OSCE3 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

UNION column count discovery

Increment ORDER BY n until the query errors; the last successful n equals the column count. Then inject NULLs to find which positions render strings.

Second-order SQL injection

The payload is stored safely in one request and later concatenated unsafely in another, such as a profile field used in an admin report query.

SSTI engine fingerprinting

Arithmetic in template syntax reveals the engine: Jinja2 evaluates {{7*7}} to 49, Twig evaluates {{7*'7'}} to 49, Freemarker uses ${7*7}.

Blind XXE out-of-band

When no response reflects entity content, define an external parameter entity pointing to an attacker DTD that exfiltrates file content over HTTP or DNS.

JWT algorithm confusion

If the server accepts RS256 but also honors HS256, sign a token with HMAC using the public key as the secret; the server verifies it as valid.

PHP object injection sink

Unserializing user input instantiates classes and triggers magic methods like __wakeup and __destruct, which may reach dangerous file or command functions.

Kerberoasting

Request a TGS for an SPN-bearing account, then crack the ticket offline. The encryption key derives from the service account's password hash.

AS-REP roasting

Accounts with preauthentication disabled return an AS-REP encrypted with their own hash, enabling offline cracking without any prior credential.

Unconstrained delegation abuse

A host trusted for unconstrained delegation caches TGTs of authenticating users. Coerce a DC to authenticate, then extract the cached ticket.

Resource-based constrained delegation

Write msDS-AllowedToActOnBehalfOfOtherIdentity on the target, then use S4U2Self and S4U2Proxy from a controlled account with an SPN.

DCSync required rights

Replicating Directory Changes and Replicating Directory Changes All on the domain object let an attacker pull password hashes via DRSUAPI without code execution on the DC.

Golden versus Silver Ticket

A Golden Ticket is a forged TGT signed with the krbtgt hash. A Silver Ticket is a forged service ticket signed with a service account hash.

ForceChangePassword abuse

The extended right lets a principal reset another user's password without knowing the current one, granting immediate access to that account.

AMSI patching scope

Patching AmsiScanBuffer in a process disables script scanning only for that process; new processes and kernel telemetry remain unaffected.

Script Block Logging 4104

PowerShell logs deobfuscated script blocks as event 4104. PowerShell v2, when present, lacks this logging and is a common downgrade path.

Direct syscall limitation

Invoking syscalls directly bypasses userland API hooks but does not evade kernel callbacks such as process creation notifications used by EDR.

RWX allocation indicator

Private memory allocated with execute permission, or a protection change to RX on private memory, is a strong injection signal for defenders.

SeImpersonatePrivilege abuse

Service accounts holding this privilege can impersonate a token from a coerced connection, escalating to SYSTEM via tools like PrintSpoofer or RoguePotato.

Logon type 3 versus 10

Type 3 is a network logon with no interactive session. Type 10 is RemoteInteractive and creates a session visible to session enumeration.

Sysmon Event ID 8

CreateRemoteThread detection records cross-process thread creation, a common injection step, and is one of the highest-value Sysmon events.

Stack canary bypass

The canary sits before the saved return address. Leaking it, then overwriting the return address while writing the correct canary value, defeats the check.

Partial versus full RELRO

Partial RELRO leaves the GOT writable after relocation. Full RELRO maps it read-only, so GOT overwrite needs a write primitive elsewhere.

Format string %n write

The %n specifier writes the number of bytes output so far. Positional forms like %7$n select a stack argument as the write target.

ret2libc base calculation

Leak a GOT entry such as puts, subtract its known offset to get the libc base, then add the offsets for system and the /bin/sh string.

PIE and address leaks

Position-independent executables randomize their own code base, so gadget addresses require a leaked code pointer before a ROP chain can be built.

SROP sigreturn frame

Set rax to 15 and execute syscall with a crafted sigreturn frame on the stack to load a full register context, including execve arguments.

tcache safe-linking

glibc 2.32 and later XOR tcache next pointers with the storage address shifted right by 12, so heap leaks are needed to forge freelist entries.

NX forces ROP

Non-executable stack memory means injected shellcode cannot run; a ROP chain reuses existing code to set registers and invoke syscalls.

SameSite cookie behavior

SameSite=Lax blocks cookies on cross-site POST but allows top-level GET navigation; Strict blocks both, affecting CSRF exploitability.

Constrained delegation S4U2Proxy

With protocol transition, S4U2Self obtains a ticket for any user to the service, and S4U2Proxy forwards it to the allowed backend services.

ETW userland patching

Patching EtwEventWrite suppresses userland ETW events from .NET and Threat-Intelligence providers but leaves kernel-level telemetry intact.

Heap unsafe unlink

Corrupting fd and bk of a free chunk so unlink writes an arbitrary pointer during consolidation yields a write-what-where primitive.