PECB Certified Lead Ethical Hacker key terms

Collecting information about a target without sending traffic directly to its systems, for example through public records, search engines, certificate transparency logs, or third-party data sources. It reduces the chance the target detects the activity.

Gathering information by interacting directly with target hosts, such as port scanning, banner grabbing, or service probing. It produces more precise results than passive methods but generates logs and can trigger alerts.

Open-source intelligence: information lawfully collected from publicly available sources such as websites, social media, registries, job postings, and leaked data indexes. Analysts use it to map people, technology, and exposed assets before testing.

The structured process of building a profile of an organization's external footprint, including domains, IP ranges, mail servers, subsidiaries, and technologies. It forms the scoping baseline for later enumeration and testing.

A DNS replication mechanism (AXFR) that copies an entire zone from a primary to a secondary server. If misconfigured to allow arbitrary clients, it discloses all hostnames and IP addresses in the zone.

Querying DNS records such as A, MX, TXT, NS, and CNAME to discover hosts, mail infrastructure, and third-party service relationships. TXT and CNAME records often reveal cloud providers and verification tokens useful for further mapping.

Discovering hostnames beneath a parent domain using wordlists, certificate transparency logs, search engine queries, and DNS brute force. Forgotten or staging subdomains frequently expose weaker controls than production systems.

Connecting to a service and reading the identification string it returns, such as an SSH or web server version. The banner helps fingerprint software and versions, which then informs vulnerability research.

Determining which software, version, and configuration a listening port runs by analyzing responses, protocol behavior, and TLS characteristics. Accurate fingerprinting narrows vulnerability research to relevant candidates.

Probing TCP or UDP ports to learn which services accept connections on a host. Scan type choices such as SYN, connect, or UDP affect speed, accuracy, and how much evidence the scan leaves.

The sum of all points where an attacker could interact with or influence a system, including exposed services, interfaces, credentials, third parties, and users. Mapping it guides scoping and prioritization of testing effort.

A structured representation of what is being protected, who might attack it, and how. It typically documents assets, trust boundaries, entry points, and adversary capabilities so testing can target realistic scenarios.

A threat classification scheme covering Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Teams apply it per component and trust boundary to generate systematic threat lists.

A risk rating model scoring Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. It produces a comparative number for ranking threats, though the scores are subjective and best used consistently within one engagement.

The Common Vulnerability Scoring System, a standardized method for expressing vulnerability severity from metrics such as attack vector, complexity, privileges required, and impact. Base scores omit environmental context, so analysts adjust them for the target.

Common Vulnerabilities and Exposures: a catalog assigning unique identifiers to publicly disclosed vulnerabilities. A CVE ID enables consistent cross-referencing between scanners, advisories, and vendor patches.

A scanner or analyst finding that reports a vulnerability which does not actually exist or is not exploitable in the target's configuration. Unverified false positives erode report credibility and must be triaged before delivery.

A vulnerability that exists but was missed by the testing process. False negatives are harder to detect than false positives and are reduced by combining automated scanning with manual testing and code or configuration review.

Confirming that a reported weakness is real and reachable in the actual target environment, typically by manual reproduction or safe proof. It distinguishes actionable findings from scanner noise before exploitation or reporting.

Code or a sequence of actions that leverages a vulnerability to achieve an unintended effect, such as code execution or data access. Reliable exploits account for target versions, memory layout, and defensive controls.

The component delivered after successful exploitation that performs the desired action, such as opening a shell, adding a user, or exfiltrating data. It is distinct from the exploit mechanism that gains control.

A minimal, controlled demonstration that a vulnerability can be exploited, used to justify severity without causing harm. A good PoC records exact steps, preconditions, and observed evidence so the finding can be reproduced.

A connection in which the compromised host initiates outbound traffic back to the tester's listener, giving an interactive command session. It often bypasses inbound firewall rules that block unsolicited connections.

A session where the compromised host listens on a port and the tester connects to it. It fails when inbound filtering or network address translation blocks the connection, making reverse shells more common in practice.

Supplying crafted input that alters the structure of a database query, potentially exposing or modifying data or executing operating system commands. Union-based, error-based, and blind variants differ in how results are extracted.

Injecting script into content that other users' browsers render, letting the attacker act in the victim's session. Stored, reflected, and DOM-based variants differ in where the payload persists and executes.

Moving from a lower-privileged account or context to one with more rights, such as local administrator or root. It exploits misconfigurations, weak permissions, unpatched software, or credential exposure on the compromised host.

Accessing resources or accounts belonging to a peer with similar rights rather than gaining higher authority, for example reading another standard user's data. It still breaches confidentiality and often enables vertical escalation.

A Linux executable marked to run with the permissions of its owner, often root. Misconfigured or vulnerable SUID programs are a common escalation path because they can be abused to execute commands with elevated rights.

Exploiting cron jobs or Windows scheduled tasks that run with higher privileges but reference scripts or directories a low-privileged user can modify. Replacing or editing the referenced file yields execution in the privileged context.

Extracting stored secrets such as password hashes, cached credentials, or tokens from a compromised system's memory or configuration stores. Recovered credentials enable lateral movement and further escalation.

Authenticating with a captured password hash instead of the plaintext password, exploiting protocols that accept hash-based proof. It works where the hash can be reused directly and does not require cracking.

Moving from one compromised host to other systems in the environment to reach higher-value assets. Techniques include remote service abuse, credential reuse, and trust relationships between machines.

Using a compromised host as a relay to reach networks or services not directly accessible from the tester's position. It typically relies on port forwarding, proxy channels, or tunneled sessions through the foothold.

Redirecting traffic from one local or remote port to another address through an intermediary host. In testing it lets tools reach internal services via a compromised machine without deploying extra agents.

Encapsulating one protocol inside another to carry traffic across restrictive networks or hide its nature. Common examples carry arbitrary traffic over SSH, DNS, or HTTP to traverse egress filtering.

Transferring collected data out of the target environment, ideally over channels that blend with normal traffic and respect agreed limits. In authorized testing, exfiltration is simulated and minimized to prove impact safely.

A documented agreement defining scope, permitted techniques, timing, escalation contacts, and prohibited actions for a security test. It protects both tester and client and anchors decisions when unexpected situations arise.

The opening section of a report written for non-technical leadership, conveying overall risk posture, key themes, and prioritized recommendations without deep technical detail. It should stand alone for readers who never open the technical sections.

Specific, actionable advice for fixing each reported weakness, including configuration changes, patches, or compensating controls. Useful guidance explains why the issue matters and how to verify the fix.