Attack Types
Exam questions rarely name an attack. They describe one and ask what it was. Each row here carries the detail that separates it from the attack next to it, which is the part the question turns on.
Attack Types · firsttry.app/cheatsheets/attack-types · original reference written from published exam objectives. Not affiliated with any certification body.
Social engineering
| Attack | The tell |
|---|---|
| Phishing | Mass email, generic greeting, a link or attachment |
| Spear phishing | Targeted at a named person, uses real details about them |
| Whaling | Spear phishing aimed at an executive |
| Vishing | Voice call, often spoofed caller ID |
| Smishing | SMS message with a link |
| Pretexting | An invented scenario that justifies the request |
| Business email compromise | A real or lookalike internal account asks for a payment |
| Watering hole | A site the target group already visits is compromised |
| Tailgating | Following someone through a door they badged open |
| Piggybacking | Same, but the person holds the door knowingly |
| Shoulder surfing | Reading a screen or keypad over someone's shoulder |
| Dumpster diving | Recovering documents or media from waste |
| Typosquatting | A domain one keystroke away from the real one |
| Impersonation | Claiming a role, usually one that discourages questions |
Malware
| Type | The tell |
|---|---|
| Virus | Attaches to a file, needs the file to be run |
| Worm | Spreads on its own across a network, no user action |
| Trojan | Presents as something wanted, carries something else |
| RAT | Trojan that gives the attacker interactive control |
| Ransomware | Encrypts data and demands payment |
| Logic bomb | Dormant until a condition or date is met |
| Rootkit | Hides itself and other malware, often below the OS |
| Bootkit | Rootkit in the boot process, loads before the OS |
| Keylogger | Records keystrokes |
| Spyware | Collects activity and sends it out |
| Fileless malware | Runs in memory, often through PowerShell or WMI |
| Potentially unwanted program | Installed alongside something the user did want |
Network attacks
| Attack | The tell |
|---|---|
| On-path (MITM) | Attacker sits between two parties and relays traffic |
| ARP poisoning | Forged ARP replies redirect local traffic |
| DNS poisoning | Forged records send a name to the wrong address |
| DNS tunnelling | Data smuggled inside DNS queries |
| Domain hijacking | The registrar record itself is taken over |
| DDoS | Many sources exhaust a resource |
| Amplification | Small request, large reply, spoofed source |
| Replay | A captured valid message is sent again |
| Session hijacking | A live session token is stolen and reused |
| Evil twin | Rogue access point using the real network name |
| Deauthentication | Forces clients off wireless so they reconnect |
| MAC flooding | Fills the switch table so it floods like a hub |
| VLAN hopping | Reaches a VLAN the port should not reach |
Application and password attacks
| Attack | The tell |
|---|---|
| SQL injection | Input is interpreted as database commands |
| Cross-site scripting | Input is executed as script in another user's browser |
| CSRF | A logged-in user's browser is made to send a request |
| SSRF | The server is made to fetch a URL the attacker chose |
| Directory traversal | Path input reaches files outside the web root |
| Buffer overflow | Input longer than the buffer overwrites adjacent memory |
| Race condition (TOCTOU) | State changes between the check and the use |
| Privilege escalation | A low-privilege foothold becomes a high-privilege one |
| Brute force | Every combination, in order |
| Dictionary | A wordlist of likely passwords |
| Password spraying | One common password against many accounts, avoids lockout |
| Credential stuffing | Username and password pairs leaked from another breach |
| Rainbow table | Precomputed hashes, defeated by salting |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.