Step-by-Step Exercises

Trace through attack processes to understand how they work

How to Use These Exercises

Work through each step to understand how different attacks unfold. Click "Show Step" to reveal each stage.

Exercise 1: Phishing Attack Chain

Scenario: An attacker wants to steal login credentials from employees at a company. Trace the phishing attack from preparation to success.

Step 1

Research and Preparation

Attacker researches the target company - finds employee emails, identifies which systems they use (e.g., Microsoft 365).

Attacker creates a list of target email addresses.

Step 2

Create Fake Login Page

Attacker creates a convincing copy of the Microsoft login page on a domain they control (e.g., micr0soft-login.com).

Fake page looks identical to real Microsoft login.

Step 3

Craft Phishing Email

Attacker creates an email that appears to be from IT department: "Your password expires today. Click here to update it."

Email contains link to the fake login page.

Step 4

Victim Receives Email

Employee receives the email, believes it's legitimate due to urgent tone and familiar appearance.

Employee clicks the link, is taken to fake login page.

Step 5

Credentials Captured

Employee enters username and password on fake page. Credentials are sent to attacker's server.

Attacker now has valid login credentials.

Step 6

Account Compromise

Attacker uses stolen credentials to access the employee's real account, gaining access to emails, files, and systems.

Attacker has full access to employee's corporate account.

Exercise complete! You've traced a phishing attack.

Exercise 2: Ransomware Infection

Scenario: A user opens an email attachment containing ransomware. Trace what happens to their computer.

Step 1

Initial Execution

User opens "Invoice.pdf.exe" - the malware executes with user's permissions.

Ransomware begins running silently in background.

Step 2

Disable Security

Ransomware attempts to disable antivirus and Windows Defender.

Security software is disabled or bypassed.

Step 3

Delete Backups

Ransomware deletes Windows shadow copies and restore points to prevent recovery.

Local backup options are destroyed.

Step 4

Contact Command Server

Ransomware connects to attacker's server to receive unique encryption key.

Unique encryption key generated for this victim.

Step 5

Encrypt Files

Ransomware scans for documents, photos, databases and encrypts them with strong encryption (AES-256).

All valuable files are now encrypted and inaccessible.

Step 6

Display Ransom Note

Desktop wallpaper changes, ransom note appears demanding Bitcoin payment within 72 hours.

User discovers they are a ransomware victim.

Exercise complete! You've traced a ransomware attack.

Exercise 3: DDoS Attack

Scenario: Attackers launch a DDoS attack against an online store during a major sale event.

Step 1

Build the Botnet

Attacker has previously infected thousands of devices with malware, creating a botnet of "zombie" computers.

Botnet of 100,000 infected devices ready to attack.

Step 2

Send Attack Command

Attacker sends command to all botnet devices: "Attack target website now."

All 100,000 devices begin sending requests simultaneously.

Step 3

Traffic Flood Begins

Website receives millions of requests per second from IP addresses worldwide.

Server resources are consumed handling fake requests.

Step 4

Server Overload

Web servers cannot handle the volume. Response times increase dramatically.

Website becomes extremely slow for real customers.

Step 5

Service Unavailable

Servers crash or become completely unresponsive. Website displays error messages.

Denial of Service achieved - legitimate customers cannot shop.

Step 6

Impact

Company loses sales, customers go to competitors, reputation damaged.

Attack achieves its goal of disrupting business.

Exercise complete! You've traced a DDoS attack.

Exercise 4: SQL Injection Attack

Scenario: An attacker discovers a vulnerable login form and exploits it to access the database.

Step 1

Test for Vulnerability

Attacker enters a single quote (') in the username field to see if it causes an error.

Website shows SQL error - vulnerable to injection!

Step 2

Craft Injection Payload

Attacker prepares input: ' OR '1'='1' --

This will make the WHERE clause always true.

Step 3

Submit Malicious Input

Attacker enters the payload in the login form and submits.

SQL query becomes: SELECT * FROM users WHERE username='' OR '1'='1'...

Step 4

Authentication Bypassed

Query returns all users (because '1'='1' is always true). Attacker logged in as first user (often admin).

Attacker gains admin access without knowing any password!

Step 5

Data Extraction

Attacker uses more advanced injection to extract data: user details, passwords, credit cards.

Sensitive data is stolen from the database.

Exercise complete! You've traced an SQL injection attack.

Exercise 5: Brute-Force Password Attack

Scenario: An attacker attempts to crack a user's password using brute-force techniques.

Step 1

Obtain Target

Attacker identifies username/email from data breach or public information.

Target: john.smith@company.com

Step 2

Load Password List

Attacker loads a dictionary of common passwords (millions of entries) into cracking software.

Password list includes: password, 123456, qwerty, letmein...

Step 3

Begin Automated Attack

Software automatically tries each password, thousands per second.

Attempt 1: password - Failed. Attempt 2: 123456 - Failed...

Step 4

Try Variations

Software tries hybrid attacks - adding numbers and symbols to dictionary words.

Trying: Company2023, company123!, C0mpany!, Company1...

Step 5

Password Cracked

After 50,000 attempts, the weak password is found: Summer2023!

SUCCESS! Password cracked: Summer2023!

Exercise complete! You've traced a brute-force attack.

← Previous: Worked Examples Next: Parsons Problems →