EC-Council Certified Ethical Hacker (C|EH): key terms

Flashcards for this exam EC-Council Certified Ethical Hacker (C|EH) guide Class dates

• Active ReconnaissanceGathering information by directly interacting with target systems, such as scanning or probing services.Foundational
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• AdwareSoftware that displays unwanted advertisements, often bundled with free applications.Foundational
• Alternate Data Stream (ADS)An NTFS feature allowing additional data streams to be attached to a file, which can hide data or malicious code.Advanced
• Amplification AttackA DDoS technique that sends small spoofed requests to services that return much larger responses to the victim.Intermediate
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• ARP PoisoningSending forged ARP replies to associate the attacker's MAC address with another host's IP, redirecting LAN traffic.Intermediate
• Attack TreeA hierarchical diagram with an attacker's goal at the root and the alternative ways to achieve it as child nodes.Intermediate
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Authorization LetterWritten permission from an asset owner allowing testers to attack specified systems, sometimes called a get-out-of-jail-free letter.Foundational
• BackdoorA hidden method of bypassing normal authentication or security controls to access a system.Foundational
• BaitingA social engineering attack that leaves an enticing item, such as an infected USB drive, for a victim to use.Foundational
• Banking TrojanA trojan designed to steal online banking credentials and manipulate financial transactions.Intermediate
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• Birthday AttackCryptographic attack exploiting the birthday paradox to find hash collisions in about the square root of the output space.Intermediate
• Black-Box TestingTesting with no prior knowledge of the target's internals, simulating an external attacker; CompTIA calls it unknown-environment testing.Foundational
• Blind SQL InjectionSQL injection where the application does not return query results or errors, so impact is inferred from behavior or timing.Intermediate
• BluesnarfingUnauthorized access to data on a Bluetooth-enabled device, such as contacts, messages or files.Foundational
• BootkitA rootkit that infects the boot process, such as the MBR, VBR or UEFI firmware, to load before the operating system.Advanced
• BotnetA network of compromised devices remotely controlled by an attacker to perform coordinated tasks.Foundational
• Brand ImpersonationMimicking a trusted company's name, logo and communications to deceive victims.Foundational
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Brute Force AttackSystematically trying all possible passwords or keys until the correct one is found.Foundational
• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Burp SuiteA widely used web application security testing platform from PortSwigger built around an intercepting proxy.Intermediate
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Capture the Flag (CTF)A security competition or training exercise in which participants solve challenges to find hidden 'flags'.Foundational
• CensysAn internet-wide scanning and search platform for hosts, services and certificates.Intermediate
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• Command InjectionInjecting operating system commands through an application input that is passed to a system shell.Intermediate
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Credential HarvestingCollecting usernames and passwords from victims, usually through fake login pages or malware.Foundational
• Credential StuffingAutomated use of username-password pairs leaked from one breach to log in to other services.Intermediate
• CRLF InjectionInjection of carriage return and line feed characters into data used in protocol headers or logs.Intermediate
• Cross-Site Request Forgery (CSRF)An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.Intermediate
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• CryptojackingUnauthorized use of a victim's computing resources to mine cryptocurrency.Foundational
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Deauthentication AttackA wireless attack that sends forged 802.11 deauthentication frames to disconnect clients from an access point.Intermediate
• DeepfakeSynthetic audio, video or images generated with AI to convincingly impersonate a real person.Intermediate
• Default CredentialsFactory-set usernames and passwords on applications, devices or services that are publicly documented.Foundational
• Denial of Service (DoS)An attack that makes a system or network unavailable to legitimate users by exhausting resources or crashing services.Foundational
• Dictionary AttackA password attack that tries words from a list of common passwords and dictionary terms.Foundational
• Directory ListingA web server setting that displays a list of files in a directory when no index file is present.Foundational
• Directory TraversalAn attack that manipulates file paths with sequences like ../ to access files outside the intended directory.Foundational
• DisinformationDeliberately false or misleading information spread to deceive, often as part of an influence campaign.Foundational
• Distributed Denial of Service (DDoS)A denial-of-service attack launched from many sources, often a botnet, to overwhelm a target.Foundational
• DLL InjectionForcing a running process to load a malicious dynamic-link library.Advanced
• DNS AmplificationA reflected DDoS attack that abuses open DNS resolvers to send large responses to a spoofed victim address.Intermediate
• DNS Cache PoisoningInserting false records into a DNS resolver's cache so users are directed to malicious IP addresses.Intermediate
• DNS EnumerationDiscovering hostnames, records and infrastructure details by querying a target's DNS.Foundational
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• DNS Zone Transfer (AXFR)A DNS mechanism for replicating zones between servers that, if allowed to anyone, leaks every record in a domain.Intermediate
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Domain Generation Algorithm (DGA)An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.Advanced
• Domain HijackingTaking unauthorized control of a domain registration, often by compromising the registrar account.Intermediate
• Downgrade AttackForcing a system to use an older, weaker protocol or cipher version that the attacker can exploit.Intermediate
• DREADA threat risk-rating model scoring Damage, Reproducibility, Exploitability, Affected users and Discoverability.Intermediate
• Drive-by DownloadAn unintended download of malicious code that occurs simply by visiting a compromised or malicious website.Foundational
• DropperMalware whose purpose is to install another malicious payload that it carries within itself.Intermediate
• Dumpster DivingSearching trash for discarded information or media that can aid an attack.Foundational
• Dynamic Malware AnalysisExecuting malware in a controlled environment to observe its behavior, network activity and system changes.Intermediate
• EmotetA modular malware family that evolved from a banking trojan into a major spam-distributed loader for other malware.Intermediate
• Evil TwinA malicious wireless access point that impersonates a legitimate SSID to lure clients into connecting.Foundational
• Executive SummaryA short, non-technical section of a report summarizing overall risk, key findings and business impact for leadership.Foundational
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Exploit KitA toolkit hosted on malicious or compromised websites that automatically probes visitors' browsers for vulnerabilities and delivers malware.Intermediate
• Fast FluxA DNS technique that rapidly changes the IP addresses associated with a domain to hide malicious infrastructure.Advanced
• Fileless MalwareMalware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.Intermediate
• FootprintingThe process of collecting as much information as possible about a target organization to build a profile of its attack surface.Foundational
• Forced BrowsingDirectly requesting URLs or resources that are not linked in the application, to find unprotected pages or files.Foundational
• Format String VulnerabilityPassing user input as the format argument to functions such as printf, allowing memory reads or writes.Advanced
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Golden TicketA forged Kerberos TGT created with the KRBTGT account hash, granting unrestricted domain access.Advanced
• Google DorkingUsing advanced search engine operators to find sensitive information or vulnerable systems indexed by search engines.Foundational
• Google Hacking Database (GHDB)A curated collection of search engine queries that reveal sensitive information or vulnerable systems, hosted by Exploit-DB.Intermediate
• GophishAn open-source phishing framework for running and tracking authorized phishing campaigns.Intermediate
• Gray-Box TestingTesting with partial knowledge of the target, such as user-level credentials or limited documentation; CompTIA's partially known environment.Foundational
• HacktivistA threat actor who attacks to promote a political, social or ideological cause rather than for profit.Foundational
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• HeartbleedA 2014 OpenSSL vulnerability (CVE-2014-0160) in the TLS heartbeat extension that let attackers read up to 64 KB of server memory per request.Foundational
• HoneynetA network of honeypots that simulates a realistic environment to observe attacker behavior.Foundational
• HoneypotA decoy system designed to attract attackers, detect intrusion attempts and study their techniques.Foundational
• HoneytokenA fake credential, record or data item planted to detect unauthorized access or use.Intermediate
• HTTP Response SplittingAn attack using CRLF injection to make a server emit what a client or cache interprets as two separate HTTP responses.Advanced
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• ImpersonationPretending to be another person or role, such as an executive, technician or vendor, to gain trust or access.Foundational
• IMSI CatcherA fake cellular base station that tricks phones into connecting to capture identities or intercept traffic.Advanced
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Integer OverflowAn arithmetic result that exceeds the maximum value of its integer type and wraps around, often leading to undersized buffers.Advanced
• Intercepting ProxyA tool that sits between a browser or app and a server to capture, inspect and modify HTTP(S) traffic.Foundational
• IP SpoofingForging the source IP address of packets to hide the sender's identity or impersonate another system.Intermediate
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• Key Reinstallation Attack (KRACK)2017 attack that tricks clients into reinstalling an in-use key, resetting nonces and enabling decryption.Advanced
• KeyloggerSoftware or hardware that records keystrokes to capture passwords and other sensitive input.Foundational
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• LDAP InjectionInjection that alters LDAP queries built from user input, potentially bypassing authentication or disclosing directory data.Intermediate
• Lightweight Extensible Authentication Protocol (LEAP)A legacy Cisco proprietary EAP method using unprotected MS-CHAP that is vulnerable to dictionary attacks.Intermediate
• Local File Inclusion (LFI)A vulnerability where an application includes or reads a local file whose path is controlled by user input.Intermediate
• Logic BombMalicious code that lies dormant until a specific condition, such as a date or event, triggers its payload.Foundational
• MAC FloodingOverwhelming a switch's MAC address table with fake entries so it floods frames to all ports like a hub.Intermediate
• Macro VirusA virus written in a macro language, such as VBA, embedded in documents and executed when the document is opened.Foundational
• MaltegoA graphical link-analysis tool that maps relationships between people, domains, organizations and infrastructure for OSINT.Intermediate
• MalvertisingThe use of online advertising to deliver malware or redirect users to malicious sites.Intermediate
• MalwareMalicious software designed to damage, disrupt, spy on or gain unauthorized access to systems or data.Foundational
• Malware SandboxAn isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.Intermediate
• Man-in-the-Browser (MitB)An attack in which malware inside the browser intercepts and modifies web content and transactions.Intermediate
• Memory InjectionInserting malicious code into the memory space of a running process to execute it under that process's context.Advanced
• Metadata AnalysisExtracting hidden information such as usernames, software versions and paths from public documents and images.Intermediate
• Metamorphic MalwareMalware that rewrites its own code on each propagation so no two copies share the same instructions.Advanced
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• MiraiAn IoT botnet malware family that spreads by logging in to devices with default credentials and launches massive DDoS attacks.Intermediate
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• ModbusA simple master/slave (client/server) industrial communication protocol created by Modicon in 1979, widely used to read and write PLC registers.Foundational
• NessusA widely used commercial vulnerability scanner from Tenable that uses plugins to detect vulnerabilities and misconfigurations.Foundational
• Non-Disclosure Agreement (NDA)A legally binding contract that obligates parties to keep shared confidential information secret.Foundational
• NoSQL InjectionInjection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• On-Path AttackAn attack in which the adversary positions themselves between two communicating parties to intercept or alter traffic.Foundational
• Open RedirectA flaw where an application redirects users to a URL supplied in a parameter without validation.Foundational
• Open Source Security Testing Methodology Manual (OSSTMM)A peer-reviewed security testing methodology from ISECOM focused on measurable, repeatable operational security testing.Intermediate
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• OWASP AmassAn OWASP project tool for in-depth attack surface mapping and subdomain discovery.Intermediate
• OWASP IoT Top 10OWASP's 2018 list of the top security issues for Internet of Things devices and ecosystems.Foundational
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• PackerA HashiCorp tool that builds identical machine images for multiple platforms from a single HCL template.Intermediate
• Pairwise Master Key Identifier (PMKID)A hash identifying a cached PMK, used in fast roaming and exploitable for clientless WPA2-PSK cracking.Advanced
• Parameter TamperingModifying request parameters such as prices, quantities, IDs or hidden fields to change application behavior.Foundational
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Pass-the-Ticket (PtT)Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.Advanced
• Passive ReconnaissanceGathering information about a target without directly interacting with its systems.Foundational
• Password SprayingTrying a few common passwords against many accounts to avoid lockout thresholds.Intermediate
• Penetration Test Planning and ScopingThe first phase of a penetration test, defining objectives, targets, constraints, rules of engagement and legal authorization.Foundational
• Penetration Test ReportThe final deliverable of a pen test, documenting methodology, findings, risk ratings, evidence and remediation recommendations.Foundational
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• Penetration Testing Execution Standard (PTES)A penetration testing methodology defining seven phases from pre-engagement interactions to reporting.Intermediate
• Penetration Testing PhasesThe typical sequence of a penetration test: planning and scoping, reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting.Foundational
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• PharmingRedirecting users from a legitimate website to a fraudulent one by manipulating DNS or host files.Intermediate
• PhishingA social engineering attack using fraudulent messages, typically email, to steal credentials, deliver malware or induce payments.Foundational
• Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
• Physical Penetration TestingTesting the effectiveness of physical security controls by attempting unauthorized entry to facilities.Intermediate
• PiggybackingEntering a secure area with the consent of an authorized person who lets the intruder in.Foundational
• PivotingUsing a compromised system as a relay to reach other networks or hosts that are not directly accessible to the tester or attacker.Intermediate
• Polymorphic MalwareMalware that changes its code appearance with each infection, often through encryption, to evade signature detection.Intermediate
• Post-Engagement CleanupRemoving all tools, accounts, shells, files and configuration changes introduced during testing.Foundational
• Post-ExploitationThe pentest phase after initial compromise that assesses what an attacker could achieve, such as privilege escalation, lateral movement and data access.Intermediate
• Potentially Unwanted Program (PUP)Software that is not clearly malicious but is unwanted, often installed through bundling, such as toolbars or adware.Foundational
• PretextingCreating a fabricated scenario or identity to persuade a target to disclose information or take an action.Foundational
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Process for Attack Simulation and Threat Analysis (PASTA)A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.Intermediate
• Programmable Logic Controller (PLC)A ruggedized industrial computer that reads inputs from sensors and controls outputs to machinery according to a stored program.Foundational
• Proof of Concept (PoC)A demonstration that a vulnerability is real and exploitable, used to validate findings and prioritize remediation.Foundational
• Quid Pro QuoA social engineering attack that offers a service or benefit in exchange for information or access.Foundational
• QuishingPhishing that uses QR codes to direct victims to malicious websites.Intermediate
• Race ConditionA flaw where the outcome depends on the timing of events, allowing attackers to exploit the gap between operations.Advanced
• Rainbow TableA precomputed table of hash values used to rapidly reverse unsalted password hashes.Intermediate
• RansomwareMalware that encrypts or locks a victim's data or systems and demands payment for restoration.Foundational
• Recon-ngA modular, Metasploit-like command-line framework for web-based OSINT reconnaissance.Intermediate
• ReconnaissanceThe information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.Foundational
• Red TeamA group that emulates real adversaries to test an organization's detection and response capabilities.Foundational
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Remediation RetestA follow-up test verifying that previously reported vulnerabilities have been properly fixed.Foundational
• Remote Access Trojan (RAT)A trojan that gives an attacker covert remote administrative control over an infected system.Foundational
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Remote File Inclusion (RFI)A vulnerability where an application includes and executes a file from a remote URL supplied by the user.Intermediate
• Replay AttackCapturing valid data transmissions, such as authentication tokens, and retransmitting them to gain unauthorized access.Intermediate
• Return-Oriented Programming (ROP)A code-reuse exploitation technique that chains short existing instruction sequences ending in return instructions to bypass non-executable memory.Advanced
• Reverse EngineeringAnalyzing software to understand its design and behavior, typically by disassembling or decompiling compiled code.Advanced
• RFID Badge CloningCopying the data from an access badge's RFID credential to create a working duplicate.Intermediate
• Rogue Access PointAn unauthorized wireless access point connected to a network, bypassing perimeter security.Foundational
• RootkitMalware that hides its presence and other malicious activity by subverting the operating system at a deep level.Intermediate
• Rules of Engagement (RoE)The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.Foundational
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• Sandbox EvasionTechniques malware uses to detect analysis environments and alter or delay its behavior to avoid detection.Advanced
• ScarewareSoftware or pop-ups that use fear of infection to trick users into buying fake security products or installing malware.Foundational
• ScopeThe defined boundaries of an engagement: which assets, locations, techniques and time frames are included or excluded.Foundational
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Server-Side Request Forgery (SSRF)An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.Advanced
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• ShodanA search engine that indexes internet-connected devices and their service banners.Foundational
• Shoulder SurfingObserving someone's screen or keyboard to obtain sensitive information such as passwords or PINs.Foundational
• SIM SwappingFraudulently transferring a victim's phone number to an attacker-controlled SIM to intercept calls and SMS codes.Intermediate
• SmishingPhishing conducted through SMS or other text messaging.Foundational
• Social EngineeringManipulating people into revealing information, granting access or performing actions that compromise security.Foundational
• Social Engineering Penetration TestingAssessing human susceptibility to manipulation through phishing, vishing, pretexting and physical impersonation.Foundational
• Social Engineering PrinciplesThe psychological levers attackers use to persuade victims, such as authority, urgency, scarcity, trust and consensus.Foundational
• Social-Engineer Toolkit (SET)An open-source Python framework by TrustedSec for social engineering attacks such as credential harvesting and malicious payload delivery.Intermediate
• Spear PhishingA targeted phishing attack crafted for a specific individual or group using personal or organizational details.Foundational
• SpiderFootAn automated OSINT tool that queries over 200 data sources to map a target's attack surface.Intermediate
• SpoofingPretending to be another user, system or component in order to gain its access or trust.Foundational
• SpywareMalware that secretly monitors user activity and collects information without consent.Foundational
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• SSL StrippingAn on-path attack that downgrades a user's HTTPS connection to HTTP so traffic can be read in clear text.Intermediate
• Stack CanaryA random value placed before the return address on the stack and checked before a function returns, detecting stack buffer overflows.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Statement of Work (SOW)A contract document detailing the specific deliverables, timeline, scope and cost of a particular engagement.Foundational
• Static Malware AnalysisExamining a malware sample without executing it, using file properties, strings, headers and disassembly.Intermediate
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• StuxnetA sophisticated worm discovered in 2010 that sabotaged Iranian uranium enrichment centrifuges by manipulating PLCs.Intermediate
• Subdomain EnumerationDiscovering subdomains of a target domain to expand the known attack surface.Foundational
• Supervisory Control and Data Acquisition (SCADA)An ICS architecture for monitoring and controlling geographically dispersed assets from a central location.Foundational
• SYN FloodA DoS attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table.Foundational
• TailgatingGaining physical access by following an authorized person through a secured entrance without their knowledge.Foundational
• theHarvesterAn OSINT tool that gathers emails, subdomains, hosts and names from public sources such as search engines and certificate logs.Foundational
• Threat VectorThe path or means by which a threat actor gains access to a target, such as email, removable media or vulnerable software.Foundational
• Trojan HorseMalware disguised as legitimate software that performs hidden malicious actions once the user runs it.Foundational
• TyposquattingRegistering domain names that are common misspellings or variants of legitimate domains to deceive users.Foundational
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unskilled AttackerA low-sophistication threat actor who relies on pre-built tools and exploits written by others.Foundational
• Use-After-Free (UAF)Using a pointer to memory after it has been freed, which may now hold attacker-controlled data.Advanced
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• VirusMalware that attaches to a host file or program and replicates when that host is executed, requiring user action to spread.Foundational
• VishingVoice phishing that uses phone calls or voicemail to manipulate victims into revealing information or taking action.Foundational
• VLAN HoppingAn attack that sends traffic from one VLAN to another without passing through a router, via switch spoofing or double tagging.Intermediate
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• WannaCryA 2017 ransomware worm that spread globally through the EternalBlue SMBv1 exploit.Foundational
• Watering Hole AttackAn attack that compromises a website frequently visited by a target group in order to infect those visitors.Intermediate
• Wayback MachineThe Internet Archive's service storing historical snapshots of websites, useful for finding removed content.Foundational
• WeaponizationThe kill-chain stage where an attacker couples an exploit with a deliverable payload, such as a malicious document.Foundational
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• WhalingSpear phishing aimed at senior executives or other high-value individuals.Foundational
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational
• WHOISA query protocol and database that returns registration details for domain names and IP address blocks.Foundational
• Wi-Fi Protected Setup (WPS)A simplified setup method using a PIN or push button, vulnerable to brute-force and Pixie Dust attacks.Foundational
• Wired Equivalent Privacy (WEP)Original, broken 802.11 encryption protocol using RC4 with a 24-bit IV.Foundational
• WiresharkA free, open-source graphical protocol analyzer that captures and decodes network packets.Foundational
• WormSelf-replicating malware that spreads across networks without user interaction by exploiting vulnerabilities.Foundational
• X-Frame-Options (XFO)A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.Foundational
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational