Definitions and pro-tips for the PT0-002 certification.
Adversary Emulation is the practice of simulating the specific tactics, techniques, and procedures (TTPs) of a known threat actor to test a network's defenses. It differs from general penetration testing by focusing on realistic, threat-informed scenarios.
An Air Gap is a security measure that ensures a computer or network is physically isolated from all other networks, including the public internet. This is typically used for high-security systems, such as those controlling nuclear power plants or classified government databases.
ARP Poisoning is a technique used to associate an attacker's MAC address with the IP address of another host, such as the default gateway. This enables the attacker to intercept, modify, or stop traffic flowing between two devices on a local area network.
The attack surface is the total sum of all possible points, known as attack vectors, where an unauthorized user can attempt to enter or extract data from an environment. Reducing the attack surface involves disabling unused services, closing unnecessary ports, and limiting user permissions.
An Authenticated Vulnerability Scan is a security assessment where the scanner is provided with valid credentials to access the target system. This allows the scanner to identify internal vulnerabilities, missing patches, and configuration issues that are invisible from the network perimeter.
Baiting is a social engineering technique that promises a reward to lure a victim into a trap, such as leaving a malware-infected USB drive in a public area. The attacker relies on the victim's curiosity or greed to prompt them to plug the device in.
Banner Grabbing is a reconnaissance technique used to identify the version and type of service running on a remote network port. By connecting to a port, the attacker captures the welcome message or 'banner' sent by the service to determine potential vulnerabilities.
Beaconing is the process where a compromised system sends periodic signals to a command-and-control (C2) server to check for instructions. This heartbeat mechanism allows attackers to maintain communication through firewalls while avoiding detection by blending in with normal outbound web traffic patterns.
A Bind Shell is a type of shell where the attacker connects to a specific port opened on the target machine. In this scenario, the target acts as the server, listening for a connection from the attacker, which is often blocked by perimeter firewalls.
A Birthday Attack is a cryptographic attack that exploits the mathematics behind the birthday paradox to find collisions in hash functions. The attacker seeks two different inputs that produce the same hash output, effectively breaking the integrity of digital signatures or passwords.
Black Box Testing is a penetration testing methodology where the tester has no prior knowledge of the target environment, simulating an external attack. The tester must perform their own reconnaissance and enumeration to discover vulnerabilities, mimicking the perspective of an unprivileged outside adversary.
BloodHound is a tool used to visualize Active Directory environments and identify hidden attack paths. It uses graph theory to map relationships between users, groups, and computers, allowing attackers to find the shortest path to Domain Admin.
A Brute Force Attack is a trial-and-error method used to guess passwords, keys, or hidden URLs by systematically trying every possible combination. While exhaustive and guaranteed to work eventually, it is time-consuming and easily detected by account lockout policies and logging systems.
A Buffer Overflow occurs when a program writes more data to a fixed-length block of memory (the buffer) than it can hold. This extra data overflows into adjacent memory, potentially overwriting the return address to execute malicious code.
Burp Suite is an integrated platform for performing security testing of web applications. It functions primarily as an intercepting proxy, allowing testers to capture, analyze, and modify HTTP/S requests and responses between the browser and the server in real-time.
Clickjacking is a malicious technique where an attacker uses transparent or opaque layers, usually iframes, to trick a user into clicking a button or link on another page when they intended to click on the top-level page. This can lead to unauthorized account changes.
Command and Control (C2) refers to the infrastructure used by an attacker to send commands to systems compromised by malware. This channel allows the attacker to maintain persistence, exfiltrate data, and deploy additional payloads across the target network remotely.
Common Vulnerabilities and Exposures (CVE) is a list of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identification number. This standardized naming system allows security professionals to track, share, and synchronize vulnerability data across different tools and databases.
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of software vulnerabilities. It provides a numerical score reflecting the ease of exploitation and the potential impact on confidentiality, integrity, and availability.
Common Weakness Enumeration (CWE) is a community-developed list of common software and hardware security weaknesses. Unlike CVEs, which identify specific instances of vulnerabilities in products, CWEs categorize the underlying types of flaws, such as 'Improper Input Validation.'
Credential stuffing is a cyberattack where stolen username and password pairs from one service are automatically tested against other unrelated services. This technique leverages the common habit of password reuse across multiple platforms to gain unauthorized access to user accounts without needing to crack passwords.
Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to execute unwanted actions on a web application in which they are currently logged in. It tricks the browser into sending a forged HTTP request to the target server.
Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious scripts into trusted websites, which are then executed in the victim's browser. This allows attackers to steal session cookies, redirect users, or deface pages by manipulating the client-side code.
Data Exfiltration is the unauthorized transfer of sensitive data from a target system to an external location controlled by an attacker. This is often performed using covert channels, such as DNS tunneling or encrypted HTTPS requests, to avoid detection.
A dictionary attack is a password-cracking method that uses a predefined list of likely passwords, known as a dictionary, to attempt to gain access. It is more efficient than a pure brute-force attack because it focuses on common words and previously leaked passwords.
Directory Traversal, also known as path traversal, is a vulnerability that allows an attacker to read arbitrary files on the server by manipulating file paths. This is typically achieved using sequences like '../' to move up the directory tree.
DLL Hijacking is an attack where a malicious Dynamic Link Library (DLL) is placed in a directory where an application searches for it. When the application launches, it loads the malicious DLL instead of the legitimate one.
DNS tunneling is a method used to encapsulate non-DNS traffic within DNS queries and responses to bypass network security controls. By hiding data inside DNS packets, attackers can establish a covert communication channel for data exfiltration or command-and-control traffic that often bypasses traditional firewalls.
A DNS Zone Transfer (AXFR) is the process of replicating DNS databases across a set of DNS servers. If misconfigured, an attacker can request a full zone transfer to enumerate all hosts and IP addresses within a domain.
Egress filtering is the practice of monitoring and restricting outbound network traffic from an internal network to the internet. By limiting the ports and protocols allowed to leave the network, security professionals can prevent compromised systems from communicating with C2 servers or exfiltrating sensitive data.
An Evil Twin is a fraudulent Wi-Fi access point that appears to be a legitimate one, designed to trick users into connecting to it. Once connected, the attacker can intercept traffic, steal credentials, or perform man-in-the-middle attacks.
A False Positive is a result in a vulnerability scan that incorrectly indicates the presence of a security flaw when none actually exists. These occur due to inaccurate signatures or misinterpretations of system responses and must be manually verified.
Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The goal is to cause the application to crash or behave unexpectedly, revealing memory leaks or buffer overflows.
A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created after an attacker compromises the KRBTGT account in an Active Directory environment. This allows the attacker to impersonate any user and gain unrestricted access to any service in the domain.
Gray Box Testing is a penetration testing methodology that provides the tester with limited information about the target, such as user-level credentials or a basic network map. It balances the efficiency of white box testing with the realism of black box testing.
A hash collision occurs when two different input strings produce the exact same hash value through a cryptographic hashing function. Collisions are a sign of a weak or broken hashing algorithm, allowing attackers to substitute a legitimate file with a malicious one that shares the same hash.
Hashcat is a powerful, open-source password recovery tool that utilizes the GPU to perform high-speed cracking of various hash types. It supports a wide array of attack modes, including dictionary, brute-force, and rule-based attacks.
Heap Spraying is a technique used to facilitate the exploitation of a memory corruption vulnerability by flooding the heap with a specific sequence of bytes. This increases the probability that a jump instruction will land on the attacker's malicious shellcode.
A Honeypot is a decoy system designed to mimic a legitimate target to lure attackers and study their methods. It provides a controlled environment where security professionals can monitor unauthorized access attempts and gather intelligence on threat actor behavior without risking production systems.
A honeytoken is a piece of fake data, such as a fraudulent API key or a deceptive database record, placed within a system to detect unauthorized access. When an attacker interacts with the token, it triggers an immediate alert, providing high-fidelity evidence of a breach.
Horizontal Privilege Escalation occurs when an attacker gains access to resources or data belonging to another user who possesses the same level of privileges. This often happens through insecure direct object references where a user changes a URL parameter to view another user's profile.
An Indicator of Compromise (IoC) is a piece of digital evidence, such as a file hash, IP address, or registry key, that indicates a system has been breached. These artifacts are used by security analysts to detect intrusions and map adversary activity.
Insecure Direct Object Reference (IDOR) is a vulnerability where an application provides direct access to objects based on user-supplied input. This allows an attacker to bypass authorization and access files, database records, or other user accounts by simply changing a parameter value in the URL or request.
John the Ripper is a versatile password cracking tool used to identify weak passwords by performing dictionary and brute-force attacks. It is highly portable and supports a vast range of password hash types across different operating systems.
Kerberoasting is a post-exploitation technique used to extract Kerberos service tickets (TGS) from Active Directory and crack them offline to obtain service account passwords. This attack targets accounts with Service Principal Names (SPNs) assigned to them.
Lateral Movement is the process by which an attacker moves through a network after gaining an initial foothold. The goal is to navigate from the entry point to higher-value targets, such as domain controllers or database servers, using stolen credentials.
LDAP Injection is a vulnerability that occurs when an application fails to properly sanitize user input used in a Lightweight Directory Access Protocol (LDAP) query. Attackers can manipulate the query to bypass authentication or extract sensitive information from the directory service.
Living off the Land (LotL) is a technique where attackers use legitimate, pre-installed system tools—such as PowerShell, WMI, or Certutil—to perform malicious activities. This approach reduces the need for custom malware, making the attack significantly harder to detect by traditional antivirus and endpoint detection software.
LLMNR/NBT-NS Poisoning involves spoofing Link-Local Multicast Name Resolution or NetBIOS Name Service responses to capture user credentials. When a client fails to resolve a hostname via DNS, the attacker responds, tricking the client into sending an NTLM hash.
Local File Inclusion (LFI) is a vulnerability where a web application allows an attacker to include files that are already present on the local server. This can lead to the disclosure of sensitive configuration files or remote code execution.
A Man-in-the-Middle (MitM) attack occurs when a malicious actor secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. This allows the attacker to intercept sensitive data, steal session cookies, or inject payloads.
Master Service Agreement (MSA) is a contract that outlines the general terms and conditions of a long-term relationship between a service provider and a client. It simplifies future transactions by establishing a foundational framework, allowing specific project details to be handled via separate Statements of Work.
The Metasploit Framework is a powerful, open-source penetration testing platform used for developing, testing, and executing exploit code against a remote target. It provides a vast library of pre-made exploits, payloads, and post-exploitation modules to streamline the attack process.
Mimikatz is a powerful post-exploitation tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory (LSASS). It is widely used by attackers to perform credential harvesting and lateral movement within Windows environments.
The MITRE ATT&CK Framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a standardized taxonomy for describing the various stages of a cyberattack, allowing teams to map defenses against specific, documented threat behaviors.
Nmap (Network Mapper) is an industry-standard open-source tool used for network discovery and security auditing. It uses raw IP packets to determine what hosts are available on the network, what services they offer, and what operating systems they are running.
Open Source Intelligence (OSINT) is the process of collecting and analyzing information from publicly available sources to gather intelligence on a target. This includes social media, public records, domain registration data, and search engine results to identify potential attack vectors during the reconnaissance phase.
The OWASP Top 10 is a regularly updated report outlining the most critical security risks to web applications. It serves as a global standard for developers and security professionals to prioritize vulnerability remediation and testing.
Pass-the-Cookie is a session hijacking technique where an attacker steals a valid session cookie from a user's browser and uses it to impersonate that user. This allows the attacker to bypass the authentication process entirely, as the server believes the attacker is the authenticated user.
Pass-the-Ticket (PtT) is a technique where an attacker steals a Kerberos ticket from memory and uses it to authenticate to a service without needing the user's password. This bypasses the need for the initial authentication process.
Password Salting is the process of adding a unique, random string of characters to a password before it is hashed. This prevents attackers from using precomputed tables, like rainbow tables, to crack passwords during an offline attack on a stolen database.
Password Spraying is a brute-force technique where an attacker tries a few commonly used passwords against a large number of different accounts. This approach is designed to avoid account lockouts that typically occur when multiple passwords are tried against a single account.
A payload is the part of the exploit code that performs the actual malicious action on the target system. While the exploit is the mechanism used to gain access, the payload is the specific set of instructions executed once access is achieved.
PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. Compliance requires rigorous controls, including regular vulnerability scanning and penetration testing.
Persistence refers to the techniques used by an attacker to maintain access to a compromised system across restarts or credential changes. Common methods include creating new user accounts, installing backdoors, or modifying registry keys to execute malicious code on boot.
Phishing is a social engineering attack where the attacker sends fraudulent messages designed to trick a person into revealing sensitive information or deploying malware. These messages often mimic trusted entities and create a sense of urgency to provoke a quick, unplanned response.
Pivoting is the technique of using a compromised system as a gateway to attack other systems within the same network that are not directly accessible from the outside. It allows an attacker to move deeper into a restricted internal network.
Post-Exploitation consists of the actions taken after a system has been successfully compromised. This phase focuses on identifying the value of the machine, escalating privileges, maintaining access, and searching for sensitive data to pivot further into the network.
Pretexting is a form of social engineering where an attacker creates a fabricated scenario, or 'pretext,' to trick a victim into divulging sensitive information. Unlike simple phishing, pretexting involves building a believable story to establish trust with the target.
Privilege Escalation is the act of exploiting a bug or configuration flaw to gain a higher level of access than originally intended. This can be vertical, moving from a user to an admin, or horizontal, moving between accounts with similar privilege levels.
Privileged Access Management (PAM) is a framework of technologies and policies used to secure, manage, and monitor accounts with elevated permissions. By implementing 'just-in-time' access and session recording, PAM reduces the risk of credential theft and limits the potential impact of an insider threat.
Quid Pro Quo is a social engineering attack where the attacker offers a service or benefit in exchange for information or access. A common example is an attacker posing as IT support and offering to 'fix' a technical problem if the user provides their password.
Rainbow Tables are precomputed tables of hashed passwords used to reverse cryptographic hash functions. They trade storage space for computation time, allowing an attacker to crack passwords much faster than a brute-force attack.
A Red Team is a group of security professionals who simulate a sophisticated adversary to test an organization's detection and response capabilities. Unlike a standard penetration test, red teaming is a full-scope exercise that tests people, processes, and technology over an extended period of time.
Remediation is the process of fixing a vulnerability or security gap identified during a penetration test to prevent future exploitation. This can include applying software patches, changing configuration settings, or implementing new security controls to reduce the overall risk to the organization.
Remote Code Execution (RCE) is a critical vulnerability that allows an attacker to execute arbitrary code of their choosing on a remote machine. This typically occurs due to improper input validation or memory corruption, granting the attacker full control over the target system.
A Replay Attack occurs when an attacker intercepts a valid data transmission, such as an authentication token or a session cookie, and later re-transmits it to the server to impersonate the original user. This bypasses authentication without needing to know the password.
Representational State Transfer (REST) is an architectural style for designing networked applications that uses standard HTTP methods like GET, POST, PUT, and DELETE. It is more lightweight than SOAP and typically uses JSON for efficient data exchange between systems.
A Reverse Shell is a connection initiated from a compromised target machine back to the attacker's listening machine. This technique is used to bypass firewalls that typically block incoming connections but allow outgoing traffic on common ports like 80 or 443.
A Rootkit is a collection of malicious software designed to provide continued privileged access to a computer while actively hiding its presence from the operating system and security tools. It often modifies kernel-level functions to conceal files, processes, and network connections.
The Rule of Engagement (RoE) is a formal document that defines the technical and operational constraints of a penetration test. It specifies the scope, allowed tools, testing windows, communication channels, and the specific IP addresses or systems that are strictly off-limits.
Rules of Engagement (ROE) is a formal document that defines the constraints and boundaries of a penetration test. It specifies the approved timeframes, authorized IP addresses, prohibited techniques, and communication channels to ensure the test is conducted safely and legally.
Salting is the process of adding a unique, random string of characters to a password before it is hashed. This technique prevents attackers from using precomputed rainbow tables to crack passwords, as the same password will result in a different hash for every user.
Scope Creep refers to the uncontrolled expansion of a project's goals or requirements without corresponding adjustments to time, budget, or resources. In penetration testing, this often occurs when a client requests additional systems or networks be tested mid-engagement without a formal contract amendment.
Security Information and Event Management (SIEM) is a security solution that aggregates and analyzes log data from various sources across an organization's network. It provides real-time monitoring, correlation of events, and alerting to help security teams detect and respond to threats.
Server-Side Request Forgery (SSRF) occurs when an attacker induces a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This is often used to target internal systems behind a firewall that are not accessible from the external network.
Session Hijacking is the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system. This is typically achieved by stealing a session token or cookie, allowing the attacker to take over the user's authenticated state.
Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is typically written in assembly language to be compact and directly executable by the CPU, often spawning a command shell for the attacker.
Shodan is a specialized search engine that indexes internet-connected devices, such as servers, IoT devices, and industrial control systems, by scanning the entire internet. It allows penetration testers to identify publicly exposed services and vulnerabilities without interacting directly with the target system.
SIEM (Security Information and Event Management) is a security solution that provides real-time analysis of security alerts generated by applications and network hardware. It aggregates log data from multiple sources to identify patterns and potential security incidents.
A Silver Ticket is a forged Kerberos Ticket Granting Service (TGS) ticket that grants an attacker access to a specific service on a specific server. It is created using the service account's password hash rather than the KRBTGT account hash.
Simple Object Access Protocol (SOAP) is a XML-based messaging protocol used for exchanging structured information in the implementation of web services. It relies on a strict schema and is typically used in enterprise environments for highly secure and standardized transactions.
An SMB Relay Attack involves intercepting an SMB authentication request and forwarding it to another server on the network to gain unauthorized access. This attack leverages the lack of SMB signing to impersonate a user without needing to crack their password.
Smishing (SMS Phishing) is a form of social engineering where attackers send deceptive text messages to trick victims into clicking malicious links or providing private data. These messages often appear as urgent alerts from delivery services or financial institutions to prompt immediate action.
An SNMP Walk is a technique used to query a network device for all available information using the Simple Network Management Protocol. By iterating through the Management Information Base (MIB), an attacker can discover system details and network interfaces.
Social Engineering is the psychological manipulation of people into performing actions or divulging confidential information. It leverages human trust and error rather than technical vulnerabilities, using techniques like phishing, pretexting, and baiting to gain unauthorized access.
Spear Phishing is a targeted form of phishing where the attacker researches a specific individual or organization to make the fraudulent message highly personalized. This increased relevance makes the attack more convincing and significantly increases the likelihood of the victim falling for the scam.
SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. By inserting malicious SQL code into input fields, attackers can bypass authentication or extract sensitive data from the backend database.
SQLmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. It can fingerprint databases, dump tables, and in some cases, access the underlying file system or execute system commands on the server.
A Statement of Work (SOW) is a formal document that defines the specific activities, deliverables, and timelines for a penetration testing engagement. It serves as a binding agreement between the tester and the client, outlining the exact scope of work to be performed.
Steganography is the practice of hiding secret information within an ordinary, non-secret file, such as an image, audio clip, or video. Unlike encryption, which makes data unreadable, steganography hides the very existence of the data, making it a powerful tool for covert communication.
A SYN Scan (Half-Open Scan) is a stealthy port scanning technique that sends a SYN packet and waits for a SYN/ACK response. The scanner sends a RST packet instead of completing the three-way handshake, avoiding the creation of a full connection.
TTPs (Tactics, Techniques, and Procedures) refer to the behavioral patterns and methodologies used by threat actors to execute attacks. Understanding TTPs allows security analysts to move beyond simple indicators of compromise and identify the overarching strategy and habits of a specific adversary or threat group.
Vertical Privilege Escalation occurs when a user with low-level permissions successfully gains access to functions or data reserved for higher-privileged users. A common example is a standard user gaining administrative or root-level access to a system through a kernel exploit.
Vishing (Voice Phishing) is a social engineering attack that uses voice communication, such as phone calls or VoIP, to deceive victims into revealing sensitive information. Attackers often use urgency or impersonate authority figures, like bank officials or IT support, to manipulate the target.
VLAN Hopping is a network attack that allows an attacker on one VLAN to gain access to traffic on other VLANs that would normally be isolated. This is typically achieved through switch spoofing or double tagging of Ethernet frames.
The Vulnerability Management Lifecycle is a continuous process of identifying, classifying, remediating, and mitigating software vulnerabilities. It involves a repetitive cycle of scanning, prioritizing risks based on business impact, and verifying that patches were applied correctly.
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application. It operates at Layer 7 of the OSI model to protect against attacks like SQLi and XSS.
Whaling is a specialized form of spear phishing that targets high-profile executives, such as CEOs or CFOs, within an organization. These attacks are highly sophisticated and often aim to steal large sums of money or sensitive corporate intellectual property.
White box testing is a penetration testing methodology where the tester is provided with full knowledge of the target system, including source code, network diagrams, and IP addresses. This comprehensive access allows for a more thorough security analysis and identifies vulnerabilities missed in black box tests.
Whois is a query and response protocol used for searching databases that store the registered users or assignees of an internet resource, such as a domain name or an IP address block. It provides essential reconnaissance data, including registrant contact information.
WPA3 is the latest security standard for wireless networks, designed to replace WPA2. It introduces Simultaneous Authentication of Equals (SAE) to prevent offline dictionary attacks and provides stronger encryption for open public networks.
An Xmas Scan is a network scanning technique that sets the FIN, PSH, and URG flags in the TCP header, making the packet 'lit up like a Christmas tree.' It is used to identify open ports on systems that follow RFC 793.
XML External Entity (XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML input. It can lead to the disclosure of internal files, server-side request forgery, and in some cases, remote code execution by referencing external entities.
A zero-day vulnerability is a software flaw that is unknown to the vendor and for which no official patch or fix exists. Because the vendor has 'zero days' to address the issue, these vulnerabilities are highly prized by attackers for creating reliable, undetected entry points.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!