CFR-410 key terms

The information-gathering phase of an attack in which an adversary maps targets, services, and personnel before exploitation, using passive sources or active probing to reduce uncertainty and select the most promising entry point.

Open-source intelligence: collecting and correlating publicly available data such as DNS records, certificate transparency logs, job postings, and social media to profile an organization's technology and people without touching its systems directly.

Actively probing a host's TCP or UDP ports to determine which services are listening and reachable, typically producing a list of open ports, service banners, and version guesses used to plan exploitation.

The follow-on step after port discovery in which an attacker or tester identifies the exact software, version, and configuration behind each open port, often through banners, protocol queries, or default page requests.

Automated comparison of discovered hosts and services against known vulnerability signatures and configuration checks, producing findings that still require manual validation to separate real exploitable issues from false positives.

Code or a crafted input that takes advantage of a specific weakness to change a program's intended behavior, such as achieving code execution, reading protected files, or bypassing an authentication check.

The action delivered after an exploit succeeds, such as a reverse shell, command execution, or file upload; it is distinct from the exploit itself, which only creates the opening.

An open-source exploitation framework organized around modules, exploits, payloads, and auxiliary scanners, driven through msfconsole or resource scripts, widely used to validate vulnerabilities in authorized tests.

An advanced Metasploit payload that runs in memory and provides an interactive session with commands for file transfer, credential dumping, pivoting, and privilege escalation without writing a binary to disk.

Using a compromised host as a relay to reach systems that are not directly routable from the attacker's position, often through port forwarding or a proxy tunnel established inside the victim network.

A web flaw where untrusted input is concatenated into a database query, letting an attacker alter query logic to bypass logins, extract data, or in some configurations execute operating-system commands.

A web vulnerability in which attacker-supplied script is stored or reflected into a page and executes in another user's browser, enabling session theft, credential phishing, or actions performed as the victim.

An attack that tricks a logged-in user's browser into sending an authenticated state-changing request to a site the user trusts, exploiting the automatic attachment of session cookies.

The total set of points an adversary can try to influence a system, including exposed services, APIs, user roles, third-party integrations, and human channels; reducing it limits available paths.

A minimal, controlled demonstration that a vulnerability is genuinely exploitable in a given environment, used to justify remediation priority without causing harm or exceeding authorized scope.

A written agreement defining the scope, timing, permitted techniques, escalation contacts, and stop conditions for an authorized attack simulation, protecting both the testers and the target organization.

A standard protocol and message format for shipping event records from network devices and servers to a central collector, carrying facility, severity, timestamp, host, and message fields used in correlation.

Centralizing logs from many sources into one searchable store with normalized timestamps and fields, so analysts can investigate incidents across hosts instead of logging into each system individually.

Combining multiple low-level log events across sources and time windows into a higher-level finding, such as linking many failed logins followed by one success into a suspected compromise.

Security information and event management: a platform that ingests logs, applies detection rules and correlation, stores events for search, and raises alerts for analyst triage and investigation.

An alert or scanner finding that appears to indicate malicious activity or a vulnerability but is benign on review, consuming analyst time and eroding trust in detection if not tuned.

Observable evidence suggesting intrusion, such as a malicious file hash, command-and-control domain, registry key, or unusual parent-child process pair, used to hunt for related activity.

Proactive, hypothesis-driven searching through telemetry for undetected adversary activity, rather than waiting for alerts, often guided by known attacker techniques and environment baselines.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, used to structure detection coverage, threat hunting hypotheses, and red-team scenario design.

Techniques an intruder uses to move from one compromised host to others, such as remote service execution, stolen credentials, or shared administrative tools, expanding control across the network.

Extracting stored or cached authentication material from a compromised system's memory or databases so the attacker can authenticate as legitimate users and avoid noisy exploitation.

A documented, unbroken record of who collected, handled, and stored evidence and when, required to show that digital artifacts were not altered between seizure and presentation.

The principle of collecting the most perishable evidence first, such as memory and network connections, before slower-changing data like disk contents, so transient artifacts are not lost.

Creating a bit-for-bit copy of a storage device with a verified hash so analysis occurs on the duplicate while the original remains preserved as evidence.

Ordering file system, log, and memory artifacts by timestamp to reconstruct the sequence of attacker actions and distinguish initial access from later persistence and cleanup.

Granting each user, service, and process only the permissions needed for its function, limiting the blast radius when an account or application is compromised.

Gaining a higher level of access than originally granted, either by abusing misconfigurations and vulnerable services on a host or by manipulating tokens and roles in an application.

An access model where permissions are assigned to roles rather than individuals, and users receive permissions by being placed in roles, simplifying review and revocation.

Requiring two or more independent credential types, such as a password plus a hardware key or push approval, so a stolen password alone is insufficient to authenticate.

A value issued after authentication that the client presents on subsequent requests to prove its identity; if stolen or predictable, an attacker can impersonate the user without a password.

A cookie attribute that restricts whether the browser sends the cookie on cross-site requests, mitigating cross-site request forgery when set to Lax or Strict.

Checking and constraining untrusted data at trust boundaries so it matches expected type, length, and format, reducing injection and parsing flaws before data reaches sensitive operations.

An HTTP response header that tells the browser which script, style, and frame sources are allowed, limiting the impact of injected script and blocking many cross-site scripting payloads.

Dividing a network into zones with enforced traffic controls between them, so a compromised host in one zone cannot freely reach sensitive systems in another.

Protecting stored data, such as disks, backups, and database files, with cryptographic keys so that physical theft or unauthorized file access does not expose readable contents.