eJPT key terms

An authorized, goal-driven simulation of real attacks against agreed targets to prove which weaknesses are exploitable and what damage they could cause, ending in a report with remediation advice.

A systematic scan and enumeration of systems to find and rank known weaknesses. It normally stops at identification, without proving exploitability or real business impact.

A written agreement covering targets, timing, permitted techniques, emergency contacts, and data handling, so testing stays legal and does not disrupt the client's business.

The explicit list of IP ranges, hostnames, applications, and accounts a test may touch, together with anything expressly excluded. Testing outside scope is unauthorized.

Collecting information about a target before exploitation. Passive recon uses public sources only; active recon sends traffic to the target's own systems and networks.

Intelligence gathered from publicly available sources such as search engines, social media, WHOIS records, job adverts, and certificate transparency logs, without directly touching the target.

A vendor-neutral scoring system that rates vulnerability severity from zero to ten using metrics for attack vector, complexity, privileges required, user interaction, and impact.

A finding reported by a scanner or tester that does not really exist or cannot be exploited in the target's actual configuration, wasting remediation effort.

The Penetration Testing Execution Standard, a phased methodology covering pre-engagement, intelligence gathering, threat modeling, exploitation, post-exploitation, and reporting.

A port scan that sends TCP SYN packets and reads the replies: SYN-ACK means open, reset means closed, silence usually means filtered. The handshake is never completed.

Connecting to a listening service and reading the greeting or response headers it returns, revealing software name, version, and sometimes configuration details.

Actively querying discovered services for versions, users, shares, policies, and configuration so the tester can map attack surface and choose relevant exploits.

Querying Server Message Block services for shares, users, groups, and operating system details; weak SMB configuration often leaks credentials and file access.

An unauthenticated SMB connection, usually to the IPC$ share, that on badly configured legacy systems reveals user, group, and share information.

Sending forged ARP replies so victims map a legitimate IP address to the attacker's MAC address, letting the attacker intercept or modify local network traffic.

Answering broadcast name-resolution requests with the attacker's address so victims authenticate to the attacker, who captures hashes to crack or relay.

Authenticating with a captured NTLM hash instead of the plaintext password, letting an attacker reach other systems without ever cracking the hash.

Requesting Kerberos service tickets for accounts that have service principal names, then cracking those tickets offline to recover the service account password.

Raising the level of access on a compromised host, for example from standard user to administrator or root, by abusing misconfigurations, weak permissions, or missing patches.

Moving from one compromised machine to other hosts in the environment using stolen credentials, trust relationships, or remote execution tools, to reach higher-value targets.

Using a compromised host as a relay so the tester can reach internal systems that are not routable from the attack machine, often via port forwarding or a proxy.

A payload in which the target opens a connection back to a listener the attacker controls, which usually passes outbound firewall rules more easily than inbound ones.

Recovering plaintext passwords from captured hashes with wordlists, mangling rules, or brute force using tools such as Hashcat or John the Ripper.

A documented, approved set of settings for a system or device, used as the reference against which the live configuration is compared during an audit.

Consensus hardening guides published for specific operating systems and applications, listing concrete settings and values an auditor can check and score.

Giving users, services, and applications only the access they need for their tasks, which limits the damage a compromised account or insider can do.

The repeatable process of identifying, testing, and deploying software updates so known vulnerabilities are closed within an agreed timeframe.

Hashing critical files and alerting when they change, which exposes tampering, unauthorized edits, or malware that modifies system binaries and configuration.

Regularly examining system, application, and security logs for anomalies and policy violations; a detective control that auditors expect to see documented and performed.

Supplying SQL syntax through user-controlled input so the database runs attacker-chosen queries, which can leak, alter, or delete data and sometimes execute commands.

Injecting script into content other users view so it executes in their browsers, letting the attacker steal session cookies, log keystrokes, or act as the victim.

An attack where a victim's browser is tricked into sending an authenticated state-changing request to a site that trusts the session cookie, without the user's intent.

A flaw where the application takes an object identifier from the request but never checks that the requester owns it, exposing other users' records.

User input chooses which file the server includes, letting an attacker read local files and, combined with log poisoning or uploads, often achieve code execution.

Untrusted input reaches an operating system shell, so the attacker appends or substitutes commands that run with the web server's privileges.

Making the server issue requests to destinations the attacker chooses, reaching internal services, cloud metadata endpoints, or localhost ports that are not externally exposed.

A tool such as Burp Suite or ZAP placed between browser and server so requests and responses can be paused, inspected, replayed, and modified during testing.

A script uploaded to a web server that accepts commands over HTTP, giving the attacker persistent remote execution that blends in with normal web traffic.