HTB CPTS key terms

Gathering information about a target without sending traffic directly to its systems, using public sources such as certificate transparency logs, DNS records, search engines, and archived pages. It reduces detection risk before active probing begins.

Open-source intelligence: collecting and correlating publicly available data such as employee names, email formats, job postings, code repositories, and social media to build a picture of the target organization and its technology stack.

Directly interacting with target hosts and services to discover users, shares, versions, and configuration details. It produces richer data than passive collection but generates logs and traffic that defenders may notice.

Documenting every reachable host, port, service, and application entry point that an attacker could use, then ranking them by exposure and likely impact. The map guides where to spend exploitation effort first.

Identifying the exact software and version behind an open port by analyzing banners, protocol responses, and probe replies. Accurate versions let you match known vulnerabilities and choose the right exploitation path.

The written agreement defining which systems, IP ranges, and techniques are authorized, plus timing, escalation contacts, and prohibited actions. Exceeding it turns authorized testing into unauthorized access with legal consequences.

Confirming that a suspected weakness is genuinely exploitable in the target environment rather than trusting a scanner's output. It typically involves a safe proof-of-concept that demonstrates impact without causing damage.

Reviewing scanner and tool findings to separate real issues from version-matching noise, unreachable paths, or misconfigured checks. Only validated findings should reach the client report.

A minimal, reproducible demonstration that a vulnerability can be exploited, usually with the exact command or request used and its observed output. It gives the client confidence the finding is real.

A phase model describing intrusion progression from reconnaissance through exploitation, installation, command and control, and actions on objectives. It helps testers plan which phase they are in and what evidence to collect next.

A public knowledge base of adversary tactics and techniques observed in real intrusions. Testers use it to structure testing coverage and to describe findings in language defenders already understand.

Using legitimate built-in operating system tools, such as PowerShell, certutil, or wmic, to perform actions instead of dropping custom malware. This blends with normal administration and evades signature-based detection.

An unauthenticated connection to a Windows SMB service that, when legacy settings allow it, reveals shares, users, and policy information. Modern systems usually restrict it, but it remains worth testing during enumeration.

Listing and inspecting Server Message Block shares and their permissions to find readable files, scripts, backups, or configuration containing credentials. Misconfigured share access is a common path to initial access and lateral movement.

Requesting service tickets for accounts with registered service principal names, then cracking the ticket offline to recover the service account password. Success depends on weak passwords and does not require special privileges.

Requesting an authentication response for an Active Directory account that has pre-authentication disabled, then cracking it offline to recover the password. The technique needs only a valid username and network access to the domain controller.

Service principal name: an Active Directory attribute binding a service instance to an account so clients can locate it. Accounts holding SPNs are targets for Kerberoasting because their ticket encryption can be attacked offline.

Exploiting Active Directory delegation settings, such as unconstrained or constrained delegation, to impersonate other users to services. Misconfigured delegation can grant access far beyond the account's intended rights.

Dumping ticket-granting and service tickets from a compromised host's memory or cache to reuse the authenticated sessions they represent. Extracted tickets can enable access without knowing the account password.

Authenticating to a remote service using a captured NTLM password hash instead of the plaintext password. It works because some protocols accept the hash directly as proof of identity.

Using a captured NTLM hash to obtain a Kerberos ticket, then authenticating with that ticket. It converts a hash into a Kerberos credential usable against services that reject raw NTLM.

Intercepting an authentication attempt and forwarding it to another service to act as the victim, without cracking any password. Success requires a coerced or lured authentication and a target that accepts relayed credentials.

Answering broadcast name-resolution requests on a local network to capture authentication attempts and their hashes. The captured material can then be cracked offline or relayed to another host.

Trying one or a few common passwords against many accounts while respecting lockout thresholds, avoiding the noise of brute force. It targets weak organizational password habits rather than a single account.

Replaying username and password pairs leaked from other breaches against the target's login services. It succeeds where users reuse passwords across systems and is fast to test at scale.

The threshold and duration after which repeated failed logins disable an account. Knowing it prevents accidental denial of service during password attacks and dictates how slowly spraying must proceed.

Collecting usernames, passwords, hashes, and tokens from files, memory, configuration, and network traffic. Harvested credentials fuel further access, privilege escalation, and lateral movement.

Recovering plaintext from captured hashes or encrypted tickets using wordlists, rules, and hardware acceleration. The method chosen depends on hash type, available compute, and the time budget of the engagement.

Reading the memory of the Windows Local Security Authority Subsystem Service to extract cached credentials and hashes. It usually requires administrator rights and is a common step before lateral movement.

Injecting database syntax through unsanitized input so the query executes attacker-controlled logic. Impact ranges from data disclosure to authentication bypass and, in some configurations, command execution.

Abusing a parameter that loads local or remote files so the application executes attacker-supplied content or discloses sensitive files. Local inclusion can escalate to code execution through log poisoning or uploaded files.

Supplying operating system syntax through application input so the server runs attacker-chosen commands. It typically yields immediate code execution under the web service account.

A small script uploaded to a web server that accepts commands or file operations over HTTP. It provides persistent interactive access through the web service's network path and permissions.

A payload where the compromised host initiates an outbound connection back to the tester's listener, giving an interactive command session. It is preferred when inbound connections to the target are filtered.

A payload that opens a listening port on the compromised host, which the tester then connects to. It works only when the target's firewall permits inbound access to that port.

Routing traffic through a compromised host to reach networks that are not directly accessible from the tester's machine. Tools like proxychains or SSH tunnels make internal hosts appear reachable.

Redirecting traffic from one host and port to another, often through an SSH session or a tool such as chisel, to expose an internal service locally. It is the building block of most tunneling setups.

Moving from one compromised host to other systems using harvested credentials, tickets, or trust relationships. The goal is to reach higher-value assets while keeping access stable and quiet.

Gaining rights beyond those initially obtained, such as moving from a standard user to administrator or root. It commonly exploits misconfigured permissions, scheduled tasks, services, or vulnerable kernel versions.

Exploiting a Linux binary with the set-user-ID bit that runs with the file owner's privileges, usually root. A misconfigured or vulnerable SUID program can be leveraged to execute commands as that owner.

Sudo rules that let a user run specific commands, or all commands, as another account. Allowed commands that can spawn shells, read files, or edit scripts often lead directly to root.

A Windows service whose executable path contains spaces but no quotes, so Windows tries candidate paths in order. Placing a malicious binary at a writable earlier path causes it to run as the service account.

Duplicating an access token from a process running as a more privileged user, such as SYSTEM, to act with those rights. It requires the ability to obtain and impersonate the token on the host.

Any change that keeps attacker access across reboots, logoffs, or credential resets, such as scheduled tasks, services, or startup entries. Testers document these carefully so the client can remove them after the engagement.

Transferring sensitive data out of the target environment, often over covert or allowed channels to avoid detection. Testers demonstrate feasibility while limiting volume and handling data per the engagement terms.

Temporarily collecting and compressing target data in a controlled location before exfiltration. It reduces transfer time and exposure, and testers must remove staged copies afterward.

Contemporaneous notes of commands, timestamps, hosts, credentials, and screenshots captured during testing. Complete records support accurate reporting, remediation guidance, and cleanup verification.

A short, non-technical opening section of the report stating overall risk, key themes, and prioritized recommendations for leadership. It should be understandable without reading the technical findings.

A consistent score assigned to each finding based on likelihood and impact, often using a standard scale such as CVSS combined with business context. Ratings drive remediation priority for the client.

Specific, actionable advice for fixing each finding, including configuration changes, patching, and compensating controls. Good guidance names the affected asset and explains how to verify the fix.