CNSP Certification flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Same-origin policy

Browser rule that permits scripts from one origin to read responses from the same scheme, host, and port only; cross-origin reads are blocked unless CORS headers explicitly allow them.

Synchronizer token pattern

CSRF defense where the server embeds a random per-session token in forms and rejects state-changing requests lacking a matching token, preventing forged cross-site submissions.

DOM-based XSS

Cross-site scripting where attacker-controlled data reaches a dangerous DOM sink such as innerHTML or eval without the payload being reflected by the server response.

Server-side request forgery

Vulnerability where an application fetches a URL supplied by the attacker, letting them reach internal services, cloud metadata endpoints, or localhost-only administrative interfaces.

Content Security Policy

HTTP response header that restricts which script, style, frame, and connection sources a page may load, mitigating injected script execution when configured with nonces or hashes.

Kerberoasting

Attack requesting Kerberos service tickets for accounts with service principal names, then cracking the ticket offline to recover the service account password.

NTLM relay

Attack that forwards captured NTLM authentication to another service to impersonate the victim; mitigated by SMB signing, LDAP signing, and channel binding.

LLMNR poisoning

Technique answering failed multicast name resolution requests to capture NetNTLM hashes; disabling LLMNR and NBT-NS removes the attack path.

Pass-the-hash

Authentication technique using a captured NTLM hash directly against a remote service, without recovering the plaintext password, enabled by NTLM challenge-response.

Active Directory tiering

Model separating administrative credentials by asset sensitivity so Tier 0 domain controllers never authenticate to lower-tier workstations, limiting credential theft and lateral movement.

Certificate Transparency enumeration

Reconnaissance method querying public CT logs for certificates issued to a domain, revealing subdomains and internal hostnames exposed in certificate subject alternative names.

SYN scan

Port scanning technique sending TCP SYN packets and inferring state from responses without completing the handshake, reducing application logging compared with connect scans.

DNS zone transfer

AXFR query that returns every record in a zone when the nameserver allows it, disclosing hosts, mail servers, and internal naming conventions to an attacker.

HSTS

Response header instructing browsers to use HTTPS only for a domain for a set duration, preventing protocol downgrade and cookie theft over plaintext connections.

Android exported component

Application component declared reachable by other apps through intents; without permission protection it can be invoked to leak data or trigger privileged actions.

iOS keychain accessibility

Attribute controlling when keychain items are decryptable, from WhenUnlocked to Always; Always remains readable while the device is locked and is the weakest option.

Certificate pinning bypass

Runtime instrumentation with tools such as Frida hooks the trust manager to accept attacker certificates, defeating pinning during mobile traffic interception.

Mobile root detection

Client-side check for superuser binaries and modified system partitions; bypassable by hooking or repackaging, so it raises attacker effort but is not a security boundary.

Taint analysis

Static analysis technique tracing data flow from untrusted sources such as request parameters to sensitive sinks such as SQL execution or command shells.

Hardcoded secret detection

Scanning source and commit history for embedded credentials using pattern matching and entropy heuristics; any committed key must be rotated, not merely deleted.

TOCTOU flaw

Race condition where a resource is checked and then used in separate steps, allowing an attacker to swap the resource between check and use.

Unsafe deserialization sink

Code path converting untrusted bytes into native objects, as with Python pickle or Java ObjectInputStream, which can execute attacker-supplied code during reconstruction.

Cloud shared responsibility

Division where the provider secures physical and managed infrastructure while the customer secures identity, configuration, data, and access policy in cloud services.

IMDSv2

Instance metadata service version requiring a PUT request to obtain a session token, blocking simple server-side request forgery from retrieving temporary role credentials.

IAM PassRole escalation

Privilege escalation where a principal with iam:PassRole creates a compute resource attached to a more privileged role and inherits its permissions.

Public S3 bucket

Storage bucket reachable anonymously through ACLs or a policy granting Principal wildcard access, typically with account-level public access block disabled.

Rules of engagement

Document defining scope, permitted techniques, timing windows, and escalation contacts for an assessment; actions outside it are unauthorized and legally exposed.

C2 beacon jitter

Randomization of callback interval in command-and-control traffic, breaking fixed-period patterns that network detection systems use to identify implants.

MITRE ATT&CK

Knowledge base of adversary tactics and techniques observed in real intrusions, used both to plan red team operations and to measure detection coverage.

Indirect prompt injection

Attack where malicious instructions arrive through content the model retrieves, such as documents, web pages, or tool output, rather than from the user directly.

Adversarial example

Input deliberately perturbed so a model misclassifies it while appearing normal to humans; transferability lets perturbations crafted on one model affect others.

Membership inference attack

Privacy attack determining whether a specific record was part of a model's training data by comparing confidence scores against a reference baseline.