CAP-C01 key terms

A flaw where attacker-supplied markup is stored or reflected into a page and executed by a victim's browser, letting the attacker run script in that site's origin and act as the user.

An attack that makes a logged-in victim's browser send a state-changing request to a site the victim trusts, exploiting the automatic inclusion of credentials like cookies rather than stealing them.

A browser rule that lets scripts read responses only from pages sharing the same scheme, host, and port, isolating one site's data from scripts loaded by another site.

A set of response headers a server uses to tell the browser which other origins may read its responses, loosening the same-origin policy in controlled, explicit ways.

A response header that lists approved sources for scripts, styles, and other resources so the browser blocks anything else, reducing the impact of injected markup.

An attack where untrusted input is concatenated into a database query, changing the query's logic so the attacker can read, alter, or delete data beyond their intended access.

A database call where the SQL text is fixed and user values are passed separately as bound parameters, so input cannot change the query's structure.

A flaw where the server fetches a URL supplied by the user, letting an attacker reach internal services, cloud metadata endpoints, or otherwise unreachable hosts through the server.

An access-control gap where an application uses a user-supplied identifier to fetch a record without checking that the requester is entitled to it, exposing other users' data.

A class of weakness where the application fails to enforce who may perform which action or view which record, allowing privilege escalation or horizontal data access.

A flaw in XML parsers that resolve external entities, letting an attacker read local files, reach internal hosts, or cause denial of service through a crafted document.

A random, per-session value embedded in forms and checked on submission so that requests forged from another site, which cannot read the token, are rejected.

A cookie attribute that controls whether the browser sends the cookie on cross-site requests, limiting exposure to cross-site request forgery and some data leaks.

A flaw where a site accepts a destination parameter and forwards users there without validation, enabling convincing phishing links and chaining into other attacks.

Gaining rights beyond those granted, either vertically to a higher role or horizontally to another user's resources, often by abusing misconfigured permissions or vulnerable components.

Requesting service tickets for accounts with service principal names, then cracking the encrypted ticket offline to recover the service account's password without touching the target host.

Authenticating with a captured password hash instead of the plaintext, letting an attacker move laterally to systems that accept the hash as proof of identity.

Techniques an intruder uses to move from one compromised host to others in the same network, expanding control while seeking higher-value systems and credentials.

Using a compromised host as a relay so traffic from the attacker's tooling reaches network segments that are not directly routable from the attacker's position.

An attack that captures an authentication attempt and forwards it to another server to authenticate as the victim, succeeding where message signing is not required.

Answering broadcast name-resolution queries on a local segment with the attacker's address so victims send authentication attempts to a host the attacker controls.

Dividing a network into zones with enforced boundaries so that a compromise in one zone cannot freely reach systems in another, limiting blast radius.

A decoy credential or file placed where attackers look, which triggers an alert when used or opened, giving early warning of intrusion.

The information-gathering phase in which an assessor maps hosts, services, versions, and exposed data before attempting exploitation.

Probing a host's TCP or UDP ports to learn which services are listening and, with further probing, which software and versions respond.

Text a network service returns on connection or request that often reveals product name and version, helping an assessor match known vulnerabilities.

The sum of entry points an adversary could use, including exposed services, interfaces, accounts, and data flows; reducing it lowers exposure.

Automated comparison of discovered services and configurations against known weakness signatures and version data, producing candidate findings that require validation.

A reported finding that does not actually represent an exploitable weakness in the target's real configuration, often caused by version matching or blocked probes.

A minimal, controlled demonstration that a suspected weakness can actually be triggered, used to confirm a finding without causing harm.

Weaknesses in transport encryption such as expired or mismatched certificates, deprecated protocol versions, weak cipher suites, or missing forward secrecy that expose or downgrade traffic.

Hard-coding an expected certificate or public key in a client so it rejects any other certificate, even one signed by a trusted authority.

App logic that checks whether the device is jailbroken or rooted and changes behavior accordingly, aiming to keep sensitive functions off tampered devices.

Saving sensitive values such as tokens or personal data in plaintext on a device, where other apps, backups, or a thief can read them.

Analyzing source or bytecode without running it to find risky patterns such as tainted data reaching dangerous calls, often producing findings that need triage.

Tracking values from untrusted sources through code to sensitive sinks, reporting paths where input reaches a dangerous operation without adequate sanitization.

Identifying third-party libraries and their versions in a project and matching them against known vulnerability databases to flag outdated or risky dependencies.

A credential, key, or token written directly into source or configuration and committed to a repository, where it can leak through history or builds.

A link-local endpoint on cloud virtual machines that returns credentials and configuration to anything on the host, making it a prime target for server-side request forgery.

A cloud identity policy granting broader actions or resources than the workload needs, so a single compromise yields far-reaching access.

An object storage container whose policy allows unauthenticated reads or writes, exposing or corrupting data that was meant to stay private.