PJPT key terms

Information collected from publicly available sources such as websites, social media, public records, and certificate transparency logs, used to map an organization's people, infrastructure, and technology before any active contact.

Gathering information about a target without directly interacting with its systems, so no packets reach the target's infrastructure. Examples include WHOIS lookups, search engine queries, and third-party data brokers.

Directly querying or probing target-owned systems, such as DNS zone transfers, port scans, or banner grabs. Traffic reaches the target, so it is detectable and must be covered by written authorization.

A public registry query that returns domain registration details such as registrar, creation date, name servers, and sometimes registrant contact data, useful for identifying hosting providers and related domains.

Using advanced search operators like site:, filetype:, and intitle: to surface exposed files, login portals, directory listings, and indexed sensitive content belonging to a target organization.

Public append-only records of issued TLS certificates. Querying them reveals subdomains and internal hostnames an organization has certificates for, often exposing assets not listed in public DNS.

Discovering hostnames beneath a parent domain using wordlists, brute force, certificate logs, search engines, and DNS datasets, expanding the attack surface beyond the primary website.

Querying DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA) to map mail servers, third-party services, SPF/DMARC configuration, and naming conventions that reveal internal structure.

A misconfigured AXFR request that returns the full contents of a DNS zone, disclosing every hostname and IP address the name server is authoritative for in a single query.

A search engine that indexes internet-facing devices by banner and service metadata, letting testers find exposed services, default credentials pages, and unpatched software without scanning the target directly.

Connecting to a service and reading its greeting text to identify software name, version, and sometimes operating system, which informs later vulnerability research and exploit selection.

The SYN, SYN-ACK, ACK sequence that establishes a TCP connection. Scan types differ by how they open or abort this handshake, which determines stealth and logging behavior.

A half-open scan that sends SYN packets and never completes the handshake, making it faster and less likely to be logged by the application than a full connection scan.

A scan that completes the full TCP handshake using the operating system's connect call. It works without raw socket privileges but is slower and reliably logged by target services.

Probing connectionless UDP ports by sending payloads and interpreting ICMP unreachable replies or silence. Slower and less reliable than TCP scanning because open ports may never respond.

Actively probing open ports to determine the exact application, version, and configuration behind them, typically with version-detection scripts, so findings map to real vulnerabilities.

A framework of community scripts run during scanning to detect versions, enumerate shares and users, check for known vulnerabilities, and brute force credentials on discovered services.

Querying Server Message Block services (ports 139 and 445) to list shares, users, groups, and policies, often revealing null-session access, guest access, or signed-share misconfigurations.

An anonymous SMB connection accepted without credentials, allowing enumeration of users, groups, and shares. It is a legacy misconfiguration that still appears on older or misconfigured hosts.

Identifying multiple websites served from one IP address by sending requests with different Host headers, revealing hidden applications that share infrastructure but are not linked publicly.

A payload in which the compromised host initiates a connection back to the attacker's listener, bypassing inbound firewall rules that block unsolicited connections to the target.

A payload that opens a listening port on the compromised host, which the attacker then connects to. It fails when inbound traffic to the target is filtered by a firewall.

Delivering a small stager that downloads or executes the full payload in memory. It keeps the initial exploit small and can evade file-based detection on disk.

An exploitation platform with modules for exploits, payloads, encoders, and post-exploitation, plus a database for tracking hosts and credentials during an engagement.

An advanced in-memory payload providing an interactive shell with built-in commands for privilege escalation, credential dumping, pivoting, and file transfer on compromised hosts.

Using a compromised host as a relay to reach systems on internal networks that are not directly routable from the tester's machine, often through port forwarding or proxy channels.

Gaining higher permissions on a host, such as moving from a standard user to administrator or root, by abusing misconfigurations, weak permissions, unpatched software, or credential exposure.

Requesting service tickets for accounts with service principal names, then cracking them offline to recover plaintext passwords, because ticket encryption is often weak and tied to the account password.

Requesting authentication data for accounts that do not require Kerberos pre-authentication, then cracking the returned encrypted blob offline to recover the account password.

A Kerberos step where the client proves identity by encrypting a timestamp with its password-derived key. Disabling it lets attackers request crackable material without valid credentials.

An identifier binding a service instance to an Active Directory account. Accounts with SPNs are targets for Kerberoasting because service tickets are encrypted with their password hash.

A tool that ingests Active Directory relationship data and graphs attack paths, showing how users, groups, sessions, and permissions chain together to reach domain administrator.

Moving from one compromised host to another within a network using stolen credentials, tokens, or remote execution techniques, progressively expanding control toward high-value targets.

Authenticating with a captured NTLM hash directly, without cracking it, to access systems that accept NTLM authentication, allowing lateral movement when the hash belongs to a privileged account.

Capturing an authentication attempt and forwarding it to another service to authenticate as the victim, effective where SMB signing is disabled or not required.

A setting that cryptographically signs SMB traffic to prove authenticity and integrity. When disabled, attackers can relay or tamper with SMB authentication between hosts.

The most privileged default group in an Active Directory domain, granting control over domain controllers, member servers, and user accounts. Reaching it is usually the engagement's objective.

A forged Kerberos ticket-granting ticket created with the KRBTGT account hash, granting persistent domain-wide access to any account until the password is changed twice.

Inserting SQL syntax into user-controlled input so the database executes unintended queries, potentially bypassing authentication or extracting, modifying, or deleting stored data.

SQL injection where results are not returned directly; the tester infers data by observing boolean responses, timing delays, or error behavior across many crafted requests.

Injecting script into pages viewed by other users so it runs in their browsers, enabling session theft, credential phishing, or actions performed as the victim.

An HTTP response header that restricts which script sources a browser may execute, mitigating cross-site scripting when configured strictly rather than permissively.

An access control flaw where a user-supplied identifier, such as an account or file number, directly references an object the requester should not be allowed to access.

A class of flaw where the application fails to enforce who may perform an action or view a resource, letting users exceed their intended permissions horizontally or vertically.

Leakage of sensitive data through error messages, debug pages, backups, headers, or verbose responses, providing attackers with versions, paths, credentials, or internal logic.

The exchange that derives session keys between a client and access point. Capturing it allows offline dictionary attacks against the pre-shared key.

Obtaining a key identifier from a single frame sent by the access point, then attacking it offline without waiting for a client handshake, making it faster and stealthier than handshake capture.

Sending forged management frames that disconnect clients from an access point, used to force reconnection so a handshake can be captured, and also usable as a denial-of-service technique.

Simultaneous Authentication of Equals, a password-authenticated key exchange in WPA3 that resists offline dictionary attacks on captured handshakes, unlike WPA2's pre-shared key exchange.

A rogue access point impersonating a legitimate network name to lure clients into connecting, enabling traffic capture or credential harvesting through a captive portal.

A signed document defining scope, permitted techniques, testing windows, escalation contacts, and prohibited actions, establishing what the tester may legally do and when to stop.

A contractual document describing deliverables, timeline, scope boundaries, and cost of an engagement, forming the commercial basis alongside the authorization to test.

A signed authorization letter carried during testing that identifies the tester, the client, the scope, and emergency contacts, so law enforcement or administrators can verify the activity is sanctioned.

Assigning severity to each finding using a consistent scale such as CVSS or a qualitative matrix that weighs likelihood and impact, so the client can prioritize remediation.

The opening section of a report written for non-technical leadership, summarizing overall posture, the most serious risks, and recommended priorities without low-level technical detail.

Specific, actionable guidance for fixing each finding, including configuration changes, patches, or compensating controls, plus enough detail for the client's team to verify the fix.