CSPT key terms

The commercial contract for an engagement that sets out deliverables, schedule, level of effort, assumptions and cost. It defines what the client is buying and what the tester is obligated to produce.

The named person on the client side and on the tester side responsible for coordination, approvals and emergency escalation. Testers must know how to reach them at any hour during testing.

A contract obligating the tester to keep client information confidential and restricting how findings, credentials and data encountered during testing may be used, stored or disclosed.

A written agreement describing how testing will be conducted: allowed techniques, in-scope targets, timing, prohibited actions such as denial of service, and the escalation path when something goes wrong.

The explicit list of addresses, hostnames, applications, accounts and environments authorized for testing, together with what is excluded. Anything not listed must not be touched, even if reachable.

A signed statement from someone with authority at the client confirming that testing of the listed assets is permitted during stated dates. It is the document produced if activity is questioned.

The agreed dates and hours during which testing activity may take place, often set to avoid business-critical periods. Activity outside this window is unauthorized even if the target is in scope.

Collecting and correlating publicly available information such as registered domains, employee roles, technology job adverts and leaked credentials to map an organization's exposure without touching its systems.

Gathering information about a target from third-party sources, cached pages and public records without sending traffic to the target's own systems, making it very hard for the target to detect.

Directly querying and probing the target's systems to discover hosts, open ports, services and versions. It produces logs and can trigger monitoring, so timing must respect the rules of engagement.

Discovering hostnames under a parent domain using wordlists, DNS records, certificate logs and search engines. Forgotten development, staging and VPN portals found this way often carry weaker controls.

Public append-only logs of issued TLS certificates. Searching them reveals hostnames an organization has provisioned, including internal or staging systems that were never linked from public pages.

Automated checks that compare hosts and applications against known signatures and configuration baselines to produce candidate weaknesses. Results are leads, not findings, until a human confirms them.

A reported weakness that either does not exist or cannot be exploited in the target's actual configuration. Reporting these without checking damages credibility and wastes the client's remediation effort.

Human confirmation that a suspected weakness is genuine and reachable, usually by reproducing the condition carefully and recording the exact request, response and result.

A standardized framework that scores vulnerability severity from metrics such as attack vector, complexity, privileges required and impact. Scores help compare issues but do not replace business context.

A minimal, controlled demonstration that a weakness can actually be exploited, showing the precise steps or request and the resulting evidence while avoiding damage or data loss.

Using a compromised host as a relay point to reach network segments and services that are not directly reachable from the tester's own machine.

Redirecting a local port through a compromised host to a service on an internal network, so ordinary tools can interact with the internal target as though it were local.

A proxy tunnel built over an existing foothold that relays arbitrary TCP connections through the compromised host, letting scanning and client tools reach many internal addresses at once.

Moving from one compromised system to other hosts in the environment using stolen credentials, remote execution services or trust relationships, with the aim of reaching higher-value assets.

Supplying database syntax through unsanitized input so the application executes altered queries, which can bypass authentication, disclose data or modify records.

Injecting script into content that other users will view, so it runs in their browsers and can steal sessions, perform actions as them or manipulate what they see.

Accessing another user's records by changing an identifier in a request, because the application verifies that a user is logged in but not that they own the object.

Causing the server to issue requests to destinations the attacker chooses, such as internal services or cloud metadata endpoints, exploiting the server's own network position and trust.

A small script placed on a web server that accepts commands over HTTP, giving the attacker remote execution in the context of the web service account.

Requesting Kerberos service tickets for accounts that have service principal names, then cracking the encrypted material offline to recover the service account's password.

Requesting authentication response data for accounts configured without Kerberos pre-authentication, then cracking it offline to obtain those accounts' passwords without any prior access.

A graph analysis tool that maps users, computers, sessions and permissions in Active Directory to reveal the shortest relationship paths from a starting account to highly privileged targets.

Exploiting delegated Active Directory permissions, such as GenericAll or WriteDACL, to reset passwords, add group members or grant rights without cracking any credentials.

Impersonating a domain controller's replication request to pull stored password hashes for domain accounts, including the krbtgt account, from Active Directory.

A Linux executable marked to run with the permissions of its owner rather than the caller. Certain binaries can be abused to execute commands as root.

A sudoers entry that lets a user run particular commands as root, where those commands can be leveraged to read files, spawn a shell or edit permissions.

A Windows service whose executable path contains spaces and lacks quotation marks, allowing an attacker who can write to a parent directory to plant a binary that the service runs as its own account.

Abusing Windows access tokens held by services or logged-on users, often through the SeImpersonate privilege, to execute code in a higher-integrity or more privileged security context.

A short, non-technical opening section describing the engagement, the overall risk posture and the most important themes, written for decision makers who will not read the technical detail.

Assigning severity to each finding by combining technical impact with business context such as data sensitivity and exposure, so the client can prioritize remediation sensibly.

A documented record of who collected each piece of evidence, when, from where, and every transfer or storage location since, so its integrity can be defended later.

Recording proof of exploitation, such as timestamped screenshots, command output and HTTP requests, stored securely and referenced in the report so findings can be reproduced.

Specific actionable advice on how to fix a finding, covering code or configuration changes, compensating controls where a full fix is delayed, and how the fix can be verified.