OffSec Certified Professional (OSCP+): key terms

Flashcards for this exam OffSec Certified Professional (OSCP+) guide

• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• DNS EnumerationDiscovering hostnames, records and infrastructure details by querying a target's DNS.Foundational
• DNS Zone Transfer (AXFR)A DNS mechanism for replicating zones between servers that, if allowed to anyone, leaks every record in a domain.Intermediate
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Penetration TestingAn authorized, simulated attack on systems to find and safely exploit vulnerabilities before real attackers do.Foundational
• PivotingUsing a compromised system as a relay to reach other networks or hosts that are not directly accessible to the tester or attacker.Intermediate
• Post-ExploitationThe pentest phase after initial compromise that assesses what an attacker could achieve, such as privilege escalation, lateral movement and data access.Intermediate
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• ReconnaissanceThe information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.Foundational
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• Subdomain EnumerationDiscovering subdomains of a target domain to expand the known attack surface.Foundational
• theHarvesterAn OSINT tool that gathers emails, subdomains, hosts and names from public sources such as search engines and certificate logs.Foundational