PNPT flashcards
PNPT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Passive DNS
- A historical database of DNS resolutions that reveals subdomains and IP changes without sending traffic to the target, useful for mapping external attack surface.
- Certificate Transparency
- Public logs of issued TLS certificates; querying them (crt.sh) enumerates subdomains and internal hostnames exposed via certificate SANs.
- Google Dork
- A search query using advanced operators (site:, filetype:, inurl:) to surface exposed files, login pages, or indexed sensitive data on a target domain.
- Shodan
- An internet-wide scanner search engine indexing banners, ports, and TLS certificates; filters like org: and product: map an organization's exposed services.
- TheHarvester
- A OSINT tool that collects emails, hostnames, and employee names from public sources such as search engines, PGP keyservers, and LinkedIn.
- Metadata harvesting
- Extracting EXIF, PDF author, and Office last-modified-by fields from public documents to infer internal usernames, software versions, and file paths.
- AMSI bypass
- Techniques that prevent the Antimalware Scan Interface from inspecting script content, often by patching AmsiScanBuffer in memory; heavily signatured by EDR.
- Egress filtering test
- Probing outbound allowed ports and protocols (DNS, HTTP/S, ICMP, alternate ports) from a foothold to determine which channels can carry command-and-control traffic.
- Pass-the-Hash
- Authenticating with a captured NTLM hash instead of the plaintext password; works only where NTLM authentication is enabled, not in Kerberos-only environments.
- Kerberoasting
- Requesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords; success depends on password strength.
- AS-REP Roasting
- Requesting an AS-REP for accounts with Kerberos preauthentication disabled, then cracking the encrypted portion offline without any valid credentials.
- DCSync
- Abusing directory replication rights (DS-Replication-Get-Changes) to request password hashes from a domain controller as if it were another DC.
- Golden Ticket
- A forged Kerberos TGT created with the krbtgt account hash and domain SID, granting domain-wide access until krbtgt is changed twice.
- Silver Ticket
- A forged Kerberos service ticket for a specific SPN, encrypted with the service account hash; does not contact the domain controller.
- BloodHound
- A graph-based tool that maps Active Directory relationships and identifies shortest attack paths to Domain Admin using collected ACL and session data.
- Nmap -Pn
- A scan option that skips host discovery and treats all targets as online, necessary when ICMP or ARP is filtered on external assessments.
- testssl.sh
- A command-line tool that assesses TLS/SSL configuration, including protocol versions, cipher suites, certificate validity, and known vulnerabilities like Heartbleed.
- Password spraying
- Trying a small set of common passwords across many accounts to avoid lockout thresholds; effective against external VPN, OWA, and RDP portals.
- ProxyShell
- A chain of Microsoft Exchange vulnerabilities (CVE-2021-34473, -34523, -31207) enabling unauthenticated remote code execution on exposed Exchange servers.
- Citrix Bleed
- CVE-2023-4966, a buffer over-read in Citrix NetScaler ADC/Gateway that leaks session tokens, allowing hijacking of authenticated sessions.
- Responder
- A tool that poisons LLMNR, NBT-NS, and mDNS to capture NetNTLMv2 challenge-response hashes from internal hosts attempting name resolution.
- ntlmrelayx
- Part of Impacket; relays captured NTLM authentication to other hosts or LDAP to gain access, especially where SMB signing is disabled.
- mitm6
- Exploits unmanaged IPv6 by acting as a DHCPv6 server and DNS resolver, enabling relay of authentication to LDAP for privilege escalation.
- SMB signing
- A security feature that cryptographically signs SMB traffic; when disabled, NTLM relay attacks against SMB are possible. Check with nmap smb2-security-mode.
- GPP passwords
- Group Policy Preferences files in SYSVOL may contain cpassword values encrypted with a publicly known AES key; decrypt with gpp-decrypt.
- Unquoted service path
- A Windows service binary path containing spaces without quotes; an attacker can place a malicious executable in an earlier directory to hijack execution.
- SUID binary
- A Linux executable that runs with the file owner's privileges; misconfigured SUID binaries can be abused via GTFOBins to escalate to root.
- Ligolo-ng
- A tunneling tool that creates a TUN interface for pivoting into internal networks without proxychains, supporting multiple reverse connections.
- CVSS
- The Common Vulnerability Scoring System produces a 0–10 base score from exploitability and impact metrics; used as an input to risk rating in reports.
- Executive summary
- The non-technical opening section of a report that states overall risk posture, key business impacts, and top recommendations for leadership.
- Debrief readout
- A live session with the client to walk through the attack narrative, top findings, and remediation priorities; typically 45–60 minutes with Q&A.
- Remediation tracking
- A spreadsheet or ticketing list mapping each finding to an owner, due date, and status, used by the client to close gaps after the engagement.