CompTIA PenTest+ key terms

A written agreement that defines the scope, targets, timing, allowed techniques, and emergency contacts for a penetration test before work begins. It protects both the tester and the client legally.

A contractual document listing deliverables, milestones, schedule, and cost for an engagement. It converts the client's goals into measurable work items the tester is paid to complete.

The gradual, unapproved expansion of testing beyond the agreed targets or techniques. Testers must document and get written approval for any addition to avoid legal and operational risk.

A document carried by the tester that authorizes the activity and provides emergency contact details. It helps resolve confusion if law enforcement or a third party interrupts the assessment.

An assessment where the tester receives no prior knowledge of the target's architecture, credentials, or source code. It simulates an external attacker and emphasizes reconnaissance and discovery.

An assessment where the tester is given full documentation, source code, and credentials. It finds deeper logic flaws faster but does not reflect what an outside attacker can see.

An assessment with partial information, such as credentials for a standard user or limited network diagrams. It balances realism against time and is common for internal network tests.

Collecting information about a target without directly interacting with its systems, for example through search engines, public records, and certificate transparency logs. It leaves little trace on target infrastructure.

Directly probing target systems, such as port scanning or banner grabbing, to gather information. It produces more reliable data but can be logged, detected, or blocked by defenses.

Open-source intelligence: information gathered from publicly available sources such as websites, social media, job postings, and domain registries. It builds target profiles without touching the target's network.

A public registry query that returns domain registration details such as registrar, creation date, and sometimes registrant contact data. It helps map an organization's internet footprint and related domains.

Querying DNS records such as A, MX, TXT, and NS to map hosts, mail servers, and third-party services. Misconfigured zone transfers can reveal the entire internal namespace.

A DNS mechanism (AXFR) that replicates a zone between authoritative servers. If unrestricted, it discloses every hostname in the zone, making it a high-value enumeration finding.

Discovering hostnames under a parent domain using wordlists, certificate transparency logs, and search engines. Forgotten subdomains often host staging systems with weaker security controls.

Public append-only logs of issued TLS certificates. Searching them reveals subdomains and internal hostnames that were never intended to be publicly discoverable.

Sending probes to TCP or UDP ports to determine which services are listening and reachable. Results guide service identification and later vulnerability checks.

A half-open TCP scan that sends a SYN and analyzes the reply without completing the handshake. It is fast and less likely to be logged by applications, though still visible to network sensors.

Fingerprinting a listening service by its banners, response patterns, and protocol behavior. Accurate versions let the tester match findings to known vulnerabilities and exploits.

Reading the identification string a service returns on connection, such as an SSH or FTP greeting. Banners may expose software name, version, and sometimes operating system details.

Querying Server Message Block services for shares, users, groups, and policies. Null sessions or guest access can reveal usernames and file shares that enable later attacks.

An unauthenticated SMB connection that allows anonymous enumeration of users, groups, and shares on poorly configured Windows systems. It is a classic foothold for lateral movement.

Automated probing of hosts and services against a database of known weaknesses. Results must be validated manually because scanners produce false positives and miss logic flaws.

A vulnerability scan that authenticates to targets, allowing deeper checks such as missing patches and local configuration issues. It produces fewer false positives than unauthenticated scanning.

A reported vulnerability that does not actually exist or is not exploitable in the target's configuration. Testers must verify findings before including them in a report.

A real vulnerability that a scan or test fails to detect. Causes include missing signatures, filtered ports, and application logic flaws scanners cannot reason about.

Common Vulnerability Scoring System: a standardized 0-10 score reflecting exploitability and impact. Testers use it to prioritize findings, but environmental context still drives real risk.

Common Vulnerabilities and Exposures: a unique identifier assigned to a publicly disclosed vulnerability. It enables consistent tracking and lookup of details and available exploits.

A public archive of proof-of-concept exploit code mapped to CVE identifiers. Testers use it to confirm exploitability, while treating untrusted code with caution in client environments.

The sum of all points where an attacker could interact with a system, including network services, APIs, user input, and third-party integrations. Mapping it focuses testing effort on realistic entry points.

Inserting crafted SQL syntax into user input so the database executes unintended queries. Successful exploitation can bypass authentication, read data, or alter records.

SQL injection where results are not returned directly; the tester infers data through true/false responses or time delays. It requires careful automation to extract information reliably.

Injecting script into pages viewed by other users so it executes in their browsers. It can steal session tokens, perform actions as the victim, or alter page content.

Cross-site request forgery: tricking a logged-in user's browser into sending an unwanted authenticated request. Defenses include anti-CSRF tokens and SameSite cookie settings.

Trying a small set of common passwords against many accounts to avoid lockout thresholds. It exploits weak password policy rather than guessing a single user's credential.

Requesting service tickets for accounts with service principal names, then cracking them offline. Weak service account passwords yield credentials that enable privilege escalation and lateral movement.

Authenticating with a captured NTLM hash instead of the plaintext password. It lets an attacker move laterally without cracking the credential.

Responding to broadcast name-resolution requests to capture authentication hashes from Windows hosts. Captured hashes can be cracked or relayed to other systems.

Moving from one compromised host to other systems using stolen credentials, trust relationships, or remote execution. It expands access toward higher-value targets such as domain controllers.

Maintaining access across reboots and credential changes using scheduled tasks, services, or implants. Testers document these mechanisms so the client can remove them after the engagement.

The channel an attacker uses to send instructions to and receive results from compromised hosts. It is often disguised as normal traffic to evade network detection.

Unauthorized transfer of data from a compromised environment to attacker-controlled systems. Testers demonstrate feasibility carefully within scope, often using a harmless sample file.

Gaining higher permissions than initially granted, such as moving from a standard user to administrator or root. It may exploit misconfigurations, weak permissions, or unpatched software.