LPF LPQ key terms

A model describing information security through three goals: confidentiality, keeping data from unauthorized readers; integrity, preventing unauthorized changes; and availability, ensuring systems and data remain accessible to authorized users when needed.

A structured process that identifies threats and vulnerabilities, estimates the likelihood and impact of harm, and ranks risks so that treatment decisions can be prioritized and justified.

The principle that each user, process, or service receives only the permissions required to perform its task, and nothing more, limiting the blast radius of mistakes and compromise.

The written agreement defining which systems, addresses, applications, and techniques a penetration test may target, plus timing and exclusions. Testing anything outside it is unauthorized and can be unlawful.

Operational constraints agreed before testing begins, covering allowed attack types, escalation contacts, emergency stop procedures, and handling of sensitive data discovered during the engagement.

A signed authorization document carried by testers that identifies the client, the engagement, the permitted scope, and contact details, so that law enforcement or security staff can verify the activity is legitimate.

Open-source intelligence: information gathered from publicly available sources such as websites, registries, job postings, and social media, used to map an organization's people, technology, and exposed assets without touching its systems.

Information gathering that does not directly interact with the target's systems, relying on third-party sources and cached data so that the target has no chance to detect the activity.

Gathering information by sending traffic directly to target systems, such as port scans or banner grabs. It produces more reliable results than passive methods but is detectable and must be within scope.

Querying domain name system records and servers to discover hostnames, mail servers, subdomains, and zone information, often revealing systems that were never intended to be publicly known.

A vulnerability where a DNS record points to a third-party service that is no longer claimed, letting an attacker register that service name and serve content under the victim's domain.

Probing TCP or UDP ports on a host to determine which services are listening, typically using SYN, connect, or UDP scans, and forming the basis for service identification and attack planning.

Analyzing responses such as banners, protocol behavior, and TLS details to identify the exact software and version running on an open port, which guides selection of relevant exploits and misconfigurations.

Automated probing of systems against a database of known weaknesses and missing patches. It produces candidate findings that require manual validation before being reported as confirmed vulnerabilities.

Manually confirming that a suspected weakness is real and exploitable in the target's context, eliminating scanner noise and establishing evidence and impact before reporting.

A reported finding that does not actually exist or is not exploitable on the target. Reporting these damages credibility, so each result should be reproduced and evidenced before inclusion.

A flaw where untrusted input is concatenated into a database query, letting an attacker alter query logic to bypass authentication, read or modify data, or in some configurations execute operating system commands.

A weakness where attacker-supplied script runs in a victim's browser in the context of a trusted site, enabling session theft, credential phishing, or actions performed as the victim.

An attack that tricks a logged-in user's browser into sending a state-changing request to a site that trusts the user's session, so the action appears to come from the victim.

Checking and constraining data received from users or systems so it conforms to expected format, type, and length, reducing injection and parsing flaws when applied on the server side.

Taking over an authenticated session by stealing or predicting a session token, for example through script injection, network interception, or insecure cookie settings, then reusing it to act as the victim.

Gaining a higher level of access than initially obtained, either vertically to administrative rights on the same host or horizontally to another user's account with similar permissions.

Moving from one compromised host to other systems in the same environment, using stolen credentials, trust relationships, or remote administration services, to reach higher-value targets.

Mechanisms an attacker establishes to retain access across reboots and credential changes, such as scheduled tasks, services, or added accounts. Testers document these and remove them during cleanup.

The channel and infrastructure used to communicate with compromised hosts, receiving results and sending instructions. Testers usually simulate this with controlled, logged infrastructure.

Activities after initial compromise: confirming access level, collecting evidence of impact, identifying sensitive data reachable, and demonstrating business risk, all within agreed scope and data-handling rules.

Recording the four-way authentication exchange between a wireless client and access point, which can later be attacked offline to test whether the pre-shared key is weak.

A rogue access point that imitates a legitimate network's name to lure clients into connecting, allowing the tester to capture credentials or traffic and demonstrate wireless trust weaknesses.

Sending forged management frames that disconnect wireless clients from an access point, often used to force reconnection and capture authentication traffic, or simply to disrupt availability.

Defensive controls in mobile apps such as certificate pinning, root or jailbreak detection, code obfuscation, and secure storage, which testers assess for bypassability during mobile security reviews.

Storing sensitive information such as tokens or personal data in plaintext on a device, in logs, or in world-readable locations, where other apps or a thief can retrieve it.

Analyzing compiled software or firmware to recover logic, hardcoded secrets, and hidden functionality, commonly applied to mobile packages and binaries during security assessments.

A social engineering attack that impersonates a trusted party through email, messages, or sites to trick recipients into revealing credentials, approving payments, or running malicious content.

Constructing a believable scenario and identity to justify a request, giving the target a plausible reason to comply with actions they would otherwise question.

Following an authorized person through a controlled door without presenting credentials, exploiting social norms of politeness to gain physical access to restricted areas.

Systematically examining a system's architecture, data flows, and trust boundaries to identify plausible threats and prioritize controls before or alongside testing.

The ordered phases of an engagement: scoping and contracting, reconnaissance, exploitation and post-exploitation, analysis, reporting, and remediation retesting, each producing documented outputs.

Communicating findings in writing with clear titles, technical detail, evidence, business impact, severity ratings, and actionable remediation advice, tailored to both technical and executive readers.

Assigning severity to findings using a consistent scheme that weighs exploitability, impact, and exposure, so readers can compare issues and prioritize remediation effort.

The corrective actions recommended to remove or reduce a vulnerability, such as patching, configuration change, or code fix, ideally specific enough for the client to implement and verify.