The Post-Connection Kill Chain

You're on the network. Now what?

Getting a foothold — cracking the WiFi, plugging into the LAN, landing on one box — is only the opening move. The impact a defender must worry about comes after: an intruder intercepting other people's traffic, delivering a payload, surviving reboots, and stepping deeper toward the crown jewels. This course covers that post-connection phase so you can recognize and stop it: understand it, model it safely, defend against it.

The post-connection chain has four moves once an attacker is on the wire:

1. Man-in-the-Middle (MITM) — position between a victim and their gateway (ARP spoofing), then read and rewrite traffic (sniffing, DNS spoofing).
2. Client-side delivery — when the server has no bug, the human is targeted: a backdoor disguised as a file or a fake update.
3. Post-exploitation — turning one foothold into lasting control: persistence and credential theft.
4. Pivoting — using one compromised box as a springboard to networks not reachable directly.

Every lesson ends with a defence section, because the point of understanding the attack is to shut it down.

Safe practice setup — your own isolated lab

Build a small, fully isolated virtual network that you own — a handful of VMs on a host-only network with no route to the internet or any real LAN. Snapshot them so you can revert. Model three neighbours to study, using documentation-only addresses (the 192.0.2.0/24 range):

192.0.2.2   web01    intranet + admin panel (HTTP Basic auth)
192.0.2.3   ssh01    SSH, weak credentials
192.0.2.4   cache01  Redis, password in a backup file

Useful open-source tools to install on your own analysis VM: nmap, tcpdump, tshark, dig/nslookup, redis-cli, python3, and ip/arp.

Solution (try the challenge first)

nmap -sn 192.0.2.0/24            # who's up
nmap -p80,22,6379 192.0.2.2-4   # what's listening
# web01(.2)=80 open, ssh01(.3)=22 open, cache01(.4)=6379 open

You now have the map. The rest of the course explains what sits on those ports and, for each attack, the detection and control that stops it — starting with how an attacker gets between hosts.