CSPT flashcards
CSPT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Engagement Letter
- Formal document authorizing penetration testing and defining parties, scope, and limitations; an authorized representative signs it before active testing begins.
- Non-Disclosure Agreement
- Legal contract that prohibits disclosure of confidential information learned during testing and protects client data, credentials, and findings from unauthorized release.
- Escalation Contact
- Named individual and backup reachable during testing for emergencies, scope questions, and incident response; confirm both before active testing starts.
- In-Scope Assets
- Explicit list of systems, networks, applications, cloud accounts, or people authorized for testing, expressed as CIDR ranges, hostnames, URLs, or account identifiers.
- Out-of-Scope Assets
- Assets and techniques explicitly excluded from testing, such as third-party SaaS, shared infrastructure, production data, or partner networks, to prevent unauthorized impact.
- Testing Window
- Approved dates, times, and time zone during which active testing may occur, including blackout periods and maximum request rates.
- Passive Reconnaissance
- Information gathering from public sources without sending packets to the target, including WHOIS, DNS records, certificate logs, search engines, and breach data.
- Certificate Transparency
- Public logs of TLS certificates that can reveal subdomains and hostnames; search by domain or organization using services such as crt.sh.
- DNS Zone Transfer
- AXFR query to an authoritative name server that returns all zone records if misconfigured; reveals hostnames, IPs, and mail servers.
- Autonomous System Number
- Identifier for a network's routing domain; ASN and BGP lookups map IP ranges to organizations for external reconnaissance.
- CVSS Base Score
- Numerical severity from 0 to 10 derived from exploitability and impact metrics; it excludes temporal and environmental factors.
- False Positive
- Scanner finding that does not represent an exploitable vulnerability; common causes include version-only matches, backported patches, and misread banners.
- Authenticated Scan
- Vulnerability scan that logs into hosts with credentials to inspect installed patches and configuration, reducing false positives compared with unauthenticated scanning.
- CWE Identifier
- Taxonomy code classifying the type of software weakness, such as CWE-79 for cross-site scripting, independent of any specific product vulnerability.
- SSH Local Forwarding
- Command ssh -L localport:target:targetport user@pivot binds a local listener that forwards traffic through the pivot to the target service.
- SOCKS Proxy
- Proxy protocol that relays arbitrary TCP connections; ssh -D or Chisel can create a SOCKS proxy for proxychains to route tools through a pivot.
- Pass-the-Hash
- Authentication technique using an NTLM hash directly instead of a plaintext password; tools such as Impacket and Mimikatz support it.
- Insecure Direct Object Reference
- Access control flaw where a user-controlled identifier, such as an account number or file ID, exposes another user's object without authorization checks.
- Server-Side Request Forgery
- Vulnerability where the server fetches a user-supplied URL, enabling access to internal services or cloud metadata such as 169.254.169.254.
- Time-Based SQL Injection
- Blind SQL injection technique that infers query results from deliberate database delays, using conditional sleeps or heavy queries.
- Cross-Site Scripting
- Injection of client-side script into pages viewed by other users; variants are reflected, stored, and DOM-based, and impact depends on session and CSP controls.
- Kerberoasting
- Attack that requests Kerberos service tickets for accounts with SPNs and cracks them offline to recover service account passwords.
- DCSync
- Credential theft technique that impersonates domain controller replication to request password hashes, requiring replication permissions such as DS-Replication-Get-Changes.
- BloodHound
- Graph analysis tool that ingests Active Directory collection data to reveal privilege escalation paths through ACLs, sessions, and group memberships.
- SeImpersonatePrivilege
- Windows privilege allowing a process to impersonate another user's token; service accounts often hold it, enabling Potato-family privilege escalation.
- SUID Binary
- Linux executable with the set-user-ID bit set; it runs with the file owner's privileges, often root, and can be abused via GTFOBins.
- Unquoted Service Path
- Windows service path containing spaces without quotes; the system may execute a malicious binary placed in an earlier writable directory.
- Executive Summary
- Non-technical report section describing overall security posture, key risks, and business impact for decision-makers, without exploit-level detail.
- Finding Reproduction Steps
- Ordered instructions, requests, and payloads that let a third party independently verify a reported vulnerability and confirm the affected asset.
- Chain of Custody
- Chronological record of evidence collection, handling, transfer, and storage, with signatures and timestamps, to preserve admissibility and integrity.
- SHA-256 Hash
- Cryptographic digest used to verify evidence integrity; compute at collection and before analysis, and record values in the report.
- Remediation Guidance
- Specific, prioritized actions to fix a finding, including configuration changes, patches, validation criteria, and residual risk acceptance.