PenTest+ flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of engagement

Document that defines authorized targets, testing windows, permitted techniques, escalation contacts, and stop conditions for an engagement; activity outside it is unauthorized.

Statement of work

Contract artifact listing deliverables, timeline, fees, and acceptance criteria for a penetration test; it complements the rules of engagement and legal authorization.

Black-box testing

Assessment performed with no prior knowledge of the target's internal design, credentials, or configuration, simulating an external attacker with limited information.

White-box testing

Assessment where testers receive source code, architecture diagrams, configuration details, and credentials, allowing deeper coverage and more efficient vulnerability discovery.

CVSS base score

Numeric severity from 0 to 10 derived from exploitability and impact metrics; it measures technical severity, not business risk or likelihood of exploitation.

Kill switch procedure

Pre-agreed method to immediately halt testing if critical systems, safety, or legal boundaries are affected; contacts and commands are defined before execution.

NDA in pentest

Confidentiality agreement that governs how findings, credentials, and sensitive client data are stored, shared, and destroyed after the engagement.

Passive reconnaissance

Information gathering that does not directly touch target-owned systems, using public records, search engines, certificate logs, and third-party data sources.

DNS zone transfer

AXFR query to an authoritative DNS server that returns all records in a zone if the server permits transfers; it can expose hosts and services.

Nmap SYN scan

Half-open TCP scan using -sS that sends SYN packets and analyzes responses without completing the three-way handshake; requires raw packet privileges.

Service version detection

Nmap -sV probing that identifies application name and version on open ports by sending targeted probes and matching responses to signatures.

SNMP enumeration

Querying SNMP agents, often with default community strings, to collect system details, interfaces, routes, and sometimes user or process information.

Certificate transparency

Public append-only logs of issued TLS certificates; searching them can reveal subdomains and assets not linked from the main website.

Credentialed vulnerability scan

Scan that authenticates to hosts to inspect installed patches, configuration, and software, producing fewer false positives and deeper results than unauthenticated scanning.

CVE identifier

Unique public identifier for a specific disclosed vulnerability, maintained in a catalog and often enriched by NVD with severity and references.

CWE

Classification system for software weakness types, such as injection or buffer overflow, independent of any single vulnerability instance.

EPSS score

Probability estimate that a specific CVE will be exploited in the wild within the next 30 days; it complements but does not replace severity scoring.

False positive

Scanner finding that reports a vulnerability which is not actually present or exploitable on the target, often due to version backports or configuration differences.

SAST

Static application security testing that analyzes source or bytecode without executing the application, looking for coding patterns that indicate weaknesses.

DAST

Dynamic application security testing that probes a running application from the outside, exercising inputs and observing responses for vulnerabilities.

Password spraying

Attack that tries a small set of common passwords across many accounts to avoid lockout, exploiting weak password policy rather than breached credentials.

Pass-the-hash

Authentication attack using a captured NTLM hash directly, without cracking the plaintext password, against systems that accept NTLM authentication.

Kerberoasting

Attack that requests Kerberos service tickets for accounts with service principal names and cracks them offline to recover the service account password.

SQL injection

Web vulnerability where untrusted input alters the structure of a SQL query, enabling data disclosure, authentication bypass, or modification; parameterized queries prevent it.

SSRF

Server-side request forgery, where an attacker causes a server to request an attacker-chosen URL, potentially reaching internal services or cloud metadata endpoints.

Reverse shell

Payload where the compromised host initiates a connection back to the attacker's listener, commonly used to bypass inbound firewall restrictions.

DCSync

Post-exploitation technique that impersonates domain controller replication to request password hashes from Active Directory without executing code on the domain controller.

Golden ticket

Forged Kerberos ticket-granting ticket created with the KRBTGT password hash, allowing persistent domain-wide authentication as any user.

Silver ticket

Forged Kerberos service ticket created with a service account's password hash, granting access to that specific service without contacting the domain controller.

Lateral movement

Techniques used after initial compromise to move between hosts and accounts, including remote service creation, PsExec, WMI, WinRM, SMB, SSH, and RDP.

Pivoting

Using a compromised host as a relay to reach networks not directly accessible to the attacker, often through port forwarding or SOCKS proxies.

C2 beaconing

Periodic outbound communication from an implant to a command-and-control server; jitter and common protocols help blend with normal network traffic.