PJPT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Passive reconnaissance

Collecting target information without sending packets to client infrastructure, using WHOIS, certificate transparency logs, DNS history, Shodan banners, and public job postings.

Certificate transparency logs

Public append-only records of issued TLS certificates; querying them (for example crt.sh) reveals subdomains, including expired ones that may still resolve to forgotten hosts.

Wildcard DNS detection

Resolving a random nonexistent label before subdomain brute force; if it returns an address, every brute-force result is a false positive and passive sources must be used instead.

TXT record reconnaissance

TXT records carry SPF and DMARC policy plus third-party domain-verification tokens, which disclose which SaaS and cloud vendors the organization uses.

Nmap port state meanings

Open means SYN/ACK or ACK received, closed means RST, filtered means no reply or ICMP unreachable, and open|filtered means no reply, typical of UDP services.

TCP connect versus SYN scan

-sT completes the handshake and needs no root but is logged by the target; -sS is faster and less logged but requires raw sockets and is blocked by stateful firewalls.

Service and version detection

Nmap -sV probes open ports to identify service and version; -sC adds default scripts and -A bundles OS detection, version detection, scripts, and traceroute.

UDP scan behavior

UDP scans are slow because open|filtered requires retransmission; limit to likely services such as 53, 123, 161, and 500 with --top-ports and a longer host timeout.

SNMP enumeration

snmpwalk with community strings such as public or private dumps device configuration, interfaces, and sometimes user accounts; SNMPv3 requires credentials instead of a community string.

Reverse shell preference

Reverse shells are preferred over bind shells because egress filtering is rarer than ingress filtering; a listener such as nc -lvnp or multi/handler receives the callback.

Staged versus stageless payloads

Staged payloads download a second stage and are smaller on the wire; stageless payloads survive egress proxies that block the second download, at the cost of size.

Linux shell stabilization

Spawn a PTY with python3 pty.spawn('/bin/bash'), press Ctrl+Z, run stty raw -echo, foreground the job, and export TERM=xterm to restore job control and tab completion.

Hashcat mode selection

Hashcat -m maps hash types to modes: 1000 for NTLM, 1800 for sha512crypt, 13100 for Kerberoast tickets, and 22000 for WPA handshakes and PMKIDs.

Kerberoasting

Requesting a Kerberos service ticket for any account with an SPN and cracking it offline; the traffic is ordinary Kerberos, and success depends on the service account password strength.

AS-REP roasting

Requesting an AS-REP for accounts with Kerberos pre-authentication disabled; the response is encrypted with the account password and cracks offline with hashcat mode 18200.

BloodHound ACL edges

Key Active Directory attack edges include GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync, each mapping to a specific privilege escalation technique.

DCSync attack

Abusing Replicating Directory Changes (All) rights on the domain object to impersonate a domain controller and extract password hashes, including krbtgt, with secretsdump or mimikatz.

NTLM relay prerequisites

SMB signing must be disabled on the target; authentication is coerced with PetitPotam or PrinterBug to a relay listener such as ntlmrelayx.py, granting access without cracking hashes.

Unconstrained delegation risk

Hosts trusted for unconstrained delegation cache user TGTs; coercing a privileged account to authenticate to such a host lets an attacker capture and reuse its ticket.

IDOR testing

Changing object identifiers or user parameters in requests and replaying them with a lower-privileged session to confirm horizontal or vertical access control failures.

XSS sink versus source

DOM-based XSS occurs when source data reaches a dangerous sink such as innerHTML or eval; testing the sink, not just the response body, is required to confirm it.

SQLi confirmation with sqlmap

Confirm injection with boolean or time-based payloads, then run sqlmap against a saved request file so cookies, headers, and session state are preserved.

Mass assignment

Adding fields such as role=admin to a profile update request; if the server binds them without an allowlist, the user gains privileges they should not hold.

Out-of-band SSRF and XXE

A collaborator or listener catching DNS or HTTP callbacks proves server-side request forgery or XML external entity access without dumping sensitive file contents.

WPA2 handshake capture

Monitor mode plus airodump-ng captures the four-way handshake, a deauth forces a client reconnect, and the capture cracks offline with aircrack-ng or hashcat mode 22000.

PMKID attack

Capturing the PMKID from an access point's first EAPOL message with hcxdumptool or airodump-ng; no client is needed, and the value cracks offline with hashcat mode 22000.

WPA3-SAE resistance

WPA3-SAE resists offline dictionary attacks; practical paths are transition-mode downgrade to WPA2 or a rogue access point rather than handshake cracking.

Evil twin with hostapd-wpe

A rogue access point cloning the SSID; auto-connecting clients may submit credentials to a captive portal, and 802.1X clients can leak MSCHAPv2 challenge and response.

Wireless scope limitation

Wireless testing covers only SSIDs and BSSIDs named in the authorization; deauthentication and rogue access points affect third parties and need explicit written approval.

Rules of engagement contents

Scope of IPs, domains, and SSIDs, test window, allowed techniques, emergency contacts, and data-handling rules; activity outside these terms is unauthorized access.

Anatomy of a finding

A title, affected asset, reproducible steps with request or command evidence, and concrete remediation; a scanner screenshot alone does not constitute a valid finding.

CVSS with environmental context

Severity starts from the CVSS base score and adjusts for exposure, data sensitivity, and compensating controls, with the adjustment rationale stated explicitly in the report.