OSC flashcards
OSC · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- SYN scan vs connect scan
- A SYN scan sends a SYN and never completes the handshake, requiring raw-socket privilege. A connect scan completes the handshake and is logged by the target application.
- DNS zone transfer
- An AXFR query asks a nameserver to replicate its zone. If allow-transfer is misconfigured, the response lists every hostname and IP in the zone.
- SMB null session
- An unauthenticated SMB connection that, when RestrictAnonymous is disabled, allows enumeration of shares, users, groups, and password policy via rpcclient or enum4linux.
- SNMP community string
- A shared secret for SNMPv1/v2c. Default values public and private often expose interface, ARP, and process tables through snmpwalk.
- Virtual host fuzzing
- Sending different Host header values to one IP to discover sites served by name-based virtual hosting that are not linked from the main application.
- CVSS base score ranges
- CVSS v3.1 base scores map to None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, and Critical 9.0–10.0.
- Authenticated vs unauthenticated scan
- An authenticated scan logs into the host to read patch levels and configuration directly; an unauthenticated scan infers versions from banners and produces more false positives.
- False positive validation
- A scanner finding is confirmed only when the reported condition is reproduced manually and the request/response evidence is captured; banner mismatch is a common cause of false positives.
- IDOR
- Insecure Direct Object Reference: an application exposes an internal identifier and fails to check authorization, letting a user read or modify another user's records.
- Staged vs stageless payload
- A staged payload sends a small stager that downloads the full payload; a stageless payload is a single larger file that is more reliable across filtered networks.
- Reverse vs bind shell
- A reverse shell has the target connect back to the attacker and works through most egress filtering; a bind shell listens on the target and requires inbound reachability.
- Password spraying
- Trying one common password against many accounts to avoid lockout. The lockout threshold and observation window from the domain policy must be known first.
- xp_cmdshell
- A Microsoft SQL Server stored procedure that runs operating-system commands. It is disabled by default and requires sysadmin to enable, giving code execution as the SQL service account.
- SUID binary escalation
- A root-owned file with the SUID bit runs with the owner's privileges. GTFOBins lists binaries such as find or vim that spawn a shell when SUID.
- Linux capabilities abuse
- File capabilities such as cap_setuid or cap_dac_read_search grant partial root powers. getcap -r / lists them, and GTFOBins maps each to an escalation.
- Unquoted service path
- A Windows service whose binary path contains spaces and is not quoted lets a user place a malicious executable in an earlier directory that Windows resolves first.
- SeImpersonatePrivilege
- A Windows privilege allowing a process to impersonate another user's token. Combined with a coerced privileged connection, tools like PrintSpoofer or Juicy Potato yield SYSTEM.
- AlwaysInstallElevated
- A policy pair in HKLM and HKCU that lets any user install an MSI with SYSTEM privileges. Both keys must be set to 1 for the escalation to work.
- Kerberoasting
- Requesting a Kerberos service ticket for an account with an SPN and cracking it offline. Any domain user can do it, and RC4 tickets crack faster than AES.
- AS-REP roasting
- Requesting an AS-REP for an account with preauthentication disabled, then cracking the encrypted timestamp offline without any domain credentials.
- DCSync
- Abusing directory replication rights (DS-Replication-Get-Changes and -Get-Changes-All) to request password hashes from a domain controller as if it were another DC.
- Golden vs Silver Ticket
- A Golden Ticket forges a TGT with the krbtgt hash and grants domain-wide access. A Silver Ticket forges a service ticket with a service account hash and is limited to that service.
- BloodHound
- A graph tool that ingests SharpHound-collected users, groups, sessions, and ACLs to reveal shortest attack paths to Domain Admin and other privileged targets.
- AD CS ESC1
- A certificate template misconfiguration allowing the requester to supply the subject and enroll for client authentication, enabling impersonation of any user including a domain admin.
- LSASS credential dumping
- Reading the Local Security Authority Subsystem Service memory to extract cleartext passwords, NTLM hashes, and Kerberos keys of logged-on users.
- Pass-the-hash
- Authenticating with an NTLM hash instead of a cleartext password. Tools such as crackmapexec and impacket-wmiexec accept the hash directly for lateral movement.
- Windows logon event IDs
- Security log event 4624 records a successful logon, 4625 a failed logon, and 4688 process creation. These are primary detection sources during post-exploitation.
- Persistence via scheduled task
- Registering a task that runs an attacker binary at logon or on a schedule. It survives reboots and is created with schtasks or Register-ScheduledTask.
- SSH local port forward
- ssh -L localport:target:targetport user@pivot exposes a service reachable from the pivot on the attacker's localhost, tunneling traffic through the SSH connection.
- SSH dynamic forward
- ssh -D 1080 opens a SOCKS proxy on the attacker host so tools routed through proxychains can reach any host the pivot can reach.
- Meterpreter route and portfwd
- route add <subnet> <session> lets modules reach a new subnet through an existing session, and portfwd add forwards a local port to a remote host and port.
- Report evidence standard
- Each finding must include reproducible request/response pairs or command output, affected asset, tool version, timestamp, impact statement, and a specific remediation.