PNPT key terms

Intelligence produced from publicly available information that is collected, filtered, and analyzed to answer a specific question about a target organization, its people, or its infrastructure.

Collecting information about a target without sending traffic directly to its systems, typically through third-party sources such as search engines, certificate logs, and public records.

Gathering information by interacting directly with target-owned systems, such as DNS queries, port scans, or banner grabs, which can be logged by the target.

The total set of exposed systems, services, accounts, and data an adversary could use to gain access, including forgotten assets that are not tracked by the target's inventory.

Public append-only records of issued TLS certificates that reveal hostnames and subdomains an organization has secured, useful for mapping infrastructure without touching target systems.

Systematically discovering hostnames beneath a parent domain using certificate logs, DNS brute forcing, search engine results, and passive DNS datasets to expand the known attack surface.

Historical records of domain-to-IP resolutions collected by third parties, letting a tester map past hosting, shared infrastructure, and related domains without querying the target's own name servers.

Identifying the autonomous system number and netblock ranges owned by an organization so that scanning can be scoped to all of its public address space rather than a single domain.

Collections of breached username and password pairs, such as public paste dumps, that a tester reviews to identify valid corporate accounts and password reuse patterns before engagement testing.

Systems, cloud accounts, and services deployed by business units without central IT approval or visibility, frequently internet-facing and outside normal patching and monitoring controls.

The subset of an organization's assets reachable from the internet, including VPN gateways, web applications, mail servers, and cloud storage, which forms the entry point for external testing.

The boundary between an organization's internal network and untrusted networks, enforced by firewalls, VPN concentrators, and remote access services that a tester attempts to cross.

Probing a host's TCP or UDP ports to determine which services are listening, typically followed by service and version detection to identify exploitable software.

Identifying the exact product, version, and configuration of a listening service through banner grabs, protocol probes, and response analysis so that known vulnerabilities can be matched.

Confirming that a suspected weakness is genuinely exploitable in the target's configuration rather than relying on scanner output alone, avoiding false positives in the final report.

The first foothold an attacker obtains on a target network or host, commonly through exposed services, phishing, valid credentials, or exploitation of an internet-facing application.

A low-privilege presence on a compromised host, such as a reverse shell or authenticated session, from which further enumeration and privilege escalation are performed.

Modifying payloads, loaders, or execution techniques so that endpoint protection does not detect or block them, for example through obfuscation, in-memory execution, or signed binary abuse.

The Antimalware Scan Interface in Windows, a programming interface that lets security products inspect scripts and in-memory content at runtime; testers must understand how it can block PowerShell payloads.

Network controls that restrict which outbound connections internal hosts may make, complicating reverse shells and command-and-control channels and forcing testers to find allowed protocols or proxies.

The channel and infrastructure an operator uses to task compromised hosts and receive results, often tunnelled over HTTPS or DNS to blend with permitted outbound traffic.

A periodic outbound check-in from an implant to its controller that signals the host is alive and retrieves tasking, designed to look like ordinary application traffic.

Malicious code or an agent placed on a compromised host that maintains access and executes operator commands, ranging from a simple shell to a full-featured post-exploitation framework.

Legitimate signed system executables, such as PowerShell or certutil, abused to download files, execute code, or move data while blending in with normal administrative activity.

Mechanisms that keep attacker access across reboots, credential changes, and cleanup, such as scheduled tasks, services, registry run keys, or added domain accounts.

Gaining a higher level of access than initially obtained, either vertically to administrator or SYSTEM on a host, or horizontally to another user with more rights.

Moving from one compromised host to another within a network using stolen credentials, remote execution protocols, or trust relationships, expanding control toward high-value targets.

Escalating from a lower-privileged account or host to a higher-privileged one, such as moving from a workstation user to a domain administrator through tiered trust abuse.

Requesting service tickets for accounts with registered service principal names and cracking the ticket material offline to recover the service account's password.

Requesting authentication data for accounts that do not require Kerberos preauthentication, then cracking the returned encrypted material offline to recover account passwords.

The default Windows domain authentication protocol, issuing ticket-granting tickets and service tickets; abuse of its ticket handling underpins many Active Directory attacks.

Authenticating to remote services using a captured NTLM password hash instead of the plaintext password, which works because the hash itself is accepted as proof of identity.

Intercepting an authentication attempt and forwarding it to another service to gain access as the victim, defeated by signing, channel binding, and disabling legacy protocols.

A configuration that cryptographically signs Server Message Block traffic, preventing tampering and relay attacks; testers check whether it is required on servers and workstations.

An Active Directory attribute that binds a service instance to an account; accounts with SPNs can be requested as Kerberos service tickets, enabling Kerberoasting.

A forged Kerberos ticket-granting ticket created with the krbtgt account hash, granting persistent domain-wide access until that hash is changed twice.

Achieving administrative control of a domain controller, which yields the domain's credential database and effectively full control of the Active Directory environment.

Impersonating a domain controller to request password replication data for accounts, including krbtgt, using directory replication rights granted to an attacker-controlled account.

Attempting a small set of common passwords against many accounts to avoid lockout thresholds, often succeeding where per-account brute force would be detected or blocked.

A domain setting that disables an account after a defined number of failed logon attempts, which testers must identify to avoid locking out users during credential attacks.

A documented, reproducible demonstration that a vulnerability or attack path is exploitable, including the commands used and evidence captured, supporting the finding's severity rating.

Specific, actionable changes an organization can make to close a finding, such as patching, configuration hardening, network segmentation, or control additions, prioritized by risk.

A structured severity assignment for a finding based on exploitability, impact, and exposure, often using a recognized scoring method, so clients can prioritize remediation effort.

A short, non-technical opening section of a penetration test report that states overall risk posture, key themes, and top recommendations for leadership readers.

The closing presentation to client stakeholders where the tester walks through findings, attack paths, business impact, and remediation priorities, and answers questions live.