CompTIA PenTest+: key terms

Flashcards for this exam CompTIA PenTest+ guide Class dates

• Active ReconnaissanceGathering information by directly interacting with target systems, such as scanning or probing services.Foundational
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• Adversary EmulationTesting defenses by replicating the specific TTPs of a known threat actor.Advanced
• Android App SigningSigning Android apps with a developer key so the OS can verify app origin and ensure updates come from the same developer.Advanced
• Android KeystoreAn Android system that stores cryptographic keys in a container that makes them hard to extract, often backed by secure hardware.Intermediate
• Android Network Security ConfigurationAn XML file that declares an Android app's network security settings, such as cleartext policy, trusted CAs and certificate pins.Advanced
• Android Runtime PermissionsAndroid's model requiring apps to request dangerous permissions, such as location or camera, from the user at runtime.Foundational
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-TamperingControls that detect or resist modification of an application's code, resources or runtime behavior.Intermediate
• API Security TestingTesting APIs for authentication, authorization, input handling, rate limiting and business logic flaws, guided by the API specification.Intermediate
• App RepackagingDecompiling a legitimate app, modifying it (for example adding malware or removing checks), re-signing it and redistributing it.Intermediate
• App Transport Security (ATS)An iOS and macOS feature that requires apps to use HTTPS with strong TLS settings by default.Intermediate
• Assumed BreachA testing approach that starts with attacker access already inside the environment to focus on post-compromise detection and impact.Intermediate
• Attack NarrativeA chronological story in a pen test report describing how testers moved from initial access to their objective.Intermediate
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Authorization LetterWritten permission from an asset owner allowing testers to attack specified systems, sometimes called a get-out-of-jail-free letter.Foundational
• Black-Box TestingTesting with no prior knowledge of the target's internals, simulating an external attacker; CompTIA calls it unknown-environment testing.Foundational
• Blind Server-Side Request ForgerySSRF in which the attacker cannot see the response but can still make the server send requests.Advanced
• Blind SQL InjectionSQL injection where the application does not return query results or errors, so impact is inferred from behavior or timing.Intermediate
• Breach and Attack Simulation (BAS)Automated platforms that continuously run safe simulated attacks to validate whether security controls detect and block them.Intermediate
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Broken Authentication (API)API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.Intermediate
• Broken Function Level Authorization (BFLA)API5:2023, failure to restrict access to administrative or privileged functions based on the caller's role.Intermediate
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Broken Object Property Level Authorization (BOPLA)API3:2023, failure to restrict which object properties a user can read or modify, combining excessive data exposure and mass assignment.Intermediate
• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Burp SuiteA widely used web application security testing platform from PortSwigger built around an intercepting proxy.Intermediate
• Business Logic VulnerabilityA flaw in the design or workflow of an application that allows misuse of legitimate functionality.Intermediate
• CAPTCHAA challenge-response test intended to distinguish humans from automated bots.Foundational
• Capture the Flag (CTF)A security competition or training exercise in which participants solve challenges to find hidden 'flags'.Foundational
• CBESTThe Bank of England's intelligence-led penetration testing framework for UK financial institutions and critical market infrastructure.Advanced
• CensysAn internet-wide scanning and search platform for hosts, services and certificates.Intermediate
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Cobalt StrikeA commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.Advanced
• Code InjectionA flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.Intermediate
• Code ObfuscationTransforming code to make it harder to read and reverse engineer while preserving its behavior.Intermediate
• Command InjectionInjecting operating system commands through an application input that is passed to a system shell.Intermediate
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Compliance-Based Penetration TestingPenetration testing performed to satisfy a regulatory or standards requirement, such as PCI DSS or FedRAMP.Intermediate
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Continuous Automated Red Teaming (CART)Automated, ongoing simulation of attacker reconnaissance and attack paths against an organization's external attack surface.Advanced
• CORS MisconfigurationAn overly permissive CORS policy that lets untrusted origins read authenticated responses.Advanced
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Credentialed ScanA vulnerability scan that logs in to targets with valid credentials to assess installed software and configurations accurately.Foundational
• CRLF InjectionInjection of carriage return and line feed characters into data used in protocol headers or logs.Intermediate
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• Cross-Site Request Forgery (CSRF)An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.Intermediate
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• Cross-Site WebSocket Hijacking (CSWSH)A CSRF-like attack in which a malicious site opens a WebSocket to a target using the victim's cookies.Advanced
• Crowdsourced Security TestingEngaging many independent researchers through a managed platform to find vulnerabilities, via bug bounties or private vulnerability programs.Intermediate
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• CSV InjectionEmbedding spreadsheet formulas in data that is later exported to CSV and opened in a spreadsheet application.Advanced
• CVSS Base MetricsCVSS metrics describing a vulnerability's intrinsic exploitability and impact characteristics.Intermediate
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber RangeA controlled virtual environment that simulates networks, systems and applications for security training, testing and exercises.Foundational
• Dangling DNS RecordA DNS record that points to an IP address or cloud resource no longer owned or controlled by the organization.Intermediate
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• DCSyncAn attack that impersonates a domain controller to request password hashes from Active Directory via replication.Advanced
• Deauthentication AttackA wireless attack that sends forged 802.11 deauthentication frames to disconnect clients from an access point.Intermediate
• Debug Mode in ProductionLeaving framework debug features, consoles or verbose diagnostics enabled on production systems.Foundational
• DeconflictionThe process of distinguishing authorized testing activity from a real attack when defenders detect suspicious behavior.Intermediate
• Deep Link HijackingAbuse of custom URL schemes or unverified links so a malicious app receives links intended for another app.Advanced
• Default CredentialsFactory-set usernames and passwords on applications, devices or services that are publicly documented.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• Directory ListingA web server setting that displays a list of files in a directory when no index file is present.Foundational
• Directory TraversalAn attack that manipulates file paths with sequences like ../ to access files outside the intended directory.Foundational
• DNP3Distributed Network Protocol 3, an industrial protocol used mainly in electric and water utilities for communication between SCADA masters, RTUs and IEDs.Intermediate
• DNS EnumerationDiscovering hostnames, records and infrastructure details by querying a target's DNS.Foundational
• DNS RebindingA technique in which a domain's DNS answer changes between validation and use, so a host check passes but the request goes to an internal IP.Advanced
• DNS Zone Transfer (AXFR)A DNS mechanism for replicating zones between servers that, if allowed to anyone, leaks every record in a domain.Intermediate
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Evil TwinA malicious wireless access point that impersonates a legitimate SSID to lure clients into connecting.Foundational
• EvilginxAn adversary-in-the-middle phishing framework that proxies real login pages to capture credentials and session cookies, bypassing many MFA methods.Advanced
• Excessive Data ExposureAn API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.Intermediate
• Executive SummaryA short, non-technical section of a report summarizing overall risk, key findings and business impact for leadership.Foundational
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Exploit Prediction Scoring System (EPSS)A FIRST data-driven model estimating the probability that a CVE will be exploited in the wild within the next 30 days.Intermediate
• Exported Android ComponentAn Android activity, service, broadcast receiver or content provider that other apps can invoke.Advanced
• External Attack Surface Management (EASM)Continuous discovery and monitoring of an organization's internet-facing assets as an attacker would see them.Intermediate
• Firmware AnalysisExamining device firmware images to find vulnerabilities, hard-coded secrets, outdated components and insecure configurations.Advanced
• FootprintingThe process of collecting as much information as possible about a target organization to build a profile of its attack surface.Foundational
• Forced BrowsingDirectly requesting URLs or resources that are not linked in the application, to find unprotected pages or files.Foundational
• Format String VulnerabilityPassing user input as the format argument to functions such as printf, allowing memory reads or writes.Advanced
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Gadget ChainA sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, performs unintended actions.Advanced
• Generation-Based FuzzingFuzzing that builds test inputs from a model, grammar or specification of the expected input format.Intermediate
• Golden TicketA forged Kerberos TGT created with the KRBTGT account hash, granting unrestricted domain access.Advanced
• Google DorkingUsing advanced search engine operators to find sensitive information or vulnerable systems indexed by search engines.Foundational
• Google Hacking Database (GHDB)A curated collection of search engine queries that reveal sensitive information or vulnerable systems, hosted by Exploit-DB.Intermediate
• GophishAn open-source phishing framework for running and tracking authorized phishing campaigns.Intermediate
• GraphQL IntrospectionA GraphQL feature that lets clients query the full schema, which can disclose sensitive types and operations in production.Intermediate
• Gray-Box TestingTesting with partial knowledge of the target, such as user-level credentials or limited documentation; CompTIA's partially known environment.Foundational
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• HeartbleedA 2014 OpenSSL vulnerability (CVE-2014-0160) in the TLS heartbeat extension that let attackers read up to 64 KB of server memory per request.Foundational
• Host Header InjectionAbuse of an application's trust in the HTTP Host header to poison links, caches or routing.Advanced
• HTTP Request SmugglingExploiting disagreement between front-end and back-end servers about where an HTTP request ends, to hide a second request.Advanced
• HTTP Response SplittingAn attack using CRLF injection to make a server emit what a client or cache interprets as two separate HTTP responses.Advanced
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• Improper Credential UsageMobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.Foundational
• Improper Inventory ManagementAPI9:2023, failure to track API hosts, versions and endpoints, leaving old, debug or undocumented APIs exposed.Intermediate
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Insecure Communication (Mobile)Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.Foundational
• Insecure Data Storage (Mobile)Storing sensitive data on a mobile device in a way that other apps, backups or someone with physical access can read.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insecure Password RecoveryWeak account recovery flows that let attackers reset other users' passwords.Intermediate
• Insufficient Binary ProtectionsMobile Top 10 2024 risk (M7) where app binaries lack protections against reverse engineering and tampering.Intermediate
• Integer OverflowAn arithmetic result that exceeds the maximum value of its integer type and wraps around, often leading to undersized buffers.Advanced
• Intercepting ProxyA tool that sits between a browser or app and a server to capture, inspect and modify HTTP(S) traffic.Foundational
• iOS KeychainApple's encrypted storage service for small secrets such as passwords, tokens and keys on iOS and macOS.Intermediate
• JWT Algorithm ConfusionA JWT flaw where an attacker switches the token's algorithm (for example RS256 to HS256) so the server verifies it with the wrong key type.Advanced
• JWT None AlgorithmA JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.Advanced
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• Known Exploited Vulnerabilities Catalog (KEV)CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.Intermediate
• LDAP InjectionInjection that alters LDAP queries built from user input, potentially bypassing authentication or disclosing directory data.Intermediate
• Limit OverrunA race condition in which parallel requests exceed a business limit, such as redeeming a coupon more than once.Advanced
• Local File Inclusion (LFI)A vulnerability where an application includes or reads a local file whose path is controlled by user input.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• MaltegoA graphical link-analysis tool that maps relationships between people, domains, organizations and infrastructure for OSINT.Intermediate
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• Master Service Agreement (MSA)An umbrella contract setting the general legal terms for all future work between a client and a service provider.Foundational
• Metadata AnalysisExtracting hidden information such as usernames, software versions and paths from public documents and images.Intermediate
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• Mobile App AttestationPlatform services that let a backend verify a request came from a genuine, unmodified app on a genuine device.Advanced
• Mobile App SandboxOperating system isolation that restricts each mobile app to its own data and resources unless granted permissions.Foundational
• Mobile Security Framework (MobSF)An open-source automated tool for static and dynamic security analysis of Android and iOS applications.Intermediate
• ModbusA simple master/slave (client/server) industrial communication protocol created by Modicon in 1979, widely used to read and write PLC registers.Foundational
• MQTT SecurityProtecting the MQTT publish/subscribe messaging protocol widely used by IoT devices.Intermediate
• Mutation-Based FuzzingFuzzing that creates test inputs by randomly modifying valid sample inputs.Intermediate
• NessusA widely used commercial vulnerability scanner from Tenable that uses plugins to detect vulnerabilities and misconfigurations.Foundational
• NIST SP 800-115NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.Intermediate
• Non-Credentialed ScanA vulnerability scan performed without logging in, seeing only what is exposed over the network.Foundational
• Non-Disclosure Agreement (NDA)A legally binding contract that obligates parties to keep shared confidential information secret.Foundational
• NoSQL InjectionInjection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.Intermediate
• Open RedirectA flaw where an application redirects users to a URL supplied in a parameter without validation.Foundational
• Open Source Security Testing Methodology Manual (OSSTMM)A peer-reviewed security testing methodology from ISECOM focused on measurable, repeatable operational security testing.Intermediate
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• Out-of-Band Application Security Testing (OAST)Testing that detects blind vulnerabilities by observing callbacks, such as DNS or HTTP requests, from the target to a tester-controlled server.Advanced
• Out-of-Bounds ReadReading memory outside the bounds of an allocated buffer, which can leak sensitive data or crash a program.Advanced
• OWASP AmassAn OWASP project tool for in-depth attack surface mapping and subdomain discovery.Intermediate
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP IoT Top 10OWASP's 2018 list of the top security issues for Internet of Things devices and ecosystems.Foundational
• OWASP Mobile Application Security Testing Guide (MASTG)OWASP's comprehensive manual of techniques and test cases for verifying mobile apps against MASVS.Intermediate
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• Parameter TamperingModifying request parameters such as prices, quantities, IDs or hidden fields to change application behavior.Foundational
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Pass-the-Ticket (PtT)Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.Advanced
• Passive ReconnaissanceGathering information about a target without directly interacting with its systems.Foundational
• Penetration Test Planning and ScopingThe first phase of a penetration test, defining objectives, targets, constraints, rules of engagement and legal authorization.Foundational
• Penetration Test ReportThe final deliverable of a pen test, documenting methodology, findings, risk ratings, evidence and remediation recommendations.Foundational
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• Penetration Testing as a Service (PTaaS)A delivery model providing penetration testing through a platform that combines on-demand human testing, scanning and real-time findings.Intermediate
• Penetration Testing Execution Standard (PTES)A penetration testing methodology defining seven phases from pre-engagement interactions to reporting.Intermediate
• Penetration Testing PhasesThe typical sequence of a penetration test: planning and scoping, reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting.Foundational
• Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
• Physical Penetration TestingTesting the effectiveness of physical security controls by attempting unauthorized entry to facilities.Intermediate
• PivotingUsing a compromised system as a relay to reach other networks or hosts that are not directly accessible to the tester or attacker.Intermediate
• Post-Engagement CleanupRemoving all tools, accounts, shells, files and configuration changes introduced during testing.Foundational
• Post-ExploitationThe pentest phase after initial compromise that assesses what an attacker could achieve, such as privilege escalation, lateral movement and data access.Intermediate
• PretextingCreating a fabricated scenario or identity to persuade a target to disclose information or take an action.Foundational
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Proof of Concept (PoC)A demonstration that a vulnerability is real and exploitable, used to validate findings and prioritize remediation.Foundational
• Race ConditionA flaw where the outcome depends on the timing of events, allowing attackers to exploit the gap between operations.Advanced
• Recon-ngA modular, Metasploit-like command-line framework for web-based OSINT reconnaissance.Intermediate
• ReconnaissanceThe information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.Foundational
• Red TeamA group that emulates real adversaries to test an organization's detection and response capabilities.Foundational
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Remediation RetestA follow-up test verifying that previously reported vulnerabilities have been properly fixed.Foundational
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Remote File Inclusion (RFI)A vulnerability where an application includes and executes a file from a remote URL supplied by the user.Intermediate
• Return-Oriented Programming (ROP)A code-reuse exploitation technique that chains short existing instruction sequences ending in return instructions to bypass non-executable memory.Advanced
• RFID Badge CloningCopying the data from an access badge's RFID credential to create a working duplicate.Intermediate
• Root and Jailbreak DetectionMobile app checks that determine whether a device has been rooted (Android) or jailbroken (iOS), indicating weakened platform security.Intermediate
• Rules of Engagement (RoE)The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.Foundational
• Safe HarborA commitment in a disclosure policy not to pursue legal action against researchers acting in good faith within the stated rules.Intermediate
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• ScopeThe defined boundaries of an engagement: which assets, locations, techniques and time frames are included or excluded.Foundational
• Scope CreepUncontrolled growth of an engagement's scope beyond what was originally agreed.Foundational
• Screen Capture ProtectionMobile controls that prevent sensitive screens from appearing in screenshots, screen recordings or the app switcher.Advanced
• Second-Order SQL InjectionSQL injection in which malicious input is stored safely first and later used unsafely in another query.Advanced
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• security.txtA standard file (RFC 9116) placed at /.well-known/security.txt that tells researchers how to report security vulnerabilities to an organization.Intermediate
• Segmentation TestingTesting that verifies network segmentation controls actually isolate sensitive zones from other networks.Intermediate
• Server-Side Request Forgery (SSRF)An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.Advanced
• Server-Side Template Injection (SSTI)A vulnerability where user input is embedded into a server-side template as template code rather than data, potentially leading to remote code execution.Advanced
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Session ID in URLPassing session tokens in URL query strings or paths, which exposes them in logs, history and Referer headers.Foundational
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• ShodanA search engine that indexes internet-connected devices and their service banners.Foundational
• Silver TicketA forged Kerberos service ticket created with a service account's hash to access a specific service.Advanced
• Social Engineering Penetration TestingAssessing human susceptibility to manipulation through phishing, vishing, pretexting and physical impersonation.Foundational
• Social-Engineer Toolkit (SET)An open-source Python framework by TrustedSec for social engineering attacks such as credential harvesting and malicious payload delivery.Intermediate
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• SpiderFootAn automated OSINT tool that queries over 200 data sources to map a target's attack surface.Intermediate
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• Stack CanaryA random value placed before the return address on the stack and checked before a function returns, detecting stack buffer overflows.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Statement of Work (SOW)A contract document detailing the specific deliverables, timeline, scope and cost of a particular engagement.Foundational
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• Subdomain EnumerationDiscovering subdomains of a target domain to expand the known attack surface.Foundational
• Subdomain TakeoverGaining control of a subdomain whose DNS record points to a deprovisioned external resource, such as a deleted cloud bucket or app.Intermediate
• Symbolic Link AttackExploiting a privileged process that follows an attacker-created symbolic link to read or overwrite a protected file.Advanced
• TailgatingGaining physical access by following an authorized person through a secured entrance without their knowledge.Foundational
• theHarvesterAn OSINT tool that gathers emails, subdomains, hosts and names from public sources such as search engines and certificate logs.Foundational
• Threat-Led Penetration Testing (TLPT)An intelligence-driven red team test that emulates the tactics of real threat actors relevant to an organization against live production systems.Advanced
• TIBER-EUThe European Central Bank's framework for Threat Intelligence-Based Ethical Red teaming of financial institutions.Advanced
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• Unrestricted Access to Sensitive Business FlowsAPI6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.Intermediate
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unrestricted Resource ConsumptionAPI4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.Intermediate
• Unsafe Consumption of APIsAPI10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.Intermediate
• Use-After-Free (UAF)Using a pointer to memory after it has been freed, which may now hold attacker-controlled data.Advanced
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• Wayback MachineThe Internet Archive's service storing historical snapshots of websites, useful for finding removed content.Foundational
• Web Cache DeceptionTricking a cache into storing a victim's private, authenticated page by making it look like a static resource.Advanced
• Web Cache PoisoningCausing a cache to store a malicious response that is then served to other users.Advanced
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• WebView SecuritySecure configuration of embedded browser components in mobile apps to prevent XSS escalation and data exposure.Advanced
• White TeamThe group that oversees a red team or cyber exercise, setting rules, refereeing, scoring and ensuring safety.Foundational
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational
• WHOISA query protocol and database that returns registration details for domain names and IP address blocks.Foundational
• X-Frame-Options (XFO)A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.Foundational
• XML BombA small XML document using nested entity expansion to consume huge amounts of memory and crash the parser.Advanced
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• XPath InjectionInjection that modifies XPath queries against XML data by inserting crafted input.Advanced
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• Zip BombA small compressed archive that expands to an enormous size to exhaust disk, memory or CPU during decompression.Advanced
• Zip SlipA path traversal vulnerability in archive extraction where entries with ../ in their names are written outside the target directory.Advanced