PenTest+ key terms

A written agreement that defines what a penetration tester may and may not do during an engagement, including allowed targets, techniques, timing, and emergency contacts.

The list of systems, networks, applications, and people included in a penetration test, plus anything explicitly excluded. It keeps testing legal and focused.

A formal document describing the services to be delivered, deliverables, timeline, and cost of an engagement. It sets expectations between the tester and the client.

A signed document from an authorized client representative granting permission to test specified systems. Testers carry it as proof that activity is sanctioned.

A legal agreement that requires the tester to keep confidential information learned during the engagement private, protecting the client's sensitive data and business details.

Testing with full knowledge of the target, including source code, architecture diagrams, and credentials. It simulates an insider and often finds deeper issues faster.

Testing with partial knowledge of the target, such as limited documentation or standard user credentials. It balances realism with efficiency.

Testing with no prior knowledge of the target, simulating an external attacker who must discover everything from scratch. It is realistic but time-consuming.

Gathering information about a target without directly interacting with its systems, using public sources such as search engines, social media, and public records. It is hard for the target to detect.

Directly probing a target's systems to gather information, for example by sending packets or queries. It is more accurate than passive reconnaissance but can be detected and logged.

Intelligence collected from publicly available sources, including websites, social media, DNS records, and government filings, to learn about an organization's people, technology, and exposure.

A DNS feature that copies all records for a zone from one server to another. If misconfigured, it can reveal hostnames, IP addresses, and mail servers to an attacker.

Sending probes to a target's network ports to learn which are open, closed, or filtered. Results help identify running services and potential entry points.

Probing open ports to identify the software and version behind each service, often by reading banners or sending crafted requests. Version data helps map known vulnerabilities.

Querying the Server Message Block service on Windows hosts to list shares, users, groups, and policies. Misconfigured SMB can expose sensitive files and account information.

Discovering hostnames that belong to a target domain, using wordlists, certificate logs, and DNS queries. It expands the attack surface beyond the main website.

An automated check of systems and applications for known weaknesses, missing patches, and misconfigurations. Results must be validated because scanners can be wrong.

A vulnerability scan that logs in to the target with credentials, allowing it to inspect installed software and settings more deeply than an unauthenticated scan.

A scan result that reports a vulnerability where none actually exists. Testers must verify findings manually before including them in a report.

A weakness that exists but is not reported by a scanner. False negatives are dangerous because they create a false sense of security.

A standardized scoring system that rates the severity of a vulnerability using metrics such as exploitability, impact, and environmental factors. Scores range from 0 to 10.

A unique identifier assigned to a publicly known cybersecurity vulnerability, maintained in a global catalog. It lets tools and analysts refer to the same flaw consistently.

A probability score estimating how likely a vulnerability is to be exploited in the wild within the next 30 days. It helps prioritize patching beyond severity alone.

A catalog of common software weakness types, such as buffer overflows or injection flaws. It describes categories of mistakes rather than individual vulnerabilities.

A technique, script, or tool that takes advantage of a vulnerability to cause unintended behavior on a target, such as executing code or revealing data.

The code or action an exploit delivers once it succeeds, such as opening a shell, creating a user, or downloading a file. It determines what the attacker can do next.

A connection where the compromised target initiates contact back to the attacker's machine and provides a command prompt. It often bypasses inbound firewall rules.

Inserting malicious SQL statements into application input so the database executes attacker-controlled queries. It can expose, modify, or delete data.

Injecting malicious scripts into web pages viewed by other users, so the script runs in their browser. It can steal sessions, redirect users, or alter page content.

Trying a small set of common passwords against many accounts to avoid lockouts. It succeeds when users share weak passwords across the organization.

Requesting service tickets for Active Directory service accounts and cracking them offline to recover passwords. It works because service tickets are encrypted with the service account's password hash.

Responding to broadcast name-resolution requests on a local network to impersonate legitimate hosts and capture authentication hashes from Windows systems.

Gaining higher-level permissions on a system than initially obtained, such as moving from a standard user to administrator or from user to SYSTEM.

Using a compromised host as a relay to reach systems on other networks that the attacker cannot access directly. It extends the attack into segmented environments.

Moving from one compromised system to another within a network to reach new data or higher privileges. Techniques include remote services, stolen credentials, and shared drives.

Maintaining access to a compromised system across reboots, credential changes, or cleanup attempts, often through scheduled tasks, services, or backdoors.

Extracting stored or cached credentials, such as password hashes or plaintext passwords, from a compromised system's memory or files. Stolen credentials enable further access.

A forged Kerberos ticket-granting ticket created with the KRBTGT account hash, giving an attacker domain-wide access that can persist until the hash is changed twice.

A channel attackers use to send commands to and receive data from compromised systems, often using periodic callbacks to blend in with normal traffic.

Unauthorized transfer of data from a compromised network to an attacker-controlled location. It may be staged, compressed, or encrypted to avoid detection.