LPF LPQ flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA Triad

Confidentiality, Integrity, and Availability: the three core security properties used to classify controls and describe the impact of a finding.

Annualized Loss Expectancy

ALE equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence; it expresses expected yearly financial loss from a risk and supports remediation prioritization.

Statement of Applicability

An ISO/IEC 27001 document listing which Annex A controls are applied, which are excluded, and the justification for each decision based on risk assessment.

Recovery Point Objective

RPO is the maximum acceptable amount of data loss measured in time; it determines backup frequency and replication strategy in business continuity planning.

Certificate Transparency Logs

Public append-only logs of issued TLS certificates; querying them (e.g., crt.sh) reveals subdomains, staging hosts, and historical certificates during passive reconnaissance.

DNS Zone Transfer

An AXFR request asks an authoritative server for the full zone contents; if misconfigured to allow it, every hostname and record is disclosed at once.

TXT Record Reconnaissance

TXT records often contain SPF, DKIM, DMARC, and domain-verification tokens; they reveal mail infrastructure and third-party SaaS providers in use.

Shodan

A search engine indexing internet-facing service banners; queries by organization, ASN, product, or certificate fingerprint map an external attack surface without active scanning.

SYN Scan

An nmap -sS scan sends a SYN and never completes the handshake; it is faster and stealthier than a connect scan but requires raw socket privileges.

Filtered Port

A port state where no response or an ICMP unreachable is received, indicating a firewall or filter is dropping packets rather than the host being closed.

Responder

A tool that poisons LLMNR, NBT-NS, and mDNS broadcasts to capture NetNTLM hashes from Windows hosts attempting name resolution; hashes can be relayed or cracked.

VLAN Hopping

An attack using double-tagged 802.1Q frames or DTP spoofing to send traffic into another VLAN; mitigated by disabling unused ports and DTP.

Broken Access Control

OWASP A01; failures where users act outside intended permissions, including IDOR, forced browsing, and missing function-level checks on endpoints.

Blind SQL Injection

Injection where results are not returned directly; the tester infers data using boolean true/false responses or time delays rather than visible output.

DOM-based XSS

Cross-site scripting where the payload is processed by client-side JavaScript and written to a dangerous sink such as innerHTML, without the server reflecting it.

Server-Side Request Forgery

A vulnerability where the server fetches an attacker-controlled URL, enabling access to internal services or cloud metadata endpoints like 169.254.169.254.

JWT Algorithm Confusion

An attack that changes a token's algorithm from RS256 to HS256, tricking the server into verifying the signature with the public key as an HMAC secret.

PMKID Attack

A WPA2 attack that captures the PMKID from a single EAPOL frame and cracks it offline, avoiding the need to capture a full four-way handshake.

WPA3 SAE

Simultaneous Authentication of Equals, a password-authenticated key exchange in WPA3 that resists offline dictionary attacks on captured handshakes.

Evil Twin Attack

A rogue access point cloning a legitimate SSID to lure clients; it can harvest credentials via a fake captive portal or intercept traffic.

Exported Android Component

An activity, service, or receiver declared with android:exported=true and no permission check; other apps can invoke it, sometimes enabling data theft or privilege escalation.

Meterpreter

An in-memory Metasploit payload providing a command shell, file transfer, and post-exploitation modules; migrating to a stable process improves session reliability.

Kerberoasting

Requesting service tickets for accounts with SPNs and cracking them offline; weak service account passwords are recovered without touching the target again.

Pass-the-Hash

Authenticating with a captured NTLM hash instead of the plaintext password; it works because NTLM authentication does not require the original password.

DCSync

An attack abusing directory replication permissions to request password hashes from a domain controller, often yielding the krbtgt hash for Golden Ticket creation.

Spear Phishing

A targeted phishing message crafted for a specific individual using researched details; it is more convincing and has a higher success rate than mass phishing.

Tailgating

Following an authorized person through a controlled door without presenting credentials; it exploits politeness and is a common physical security finding.

Pretexting

Constructing a believable backstory and identity to manipulate a target into disclosing information or performing an action during a social engineering test.

CVSS Base Score

A 0–10 score from intrinsic vulnerability characteristics; 9.0–10.0 is Critical, 7.0–8.9 High, 4.0–6.9 Medium, and 0.1–3.9 Low.

Retest

A separately scoped follow-up assessment verifying that reported findings are fixed; results are recorded as fixed, partially fixed, or risk accepted.

Rules of Engagement

A document defining authorized targets, time windows, permitted techniques, emergency contacts, and exclusions; it is the legal basis for testing activity.

Responsible Disclosure

Notifying a vendor of a vulnerability privately, allowing a reasonable remediation window (commonly 90 days), and coordinating public details afterward.

PTES

The Penetration Testing Execution Standard: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting phases.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques; testers map observed actions to technique IDs to communicate detection coverage and threat relevance.

Chain of Custody

A documented record of who handled evidence, when, and how; it preserves integrity for findings and any artifacts captured during testing.