CREST CCT key terms

A formal document that defines the scope, constraints, communication protocols, and authorized activities for a security assessment. It ensures all parties agree on what is permitted and what is off-limits.

The defined boundaries of a security assessment, specifying which systems, networks, applications, or assets are included and which are excluded. It prevents unauthorized testing and legal issues.

A written document from an authorized representative of the target organization granting permission to conduct security testing. It serves as legal protection and proof of consent.

A testing approach where the tester has no prior knowledge of the target's internal structure, code, or infrastructure. It simulates an external attacker with no inside information.

A testing approach where the tester has full knowledge of the target's internal workings, including source code, architecture, and credentials. It allows for thorough analysis and efficient identification of vulnerabilities.

A testing approach where the tester has partial knowledge of the target, such as limited credentials or documentation. It balances realism with efficiency by simulating an attacker with some insider access.

A systematic process of identifying, quantifying, and prioritizing vulnerabilities in a system. It typically involves automated scanning and manual verification but does not include exploitation.

A simulated cyber attack against a system to evaluate its security. It involves identifying and exploiting vulnerabilities to determine the potential impact on the organization.

The automated process of probing systems, networks, or applications to identify known vulnerabilities, misconfigurations, and missing patches. It produces a list of potential weaknesses for further analysis.

A piece of software, code, or sequence of commands that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access or executing arbitrary code.

The component of an exploit that performs a malicious action, such as opening a reverse shell, creating a user account, or exfiltrating data. It is delivered by the exploit.

A demonstration that a vulnerability exists and can be exploited, often using minimal code or steps. It validates the finding without causing harm and is included in reports.

A reported vulnerability that is not actually present or exploitable. It can result from misinterpretation of scanner output or incorrect manual analysis, leading to wasted effort.

A vulnerability that exists but is not detected by a scanner or tester. It represents a missed weakness and can lead to a false sense of security.

A standardized identifier for publicly known cybersecurity vulnerabilities. Each CVE entry includes a unique ID, description, and references, enabling consistent tracking across tools and databases.

A framework for rating the severity of security vulnerabilities based on intrinsic characteristics. It produces a score from 0 to 10, helping prioritize remediation efforts.

A U.S. government repository of standards-based vulnerability management data, including CVE details, CVSS scores, and remediation information. It enriches CVE data with additional analysis.

A nonprofit foundation that produces freely available articles, methodologies, documentation, tools, and technologies in the field of web application security, including the OWASP Top Ten.

A regularly updated list of the ten most critical web application security risks, published by OWASP. It raises awareness and helps organizations prioritize mitigation efforts.

A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQL statements. It can lead to data theft, modification, or deletion.

A vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. It can lead to session hijacking, defacement, or redirection to malicious sites.

An attack that tricks a authenticated user into unknowingly submitting a malicious request. It exploits the trust a website has in the user's browser to perform unwanted actions.

A vulnerability that allows an attacker to execute arbitrary commands or code on a target system remotely. It is often considered the most severe type of vulnerability.

The process of gaining higher-level permissions or access on a system than initially granted. It can be vertical (gaining admin rights) or horizontal (accessing another user's resources).

Techniques used by attackers to move from one compromised system to another within a network, seeking valuable data or higher privileges. It often involves credential theft and remote execution.

A technique where an attacker uses a compromised system as a launching point to attack other systems in the same or different network. It bypasses network segmentation and firewall restrictions.

A connection initiated from a compromised target back to the attacker's machine, providing command-line access. It bypasses inbound firewall rules that block incoming connections.

A connection where the compromised target listens on a port and the attacker connects to it, gaining command-line access. It requires the target to accept inbound connections.

Encapsulating one protocol within another to bypass network restrictions or to create a covert channel. It is often used to exfiltrate data or maintain access through firewalls.

The unauthorized transfer of data from a compromised system to an external location controlled by the attacker. It is a key objective in many cyber attacks.

The infrastructure and techniques used by attackers to communicate with and control compromised systems. It enables remote command execution and data retrieval.

A qualitative or quantitative assessment of the severity and likelihood of a vulnerability being exploited, often considering impact and existing controls. It helps prioritize remediation.

The process of evaluating the potential consequences of a vulnerability being exploited, including financial, operational, and reputational damage. It informs risk prioritization.

The act of fixing or mitigating a vulnerability, such as applying a patch, changing a configuration, or implementing a compensating control. It is a key recommendation in reports.

A measure taken to reduce the likelihood or impact of a vulnerability being exploited, without necessarily eliminating it. Examples include network segmentation or input validation.

A concise overview of a penetration test report aimed at non-technical stakeholders. It highlights key findings, overall risk posture, and strategic recommendations without technical jargon.

A detailed document that describes the methodology, findings, evidence, and remediation steps from a penetration test. It is intended for technical staff to understand and fix vulnerabilities.

A documented process that records the seizure, custody, control, transfer, analysis, and disposition of evidence. It ensures the integrity and admissibility of evidence in legal proceedings.

The process of collecting, securing, and maintaining data in a forensically sound manner to prevent alteration or loss. It is critical for incident response and legal cases.

A structured approach to handling security incidents, including preparation, detection, containment, eradication, recovery, and lessons learned. It aims to minimize damage and restore normal operations.