Cybersecurity S1 — Cheatsheet

DDoS, TLS/SSH, IDS/NDR, WAF, SIEM, IAM, VPN, DNS and Metasploit — 2025–2026

---

Table of Contents

• Denial of Service
• SSH, TLS and Port Forwarding
• IDS, IPS, GeoIP and NDR
• SQL Injection, XSS and WAF
• SIEM, XDR and Wazuh
• Windows IAM Hardening
• VPN
• DNS Security
• Information Security in M365
• SASE and SSE
• Metasploit

---

Denial of Service

DoS impacts availability; DDoS uses many distributed sources.

Type	Example	Target resource
Volumetric	UDP flood, amplification	bandwidth
Protocol/state exhaustion	SYN flood	firewalls/load balancers/TCP state
Application-layer	HTTP request flood	threads, CPU, database

Reflection abuses a third-party server; amplification returns a larger response than the request. Source IP spoofing makes reflection possible.

Countermeasures: anti-spoofing (BCP 38), rate limiting, SYN cookies, connection limits, caching/CDN/Anycast, upstream scrubbing, autoscaling and application-specific detection.

Just blocking IPs

In a DDoS, sources are numerous or spoofed. Manually blocking individual IPs doesn't scale and can affect legitimate users.

Capture analysis

Look for anomalies in packets/second, bytes/second, protocol distribution, sources, TCP flags, incomplete handshakes and response/request ratio. A spike is only suspicious relative to a baseline and context.

---

SSH, TLS and Port Forwarding

SSH key authentication

ssh-keygen -t ed25519
ssh-copy-id user@server
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@server

Protect the private key with permissions and a passphrase. Verify the host key; simply wiping known_hosts to bypass a mismatch can hide a MITM attack.

SSH tunnels

ssh -L 8080:internal:80 user@gateway     # local forwarding
ssh -R 2222:localhost:22 user@gateway    # remote forwarding
ssh -D 1080 user@gateway                 # SOCKS proxy

-L: a local listening port reaches a destination via the server. -R: a remote listening port comes back to the local side through SSH. Restrict bind addresses and server settings to avoid unwanted pivots.

TLS

TLS provides confidentiality, integrity and authentication. The handshake negotiates version/cipher, validates the certificate and derives session keys. TLS 1.3 uses modern AEAD ciphers and (EC)DHE for forward secrecy.

openssl s_client -connect host:443 -servername host
openssl x509 -in cert.pem -text -noout

Check SAN/hostname, chain, expiration, signature algorithm, protocol version and revocation policy.

---

IDS, IPS, GeoIP and NDR

System	Position/function
IDS	detects and alerts, often out-of-band
IPS	inline; can block
NDR	analyzes network behavior and metadata
EDR	endpoint telemetry and response

Detection methods:

• signatures: precise for known patterns, misses variants;
• anomaly/behavior: finds deviations, needs a baseline and tuning;
• protocol analysis: validates protocol behavior.

True/false positive and true/false negative determine usefulness. More alerts doesn't automatically mean better detection.

GeoIP is indicative: VPNs, cloud, mobile providers and databases make geolocation uncertain. Use location as a risk signal, not as conclusive proof.

---

SQL Injection, XSS and WAF

SQL injection

Occurs when untrusted input becomes part of query syntax.

# safe concept: parameterized query
cursor.execute("SELECT * FROM users WHERE name = ?", (name,))

Countermeasures: prepared statements, server-side validation, a least-privileged DB account, safe error messages and logging. Escaping or a WAF alone is not a fundamental fix.

XSS

Type	Where the payload lives
Reflected	request and immediate response
Stored	persisted in application/data
DOM-based	client-side DOM/JavaScript

Countermeasures: context-aware output encoding, safe templating, sanitization for allowed HTML, CSP, HttpOnly/Secure/SameSite cookies and avoiding dangerous DOM sinks.

WAF

A WAF inspects HTTP(S), uses signatures/anomaly rules and can block, log or rate-limit. Placement in front of the application provides virtual patching and visibility, but tuning and TLS termination are needed.

WAF ≠ code fix

The vulnerability still exists. Fix the application and use the WAF as an additional layer.

---

SIEM, XDR and Wazuh

sources → collection → parsing/normalization → enrichment → correlation → alert/case → response

Term	Function
SIEM	central logs, search, correlation, compliance
SOAR	workflows and automated response
XDR	correlation/response across endpoint, identity, mail, cloud, network
Wazuh	open security platform with agents, rules and dashboards

A detection rule contains a data source, logic, time window, severity, mapping, exceptions and a response playbook. Start with use cases and the logs you actually need, not with "collect everything".

Wazuh

Core components: agents, manager, indexer and dashboard. Decoders recognize structure; rules evaluate events. Check agent enrollment/connectivity, time synchronization, ingestion, decoder/rule match and index/dashboard.

Retention

More logs increase storage, cost and privacy risk. Determine purpose, retention period and access control per source.

---

Windows IAM Hardening

Major AD attack paths arise from overly broad privileges, weak service accounts, poor ACLs, legacy authentication and credential exposure.

• separate admin accounts and tiering;
• minimal membership in privileged groups;
• Windows LAPS;
• gMSA for services;
• restrict/monitor NTLM and unconstrained delegation;
• protect admin hosts and remote admin;
• audit group/ACL/GPO changes;
• patch DCs and make tested System State backups.

Tools and interpretation

PingCastle assesses AD risk and maturity; BloodHound models relationships and attack paths. A path is not proof of exploitation, but it shows combinations of rights that can lead to control. Use such tools only within explicit scope and treat output as sensitive data.

Evilginx demonstrates adversary-in-the-middle phishing that can steal session tokens. Phishing-resistant MFA such as FIDO2/passkeys offers stronger protection than OTP/push alone.

---

VPN

Type	Use
Site-to-site	permanently connecting networks
Remote access/client-to-site	individual client to organization
Full tunnel	all client traffic via VPN
Split tunnel	only selected routes via VPN

IPsec uses IKE for authentication/key management and ESP for protected data. Tunnel mode protects the entire original IP packet; transport mode mainly the payload.

Configuration must match in proposals, DH group, authentication, traffic selectors, lifetimes and routes. NAT-T wraps ESP in UDP/4500 when NAT is present.

Diagnosis

1. Is the peer reachable and is UDP 500/4500 allowed?
2. Does IKE/security association succeed?
3. Do local/remote subnets match?
4. Do outbound and return routes exist?
5. Are firewall/NAT exemptions correct?
6. Does the encrypt/decrypt counter increase with test traffic?

---

DNS Security

Threats: spoofing/cache poisoning, tunneling, amplification, malicious domains, hijacking and privacy tracking.

Technique	Protects
DNSSEC	authenticity/integrity of DNS data
DoT	DNS transport encrypted via TLS/853
DoH	DNS via HTTPS/443
Filtering/RPZ	blocking malicious/unwanted domains
QNAME minimization	sharing less query information

DNSSEC does not encrypt queries and doesn't guarantee a domain is safe. DoH/DoT protect transport but can bypass local filtering and visibility if endpoints choose their own resolvers.

Split-horizon DNS gives internal and external clients different answers. Secure dynamic updates, zone transfers and registrar accounts; monitor new/unusual domains and unusual query patterns.

---

Information Security in M365

Microsoft Purview Information Protection uses sensitivity labels for classification and optional content marking, encryption and access restriction. Data Loss Prevention detects sensitive information types and applies policies across Exchange, SharePoint, OneDrive, Teams and endpoints.

Component	Purpose
Sensitivity labels	classify and protect
Retention labels/policies	retain or delete according to lifecycle
DLP	prevent unwanted sharing/leaks
eDiscovery/Audit	investigation and evidence
Insider Risk	correlate risky user signals

Start with audit/test mode, measure false positives, inform users and design exception/override processes. Labeling and retention are different concepts.

---

SASE and SSE

SASE combines WAN connectivity with cloud-delivered security. SSE is the security subset without SD-WAN.

SASE = SD-WAN + SSE
SSE  = SWG + CASB + ZTNA + FWaaS (depending on vendor)

• SWG secures web traffic.
• CASB provides visibility/control over SaaS and cloud apps.
• ZTNA provides application-focused access based on identity/device/context.
• Defender for Cloud Apps is a CASB component for discovery, app governance, session controls and policy enforcement.

Zero Trust: verify explicitly, least privilege and assume breach; it is an architecture principle, not a single product.

---

Metasploit

Use only in an authorized lab and within scope.

Module	Function
exploit	abuses a vulnerability
payload	code after successful exploitation
auxiliary	scan, fuzz, brute-force, service action
post	post-exploitation
encoder/nop	payload support, not a magic antivirus bypass

msfconsole
search <product/cve>
info <module>
use <module>
show options
set RHOSTS <lab-target>
set LHOST <lab-interface>
check
run
sessions

Workflow: confirm scope → validate target/service/version → read module documentation → choose safe options/payload → check → execute → document evidence and impact → cleanup/restore.

Exploitation can disrupt

Even a check or a scanner can crash a vulnerable service. Use snapshots/backups, minimal intensity and explicit authorization.