HTB CPTS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of Engagement

Document defining in-scope targets, excluded hosts, allowed techniques, test windows, emergency contacts, and data handling. It bounds what a tester may legally and ethically do.

PTES phases

Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. Seven sections used to structure an engagement from scoping through final deliverable.

CVSS base score

A 0.0-9.9 score computed from exploitability (attack vector, complexity, privileges, user interaction) and impact (confidentiality, integrity, availability) metrics. It rates technical severity, not business risk.

Certificate Transparency recon

Querying public CT logs such as crt.sh for certificates issued to a domain, which reveals subdomains that may not appear in DNS brute force. Results must be resolved to confirm they exist.

DNS zone transfer

An AXFR request to an authoritative nameserver that returns all records for a zone if misconfigured to allow it. Often discloses internal hostnames and IP ranges quickly.

ASN to CIDR expansion

Mapping an organization's autonomous system number to its announced IP ranges using whois, RADB, or bgpq4. Reveals owned netblocks that may host services outside the named domain.

Google dorking

Using advanced search operators such as site:, inurl:, intitle:, and filetype: to surface indexed admin panels, directory listings, config files, and exposed documents belonging to a target.

Kerbrute userenum

Sends Kerberos AS-REQ requests to port 88 to determine which usernames exist. Valid users return a pre-auth error while nonexistent users return principal-unknown, without generating logon failures.

AS-REP roasting

Requesting an AS-REP for accounts with Kerberos pre-authentication disabled, then cracking the encrypted portion offline. The account attribute DONT_REQ_PREAUTH must be set.

Kerberoasting

Requesting service tickets (TGS) for accounts with service principal names, then cracking them offline. Any authenticated domain user can request these tickets, so weak service passwords fall quickly.

NTLM relay precondition

SMB signing must be disabled on the target for relayed NTLM authentication to succeed. Signing enforces message integrity and causes relayed sessions to fail authentication.

BloodHound edges

Graph relationships such as GenericAll, WriteDACL, ForceChangePassword, and AddMember that describe exploitable ACLs and group memberships. Shortest paths to Domain Admin reveal privilege escalation routes.

Zerologon CVE

CVE-2020-1472 abuses Netlogon AES-CFB8 encryption with an all-zero IV and client challenge, allowing an unauthenticated attacker to impersonate a domain controller. Patched DCs reject the attempt.

Vhost fuzzing

Sending requests with varying Host headers to one IP to discover virtual hosts that share the address. Responses are compared by status, size, and content to distinguish real vhosts from defaults.

SSRF metadata target

The cloud instance metadata address 169.254.169.254, reachable from inside a host. Server-side request forgery that reaches it can return IAM credentials and instance configuration.

JWT alg none

A JWT header value that declares no signature algorithm. Servers that accept it skip signature verification, allowing an attacker to forge arbitrary claims such as admin role.

SUID enumeration

Finding set-user-ID binaries with find / -perm -4000 -type f 2>/dev/null. Binaries that run other programs or read files can be abused via GTFOBins to gain elevated privileges.

SeImpersonatePrivilege abuse

A Windows token privilege held by service accounts that allows impersonating clients. Potato-family exploits (JuicyPotato, PrintSpoofer, GodPotato) use it to obtain SYSTEM.

AlwaysInstallElevated

A policy where both HKLM and HKCU Installer values are set to 1, allowing any user to install MSI packages with SYSTEM privileges. Exploited with msiexec /quiet /qn /i payload.msi.

GPP cpassword

A Groups.xml preference value in SYSVOL encrypted with a published AES key. Any domain user can read it and decrypt with gpp-decrypt to recover the local administrator password.

SSH dynamic forwarding

ssh -D 1080 user@host creates a local SOCKS5 proxy that tunnels traffic through the SSH server. Tools are then pointed at the proxy or wrapped with proxychains.

Chisel reverse SOCKS

A tunneling tool where the server runs on the pivot and the client connects out with R:socks, creating a reverse SOCKS proxy. Useful when inbound connections to the pivot are blocked.

Ligolo-ng TUN pivot

A tunneling tool that creates a tun interface on the attacker machine, giving native IP routing to internal networks without proxychains. Supports ICMP and non-TCP protocols.

Pass-the-Hash

Authenticating with an NTLM hash instead of the plaintext password over SMB, WMI, or other NTLM-accepting services. Fails where NTLM authentication is disabled or restricted.

Hashcat mode 5600

The hashcat mode for NetNTLMv2 challenge-response captures. These are not usable for pass-the-hash; they must be cracked offline to recover the plaintext password.

Password spraying

Trying one or a few common passwords across many accounts to avoid lockout thresholds. The domain lockout policy must be checked before spraying to prevent mass lockouts.

DCSync

Abusing directory replication rights (DRSUAPI) to request password hashes from a domain controller as if a DC were replicating. Requires Replicating Directory Changes permissions.

Secretsdump usage

An Impacket tool that extracts SAM, LSA secrets, and NTDS.dit hashes locally or remotely. Remote use requires administrative rights and produces NTLM hashes for pass-the-hash.

Finding write-up fields

Each finding needs title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and CVE/CWE references. Consistent fields make reports auditable and comparable.

Evidence redaction

Removing or masking passwords, hashes, PII, and sensitive data from report screenshots and logs while preserving enough detail to reproduce the finding. Protects clients and testers.

DNS exfiltration

Encoding stolen data in DNS queries to an attacker-controlled authoritative nameserver. Chosen when egress filtering blocks TCP but allows DNS resolution through internal resolvers.

Data staging

Collecting target files into one directory, compressing, and hashing them before transfer. Reduces transfer volume and noise, and enables integrity verification after exfiltration.