EC-Council LPT Master key terms

An open, phase-based framework that structures a penetration test from pre-engagement scoping through intelligence gathering, threat modeling, exploitation, post-exploitation, and reporting so results are consistent and repeatable.

A written agreement defining in-scope targets, excluded systems, testing windows, allowed techniques, escalation contacts, and stop conditions before any active testing begins.

The uncontrolled expansion of testing beyond agreed targets or techniques, which invalidates authorization and can expose the tester and client to legal and operational risk.

An authorization document signed by an executive with authority over the assets, kept on hand by the tester to prove permitted activity if law enforcement or a third party intervenes during testing.

The contractual document listing deliverables, timelines, effort, pricing, and acceptance criteria for an engagement, distinct from the technical rules governing how testing is performed.

A structured exercise that maps likely adversaries, their goals, and the assets they would target so testing effort is prioritized toward realistic attack paths instead of exhaustive scanning.

A stage model of an intrusion, from reconnaissance and weaponization through delivery, exploitation, command and control, and actions on objective, used to describe where a test stops or succeeds.

A follow-up engagement that verifies whether previously reported findings were remediated correctly and whether fixes introduced new weaknesses, usually reported as pass or fail per finding.

A chained sequence of weaknesses and credentials that lets an adversary move from an initial foothold to a high-value objective, demonstrating real impact beyond isolated findings.

A technique that appends a UNION SELECT statement to an injectable query so the attacker can retrieve data from other tables in the same result set, requiring matching column counts and compatible data types.

An injection where query output is not returned to the attacker, so data is inferred from true/false responses or measured time delays instead of visible results.

A blind technique that confirms injection and extracts data one bit at a time by causing deliberate database delays, such as a sleep function, and measuring how long responses take.

An injection that forces the database to return error messages containing query structure or data, making it the fastest way to confirm and map an injectable parameter.

An attack where malicious input is stored safely at first, then reused unsanitized in a later query such as a profile update or report, so the payload executes in a different code path.

A parameterized query where SQL structure is fixed before user data is bound, preventing input from being interpreted as code and eliminating most classic injection variants.

A script injection where the payload is persisted server-side, such as in a comment or profile field, and executes in the browser of every user who later views that content.

A script injection where the payload is echoed back in the immediate response, usually delivered through a crafted link or form that tricks a victim into executing it.

A client-side injection where untrusted data flows from a browser source such as the URL fragment into a dangerous sink like innerHTML, without the payload ever reaching the server.

A response header that restricts which script sources a browser may execute, mitigating script injection but requiring careful configuration because unsafe directives or JSONP endpoints can bypass it.

Context-aware transformation of untrusted data before it is placed in HTML, attributes, JavaScript, or URLs, ensuring the browser treats it as text rather than executable markup.

A vulnerability where user-controlled input selects a file the server includes, allowing an attacker to read local files or, if combined with log poisoning, execute code.

A file inclusion flaw where the application loads a file from an attacker-controlled remote URL, typically leading directly to remote code execution when the allow_url_include setting is enabled.

The use of sequences such as dot-dot-slash to escape a restricted directory and reach files outside the intended web root, often chained with file inclusion to read sensitive configuration.

A stream scheme such as php://filter or data:// that changes how a file inclusion reads or decodes content, frequently used to read source code or achieve execution without uploading a file.

The practice of writing a payload into a log file, such as the user agent field in an access log, then including that log through LFI so the payload executes as server-side code.

The opening report section written for non-technical leadership that states overall risk posture, business impact, key themes, and prioritized recommendations without exploit-level detail.

A report entry that documents one vulnerability with affected asset, reproduction steps, evidence, affected component, and references, written so an engineer can independently verify and fix it.

A scored severity assigned to a finding using a documented method such as CVSS combined with business context, so management can compare and prioritize remediation work.

Minimal, reproducible evidence that demonstrates a vulnerability is exploitable, kept just sufficient to prove impact while avoiding unnecessary data exposure or service disruption.

Specific, actionable advice for closing a finding, including configuration changes, code fixes, compensating controls, and references, rather than a generic instruction to patch.

A script or program that takes advantage of a specific weakness to achieve a defined outcome, such as code execution, file read, or authentication bypass, on a target.

The portion of an exploit delivered to and executed on the target, which defines what happens after the vulnerability is triggered, such as spawning a shell or adding a user.

A small first-stage payload that connects back and downloads a larger second stage, useful when the initial injection point limits how much data can be delivered at once.

A connection where the compromised host initiates a session back to the attacker, commonly used to bypass inbound firewall rules that block listening ports on the target.

A shell where the target opens a listening port that the attacker connects to, which fails when egress filtering or NAT prevents inbound connections to the victim.

A small server-side script uploaded to a web server that accepts commands over HTTP, giving persistent remote command execution through the web application's own permissions.

The process of moving from a lower-privileged account to a higher one, such as a standard user to administrator or root, by abusing misconfigurations, weak permissions, or unpatched local flaws.

A Linux executable marked to run with the file owner's privileges, so a misconfigured or exploitable SUID program owned by root can be abused to obtain a root shell.

A Windows service whose executable path contains spaces but no quotes, letting an attacker place a malicious binary at an earlier interpreted path so the service runs attacker code as its account.

A Windows attack that steals or duplicates an access token from a higher-privileged process or session and uses it to act as that user without knowing their password.

Exploiting Linux capabilities granted to a binary, such as cap_setuid, to perform privileged operations that the invoking user would otherwise be denied.

Techniques for moving from one compromised host to other systems in the same environment using harvested credentials, trust relationships, or remote execution services.

Authenticating with a captured NTLM hash instead of a plaintext password, allowing access to remote systems where the same credential is reused.

Routing attack traffic through a compromised host so the tester can reach network segments that are not directly accessible from the testing workstation.

An encapsulated channel, such as SSH port forwarding or a SOCKS proxy, that carries traffic through a compromised host to reach otherwise unreachable services.

The practice of looking beyond standard tool output to find unconventional chains, such as combining a low-severity information leak with a default credential to reach a critical system.

Activity after a foothold is obtained, including privilege escalation, credential harvesting, data access demonstration, and cleanup, all bounded by the agreed rules of engagement.