OSCE3 key terms

An access control flaw where an application exposes an internal identifier, such as a record number or filename, and lets a user change it to reach another user's data without an authorization check.

A vulnerability where a framework automatically binds submitted request parameters to object properties, letting an attacker set fields the developer never intended to expose, such as role or account balance.

A flaw where the server fetches a URL supplied by the user, allowing an attacker to reach internal services, cloud metadata endpoints, or localhost-only administrative interfaces that are not directly accessible from outside.

Exploiting an application that reconstructs objects from untrusted serialized data, often by supplying a crafted object graph that triggers code execution or privilege changes during deserialization.

A vulnerability where user input is evaluated as part of a server-side template, allowing an attacker to execute template expressions and often escalate to arbitrary code execution on the server.

Injecting script into pages viewed by other users so the browser executes it in the site's origin, enabling session theft, request forgery, or keylogging. Stored, reflected, and DOM-based variants differ in where the payload persists.

An HTTP response header that restricts which script sources and inline code a browser will run, reducing XSS impact. Misconfigurations such as overly broad allowlists or unsafe-inline weaken it significantly.

A cookie flag controlling whether the browser sends a cookie on cross-site requests. Lax and Strict settings mitigate cross-site request forgery, while None requires the Secure flag.

Tricking a logged-in user's browser into sending a state-changing request to a site that trusts the user's session cookies, without the attacker being able to read the response.

Requesting resources by guessing or enumerating paths that are not linked in the interface, such as admin pages or backup files, to find content that relies on obscurity rather than authorization.

A small script uploaded to a compromised web server that accepts commands or file operations over HTTP, giving an attacker persistent interactive control through the web application's own process.

Requesting service tickets for accounts with registered SPNs, then cracking the encrypted ticket material offline to recover the service account's password without triggering authentication failures.

Requesting an AS-REP for accounts that have Kerberos pre-authentication disabled, then cracking the encrypted portion offline to recover the account password. Requires no valid domain credentials.

The initial step where a client proves knowledge of its password by encrypting a timestamp before the KDC issues a ticket. Disabling it exposes the account to offline AS-REP cracking.

An attribute mapping a service instance to an account in Active Directory. Any authenticated user can request a service ticket for an SPN, which is the basis of Kerberoasting.

A forged Kerberos service ticket encrypted with a compromised service account's key. It grants access to that specific service without contacting the KDC, making it harder to detect than a golden ticket.

A forged Kerberos ticket-granting ticket encrypted with the krbtgt account hash, allowing an attacker to impersonate any user in the domain until the krbtgt password is changed twice.

Abusing directory replication permissions to make a domain controller disclose password hashes for accounts, including krbtgt, without executing code on the domain controller itself.

A delegation setting where a service can impersonate users to any resource and receives their ticket-granting tickets. Coercing a privileged account to authenticate to such a host yields reusable credentials.

A delegation configuration limiting a service to specific target SPNs. It can be abused via protocol transition to impersonate arbitrary users to those targets without their credentials.

A delegation model configured on the target resource rather than the front-end service. An attacker who can write the msDS-AllowedToActOnBehalfOfOtherIdentity attribute can impersonate users to that machine.

Exploiting misconfigured Active Directory permissions, such as GenericAll, WriteDACL, or ForceChangePassword, on objects to reset passwords, add group members, or escalate privileges within the domain.

A graph-based tool that maps Active Directory relationships and permission edges, helping testers identify short paths from a controlled account to high-value targets like Domain Admins.

The Active Directory database file stored on domain controllers, containing all directory objects and password hashes. Extracting it offline yields credentials for every domain account.

Responding to broadcast name-resolution requests that fail DNS lookup, impersonating the sought host to capture NetNTLM authentication attempts from other machines on the local network.

Forwarding captured NetNTLM authentication to another service that accepts it, gaining access as the victim user without cracking the hash. Mitigated by SMB signing and channel binding.

A tool that poisons name resolution protocols and captures incoming authentication hashes on a local network segment, often used as the first step before relaying or cracking.

A Windows interface that lets security products scan scripts and in-memory content before execution. Testers often study bypass techniques to run tooling without triggering script-based detection.

Windows features such as Script Block Logging and Module Logging that record executed PowerShell code. They are a primary detection source during post-exploitation and must be understood for evasion.

Writing code into another process's memory and executing it there, often to inherit the target's trust or evade process-based monitoring. Detection focuses on unusual cross-process memory writes.

Security software that monitors process behavior, API calls, and memory activity on endpoints, reporting to a central console. Evasion focuses on avoiding suspicious behavior patterns rather than only bypassing signatures.

A control permitting only approved executables or scripts to run. Bypasses typically abuse signed system binaries, interpreters, or trusted installers that are already permitted.

Legitimate, often signed operating system utilities used to perform attacker actions such as downloading, executing, or exfiltrating data, reducing the need to drop custom malware.

Writing more data than a fixed-size buffer can hold, overwriting adjacent memory such as a saved return address. Exploitation redirects execution to attacker-controlled code or existing functions.

A random value placed before the saved return address on the stack and checked before function return. A corrupted canary indicates an overflow and terminates the process before control flow is hijacked.

Randomizing the base addresses of memory regions such as the stack, heap, and libraries at each run, making hardcoded addresses unreliable for exploitation. Often combined with PIE for executables.

Chaining short instruction sequences ending in a return, drawn from existing executable memory, to perform operations without injecting new code. Commonly used to bypass non-executable memory protections.

Corrupting a Global Offset Table entry so a later library call resolves to an attacker-chosen address, redirecting execution through the dynamic linker's lazy binding mechanism.