CEH flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Confidentiality, integrity, and availability are the three core security objectives: preventing unauthorized disclosure, preventing unauthorized modification, and ensuring timely, reliable access for authorized users.

Single Loss Expectancy

The monetary loss from one incident, calculated as asset value multiplied by exposure factor. Annualized loss expectancy equals SLE multiplied by the annualized rate of occurrence.

DNS Zone Transfer

A secondary DNS server pulls the complete zone record set from the primary over TCP port 53; when unrestricted, an attacker obtains every hostname and IP address in the domain.

Google Dork

A search operator such as site:, filetype:, inurl:, or intitle: used to surface exposed files, login portals, and indexed sensitive content that ordinary queries never reveal.

SYN Stealth Scan

Nmap -sS sends only a SYN. A SYN/ACK response means the port is open, a RST/ACK means closed, and the handshake is never completed so the target logs fewer traces.

XMAS Scan

A TCP scan setting FIN, PSH, and URG. Closed ports reply with RST while open ports stay silent, so it works only against stacks that follow RFC 793 behaviour.

SNMP Enumeration

Querying UDP port 161 with a valid community string, often the default public or private, to extract interfaces, ARP tables, processes, and sometimes credentials from MIB objects.

CVSS Base Score

A 0.0 to 10.0 severity rating derived from exploitability and impact metrics, banded as None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, and Critical 9.0-10.0.

False Positive

A scanner finding that reports a vulnerability which is not actually present or exploitable. It wastes remediation effort, while a false negative leaves real risk unaddressed.

Pass-the-Hash

Authenticating with a captured NTLM hash instead of the plaintext password, so no cracking is required. Mitigated by disabling NTLM, credential guard, and tiered administrative accounts.

Rainbow Table

A precomputed lookup table mapping hashes back to plaintext, trading storage for cracking speed. Salting each hash defeats rainbow tables because every salt needs its own table.

Polymorphic Virus

Malware that mutates its own code, often by encrypting the payload with a changing key, on each infection so signature-based antivirus cannot match a fixed byte pattern.

Rootkit

Programs that conceal an attacker's presence by subverting the kernel or system libraries. Detection requires offline scanning or external integrity checks rather than the infected operating system.

ARP Spoofing

Sending forged ARP replies that bind the attacker's MAC address to a victim's IP, enabling man-in-the-middle sniffing on a switched LAN. Dynamic ARP Inspection is the primary mitigation.

Spear Phishing

A targeted phishing message crafted with researched details about a specific person or team to increase credibility and trigger a click, download, or credential entry.

Smurf Attack

A denial-of-service technique that sends ICMP echo requests to a network broadcast address with the victim's spoofed source IP, so every host amplifies replies toward the victim.

Slowloris

A low-bandwidth application-layer attack that opens many partial HTTP requests and keeps them open, exhausting the web server's connection table using very little attacker traffic.

Session Fixation

The attacker plants a known session identifier on the victim, who then authenticates with it; the attacker reuses the now-privileged identifier. Regenerating IDs at login prevents it.

IDS Versus IPS

An IDS copies traffic passively and raises alerts, while an IPS sits inline and can drop malicious packets. An IDS cannot block but adds no latency to the data path.

Honeypot

A decoy system with no production role that lures attackers and records their activity. High-interaction honeypots provide real operating system access at greater containment risk.

HTTP PUT Method

An HTTP/WebDAV method that uploads a file to the server when write permission is enabled, a misconfiguration that lets attackers place web shells inside the document root.

Directory Traversal

Using ../ sequences or encoded variants such as %2e%2e%2f in a request path to climb outside the web root and read files like /etc/passwd or boot.ini.

Blind SQL Injection

The application returns no query output or error text, so the attacker infers data by asking true/false questions or by measuring time delays from conditional statements.

Stored XSS

Malicious script is saved server-side in a comment, profile, or forum post and executes in every visitor's browser. Mitigated by contextual output encoding and Content Security Policy.

Parameterized Query

A prepared statement that binds user input as data rather than SQL syntax. It is the primary defense against SQL injection because the query plan is fixed before input arrives.

WPA2 Four-Way Handshake

The exchange that derives per-session keys from the pre-shared key. Capturing it lets an attacker run offline dictionary or hashcat attacks against the network passphrase.

Evil Twin

A rogue access point broadcasting the same SSID as a legitimate network to lure clients and intercept their traffic, often paired with a deauthentication flood to force reconnection.

Mirai Botnet

IoT malware that scans the internet for devices using default Telnet credentials, enrols them into a botnet, and launches very large DDoS attacks; its source code was publicly released.

Modbus Protocol

A legacy OT/ICS protocol used over serial links and TCP port 502 with no authentication or encryption, allowing any reachable client to read and write PLC registers.

Shared Responsibility Model

The cloud provider secures facilities, hardware, and hypervisor, while the customer secures data, identities, and configuration of what they deploy. The split shifts with the service model.

Digital Signature

A hash of the message encrypted with the sender's private key. The receiver verifies it with the public key, providing integrity, authentication, and non-repudiation but not confidentiality.

Metadata SSRF Attack

Requesting http://169.254.169.254/ from a cloud-hosted application to read instance credentials from the metadata service. Prevented by IMDSv2 and restrictive egress filtering.