In this technique, the attacker places an attack toolkit on their own system, and a copy of the attack toolkit is transferred to a newly discovered vulnerable system. The attack tools installed on the attacking machine use some special methods to accept a connection from the compromised system and then transfer a file containing the attack tools to it.

In this technique, the attacker places an attack toolkit on their own system, and a copy of the attack toolkit is transferred to a newly discovered vulnerable system. The attack tools installed on the attacking machine use some special methods to accept a connection from the compromised system and then transfer a file containing the attack tools to it.

• A. Back-chaining Propagation
• B. Central Source Propagation
• C. Hit-list Scanning
• D. Autonomous Propagation

Answer: (A)

Back-chaining propagation describes using a back-channel from the newly compromised host back to the attacker to deliver the next stage of the payload. In this scenario, the attacker keeps the toolkit on their own system and waits for a compromised system to reach out. When that host connects back, the attacker uses that connection to transfer the toolkit to the compromised machine, enabling it to spread to another vulnerable system. The essential idea is that the propagation path is driven by a connection initiated from the target back to the attacker, which is the “back channel” the term highlights. This fits the situation because the transfer of the attack toolkit relies on a connection initiated by the compromised system to the attacker, rather than the attacker pushing directly to victims without support from the target, which would be more like a central-source approach. It’s not about scanning a predefined list of targets (hit-list scanning) or a fully autonomous self-spreading worm (autonomous propagation); instead, it leverages the established back-channel to chain the attack from one host to the next.

Back-chaining propagation describes using a back-channel from the newly compromised host back to the attacker to deliver the next stage of the payload. In this scenario, the attacker keeps the toolkit on their own system and waits for a compromised system to reach out. When that host connects back, the attacker uses that connection to transfer the toolkit to the compromised machine, enabling it to spread to another vulnerable system. The essential idea is that the propagation path is driven by a connection initiated from the target back to the attacker, which is the “back channel” the term highlights.

This fits the situation because the transfer of the attack toolkit relies on a connection initiated by the compromised system to the attacker, rather than the attacker pushing directly to victims without support from the target, which would be more like a central-source approach. It’s not about scanning a predefined list of targets (hit-list scanning) or a fully autonomous self-spreading worm (autonomous propagation); instead, it leverages the established back-channel to chain the attack from one host to the next.