# Lab 8.1: Identifying Indicators of a Network Attack

> CompTIA Security+ Module 08 case study by Johnathan Belcher.

## Overview

This lab strengthened my ability to recognize how real attacks look across wireless, DNS, denial-of-service, and malicious script execution scenarios. I learned to connect symptoms, tools, and attacker behavior so I can better identify threats, explain them clearly, and think like a security analyst when reviewing suspicious activity.

## What I Learned

- **Wireless Threats**: Evil twin attacks, rogue access points, Bluetooth abuse, jamming, RFID/NFC attacks, and how each one changes the way users connect or trust a network.
- **DNS & Reputation**: How DNS poisoning, spoofing, hijacking, and URL redirection alter trust, plus how domain reputation tools help validate suspicious infrastructure.
- **Flooding Attacks**: MAC flooding, SYN flooding, ICMP flooding, and Ping of Death behavior, including how these attacks affect availability and system resources.
- **Malicious Scripts**: How PowerShell, Python, Bash, and VBA macros can be used for fileless execution, automation abuse, and user-driven malware delivery.

## Tools, Websites, and Methods I Used

- **Websites and Online Checks**: Cisco Talos Intelligence Reputation Center, domain reputation lookup, Cloudflare challenge pages.
- **Network Tools**: Yersinia for CDP MAC flooding, hping3 for SYN and ICMP flooding, Wireshark and Ettercap for packet capture and ARP poisoning analysis.
- **Scripts and Command-Line Work**: PowerShell fileless execution concepts, Python and Bash as attacker automation languages, VBA macros and malicious script triggers inside Office documents.

## Exercise Summary

- **Wireless Attacks**: How attackers exploit trust in wireless environments using evil twins, rogue APs, Bluetooth threats, jamming, RFID, NFC, and IV-based attacks.
- **DNS Abuse**: Assessing domain reputation and how poisoning, spoofing, hijacking, and URL redirection can divert users to attacker-controlled destinations.
- **Flooding and MITM**: DoS, DDoS, MITM, MAC spoofing, and ARP poisoning from both attacker and defender perspectives.
- **Malicious Scripts**: How short scripts can still be dangerous, and how PowerShell, Python, Bash, and VBA macros can be used for fileless malware, automation abuse, and delivery through documents or web pages.

## Professional Value

- Recruiter-friendly range across wireless, DNS, network traffic, and script-based threats.
- Tool fluency with domain reputation services, packet analysis, attack simulation tools, and Windows/Linux command-line utilities.
- Analytical communication — summarizing technical attacks clearly for a team or hiring manager.
- Practical security awareness of how everyday technologies like DNS, Wi-Fi, and Office macros can become attack vectors.

## Security+ Alignment

Supports Security+ Objective 1.4 by reinforcing indicators associated with network attacks and malicious execution paths, covering wireless and access, availability attacks, and malicious execution.