OSCP key terms

An AXFR request in which a client asks a DNS server to send its full zone file. If the server allows transfers from untrusted hosts, every internal hostname and IP is disclosed at once.

An unauthenticated connection to the SMB IPC$ share on older or misconfigured Windows hosts that lets an attacker list users, groups, shares and password policy without valid credentials.

A plaintext value, often left as public or private, used to authenticate SNMP queries. Default or guessed strings let an attacker read interface, process and sometimes configuration data from network devices.

Discovering hostnames that do not appear in public DNS by brute-forcing wordlists, mining certificate transparency logs, or querying passive DNS sources, exposing forgotten staging and admin systems.

Connecting to a service and reading the text it returns on connect, which often identifies the software, version and sometimes the operating system, guiding later exploit selection.

A unique public identifier of the form CVE-YYYY-NNNNN assigned to one disclosed vulnerability, so scanners, advisories and tools can refer to the same flaw unambiguously.

A standardized 0-10 scoring system that rates vulnerability severity from exploitability and impact metrics, used to decide which findings to fix or attack first.

A scanner finding that reports a vulnerability which is not actually present or not exploitable given the target's configuration. It must be verified manually before being reported or attacked.

Inserting SQL syntax into user-controlled input so the backend database executes attacker-chosen queries, enabling data theft, authentication bypass and in some cases command execution.

Injecting script into a page that other users load, so the payload runs inside their browser session and can steal cookies, perform actions as them, or redirect them elsewhere.

A file-inclusion flaw where user input controls the path a web application includes, letting an attacker read local files or chain with log poisoning and uploads to execute code.

A flaw where the server fetches a URL supplied by the user, allowing the attacker to reach internal-only services, cloud metadata endpoints, or bypass network access filtering.

An access-control flaw where an application exposes an internal identifier in a parameter and does not verify the requester is authorized to access that specific object.

A script uploaded to a web server that accepts commands over HTTP, giving the attacker remote command execution with the privileges of the web service account.

An Office file containing VBA code that runs when the user enables macros, commonly used to launch a stager that downloads a shell from attacker-controlled infrastructure.

A file that runs as a full Windows application when opened, executing embedded VBScript or JScript outside the browser sandbox and frequently used as a client-side execution payload.

A crafted Windows shortcut whose target or arguments run a command when double-clicked, often packaged in an archive or USB drive to deliver code without relying on macros.

A payload that makes the victim connect back to an attacker listener, giving an interactive shell. It works when inbound connections to the victim are blocked by a firewall.

A payload that opens a listening port on the victim and waits for the attacker to connect. It fails if a firewall or NAT blocks inbound traffic to that port.

Authenticating with a captured NTLM hash instead of the plaintext password, abusing protocols that accept the hash itself as sufficient proof of identity.

A GPU-accelerated offline password cracking tool supporting many hash formats, wordlists, mangling rules and mask attacks, used once hashes have been extracted from a system.

Trying one common password against many accounts while staying under lockout thresholds, used to find weak credentials without locking out the users being tested.

A permission flag that makes a file run with the privileges of its owner. A root-owned SUID binary with abusable functionality can be leveraged into a root shell.

Entries in /etc/sudoers or NOPASSWD rules that let a low-privileged user run a specific command as root, which can often be turned into a full shell.

Per-binary privilege grants finer than full root, such as cap_setuid or cap_dac_read_search. A binary holding a dangerous capability can often be used to escalate privileges.

A curated reference of legitimate Unix binaries that can be abused to break out of restricted shells, read or write files, or escalate privileges when sudo or SUID permissions apply.

A Windows service whose executable path contains spaces but no quotes. Windows tries each space-delimited path in turn, so a planted binary in an earlier directory may run as SYSTEM.

A pair of registry policies that, when both enabled, let any user install MSI packages with SYSTEM privileges. It is trivially abused by crafting a malicious MSI.

A Windows token privilege, commonly held by service accounts, that allows impersonating other tokens. Tools that abuse named pipes and token duplication use it to reach SYSTEM.

Placing a malicious DLL where a program will load it before the legitimate one, exploiting the Windows search order or a missing dependency to run code in that process context.

Tunneling a local port through an SSH connection so traffic sent to that local port exits from the remote host, reaching services only accessible from there.

Creating a SOCKS proxy over SSH with the -D option, so any SOCKS-capable tool can send traffic through the remote network without defining a separate forward per port.

A tool that forces a program's TCP connections through a chain of proxies, typically a SOCKS tunnel, letting tools that are not proxy-aware reach internal hosts during pivoting.

A TCP and UDP tunnel carried over HTTP, written in Go, used to build SOCKS proxies and port forwards through a compromised host, often when only HTTP egress is allowed.

Requesting service tickets for accounts that have SPNs registered and cracking them offline, because each ticket is encrypted with the service account's password-derived key.

Requesting an AS-REP for accounts that have Kerberos pre-authentication disabled, then cracking the encrypted portion offline to recover that account's plaintext password.

Abusing directory replication rights to ask a domain controller to send password hashes for chosen accounts, including krbtgt, without executing code on the DC itself.

A forged Kerberos TGT signed with the krbtgt hash, granting access to any service in the domain for as long as that key is not reset.

A graph analysis tool that ingests Active Directory data collected by SharpHound and reveals privilege-escalation paths through group membership, sessions and ACL relationships.

Answering broadcast name-resolution requests on the local network with the attacker's address, capturing NetNTLM hashes or relaying them to other hosts for authentication.