CREST CPSA key terms

A written agreement that defines the scope, timing, targets, allowed techniques, and emergency contacts for a security assessment. It protects both the tester and the client from legal and operational surprises.

The gradual, unapproved expansion of testing beyond the agreed boundaries. Testers must detect and refuse out-of-scope activity, documenting it rather than acting on it.

The formal deliverable summarizing methodology, findings, evidence, risk ratings, and remediation advice. It must be clear enough for both technical staff and executives to act on.

A reported vulnerability that does not actually exist or is not exploitable in the tested context. Testers should verify findings manually before reporting them to preserve credibility.

A real vulnerability that the assessment failed to detect. Reducing false negatives depends on thorough methodology, tool diversity, and manual verification.

A standardized scoring framework that rates vulnerability severity using metrics such as attack vector, complexity, privileges required, and impact. It helps prioritize remediation consistently across findings.

The SYN, SYN-ACK, ACK exchange that establishes a TCP connection. Understanding it underpins port scanning techniques and distinguishing open, closed, and filtered ports.

A half-open port scan that sends SYN packets and interprets responses without completing the handshake. It is fast and relatively stealthy compared with full connection scans.

The process of probing a host's TCP and UDP ports to determine which services are listening. Results guide later enumeration and exploitation phases.

Collecting the text a service returns on connection to identify its software and version. This information helps match targets against known vulnerabilities.

Actively probing identified ports to determine the exact application, version, and configuration running behind them. It turns raw port lists into actionable intelligence about the target.

Open Source Intelligence: gathering information about a target from publicly available sources such as websites, registries, social media, and public documents. It supports reconnaissance without directly touching target systems.

A public registry query that returns domain registration details such as registrant organization, contact information, name servers, and creation dates. It is a standard early reconnaissance step.

Discovering a target's DNS records, subdomains, and mail servers to map its external footprint. Common records include A, MX, TXT, and CNAME entries.

A DNS mechanism (AXFR) that replicates records between name servers. If misconfigured to allow arbitrary clients, it can reveal the full internal namespace of a domain.

A logical segmentation of a switch into isolated broadcast domains. VLAN hopping attacks abuse trunking and tagging to reach traffic on other segments.

A Layer 2 protocol that prevents switching loops by electing a root bridge and blocking redundant links. Attackers can manipulate it to become root and intercept traffic.

Sending forged ARP replies to associate an attacker's MAC address with another host's IP. This enables man-in-the-middle interception on a local network segment.

A set of rules on routers or firewalls that permit or deny traffic based on addresses, ports, and protocols. Weak or overly broad rules are common assessment findings.

Server Message Block, a Windows protocol for file and printer sharing and remote administration. Misconfigured shares and legacy versions are frequent attack paths.

The Windows file storing local account password hashes. Attackers with sufficient privileges extract it to crack credentials or perform pass-the-hash attacks.

An attack that authenticates using a captured password hash without cracking it to plaintext. It exploits protocols that accept hashes as credentials.

An anonymous SMB connection made without valid credentials. If permitted, it can expose user lists, shares, and policy information to unauthenticated attackers.

A Windows mechanism for centrally enforcing security and configuration settings across domain machines. Weak GPO permissions can let attackers push malicious settings domain-wide.

Microsoft's directory service for managing users, computers, and permissions in a Windows domain. Its trust relationships and delegation make it a prime assessment target.

Requesting service tickets for accounts with service principal names, then cracking them offline. It targets weak service account passwords without needing elevated access.

A Unix permission flag that makes an executable run with the file owner's privileges. Poorly written SUID programs are classic local privilege escalation vectors.

A Unix utility allowing permitted users to run commands as another user, typically root. Misconfigured sudoers entries frequently enable privilege escalation.

Searching a Unix filesystem for files with the SUID or SGID bit set to identify potential escalation paths. Results are reviewed against known exploits and misconfigurations.

A scheduled task on Unix systems defined in crontab files. World-writable scripts or PATH issues in cron jobs can allow privilege escalation.

Inserting crafted SQL syntax into application input so the database executes unintended queries. It can expose, modify, or destroy data and sometimes the host.

SQL injection where results are not directly returned, so attackers infer data through true/false responses or timing delays. It requires careful, methodical probing.

A parameterized database query that separates SQL code from user-supplied data. It is the primary defense against SQL injection.

Injecting script into pages viewed by other users, which then runs in their browsers. It can steal sessions, alter content, or perform actions as the victim.

Causing a logged-in user's browser to send an unwanted authenticated request to a vulnerable site. Defenses include anti-CSRF tokens and SameSite cookies.

Checking and constraining user-supplied data against expected format, length, and type. It is a foundational control against injection and scripting attacks.

Manipulating file path input with sequences such as ../ to access files outside the intended directory. It can expose configuration files and credentials.

Injecting carriage-return and line-feed characters into headers so a response is interpreted as multiple responses. It can enable cache poisoning and script injection.