OCR J277 Network Security

Lesson 3: Technical Attacks

Understanding the mechanics and purpose of automated network attacks.

Lesson Progress

0/5
01 Review of Previous Learning

DO NOW: Malware Match-Up

Open your master Google Doc. Read the 4 definitions below and write down which specific type of malware they describe.

  • 1 "I secretly record every key you press on your keyboard and email the logs to a hacker."
  • 2 "I disguised myself as a free video game so you would install me, but I opened a backdoor to your system."
  • 3 "I have encrypted all of your family photos. Pay me 0.5 Bitcoin or the decryption key will be deleted."
  • 4 "I spread across your network without you doing anything, replicating so fast that I crashed the server."
Reveal Answers (Use Green Pen)
  • 1. Spyware / Keylogger
  • 2. Trojan
  • 3. Ransomware
  • 4. Worm
02 Introducing the New Objective & KWs

Context & Keywords

Learning Objective

To understand the mechanics and purpose of automated, technical attacks that target system vulnerabilities rather than human error.

Tier 3 Vocabulary (Click to flip):

Brute-Force Attack Click to enlarge

Using automated software to systematically try every single possible password combination until access is gained.

> Testing: aaaaaa [FAIL]
> Testing: aaaaab [FAIL]
> Testing: aaaaac [FAIL]
...10,000 tries later...
Click to close
Denial of Service (DoS) Click to enlarge

Flooding a server with an overwhelming number of data requests, using up all bandwidth so legitimate users are denied access.

----->
<--X

Real users get blocked out.

Click to close
Data Interception Click to enlarge

Also known as 'packet sniffing'. Intercepting data packets as they are transmitted across a network (e.g., over public Wi-Fi).

Packet
Click to close
SQL Injection Click to enlarge

Entering malicious database commands into a website's input form to manipulate the backend database, bypassing passwords or deleting data.

Username:

admin' OR 1=1 --

Tricks the database into thinking the login is always True.

Click to close
03 New Learning

Targeting the System

Unlike social engineering which targets human gullibility, technical attacks exploit the mathematical or architectural weaknesses of the system itself.

The DoS Analogy

Imagine a small corner shop that can only hold 10 customers at a time.

  • A hacker hires 1,000 people to walk into the shop and stand there doing nothing.
  • The shop is completely full.
  • When a legitimate customer tries to enter to buy something, they are denied access.

This is exactly what a Denial of Service attack does to a web server using fake data requests.

SQL Injection Concept

Websites use databases (controlled by SQL code) to check if your password is correct.

SELECT * FROM users
WHERE username = 'user_input'
AND password = 'password_input'

If a hacker types ' OR 1=1 -- into the username box, it rewrites the database's internal logic. Because 1 always equals 1, the database gets confused and logs them in without a password!

04 Application

Brute-Force & Exam Application

Brute-Force Time Estimator

Assuming 100 Billion Guesses / Sec

A brute-force script tries every possible combination of characters. Type a password below to see the mathematical reality of password complexity.

Time to Crack

0.00s

Total Combinations

0

Character Pool Size

0 characters

Task: Experiment with adding numbers, capital letters, and symbols. Write down in your Google Doc the shortest password you can create that takes over 100 years to crack.

Task 2: Exam Question

In your Google Doc, answer the following OCR exam question.

Identify what is meant by a SQL injection and explain how it can compromise a database. (3 Marks)

05 Consolidation

Plenary: Knowledge Audit

To finish the lesson, return to your master Google Doc. Copy and paste the 4 keywords below, and highlight them using the RAG (Red, Amber, Green) system to show your confidence level.

Red: Need Help Amber: Unsure Green: Confident
  • Brute-Force Attack
  • Denial of Service (DoS)
  • Data Interception
  • SQL Injection