Initial Access 🔓

• Goal: The attacker gains initial access to the target system.

• Initial Access Techniques

  • 📥 Content Injection

  • 🌐 Exploit Public-Facing Application

  • 🛠 Hardware Additions

  • 💾 Replication Through Removable Media

  • 🤝 Trusted Relationship

  • 🚗 Drive-by Compromise

  • 🌍 External Remote Services

  • 🎣 Phishing

  • 🔗 Supply Chain Compromise

  • 🔑 Valid Accounts

What is Drive-by Compromise

Adversaries can gain access to a system when a user visits a website. Typically, this involves exploiting vulnerabilities in the user's web browser, but it can also be used to steal application access tokens (e.g., OAuth tokens) without direct exploitation.

Attack Techniques

📌 Methods of Delivering Malicious Code:

• Compromising legitimate websites by injecting JavaScript, iFrames, or cross-site scripting (XSS).

• Modifying script files served from publicly writable cloud storage.

• Injecting malicious ads (Malvertising) through legitimate ad networks.

• Exploiting web application interfaces to insert malicious content into comments, forum posts, or other user-generated content.

📌 Watering Hole Attacks

• Targeting websites frequently visited by specific industries, regions, or communities to infect a particular group of users.

Typical Attack Process

1️⃣ The user visits a website that hosts adversary-controlled content.
2️⃣ Scripts execute automatically, checking browser and plugin versions for vulnerabilities.
3️⃣ The user may be tricked into enabling scripts or ignoring security warnings.
4️⃣ If a vulnerability is found, exploit code is delivered to the browser.
5️⃣ Upon successful exploitation, the adversary gains code execution on the system.
6️⃣ In some cases, the exploit is delivered only on a second visit, after initial reconnaissance.

Characteristics and Differences

• Differences from Exploit Public-Facing Application

  • Targets client-side software rather than server applications.

  • More likely to grant access to internal networks rather than external DMZ systems.

• Stealing Application Access Tokens

  • Malicious popups may be used to steal OAuth tokens and gain unauthorized access to protected applications.

To defend against these attacks, users should apply the latest security patches, use script-blocking tools, enable security extensions, and avoid visiting untrusted websites.