CNSP Certification key terms

A flaw where an attacker makes a server fetch a URL of their choosing, letting them reach internal services, metadata endpoints, or cloud credentials that are not directly accessible from the internet.

An access control failure where an application exposes a reference such as a record ID and honors it without verifying that the requesting user is entitled to that object.

Injection of executable script into pages viewed by other users, typically caused by rendering untrusted input without correct output encoding or context-aware escaping.

An HTTP response header that restricts which script sources, styles, frames, and connections a browser may load, reducing the impact of script injection when configured with nonces or hashes.

An attack that tricks a logged-in user's browser into sending a state-changing request to a site that trusts the user's ambient session cookies, defeated with anti-CSRF tokens or SameSite cookies.

A cookie flag that controls whether the browser attaches the cookie to cross-site requests, with Strict and Lax modes limiting exposure to cross-site request forgery.

Failures in enforcing who may perform an action or read a resource, including missing function-level checks, forced browsing, and privilege escalation through manipulated parameters.

An attack that requests service tickets for accounts with registered SPNs, then cracks the encrypted ticket offline to recover the service account password without touching the target host.

Authenticating to remote services using a captured NTLM hash directly, without knowing the plaintext password, because the hash itself functions as the credential in NTLM authentication.

An Active Directory attribute that binds a service instance to a logon account so clients can locate and authenticate to it; its presence makes an account eligible for Kerberoasting.

The step of moving from a lower-privileged foothold to higher permissions or broader access, whether by exploiting a local vulnerability or abusing misconfigured permissions and delegated rights.

Techniques used after initial compromise to pivot between hosts and accounts inside a network, such as remote service execution, credential reuse, and remote management protocol abuse.

A deliberately exposed decoy system or service used to detect, delay, or study unauthorized activity, providing defenders with high-fidelity alerts and insight into attacker behavior.

The sum of entry points an adversary can attempt to exploit, including internet-facing hosts, exposed services, credentials, APIs, and third-party integrations, which external assessments aim to enumerate.

Continuous discovery and inventory of an organization's internet-reachable assets, including forgotten hosts, shadow cloud instances, and certificates, so exposures can be found and remediated before attackers use them.

Infrastructure and protocols an attacker uses to send instructions to and receive output from compromised systems, often disguised as normal traffic to blend with legitimate network activity.

Regular, periodic outbound connections from an implanted host to attacker infrastructure, a pattern defenders hunt for in network telemetry as a sign of active compromise.

A mobile app restriction that accepts only a specific certificate or public key for a host, preventing interception by a user-installed proxy certificate and complicating traffic analysis.

A dynamic instrumentation toolkit used in mobile testing to hook methods at runtime, inspect memory, and modify app behavior, commonly applied to bypass client-side security controls.

The practice of defeating an app's checks for rooted or jailbroken devices so testing can proceed, typically by hooking detection routines or hiding indicators of the modified environment.

A mobile weakness where sensitive data such as tokens, credentials, or personal records is written to unencrypted local storage, logs, or backups readable by other apps or an attacker with device access.

Analysis of source code or compiled artifacts without executing them, using pattern and dataflow rules to find risky constructs such as unsanitized input reaching a sensitive sink.

A dataflow technique that marks untrusted input as tainted and tracks whether it reaches a sensitive operation without passing through a sanitizer, producing a candidate vulnerability path.

Identification of third-party libraries and their versions in a project, matched against vulnerability databases and license data to surface risky or unmaintained dependencies.

An internal endpoint reachable from within a cloud virtual machine that returns configuration data and, if not restricted, temporary role credentials; a frequent SSRF target.

Tools that continuously assess cloud configurations against policy baselines, flagging issues such as public storage buckets, overly broad identity policies, and disabled logging.

A cloud identity with more permissions than its workload needs, such as wildcard actions on all resources, which magnifies the impact of any credential theft.

A goal-oriented, adversarial engagement that emulates realistic threat actors against people, processes, and technology to measure how well detection and response actually work.

The written agreement defining scope, permitted techniques, timing, escalation contacts, and prohibited actions for an adversarial test, protecting both the testers and the target organization.

A collaborative exercise where offensive operators execute known techniques while defenders observe and tune detections in real time, converting findings directly into improved monitoring coverage.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, used to structure test plans and map detections to specific behaviors.

An attack in which crafted text in model input overrides or subverts the developer's instructions, potentially causing the model to leak data or take unintended actions through connected tools.

Deliberate manipulation of data used to train or fine-tune a model so it learns biased, backdoored, or unsafe behavior that surfaces later under specific trigger inputs.

Treating generated model text as untrusted input downstream: validating, encoding, and constraining it before it reaches browsers, shells, databases, or automated tool calls.

Repeatedly querying a deployed model to reconstruct an approximation of its behavior or parameters, enabling the attacker to avoid query costs, monitoring, or usage restrictions.