CPEH key terms

A written agreement signed before testing that fixes the in-scope targets, permitted techniques, test windows, emergency contacts, and data-handling limits, giving the tester documented authority and a boundary for stopping work.

The explicit inventory of IP ranges, domains, applications, and physical sites a client authorizes for testing, plus everything explicitly excluded, so that activity outside it counts as unauthorized access.

A signed authorization document carried by the tester that names the engagement, the client contact, and the authorized activities, so that law enforcement or a network defender can verify the work is sanctioned.

A documented, unbroken record of who handled evidence, when, and how, from seizure through storage to presentation, used to show that collected data has not been altered or contaminated.

A contractual or policy commitment that the client will not pursue legal action against a tester who stays within the agreed rules, sometimes paired with a coordinated disclosure clause for unexpected findings.

The practice of reporting a discovered weakness privately to the owner, allowing a reasonable remediation window before any public detail is released, and agreeing on timing and credit in advance.

Collecting information about a target from third-party sources and public records without sending traffic directly to the target's systems, so the target has no chance to log or block the activity.

Intelligence assembled from openly available sources such as company websites, job postings, social media, corporate registries, certificate transparency logs, and public code repositories, used to map people, technology, and infrastructure.

Probing the target's own systems directly, for example with ping sweeps or banner grabs, which produces useful detail but generates logs and may trigger alerts or blocking.

Public, append-only records of issued TLS certificates that reveal subdomains and hostnames an organization may believe are private, making them a rich passive source for mapping external attack surface.

Systematically discovering hostnames beneath a parent domain using certificate logs, DNS zone transfers, brute-force wordlists, and search-engine queries, to find forgotten or staging systems that are less defended.

Querying DNS records such as A, MX, TXT, and NS, and attempting zone transfers, to learn about mail providers, third-party services, SPF configuration, and internal naming conventions.

Sending crafted packets to a range of TCP or UDP ports and interpreting the replies to determine which services are listening, which are filtered, and which are closed.

A half-open TCP scan that sends a synchronize packet and classifies the port from the response, never completing the handshake, which is fast and less likely to be recorded by the application.

Fingerprinting open ports by comparing banner text and response patterns against known signatures, so the tester learns the exact product and version and can look up matching vulnerabilities.

Automated comparison of discovered services and configurations against a database of known weaknesses, producing a prioritized list that a human must still validate for false positives and real exploitability.

Manually verifying scanner findings by reproducing the condition or inspecting configuration, then discarding or downgrading reports that cannot actually be exploited in the target's context.

Techniques such as fragmenting packets, spoofing source addresses, using alternate source ports, or pacing traffic slowly to slip probes past filtering and rate-limiting defenses during scanning.

Moving from a low-privilege foothold to a higher-privilege account, such as local administrator or root, by abusing misconfigurations, unpatched software, weak permissions, or credential reuse.

Extracting stored password hashes or plaintext secrets from memory or registry hives on a compromised host, then cracking or replaying them to reach other systems.

Authenticating with a captured password hash directly, without knowing the plaintext, by replaying it against a protocol that accepts the hash as proof of identity.

Using signed administrative tools and built-in operating system utilities already present on the host to perform actions, which blends with normal activity and bypasses application allowlisting.

Sending deceptive messages that impersonate a trusted party to trick a recipient into revealing credentials, approving a payment, or opening a malicious attachment.

A phishing message researched and tailored to a specific person or small group, referencing real colleagues, projects, or events to make the request credible and hard to question.

Constructing a believable cover story and persona, such as a new helpdesk technician or an auditor, so the target answers questions or performs actions they otherwise would refuse.

Social engineering conducted by telephone or voice call, often spoofing a caller ID and applying urgency or authority to extract information or persuade the target to take an action.

The stage of an attack in which the malicious code reaches the target, for example through a document macro, a trojanized installer, or a link to a hosted script.

An unauthorized wireless base station planted or set up on a network, either to give attackers a foothold inside the perimeter or to lure nearby clients into connecting to it.

A wireless access point that clones the name and appearance of a legitimate network so that clients associate with it, letting the attacker capture traffic or present fake login pages.

Recording the four-way authentication exchange between a client and an access point so the captured material can be attacked offline with a dictionary or brute-force guess of the passphrase.

Forging management frames that tell a client it has been disconnected, forcing it to reconnect so the attacker can capture the handshake or push it toward a rogue access point.

Inserting database syntax into an input field so that user-supplied text is interpreted as a query, allowing data theft, authentication bypass, or modification of stored records.

A form of injection where no query output is returned, so the tester infers data one bit at a time from true-or-false responses, timing delays, or error behavior.

Injecting script into pages other users view, so the code runs in their browser session and can steal cookies, alter content, or perform actions as the victim.

Causing a logged-in victim's browser to send a state-changing request to a site that trusts the session, without the victim's intent, exploiting the automatic attachment of credentials.

Adding unique random data to each password before hashing and applying a deliberately slow function, so precomputed tables fail and each guess costs significant computation.

A one-way function that maps input of any length to a fixed-size digest, used for integrity checks and password storage because the original value cannot be recovered from the output.

Testing a service's accepted protocol versions, cipher suites, certificate chain, and key exchange to find deprecated options, weak parameters, or misissued certificates that undermine transport security.

Moving from one compromised host to others in the same environment using stolen credentials, trust relationships, or remote administration services, to reach higher-value systems.

Establishing a durable means of regaining access after reboot, logout, or remediation, such as a scheduled task, service, startup entry, or added account.

Altering, deleting, or disabling audit records and event forwarding on a compromised host so that the attacker's activity is missing or misleading during later investigation.

Capturing volatile and non-volatile data in a forensically sound way, with hashes and documented handling, before remediation destroys the record of what happened.

Retesting a fixed finding with the original proof-of-concept to confirm the weakness is actually closed, rather than assuming a patch or configuration change worked.

Scoring a finding by combining its technical severity with the likelihood of exploitation and the business impact on the specific client, so reports drive prioritized fixes.

The opening section of a report written for non-technical leaders, stating overall posture, the most serious themes, and clear recommended actions without jargon or exploit detail.