eWPTX flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

UNION column count discovery

Increment ORDER BY position until the query errors, or inject NULL values one at a time into the SELECT list until the page renders normally, revealing the column count.

Time-based blind SQLi

An injection technique where the attacker infers true/false conditions from deliberate database delays such as SLEEP(), pg_sleep(), or WAITFOR DELAY, used when no output or content difference is observable.

Second-order SQL injection

A stored payload that is harmless at input time but executes when later retrieved and concatenated into a different query, such as a username used in an admin report.

NoSQL operator injection

Passing query operators like $ne or $gt through unsanitized JSON input so authentication checks match unintended documents, commonly bypassing login forms backed by MongoDB.

SSTI confirmation payload

Injecting an arithmetic expression such as {{7*7}} into a template-rendered field; a returned 49 confirms server-side template evaluation rather than plain reflection.

Blind command injection detection

Using out-of-band DNS or HTTP callbacks, or injected sleep commands, to confirm command execution when the application returns no direct output from the injected command.

XXE external entity

An XML DOCTYPE entity whose SYSTEM identifier points to a local file or remote URL, causing the parser to disclose file contents or make server-side requests.

Insecure deserialization gadget chain

A sequence of classes already present on the target whose magic methods (readObject, __wakeup) are triggered during deserialization to achieve code execution.

SSRF metadata endpoint

The cloud instance metadata address 169.254.169.254, reachable via SSRF to retrieve credentials or configuration from AWS, GCP, or Azure hosts.

SSRF filter bypass encodings

Representing 127.0.0.1 as decimal (2130706433), octal, or hex, or using DNS rebinding, to evade naive blocklists that match only the dotted-quad string.

Stored XSS impact

Persisted script execution affecting every viewer of the injected content, enabling session theft, CSRF-token bypass, and worm-like propagation within an application.

DOM XSS sink

Client-side functions like innerHTML, document.write, or eval that execute attacker-controlled data sourced from location.hash or similar without server involvement.

CSRF token bypass conditions

A token is ineffective if it is not tied to the user session, is validated only when present, or can be predicted; SameSite cookies also mitigate cross-site submission.

JWT alg none attack

Setting the JWT header algorithm to none and removing the signature; servers that accept it treat the token as valid without any cryptographic verification.

JWT key confusion

Signing a token with the RS256 public key while declaring HS256, exploiting servers that use the public key as an HMAC secret for verification.

IDOR testing method

Changing object identifiers in requests (numeric IDs, UUIDs, filenames) while authenticated as a low-privilege user to confirm missing server-side authorization checks.

HTTP request smuggling CL.TE

A desync where the front-end uses Content-Length and the back-end uses Transfer-Encoding, letting an attacker prepend a request that poisons the next user's connection.

Web cache poisoning

Injecting a payload into an unkeyed input so a cache stores the malicious response and serves it to other users; requires identifying cache keys versus unkeyed headers.

File upload bypass techniques

Defeating upload filters via double extensions, content-type spoofing, null bytes, .htaccess uploads, or polyglot files that pass image checks yet execute as code.

LDAP injection

Injecting filter metacharacters such as )(|(uid=* to alter directory queries, potentially bypassing authentication or enumerating directory entries.

Blind XPath injection

Inferring XML document structure through boolean substrings in injected XPath expressions when query results are not reflected in the response.

OAuth redirect_uri abuse

Exploiting loose redirect_uri validation to steal authorization codes or tokens by redirecting the flow to an attacker-controlled endpoint.

WebSocket handshake security

WebSocket connections do not enforce same-origin policy, so servers must validate the Origin header and authenticate each message rather than relying on the handshake alone.

Scope definition

The documented list of in-scope hosts, applications, and testing windows; anything discovered outside it is reported, not tested, to avoid legal exposure.

Rules of engagement

The agreement covering permitted techniques, prohibited actions, emergency contacts, and data handling, forming the boundary between authorized testing and unauthorized access.

Passive versus active recon

Passive recon gathers data from third parties (CT logs, DNS, search engines) without touching the target; active recon sends traffic directly and risks detection.

CVSS as a reference

The Common Vulnerability Scoring System quantifies technical severity, but final report ratings adjust for business context, exploitability, and data sensitivity.

Minimum-impact proof of concept

Evidence that demonstrates the smallest action proving a finding, such as reading one file or one record, avoiding unnecessary data access or service disruption.

Retest purpose

A post-remediation verification confirming that reported findings are fixed, with unchanged issues re-reported using fresh evidence and updated status.

Chain of custody

Timestamped, attributable logs of every action and piece of evidence collected, supporting report credibility and any subsequent legal or audit review.

Report structure

An executive summary framing risk in business terms, technical findings with reproduction steps and remediation, and appendices of scope and tool output.

Post-engagement cleanup

Removing uploaded shells, test accounts, scheduled tasks, and configuration changes, then confirming the target is restored to its original state.