CEH key terms

The first reconnaissance phase of an attack, in which an ethical hacker gathers publicly available information about a target organization, such as domains, IP ranges, employee names, and technologies in use, to map the attack surface.

Intelligence produced from publicly available sources such as websites, social media, news, public records, and search engines. Attackers use it to profile people and infrastructure without directly touching the target's systems.

A public registry query service that returns registration details for an internet domain or IP block, including the registrar, creation and expiry dates, name servers, and sometimes registrant contact data.

A DNS mechanism, normally an AXFR query, that copies every record of a zone from a primary to a secondary server. If misconfigured to allow anyone, it discloses the full host inventory.

Using advanced search operators such as site:, filetype:, and intitle: to make a search engine reveal sensitive pages, exposed files, login portals, or directory listings that were never meant to be found.

Connecting to a network service and reading the identification text it returns, such as a server version string, to learn which software and version is running and match it to known vulnerabilities.

A TCP port scan that sends a SYN packet and never completes the handshake, judging a port open from the SYN/ACK reply. Also called a half-open scan; it is fast and less likely to be logged.

Actively extracting detailed information from a target, such as user names, shares, groups, and routing data, by querying services like SMB, SMTP, SNMP, and LDAP that respond with structured records.

An automated tool that probes hosts, compares detected software versions and configurations against a database of known weaknesses, and produces a report of suspected issues ranked by severity.

A finding reported by a scanner or analyst as a vulnerability that in reality cannot be exploited on the target. Excessive false positives waste remediation effort and erode trust in scan results.

A unique public identifier of the form CVE-YYYY-NNNN assigned to a specific disclosed security flaw, letting vendors, scanners, and advisories refer to the same issue unambiguously.

A standardized scoring framework that rates vulnerability severity from 0 to 10 using metrics such as attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability.

A vulnerability for which no vendor patch exists and often no public disclosure has occurred. Exploits against zero-days bypass signature-based defenses and are highly valued by attackers.

Gaining a higher level of access than initially obtained, such as moving from a standard user to administrator or root, by exploiting misconfigurations, kernel flaws, or weak credentials.

An attack that authenticates with a captured NTLM password hash directly, without cracking it, because the protocol accepts the hash itself as proof of identity. It enables lateral movement between Windows systems.

A precomputed table mapping password hashes to their plaintext values, used to reverse unsalted hashes quickly. Salting or using slow key-derivation functions defeats this approach.

Random data added to a password before hashing so identical passwords produce different hash values. Salts prevent precomputed tables from being reused and force attackers to attack each account separately.

Malware that hides its presence and that of other attacker tools by subverting operating system internals, often at kernel level, making processes, files, and connections invisible to normal inspection tools.

Malicious software disguised as a legitimate or desirable program that a user is tricked into installing, after which it gives the attacker remote access, steals data, or installs further malware.

Malicious code that changes its own appearance, for example by encrypting its body with a new key at each infection, while keeping the same function, so signature matching fails.

The remote infrastructure an attacker uses to send instructions to compromised hosts and receive stolen data. Traffic to it is often disguised as ordinary web or DNS activity.

Capturing network traffic as it passes through an interface, on a wired segment or a wireless medium, to read unencrypted credentials, session tokens, and other sensitive data.

Sending forged ARP replies that bind the attacker's MAC address to a legitimate IP, such as the gateway's, so victims send traffic through the attacker. It enables man-in-the-middle attacks on local networks.

Overwhelming a switch's CAM table with fake source MAC addresses so it can no longer map ports correctly and begins flooding frames to all ports, letting an attacker capture traffic.

A targeted phishing message crafted for a specific person or team, using researched details to appear credible, usually aiming to deliver malware or capture credentials rather than reach a mass audience.

A social engineering technique in which the attacker invents a believable scenario or identity, such as an IT auditor or a courier, to persuade a target to disclose information or perform an action.

An attack that makes a system or service unavailable by exhausting its bandwidth, connections, or processing capacity. A distributed variant uses many compromised hosts so traffic cannot be traced to one source.

Taking over an established authenticated session by stealing or guessing the session identifier, allowing the attacker to act as the legitimate user without knowing that user's password.

A decoy system or service deployed to attract attackers, detect intrusion attempts, and record their tools and techniques while keeping them away from production assets.

Inserting SQL syntax through unsanitized input so the database interprets it as code, allowing an attacker to read, modify, or delete data and sometimes execute operating system commands.

Injecting client-side script into pages viewed by other users so it executes in their browsers, letting the attacker steal session cookies, alter page content, or act as the victim.

A device or service that inspects HTTP traffic and blocks requests matching attack patterns or policy violations, protecting web applications from injection, scripting, and similar attacks.

A rogue wireless access point that imitates a legitimate network's name to lure clients into connecting, after which the attacker can capture their traffic and credentials.

The exchange in which a Wi-Fi client and access point prove knowledge of the pre-shared key and derive fresh session keys. Capturing it allows an offline dictionary attack on weak passphrases.

Removing the manufacturer's software restrictions on a mobile device to gain root-level control. It allows installation of unsigned apps but also strips away many built-in security protections.

A network of compromised devices, from servers to cameras and routers, controlled remotely to send spam, mine cryptocurrency, or launch distributed denial-of-service attacks.

A physical separation that keeps a network, such as an industrial control system, disconnected from the internet and other untrusted networks, so attacks require removable media or an insider.

The division of security duties in cloud computing, where the provider secures the underlying infrastructure and the customer secures data, identity, and configuration of what they deploy.

A cryptographic value produced with a private key over a message's hash, letting anyone holding the public key verify the sender's identity and confirm the message was not altered.

An exploit that lets code running inside a guest virtual machine break out of the hypervisor's isolation and execute on the host, compromising every other guest on that host.