eJPT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

TCP SYN scan

Nmap -sS sends SYN packets without completing the TCP handshake. It requires root privileges and is faster and quieter than a full connect scan.

Nmap -Pn

Skips host discovery and treats every specified target as online. Used when firewalls or ICMP filtering make a live host appear down.

Meterpreter getsystem

Attempts to raise a Windows session to SYSTEM using techniques such as named-pipe impersonation, token duplication, and service creation.

Pass-the-hash attack

Authenticates to a remote service using a captured NTLM hash without cracking it. Impacket psexec and CrackMapExec accept hashes via -hashes.

Meterpreter portfwd

Creates a local port forward through an active session, letting local tools reach services on networks the compromised host can access.

enum4linux

Linux utility that enumerates SMB and NetBIOS information from Windows hosts, including users, groups, shares, and password policy.

SUID privilege escalation

Files with the SUID bit execute as their owner. find / -perm -4000 -type f 2>/dev/null lists candidates that may spawn privileged shells.

Mimikatz sekurlsa

Module that extracts plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory on a Windows host when run with sufficient privileges.

PTES phases

Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting, executed in that order.

Passive reconnaissance

Collecting information about a target without sending traffic to its systems, for example through whois, Shodan, search engines, and third-party DNS data.

Active reconnaissance

Directly probing target systems with tools such as Nmap, dig, or banner grabbers. The traffic generated can be logged by the target.

DNS zone transfer

An AXFR query against a misconfigured authoritative nameserver that returns every record in a zone, exposing internal hosts and subdomains.

CVSS score bands

Version 3 base scores map to 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, and 9.0-10.0 critical, derived from exploitability and impact metrics.

Rules of engagement

A document defining scope, permitted techniques, testing windows, emergency contacts, and legal authorization, agreed before any testing activity begins.

Threat modeling

Identifying probable attackers, their capabilities, and the highest-value assets so that testing effort focuses on the vulnerabilities that matter most.

theHarvester

Open-source intelligence tool that collects emails, subdomains, hosts, and employee names for a target domain from public sources and search engines.

Lynis

Host-based auditing tool for Linux and Unix systems that checks hardening, file permissions, and configuration against baselines and produces a scored report.

Credentialed scan

A vulnerability scan that authenticates to the target over SSH or SMB, enabling local package and configuration checks for far more accurate results.

netstat -tulpn

Lists listening TCP and UDP sockets on Linux along with the process IDs and program names that own them, exposing unnecessarily exposed services.

Event ID 4625

Windows Security log entry recording a failed logon. Repeated occurrences indicate brute-force attempts or password spraying against local or domain accounts.

AIDE

Advanced Intrusion Detection Environment is a file integrity checker that stores hashes of monitored files and alerts when they change unexpectedly.

CIS Benchmarks

Consensus configuration hardening baselines for operating systems and applications, used to audit settings and compute a compliance score.

auditpol

Windows command that displays or configures audit policy. auditpol /get /category:* shows which event categories are currently being logged.

SMB signing

A cryptographic signature applied to SMB traffic. When required on servers it blocks NTLM relay attacks that reuse captured authentication attempts.

SQL injection probe

Inserting a quote or boolean expression such as ' OR 1=1-- to test whether user input alters query logic and returns additional rows.

sqlmap --dbs

Automates SQL injection exploitation. After confirming an injectable parameter, the --dbs flag enumerates the names of databases on the server.

Reflected XSS

Injected script is returned in the immediate response and executes in the victim's browser when the crafted URL is opened.

Burp Repeater

A component that resends a single captured HTTP request after manual edits, allowing methodical probing of one parameter at a time.

Local file inclusion

Occurs when an application includes files from a server path. Traversal such as ../../../../etc/passwd confirms arbitrary file reads.

PHP filter wrapper

php://filter/convert.base64-encode/resource=index.php returns base64-encoded file contents, revealing source code when inclusion only shows output.

HttpOnly flag

A cookie attribute that prevents JavaScript from reading the cookie, reducing session theft through cross-site scripting attacks.

gobuster dir

Brute-forces web directories and files with a wordlist to discover hidden paths that are not linked anywhere on the visible site.