Post-exploitation and pivoting in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is post-exploitation in cybersecurity?

Post-exploitation refers to the actions an attacker takes after gaining access to a system. It involves exploring the system, gathering information, maintaining access, and preparing for further attacks.

beginner

Define pivoting in the context of a cyber attack.

Pivoting is when an attacker uses a compromised system as a stepping stone to access other systems within the same network that were not directly accessible before.

intermediate

Why is maintaining access important during post-exploitation?

Maintaining access allows attackers to return to the compromised system later without repeating the initial breach, enabling long-term control and data extraction.

intermediate

Name two common techniques used for pivoting.

Two common pivoting techniques are: 1) VPN pivoting, where attackers route traffic through the compromised machine, and 2) SSH tunneling, which creates encrypted tunnels to access other systems.

intermediate

How does post-exploitation help in lateral movement within a network?

Post-exploitation provides attackers with information and tools to move laterally, meaning they can explore and compromise other machines on the network by exploiting trust relationships and credentials.

What is the main goal of post-exploitation?

A To explore and control the compromised system

B To scan for vulnerabilities

C To install antivirus software

D To disconnect the network

Post-exploitation focuses on exploring and controlling the system after initial access.

Pivoting allows attackers to:

A Encrypt data on the compromised system

B Access other systems through a compromised host

C Prevent network traffic

D Install firewalls

Pivoting uses a compromised system to reach other systems not directly accessible.

Which of the following is NOT a post-exploitation activity?

A Initial vulnerability scanning

B Maintaining access

C Gathering system information

D Credential harvesting

Initial vulnerability scanning happens before exploitation, not after.

SSH tunneling is used in pivoting to:

A Delete system logs

B Scan for open ports

C Install malware

D Create encrypted connections to other systems

SSH tunneling creates secure encrypted tunnels to access other machines.

Maintaining access during post-exploitation helps attackers to:

A Disconnect the network

B Immediately delete all files

C Return to the system without re-exploiting

D Notify system administrators

Maintaining access allows attackers to come back later without repeating the attack.

Explain what post-exploitation is and why it is important in a cyber attack.

Think about what an attacker does after breaking into a system.

Describe pivoting and how attackers use it to move within a network.

Consider how attackers reach systems they can't access directly.