EC-Council LPT Master flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PTES phases

Pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. The fixed order makes engagements repeatable and auditable across testers.

Rules of engagement

A written agreement defining in-scope targets, excluded systems, testing windows, permitted techniques, emergency contacts, and data-handling constraints, signed by someone with authority over every in-scope asset.

Boolean-based SQL injection

Injecting true and false conditions and comparing responses. A consistent difference between the two responses confirms injection even when error messages are suppressed.

UNION column enumeration

Incrementing ORDER BY n until the query fails reveals the column count. The UNION SELECT statement must then match that count and use compatible data types.

DOM-based XSS

Attacker-controlled source data reaches a dangerous sink such as innerHTML in the browser, executing script without the payload appearing in the server response.

Local file inclusion

A file include sink accepts user-controlled paths, allowing traversal to read local files. Combined with writable logs or wrappers it can escalate to code execution.

Remote file inclusion

An include sink accepts a remote URL. Exploitation requires remote inclusion enabled, outbound reachability from the target, and evidence of execution rather than mere retrieval.

Executive summary content

A business-risk narrative covering exposure, regulatory consequence, and operational disruption, deliberately omitting payloads and low-level technical detail.

Reproducible finding evidence

Full request and response, exact command line, timestamp, and target identifier, sufficient for a technical reader to recreate the result without guessing.

Finding closure criterion

A finding is closed only when the original exploit vector is re-executed and fails. A patch ticket marked resolved is not verification.

Stack overflow offset

The distance from the buffer start to the saved return address, measured with a cyclic pattern by locating the overwritten bytes in memory.

Return-oriented programming

Chaining short instruction sequences ending in a return to invoke existing code, bypassing a non-executable stack without injecting new code.

ASLR defeat

Address space layout randomization requires an information leak or a non-randomized module to learn a usable address before redirecting execution.

Unquoted service path

A Windows service binary path containing spaces without quotes lets an attacker plant a binary in a writable directory earlier in the search order.

SeImpersonatePrivilege abuse

A Windows token privilege allowing impersonation of another user's token, frequently used to escalate from a service account to SYSTEM.

SUID binary risk

A Linux executable with the SUID bit runs as its owner, often root. Shell escapes and environment-variable handling in such binaries are escalation candidates.

Linux capabilities escalation

Capabilities such as cap_setuid or cap_dac_read_search granted to a binary provide targeted privilege without full SUID and are often overlooked.

Docker group escalation

Membership in the docker group allows mounting the host filesystem into a container, yielding root-equivalent read and write access to the host.

Lateral movement pivoting

Using a compromised host as a relay through port forwarding or a SOCKS proxy to reach network segments unreachable from the tester's origin.

Finding chain documentation

Recording a sequence of low-severity issues as one finding with each link and precondition listed, so remediation can break the cheapest step.

Remote proctoring conditions

Identity verification with photo ID, live camera monitoring, screen observation, and a cleared room with no secondary devices or other people present.

Exam content confidentiality

The candidate agreement prohibits capturing or sharing exam items. Exposure undermines the credential for every holder and is subject to invalidation.

Get-out-of-jail letter

A document naming the tester, client, scope, and authorization window, carried during active testing to demonstrate lawful permission if questioned.

Coverage metric

Assets tested divided by assets in scope, supplemented by endpoints exercised over endpoints discovered and authentication states tested.

Scanner alert versus finding

An automated alert is an unvalidated lead. It becomes a finding only after manual reproduction with a controlled request and observed response.

Time-based SQLi confirmation

Repeated delayed requests compared against a baseline of clean requests. Consistent timing differences confirm injection where output is unavailable.

Post-exploitation cleanup

Removing uploaded tools, reverting configuration changes, closing created accounts, and obtaining client confirmation that no residual access remains.

Detection testing value

Correlating timestamped attacker-side logs with client monitoring records measures whether defensive controls observed the simulated intrusion.

Business-aligned severity

Adjusting technical severity by the business criticality of the affected asset, so remediation effort follows actual organizational risk.

Remediation specificity

Naming the exact configuration setting, code change, or patch level required, rather than a general category such as improve input validation.

Kernel exploit safety

Kernel exploits require exact version matching and can panic the host. Confirm snapshot or rollback before running against any production system.

Exam time budgeting

Allocating a fixed block per methodology phase and reserving a defined final block for report writing, since the report is a graded deliverable.