PECB Certified Lead Ethical Hacker flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Passive reconnaissance

Information gathering that sends no traffic to the target, relying on third-party sources such as WHOIS, DNS records, certificate transparency logs, and search engines.

DNS zone transfer

A replication request (AXFR) to an authoritative name server; if misconfigured, it returns every record in the zone, disclosing hosts and internal naming.

Certificate transparency logs

Public append-only logs of issued TLS certificates; searching them by domain reveals subdomains and SAN entries that may not appear in DNS.

Nmap filtered port state

The port produced no response or an ICMP unreachable message, indicating a firewall or filter is dropping probes rather than the host being absent.

TCP SYN scan

A half-open scan that sends SYN and never completes the handshake; it is fast and less likely to be logged by the application than a connect scan.

Banner grabbing

Connecting to a service and reading its greeting to identify software and version, which then maps to known vulnerabilities and default configurations.

STRIDE model

A threat classification covering Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege, each mapped to a violated security property.

CVSS base score

A 0-10 severity metric derived from exploitability (attack vector, complexity, privileges, user interaction) and impact on confidentiality, integrity, and availability.

CVE versus CWE

CVE identifies one specific publicly disclosed vulnerability instance; CWE classifies the underlying weakness type, such as SQL injection or buffer overflow.

Trust boundary

A line in a data-flow diagram where data moves between components of different privilege or trust; each crossing is a candidate for threat analysis.

Authenticated vulnerability scan

A scan using valid credentials to inspect installed packages and configuration locally, producing fewer false positives than unauthenticated remote fingerprinting.

False positive validation

Confirming a scanner result manually, for example by checking the actual version or safely reproducing the condition, before reporting it as a finding.

Reverse shell

A payload in which the target initiates a connection back to the attacker's listener, traversing NAT and egress-permitting firewalls more reliably than a bind shell.

Bind shell

A payload that opens a listening port on the compromised target; the attacker connects inbound, so it fails when firewalls block inbound access.

UNION-based SQL injection

An in-band technique appending a UNION SELECT to the original query; it requires matching the original column count and compatible data types.

Blind SQL injection

Injection where output is not returned; confirmation relies on boolean true/false responses or time delays that reveal the truth of injected conditions.

Stored cross-site scripting

Malicious script persisted server-side (in a comment or profile) and executed in other users' browsers; output encoding and Content-Security-Policy are the decisive controls.

Command injection

Execution of attacker-supplied shell commands because input reaches a system shell; blind cases are confirmed with time delays or out-of-band callbacks.

ASLR and DEP

Two exploit mitigations: address space layout randomization moves memory regions to hinder fixed addresses, and data execution prevention blocks code on the stack.

Offline password cracking

Attacking captured hashes locally with tools such as Hashcat; speed depends on the hash algorithm, hardware, and wordlist or mask quality, with no lockout risk.

GTFOBins

A catalog of Unix binaries that can break out of restricted shells or escalate privileges when granted sudo rights or SUID bits, such as find, vim, and awk.

SUID binary abuse

A root-owned executable with the SUID bit runs as root; if it can spawn a shell or read arbitrary files, the invoking user gains root privileges.

sudo -l enumeration

Lists commands the current user may run with sudo; NOPASSWD entries, wildcards, and retained environment variables are common escalation paths.

LD_PRELOAD escalation

If sudo retains the environment and allows LD_PRELOAD, a malicious shared library is loaded into the privileged process and runs as root.

SeImpersonatePrivilege

A Windows token privilege allowing a process to impersonate other users; it enables Potato-family attacks that steal a higher-privileged token to become SYSTEM.

Unquoted service path

A Windows service path containing spaces without quotes; the loader tries each prefix, so a malicious executable placed earlier in the path runs as SYSTEM.

LSASS credential dumping

Reading the Local Security Authority process memory to extract password hashes and tickets; mitigated by Credential Guard and protected process light.

SSH dynamic forwarding

An SSH option (-D) that opens a local SOCKS proxy tunneling traffic through the SSH server, letting tools reach networks routable from that host.

Metasploit autoroute

A module that adds a network route through an existing session, so other modules can target internal subnets reachable only from the compromised host.

Proxychains DNS leak

By default proxychains may resolve names locally, revealing the real client; enabling proxy_dns forces resolution through the proxy chain instead.

certutil download

A signed Windows utility invoked as certutil -urlcache -f to retrieve files over HTTP, commonly used when other transfer tools are unavailable.

CVSS vector string

A compact encoding of the metric values behind a CVSS score, making severity reproducible and auditable across reports and retests.