CREST CCT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Black-box testing

A testing approach where the assessor has no prior knowledge of the target's internals, source code, or architecture, and probes it as an external attacker would.

Rules of engagement

The documented agreement defining scope, permitted techniques, test windows, escalation contacts, and data-handling constraints that govern how testing is performed.

PTES phases

A penetration testing standard whose phases run from pre-engagement interactions and intelligence gathering through threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.

Threat modeling

A structured analysis identifying assets, entry points, trust boundaries, and adversary capabilities to determine where security controls and testing effort should focus.

STRIDE categories

A threat classification scheme: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, used to enumerate threats against a system design.

Grey-box testing

Testing performed with partial knowledge of the target, such as valid low-privilege credentials or architecture diagrams, simulating an insider or a partially informed attacker.

ATT&CK tactics and techniques

A knowledge base of adversary behavior where tactics describe the attacker's goal and techniques describe the specific method used to achieve it.

Retest criteria

Pre-agreed conditions, method, and evidence standard used to verify that a reported vulnerability has been remediated, defined before testing begins.

CVSS v3.1 base metrics

Eight metrics: attack vector, attack complexity, privileges required, user interaction, scope, and confidentiality, integrity, and availability impact, producing a 0.0 to 10.0 score.

CVSS severity bands

Qualitative ranges for CVSS v3.1 scores: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical.

CVE versus CWE

CVE identifies a specific publicly disclosed vulnerability instance, while CWE classifies the underlying weakness type such as buffer overflow or SQL injection.

EPSS score

An estimate of the probability that a specific CVE will be exploited in the wild within the next 30 days, used alongside severity scoring.

False positive control

The practice of confirming each finding with reproducible evidence and stated preconditions before reporting it, avoiding claims based only on version banners.

IDOR vulnerability

Insecure Direct Object Reference: an access control flaw where changing an object identifier in a request grants access to another user's data.

SSRF weakness

Server-Side Request Forgery: the server can be induced to fetch an attacker-chosen URL, potentially reaching internal services or cloud metadata endpoints.

TLS configuration review

Assessment of supported protocol versions, cipher suites, certificate validity, chain trust, and hostname matching to identify weak or misconfigured transport security.

Blind SQL injection

An injection case where output is not reflected, so confirmation relies on boolean response differences or consistent time delays from injected database sleep functions.

Nmap -sS versus -sT

-sS performs a SYN half-open scan requiring raw socket privilege, while -sT completes full TCP connections and works without elevated privileges.

Nmap -sV and -sC

-sV enables service and version detection on open ports; -sC runs the default set of NSE scripts for additional service information.

Out-of-band confirmation

Verifying a blind vulnerability by causing the target to make a request to an attacker-controlled listener, such as a DNS or HTTP callback.

Linux privilege escalation checks

Enumerate SUID and SGID binaries, sudo rights, cron jobs, writable service scripts, PATH entries, and kernel version against known local exploits.

Offline versus online cracking

Online guessing is rate-limited and logged against a live service; offline cracking of captured hashes is limited mainly by hash type and hardware speed.

Lateral movement

Moving from a compromised host to other systems by abusing credentials, trust relationships, or stolen tokens, documenting each hop and the credential used.

Proof level

The pre-agreed extent of exploitation sufficient to demonstrate impact, such as one command executed or one file read, beyond which the tester stops.

Passive reconnaissance

Intelligence gathering from public sources such as DNS records, certificate transparency logs, and search engines without directly touching the target's systems.

Command injection marker

A harmless command or callback used to demonstrate command injection without causing damage, for example running id or triggering a DNS lookup.

Executive summary

The opening report section that states overall risk posture and business impact in non-technical language, aimed at decision makers rather than engineers.

Finding entry contents

A report item containing title, affected asset, severity with rationale, description, reproduction steps, evidence, business impact, and specific remediation guidance.

Contextual severity

Adjusting a vulnerability's business risk rating to reflect exposure, data sensitivity, and compensating controls, with the adjustment explained in the report.

Reproduction steps

Ordered instructions including credentials, URLs, payloads, and expected versus observed results, sufficient for a third party to verify the finding independently.

Responsible disclosure

Reporting vulnerabilities privately to the owner, agreeing a remediation timeline, and withholding public details until remediation or the agreed date.

Evidence data handling

Storing collected evidence encrypted, transferring it only over approved channels, and returning or deleting client data at engagement close as contracted.