The Art of Attack

Chapter 4The Laws

Let all your efforts be directed to something, let [your mind] keep that end in view.

—Seneca

There are four laws of the attacker mindset. They are all heavily interlaced and interdependent. In this chapter, we will look at them and explore how to use them effectively.

Law 1: Start with the End in Mind

Assuming you already have a contract and a contact in place, there's really only one correct place to start an attack—at the end. To start with the end in mind is the first law of AMs. But doing so is material to how the rest of the skills are used, too. You cannot blindly point to information about anyone on anything and then build and execute an attack. You need to know a couple of points to start: who you are attacking and to what end. The “who” is generally solved for you—the client typically approaches you or you will sell your services to them. Either the “what end” is defined by the client—who will know what they wish to protect but want to know how easily it can be accessed or destroyed—or the client will not define their assets as such, asking you to simply penetrate their defenses as deeply as you can.

Given that, there's an almost infinite list of objectives to be achieved for an impossibly large list of businesses the world over, so I won't try to list them all. But most often for a security professional, the items most likely on the list of objectives will be (a) gaining information or (b) gaining access to an asset. So, with those goals in mind, ...