Web Foundations
This system acts like the internet’s phonebook by translating a domain name into an IP address.
DNS
This attack occurs when an attacker gets JavaScript to run inside a victim’s webpage because unsafe input was placed into HTML.
Cross-Site Scripting, or XSS
This is the original readable message before a cipher scrambles it.
plaintext
This is any leftover digital trace created when someone opens a browser, connects a USB device, or runs a program.
digital artifact
An IP address that contacted an organization is only a raw fact and belongs to this lowest level of the intelligence ladder.
data
This HTTP method is mainly used to read a resource, normally has no request body, and often places parameters in the URL.
GET
This attack happens when user input becomes part of a database query, allowing the attacker to change the query’s logic.
SQL injection
This form of encryption uses the same shared key to encrypt and decrypt data and is fast enough for bulk data such as files and video.
symmetric encryption
These are the five main stages of a digital investigation: find the evidence, protect it, copy it, study it, and explain the results.
identify, preserve, acquire, analyze, and report
Useful intelligence must have these three qualities: it must be fresh enough to matter, connected to your organization, and tell you what action to take.
timely, relevant, and actionable
Scheme, host, and port together form this browser security boundary. Changing any one of them creates a different one.
This browser policy blocks scripts from reading another origin’s response, cookies, or DOM, but it does not necessarily stop the request from being sent.
Same-Origin Policy, or SOP
This one-way process produces a digital fingerprint and is primarily used to verify integrity rather than hide information.
hashing
Investigators calculate this digital fingerprint for both an original drive and its copy to prove that the copy is identical.
hash
These are the three intelligence levels: big-picture trends for leaders, campaigns and groups for planners, and specific clues for active defenders.
strategic, operational, and tactical intelligence
Authentication proves who a user is, while this process determines what that user is allowed to access or do.
authorization
This attack tricks a logged-in browser into sending an unwanted request with its automatically attached cookies. Tokens and SameSite cookies help prevent it.
Cross-Site Request Forgery, or CSRF
A sender creates this using a private key, and others verify it using the matching public key to confirm authenticity and integrity.
digital signature
One of these devices allows investigators to read a drive without writing to it, while the other safeguard records everyone who handled the evidence.
write blocker and chain of custody
This endpoint security tool watches behavior on laptops and servers and can respond by isolating a device, killing a process, or creating an alert.
EDR
This is the correct request sequence after a user enters a secure website address: name resolution, connection setup, encryption setup, web request, server processing, web response, and browser rendering.
DNS → TCP → TLS → HTTP request → server → HTTP response → client rendering?
A website accepts a URL and asks its server to fetch it. An attacker supplies an internal-service or cloud-metadata address so the server accesses something the attacker cannot reach directly.
Server-Side Request Forgery, or SSRF
Secure web connections use asymmetric cryptography to establish trust and agree on a secret, then use fast symmetric session keys for the remaining data.
hybrid encryption, as used in TLS
This attacker technique changes a file’s recorded dates and times in an attempt to mislead investigators and break their timeline.
timestomping
Located at the top of the Pyramid of Pain, these describe an attacker’s goals, methods, and exact habits and are much harder to change than an IP address or file hash.
tactics, techniques, and procedures, or TTPs