest 2. File Systems Scans directories or local systems for: Vulnerable libraries Dependency issues Example: trivy fs /path/to/project 3. Infrastructure as Code (IaC) Scans configuration files like: Terraform Kubernetes YAML Dockerfiles Detects: Misconfigurations (e.g., open security groups, no encryption) Example: trivy config 4. Kub...

 Impacket Impacket is an open‑source Python toolkit created by SecureAuth that provides low‑level network protocol implementations. Its purpose: Allow security professionals to craft, send, and manipulate network packets for testing, auditing, and research. It’s widely used in: Penetration testing Red team operations Incident response Malware analysis Network protocol research Impacket is especially known for its Windows network protocol support, including SMB, NTLM, Kerberos, LDAP, and more. Why Impacket Is Important Impacket is powerful because it lets you interact with network protocols the same way real systems do, not just through high‑level tools. This gives security teams the ability to: Test authentication weaknesses Validate Active Directory configurations Simulate attacker behavior Reproduce real‑world attack chains Audit network exposure It’s one of the most widely used toolkits in cybersecurity. What Impacket Contains Impacket includes two major components: 1. Python Li...