CPEH flashcards
CPEH · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Rules of engagement
- A document defining authorized targets, testing windows, permitted techniques, prohibited actions, and escalation contacts. It establishes the legal boundary between authorized testing and unauthorized access.
- Get-out-of-jail letter
- Written authorization carried by the tester that identifies the engagement, the client contact, and the authorized scope, so law enforcement can verify the activity is sanctioned.
- Chain of custody
- A documented, tamper-evident record of who collected, handled, and transferred evidence, with timestamps and hashes, preserving its integrity and admissibility.
- Certificate transparency logs
- Public append-only records of issued TLS certificates. Querying them reveals subdomains and hostnames without sending traffic to the target, making it a passive reconnaissance source.
- DNS zone transfer
- An AXFR request asking an authoritative server for all records in a zone. If misconfigured to allow it, it discloses the full host inventory of the domain.
- SPF and DMARC records
- TXT DNS records listing authorized sending mail servers and a policy for handling failures. They reveal mail infrastructure and spoofing posture during footprinting.
- SYN scan
- A half-open TCP scan that sends SYN, records SYN/ACK as open, then sends RST to avoid completing the handshake. It is faster and stealthier but requires raw socket privileges.
- Filtered port state
- An Nmap state meaning no response was received or an ICMP unreachable arrived, so the port could be open or closed behind a filtering device. The state is indeterminate.
- SNMP enumeration
- Querying UDP port 161 with community strings to read device configuration, interfaces, and sometimes credentials. Default strings like public often remain unchanged and expose detailed system information.
- Pass-the-hash
- Authenticating with a captured NTLM hash directly, without cracking it to plaintext. It works because NTLM authentication accepts the hash as the credential proof.
- Kerberoasting
- Requesting Kerberos service tickets for accounts with registered SPNs, then cracking them offline. Ticket encryption uses the service account password hash, so weak passwords fall quickly.
- AlwaysInstallElevated
- A Windows registry setting that, when enabled in both machine and user hives, lets any user install MSI packages with SYSTEM privileges, enabling local privilege escalation.
- Unquoted service path
- A Windows service binary path containing spaces without quotes. Windows tries each space-delimited prefix, so a planted executable in an earlier directory can run with service privileges.
- HTML smuggling
- A client-side delivery technique where JavaScript in an HTML attachment assembles a malicious file in the browser and saves it locally, bypassing email gateway attachment scanning.
- Pretexting
- Constructing a believable scenario or identity to justify a request for information or action. It is the narrative layer that makes phishing, vishing, and impersonation convincing.
- Living-off-the-land binary
- A signed system utility such as certutil or regsvr32 abused to download or execute payloads. Because it is trusted and preinstalled, it evades allowlisting and leaves fewer artifacts.
- Evil twin access point
- A rogue wireless access point broadcasting a trusted SSID to lure client devices. Once connected, it can capture credentials via captive portals or relay traffic for interception.
- WPA3-SAE
- A wireless authentication mode using simultaneous authentication of equals, a password-authenticated key exchange resistant to offline dictionary attacks on captured handshakes.
- VLAN hopping
- Gaining access to a VLAN other than the assigned one, typically through switch spoofing with DTP or double-tagged frames. Mitigated by disabling unused ports and forcing access mode.
- ARP spoofing
- Sending forged ARP replies to associate the attacker MAC with the gateway IP, positioning the attacker as a man-in-the-middle. Dynamic ARP inspection is the standard countermeasure.
- Boolean blind SQL injection
- An injection where no data is returned but true/false conditions change the response, letting an attacker infer database contents one bit at a time through crafted queries.
- Server-side request forgery
- An attack forcing the server to make requests to internal or metadata endpoints. Blocking link-local addresses and allowlisting outbound destinations mitigates it.
- Insecure direct object reference
- An access-control flaw where changing an identifier in a request exposes another user's data, because authorization checks are missing on the referenced object.
- Content Security Policy
- An HTTP response header restricting which script sources a browser may execute. It reduces cross-site scripting impact by blocking inline and unauthorized external scripts.
- Forward secrecy
- A property where each session uses ephemeral key exchange, so compromise of the server's long-term private key does not decrypt previously recorded sessions.
- Password hashing with Argon2
- A memory-hard key derivation function with per-user salts, designed to make large-scale offline cracking expensive by consuming memory and CPU per guess.
- Nonce reuse
- Reusing an initialization value in a stream cipher or AEAD mode. It leaks the XOR of plaintexts and can expose authentication keys, breaking confidentiality.
- Windows event ID 7045
- A System log event recording a new service installation. It is a primary detection point for service-based persistence and remote execution during lateral movement.
- Timestomping
- Altering file timestamps to blend malicious files into a directory baseline. It is an anti-forensic technique that investigators detect by comparing timestamps against filesystem metadata.
- DNS tunneling exfiltration
- Encoding stolen data in DNS queries to an attacker-controlled authoritative server. It evades egress filters that allow DNS but block other outbound traffic.
- CVSS base score
- A standardized severity score derived from exploitability and impact metrics. It excludes asset criticality and existing controls, so it must be contextualized in reports.
- Remediation retest
- Re-executing the original exploit steps after a fix to confirm the vulnerability is closed. A finding is only closed when the exploit path fails, not when a ticket is resolved.