CREST CPSA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CVSS base score

A 0–10 severity rating derived from exploitability and impact metrics (AV, AC, PR, UI, S, C, I, A). It does not include environmental or temporal modifiers unless those are explicitly scored.

Rules of engagement

The signed document defining authorised targets, testing windows, permitted techniques, emergency contacts, and data-handling requirements. Any activity outside it is unauthorised and must be re-approved in writing.

Chain of custody

A documented record of evidence handling: each artefact is hashed (e.g., SHA-256), stored securely, and logged with collector identity and timestamp so its integrity can be proven later.

TCP three-way handshake

Connection setup sequence: client sends SYN, server replies SYN/ACK, client sends ACK. A SYN scan sends only the first packet and never completes the handshake.

CIDR usable hosts

For a prefix length p, usable host addresses equal 2^(32−p) − 2, subtracting the network and broadcast addresses. A /24 therefore yields 254 usable hosts.

Base64 encoding

A reversible encoding that maps 3 bytes to 4 printable characters. It provides no confidentiality and must not be treated as encryption during assessment.

Reverse shell

A payload that causes the compromised target to initiate an outbound connection back to the attacker's listener. It is often preferred because egress filtering is less common than ingress filtering.

Passive reconnaissance

Information gathering that sends no traffic to the target, such as WHOIS, DNS lookups against public resolvers, certificate transparency logs, and search-engine queries. It requires no authorisation.

Certificate Transparency logs

Public append-only logs of issued TLS certificates. Querying services such as crt.sh reveals subdomains and hostnames without sending any traffic to the target organisation.

SPF, DKIM, DMARC

Email authentication controls: SPF lists authorised sending IPs in a TXT record, DKIM signs messages with a DNS-published key, and DMARC sets a policy (none, quarantine, reject) plus reporting.

VLAN trunking 802.1Q

A standard that inserts a 12-bit VLAN identifier (range 1–4094) into Ethernet frames so multiple VLANs share a trunk link. Frames on the native VLAN are sent untagged.

Spanning Tree Protocol

A layer-2 protocol (IEEE 802.1D) that prevents switching loops by electing a root bridge and blocking redundant ports. The root is chosen by lowest bridge ID (priority then MAC).

SNMPv1 and SNMPv2c

Versions that authenticate only with a plaintext community string, often left at defaults such as 'public' or 'private'. SNMPv3 adds proper authentication and encryption.

PAT overload

Port Address Translation maps many internal sessions to a single public IP by rewriting source port numbers, allowing thousands of hosts to share one external address.

NTLM hash

The MD4 digest of a user's UTF-16LE password, stored in the SAM database and used by Windows authentication. It can be relayed or cracked offline if captured.

Unquoted service path

A Windows service whose executable path contains spaces but no quotes. Windows tries each space-delimited prefix, so a writable directory earlier in the path allows binary planting.

AlwaysInstallElevated

A pair of registry policies (HKLM and HKCU) that, when both set to 1, let any user install MSI packages with SYSTEM privileges. It is a common privilege-escalation finding.

Windows event ID 4625

A failed logon attempt recorded in the Security log when logon auditing is enabled. Repeated 4625 events can indicate password guessing or spraying against the host.

SUID binary

A Unix executable with the set-user-ID bit set (permission 4xxx) that runs with the file owner's privileges. If owned by root, it can be an escalation path when misconfigured.

/etc/shadow

A root-readable Unix file holding password hashes and ageing fields. Unlike /etc/passwd, it is not world-readable, so hash disclosure requires privilege escalation or a misconfiguration.

Linux capabilities

Fine-grained privileges (e.g., cap_setuid, cap_net_raw) that can be attached to binaries instead of full root. Enumerate with getcap -r / to find escalation candidates.

Sudo NOPASSWD

A sudoers directive allowing a command to run without a password prompt. If the permitted command can spawn a shell or edit files, it often yields full privilege escalation.

Broken access control

The OWASP Top 10 category covering failures that let users act outside their intended permissions, including IDOR, missing function-level checks, and forced browsing.

Horizontal privilege escalation

Accessing another user's resources at the same privilege level, typically by changing an object identifier. It is distinct from vertical escalation, which reaches higher-privilege functions.

Session fixation

An attack where the tester forces a known session identifier on the victim before login. If the application does not rotate the token on authentication, the attacker inherits the session.

Business logic flaw

A weakness in application workflow rather than code syntax, such as negative quantities, price tampering, or step skipping. Automated scanners generally cannot detect these.

Stored XSS

A cross-site scripting variant where the payload is persisted server-side (e.g., in a comment or profile) and executed in every visitor's browser. Output encoding and CSP mitigate it.

CSRF token

An unpredictable value tied to the user's session and required on state-changing requests. Its absence, combined with cookie-based auth, enables cross-site request forgery.

Local file inclusion

A vulnerability where user input controls a file path, allowing traversal (../../etc/passwd) or inclusion of uploaded files. It becomes remote file inclusion when remote URLs are permitted.

SSRF to cloud metadata

Server-side request forgery targeting the link-local metadata endpoint 169.254.169.254 to retrieve instance credentials or configuration from cloud providers.

UNION-based SQL injection

An injection technique that appends a UNION SELECT to the original query. It requires the same column count and compatible data types, found using ORDER BY or NULL padding.

Blind SQL injection

Injection where results are not returned directly. Boolean-based variants infer data from true/false page differences; time-based variants infer from response delays such as SLEEP(5).