Terms

Every term the path uses, in one place, in plain language. Definitions are original, informed by the NIST glossary.

802.1X: The standard for port-based network access control: a device must authenticate before the switch port or access point carries its traffic.
Appears in: Layer 2 and wireless
Acceptance criteria: Observable conditions agreed in advance for deciding whether work achieved its intended outcome.
Appears in: A recommendation needs an owner and outcome
Acceptance criterion: An observable condition that must be satisfied before a specified change can be accepted.
Appears in: Case study: decide whether a change is ready
Acceptance evidence: Recorded results that show whether a change satisfies its stated requirements in the reviewed scope.
Appears in: Case study: review a Windows service boundary
access control entry: An entry in an access-control list describing permissions for a particular security principal.
Appears in: Understanding identity access paths
Access matrix: A table relating subjects and resource actions to their required permission decisions.
Appears in: Case study: review a document-access policy
Access path: The route by which an identity reaches a resource, determining which authorization boundaries apply.
Appears in: A network share adds another access check · Understanding identity access paths
access token: The security context of a process or an impersonating thread, including identity, groups, and privileges.
Appears in: Windows privilege escalation
ACL: An access control list; its entries describe permissions or auditing rules for an object, depending on the ACL type.
Appears in: Active Directory
action approval: A decision authorizing a specific proposed action, including its target, scope, and important consequences.
Appears in: Designing layered AI defenses
Action boundary: The point where a proposed operation becomes a real effect and requires independent authorization.
Appears in: AI systems: suggestions and authority
Active Directory also: AD: Microsoft’s directory service that manages users, computers, and permissions across a Windows network. The backbone of most enterprises and the main event of internal testing.
Appears in: Active Directory · Reading an Active Directory environment
address space: The virtual addresses a process can use, with mappings and access permissions managed by the operating system.
Appears in: Memory safety: boundaries and lifetimes
adversary-in-the-middle also: man-in-the-middle, MITM, AitM: Positioning yourself between two parties so their traffic passes through you, to read or change it. ARP spoofing and evil twins are ways to get there.
Appears in: Layer 2 and wireless · Initial access and credentials
advisory: A publisher’s description of a vulnerability, affected conditions, and remediation.
Appears in: Securing common applications
Agent: A system that selects actions in an environment based on observations and an objective; it need not use a language model.
Appears in: A short history of AI
antivirus also: AV: Software that detects and blocks known malware by signatures and behavior. The first hurdle a payload on a Windows host has to clear.
Appears in: How antivirus and EDR protect endpoints
API also: application programming interface: The set of HTTP endpoints a front end or another program calls to get and change data. Testing it directly, not just the UI, finds bugs the interface hides.
Appears in: Web application architectures · APIs and GraphQL
argument array: An interface separating program arguments; it does not validate their meaning.
Appears in: Command and argument injection
argument injection: Untrusted input changes a program’s arguments or options in an unintended way.
Appears in: Command and argument injection
ARP also: Address Resolution Protocol: How devices on a local network find each other’s hardware address. It trusts any answer, so ARP spoofing lets an attacker impersonate the gateway.
Appears in: Layer 2 and wireless
artifact: Any concrete thing an attack leaves or a tester collects: a request, a log line, a file, a screenshot. Reports stand on artifacts, not on claims.
Appears in: Reporting: turn evidence into useful improvements
AS-REP roasting: Requesting authentication data for accounts that do not require Kerberos pre-authentication and cracking it offline for their passwords.
Appears in: Understanding identity access paths
Assessment coverage: The defined systems, conditions, and behaviors actually examined within an assessment.
Appears in: A clean result has a coverage boundary
asymmetric encryption also: public-key cryptography: Encryption with a key pair: a public key anyone may hold and a private key kept secret. What one locks only the other unlocks. Solves key sharing and enables signatures.
Appears in: Cryptography
ATLAS: MITRE’s knowledge base of adversarial threats to AI-enabled systems, supporting shared descriptions and defensive analysis.
Appears in: AI on offense
attack surface: Everything an attacker could touch: every open port, exposed page, API endpoint, input field, and person. Reconnaissance is the job of mapping it.
Appears in: Reconnaissance: building an evidence-based map · Network architectures
Attention: A mechanism that combines representations using learned relevance scores, subject to the model’s architecture and attention masks.
Appears in: Language models
authentication also: authn: Proving who you are to a system: a password, a token, a certificate, a fingerprint. Distinct from authorization, which is what that identity may do.
Appears in: Authentication · The words that make security clearer · Web applications · Authentication and access
authorization also: authz: Deciding what an already-identified user or service is allowed to do. Most ‘I could see someone else’s data’ bugs are authorization failures, not login failures.
Appears in: The words that make security clearer · Authentication and access · Web applications · Every request crosses a boundary · Prompt injection and instruction boundaries
authorized practice: Activity allowed by the system owner or provider, within the applicable scope and rules.
Appears in: Why this is free
availability: Ensuring timely and reliable access to information and services for authorized use.
Appears in: The words that make security clearer
back end also: server-side: The part of a web app that runs on the server, enforces the real rules, and reaches the database. Where trust actually lives and where the serious bugs are.
Appears in: Web application architectures · Server-side trust boundaries
backdoor: A hidden way into a system that bypasses normal authentication, planted by an attacker or left by a developer.
Appears in: Movement, sessions, and lasting access
backport: A fix applied to an older maintained software version.
Appears in: Securing common applications
backup: A separate copy of important data that you can use to recover after loss or damage.
Appears in: Keep what matters
banner also: banner grabbing: The greeting a service sends when you connect, often revealing its name and version. Free reconnaissance.
Appears in: Reconnaissance: building an evidence-based map
bearer token: A token that grants access to whoever holds it, presented in a header. Like cash: a leaked one in a log or URL is a real finding.
Appears in: Authentication
Bind listener: A process that accepts incoming connections; its reachability and authority are separate properties.
Appears in: Initial access and credentials
bind shell: A shell that listens on a port on the target for the attacker to connect in. Simpler than a reverse shell but blocked by any inbound firewall.
Appears in: Command and argument injection
BloodHound: A tool that maps Active Directory relationships into a graph and finds the shortest path from where you are to domain admin. Turns enumeration into a route.
Appears in: Reading an Active Directory environment · Understanding identity access paths
blue team: The defenders: the people and tooling that detect, respond to, and recover from attacks. What a red team tests.
Appears in: Defenses and detection
BOLA: Broken object-level authorization: missing or incorrect permission checks on a specific object.
Appears in: APIs and GraphQL
bound parameter: A value supplied separately from the SQL command’s structure.
Appears in: SQL injection
broken access control: The category where the server fails to enforce who may do what: IDOR, missing checks, forced browsing to admin pages. OWASP’s number-one web risk.
Appears in: Web applications · The words that make security clearer
brute force: Trying every possibility until one works: passwords, paths, tokens. Slow but sometimes unavoidable; rate limits and lockouts are the defense.
Appears in: Initial access and credentials · Authentication and access
buffer: An area of memory reserved for a sequence of data.
Appears in: Memory safety: boundaries and lifetimes
buffer overflow: Writing more data into a memory buffer than it holds, overwriting adjacent memory to corrupt data or seize control of execution. The classic memory-corruption bug.
Appears in: Memory safety: boundaries and lifetimes
bug bounty: A program where an organization pays outside researchers for responsibly reported vulnerabilities, within published rules that act as scope.
Appears in: Security frameworks: choose the right map
bundle: A packaged set of JavaScript modules delivered to a client.
Appears in: Understanding client-side JavaScript
Business invariant: A rule that must remain true across the states and transitions of a workflow.
Appears in: Business logic: valid steps, invalid outcomes
Capability: A Linux privilege for defined operations, with scope determined by process credentials, namespaces, and policy.
Appears in: Linux privilege escalation
certificate also: X.509 certificate: A signed document binding an identity to a public key, vouched for by a certificate authority. Proves a server, or with mutual TLS a client, is who it claims.
Appears in: Cryptography · Authentication
Certificate chain: A sequence of signed certificates connecting an identity or key to an accepted trust anchor.
Appears in: Certificates: who gets to vouch for whom?
CIA triad also: confidentiality, integrity, availability: The three properties security protects: confidentiality (only the right people can read it), integrity (it has not been changed), and availability (it is there when needed). Every finding damages at least one.
Appears in: The words that make security clearer
Cisco ISE also: Identity Services Engine: Cisco’s network access control server: the RADIUS-based decision point that tells switches and access points who may join and into which VLAN.
Appears in: Layer 2 and wireless
Client impersonation: A server thread acting in an authenticated client’s security context for an allowed operation.
Appears in: Impersonation is scoped responsibility
Clock offset: The difference between a clock’s reading and the reference time used for comparison.
Appears in: A timestamp needs clock context
cloud identity: Identity in cloud platforms, where access is governed by tokens and roles from a provider like Entra ID or AWS IAM rather than a password on a server. Tokens are the new keys.
Appears in: Cloud identity
cloud metadata service: An internal endpoint (169.254.169.254) that hands a cloud instance its credentials and configuration. The prize an SSRF often reaches for.
Appears in: Server-side trust boundaries · Cloud identity
CMS also: content management system: Software like WordPress, Joomla, or Drupal that runs a site through plugins and themes. Known plugin vulnerabilities make them frequent easy footholds.
Appears in: Securing common applications
command and control also: C2, C&C: The infrastructure and channel an attacker uses to send instructions to compromised systems and receive data back.
Appears in: How antivirus and EDR protect endpoints · Pivoting, proxies, and network boundaries
command injection: Injecting into a command the server runs on its operating system, turning a web input into a shell on the host. Often the fastest path from web bug to full control.
Appears in: Command and argument injection
Common-mode failure: A failure that defeats multiple protections through a dependency they share.
Appears in: Layers should not share every failure
confidentiality: Preserving authorized restrictions on access to and disclosure of information.
Appears in: The words that make security clearer
Configuration baseline: A defined, tested set of configuration expectations for a system role.
Appears in: Hardening: reduce what a device has to trust
confused deputy: A component uses its authority on a request whose authority it handles incorrectly.
Appears in: Server-side trust boundaries
Containment: Actions to limit continuing harm during an incident.
Appears in: Incident response: decisions under uncertainty · Containment changes the situation
Containment authority: The defined permission to approve a response action for a particular scope and condition.
Appears in: Response actions need authority
content discovery also: directory brute force, forced browsing: Finding pages, directories, and files a site does not link by requesting likely names from a wordlist. gobuster, ffuf, and feroxbuster do it.
Appears in: Mapping a web surface
Context window: The bounded input and generation capacity available to a model invocation under its implementation; applications decide what material to include.
Appears in: Language models
control: A safeguard or measure that changes risk.
Appears in: The words that make security clearer · Defenses and detection
Control objective: The behavior a safeguard is intended to achieve within a defined scope.
Appears in: A control needs an objective
cookie: A small value the server sets and the browser sends back on every request, usually to carry a session. Steal it and you are logged in as that user.
Appears in: HTTP and proxies · Authentication
Correlation identifier: A reference connecting related events so authorized support staff can locate the relevant diagnostic record.
Appears in: Errors need useful but limited detail
CORS also: cross-origin resource sharing: The browser rules that decide when one site’s JavaScript may read another site’s responses. Misconfigured, it lets a malicious site read authenticated data.
Appears in: APIs and GraphQL
coverage: The assets, perspectives, protocols, and time periods an assessment actually examined.
Appears in: Reconnaissance: building an evidence-based map · Mapping a web surface
credential: Anything that proves an identity: a password, a hash, a token, a key, a ticket, a certificate. Gathering and reusing credentials is the engine of most intrusions.
Appears in: Initial access and credentials · Authentication
Credential isolation: Separating selected authentication secrets from the ordinary operating-system environment using additional protection.
Appears in: Credential isolation has a defined scope
credential stuffing: Trying username-password pairs leaked from one breach against other sites, exploiting password reuse.
Appears in: Initial access and credentials
cross-site scripting also: XSS: Getting your JavaScript to run in another user’s browser on a trusted site, to steal their session or act as them. Reflected, stored, and DOM-based are the three kinds.
Appears in: Cross-site scripting
CSRF also: cross-site request forgery: Tricking a logged-in user’s browser into sending a state-changing request to a site they are authenticated to, using their session without their intent.
Appears in: Authentication and access · Web applications
CSRF token: An unpredictable value checked by the server as part of a defense against unwanted cross-site state-changing requests.
Appears in: Cookies do not prove action intent
CTF also: capture the flag: A security competition or practice format where you break into deliberately vulnerable systems to retrieve a secret string, the flag. The gym on this path is built from them.
Appears in: The gym: practice one small idea · Why this is free
CVE also: Common Vulnerabilities and Exposures: A public catalog where each known vulnerability gets one ID, like CVE-2021-44228, so everyone is talking about the same bug.
Appears in: Security frameworks: choose the right map
CVSS also: Common Vulnerability Scoring System: A standard formula that turns the properties of a vulnerability into a 0–10 score, giving a shared vocabulary for severity.
Appears in: Security frameworks: choose the right map · Reporting: turn evidence into useful improvements
CVSS Base assessment: An assessment of a vulnerability’s intrinsic severity, independent of local environmental and current threat conditions.
Appears in: Severity is one input to a risk decision
CWE also: Common Weakness Enumeration: A catalog of kinds of weakness, like CWE-89 for SQL injection. A CVE is one bug; a CWE is the category it belongs to.
Appears in: Security frameworks: choose the right map
Cyber-physical system: A system in which computation and communication interact with physical processes.
Appears in: Where hacking comes from
cybersecurity: Protecting digital systems and information so the right people can use them as intended.
Appears in: Start with everyday security
DACL: The discretionary access control list that describes permitted or denied access to an object.
Appears in: Windows privilege escalation
data minimization: Using and retaining only the information needed for a defined purpose.
Appears in: Learn with care: permission, people, and AI · Protect data through its whole life
data provenance: Information about where data came from, who changed it, and how it reached the current system.
Appears in: AI data, retrieval, and safe output
DCSync: Abusing replication rights to ask a domain controller for account password hashes, including the domain’s master key, as if you were another DC.
Appears in: Understanding identity access paths
Deep learning: Machine learning using neural networks with multiple learned processing layers.
Appears in: A short history of AI
default credentials: The username and password a device or app ships with, like admin/admin. Left unchanged, they are a free login and a constant real-world finding.
Appears in: Reconnaissance: building an evidence-based map · Initial access and credentials
defense in depth: Layering independent controls so that one failing does not mean compromise. The reason a firewall, a WAF, segmentation, and EDR all exist at once.
Appears in: Network architectures · Defenses and detection
delegation: Giving another identity limited authority to perform a task on behalf of an organization or user.
Appears in: Understanding identity access paths
deserialization: Reconstruction of data or objects from a serialized representation.
Appears in: Server-side trust boundaries
Detection: Identifying potentially relevant activity from available evidence; an alert still needs appropriate interpretation.
Appears in: Defenses and detection
DHCP also: Dynamic Host Configuration Protocol: The service that hands devices an IP address, gateway, and DNS server when they join a network. Spoofing it lets an attacker choose those for victims.
Appears in: Layer 2 and wireless
differential privacy: A mathematical privacy framework that bounds how much an individual contribution can affect released results, under stated assumptions and parameters.
Appears in: AI reliability and privacy risks
Digital signature: A private-key operation whose result can be verified with the public key to support integrity and source authentication.
Appears in: Cryptography
DMZ also: demilitarized zone: A network zone between the internet and the internal network where public-facing servers live, so a compromised web server does not sit next to the domain controller.
Appears in: Network architectures
DNS also: Domain Name System: The system that turns names into IP addresses. A goldmine in reconnaissance: subdomains, mail servers, and zone data all leak what an organization runs.
Appears in: Reconnaissance: building an evidence-based map · Computers and networks
DOM also: Document Object Model: The browser’s live, structured representation of a page that JavaScript reads and changes. DOM-based XSS happens entirely here, without the server.
Appears in: Understanding client-side JavaScript
domain also: AD domain: A group of Active Directory accounts and computers under one administrative boundary and set of policies.
Appears in: Active Directory
domain controller also: DC: The server that runs Active Directory for a domain, holding every account and password hash. Owning it is owning the domain.
Appears in: Active Directory · Understanding identity access paths
dynamic SQL: SQL text constructed at runtime; safety depends on how structure and values are handled.
Appears in: SQL injection
EDR also: endpoint detection and response: Security software that watches processes, memory, and behavior on a host to catch attacks that slip past antivirus, and gives defenders a way to respond.
Appears in: How antivirus and EDR protect endpoints · Defenses and detection
Effective user ID: A process credential used in many permission checks; Linux filesystem checks normally use the filesystem user ID, which usually follows it.
Appears in: Linux privilege escalation
Egress policy: Rules limiting the outbound network communication a service may initiate.
Appears in: Server fetches need destination policy
Elevation: Starting an operation with a more privileged administrative security context.
Appears in: UAC and administrative context
Embedding: A learned numerical representation of an item such as a token or passage; its useful similarities depend on training and context.
Appears in: Language models
emergency access: A controlled recovery path used when ordinary administrative access is unavailable.
Appears in: Securing common applications
encoding: Representing data in another form, like base64 or URL-encoding, for transport. Not encryption: anyone can decode it. Confusing the two is a common mistake.
Appears in: HTTP and proxies · Cryptography
endpoint: One address the server responds to, like /api/orders/42. Content discovery is largely the hunt for endpoints the UI never links.
Appears in: Mapping a web surface · APIs and GraphQL
Entra ID also: Azure AD, Azure Active Directory: Microsoft’s cloud identity provider, the SSO and token issuer behind Microsoft 365 and Azure. The cloud counterpart to on-premises Active Directory.
Appears in: Cloud identity · Authentication
enumeration: Systematically identifying objects and relationships within a defined scope.
Appears in: Reading an Active Directory environment
environment variable: A named value a process inherits, like PATH. Some can be abused to make a program load the attacker’s code instead of the real one.
Appears in: Linux privilege escalation
EPSS: A model estimating exploitation in the wild of a published CVE over the next thirty days.
Appears in: Prioritization: severity is not the whole risk
EPSS score: The estimated probability that exploitation activity associated with a vulnerability will be observed in the wild during the next thirty days.
Appears in: A probability is not an incident verdict
evasion: Changing an input at use time to cause an unwanted model decision within a specified threat model.
Appears in: AI reliability and privacy risks
Event semantics: The documented meaning of an event and the fields emitted by its producer.
Appears in: Log fields need defined meanings
Evidence context: The conditions and provenance needed to understand what an observation does and does not establish.
Appears in: Evidence needs enough context to review
evil twin also: rogue access point: An attacker’s Wi-Fi access point that imitates a legitimate one so victims connect to it and their traffic passes through the attacker.
Appears in: Layer 2 and wireless
exploit: Code or a procedure that uses a vulnerability to make a system do something it should not. As a verb, the act of doing so.
Appears in: The words that make security clearer
fail closed: Keeping a protected operation denied when a required security decision cannot be completed.
Appears in: Designing layered AI defenses
Federation: Trust in an external issuer’s identity evidence under defined claim and validation rules.
Appears in: Cloud identity
file inclusion: A runtime loads a file, potentially interpreting its contents as code.
Appears in: Files, uploads, and path boundaries
file permissions: The rules that say which users may read, write, or execute a file. Wrong permissions on the wrong file are a classic privilege-escalation path.
Appears in: Linux privilege escalation · Windows privilege escalation
file upload vulnerability: An upload feature that accepts a file it should not, like a script the server will execute, turning it into code execution.
Appears in: Files, uploads, and path boundaries
finding: One documented weakness in a report: what it is, where, how it was shown, how bad, and how to fix it.
Appears in: Reporting: turn evidence into useful improvements
fingerprint: Evidence suggesting a product or component, with a stated confidence.
Appears in: Mapping a web surface
firewall: A device or software that allows or blocks traffic based on rules: source, destination, port, protocol. The first layer of an enterprise edge.
Appears in: Network architectures
flag: The secret string that proves you reached a point in a practice machine: user.txt for a foothold, root.txt for full control.
Appears in: The gym: practice one small idea
Forest: The overarching Active Directory structure and security boundary containing one or more domains with shared schema and configuration.
Appears in: Active Directory
framework: An organized structure for discussing or managing a subject.
Appears in: Security frameworks: choose the right map
front end also: client-side: The part of a web app that runs in the browser: HTML, CSS, and JavaScript the user downloads and can read and change. Nothing it enforces can be trusted.
Appears in: Web application architectures · Understanding client-side JavaScript
FTP: An old file-transfer protocol that sends credentials in plaintext. Anonymous FTP still turns up and still leaks files.
Appears in: Initial access and credentials
golden ticket: A Kerberos ticket forged with the domain’s master key (krbtgt) that grants access as anyone, indefinitely. Total domain compromise and persistence.
Appears in: Movement, sessions, and lasting access
GraphQL: An API style where the client asks for exactly the fields it wants in one query. Introspection often reveals the whole schema, which is a reconnaissance gift.
Appears in: APIs and GraphQL
Hack The Box also: HTB: A training platform of deliberately vulnerable machines you attack over a VPN. The retired machines are the gym this path links to.
Appears in: The gym: practice one small idea
handle: A process’s reference to an operating-system object, with access determined by platform rules.
Appears in: Computers and networks
hardening: Reducing a system’s attack surface by removing unneeded services, tightening configuration, and applying secure defaults.
Appears in: Defenses and detection
Hash: A fixed-length digest derived from input; a cryptographic hash is designed to resist particular forms of inversion and collision finding.
Appears in: Cryptography
hash function: A one-way function turning any input into a fixed-length fingerprint that cannot be reversed. Detects change and stores passwords; SHA-256 is a common one.
Appears in: Cryptography
header also: HTTP header: A name-value line carrying metadata on a request or response: cookies, content type, authorization, host. Where much of the security-relevant behavior lives.
Appears in: HTTP and proxies
HTTP also: Hypertext Transfer Protocol: The request-and-response protocol the web runs on. Every web attack is shaped as an HTTP request; reading and editing them is the core web-testing skill.
Appears in: HTTP and proxies · Web application architectures
HTTP method also: verb: The action a request asks for: GET to read, POST to submit, PUT and DELETE to change. An endpoint that trusts the method for access control is a common bug.
Appears in: HTTP and proxies
HTTPS: HTTP wrapped in TLS, so the connection is encrypted and the server is authenticated. Protects the transport; it does not make the app itself secure.
Appears in: HTTP and proxies · Cryptography · Safer browsing
IAM also: identity and access management: The cloud system of users, roles, and policies that decides who may do what. Over-broad roles and leaked keys are the common cloud findings.
Appears in: Cloud identity
Idempotency: The property that repeating the same operation has the same intended effect as performing it once.
Appears in: Retries should not repeat consequences
idempotency key: A value used by an application to recognize repeated operations under a defined policy.
Appears in: APIs and GraphQL
identity provider also: IdP: The service that authenticates users and issues tokens other apps trust, like Entra ID or Okta. The center of single sign-on and a high-value target.
Appears in: Authentication · Cloud identity
IDOR also: insecure direct object reference: Changing an identifier in a request, like /orders/42 to /orders/43, and getting someone else’s data because the server never checked ownership. A broken-access-control classic.
Appears in: APIs and GraphQL · The words that make security clearer
IDS also: intrusion detection system: A sensor that watches traffic or hosts for signs of attack and raises an alert. Detects but does not block.
Appears in: Network architectures · Defenses and detection
implant also: agent, beacon: The attacker’s software running on a compromised host that keeps a connection open to their command-and-control server.
Appears in: How antivirus and EDR protect endpoints
Incident update: A time-bounded statement of known impact, current actions, uncertainty, and decisions needed by its audience.
Appears in: Share the facts each audience needs
independent verification: Checking a request through a separate contact route you already know is real.
Appears in: Spot the message
indicator of compromise also: IOC: An artifact that shows an intrusion happened: a file hash, an IP address, a domain, a registry key, a log line. What detection matches against.
Appears in: Defenses and detection
Inference: An interpretation drawn from observations under stated assumptions.
Appears in: Separate observation from inference
Initial access: An initial entry into an environment; the mechanism may involve an account, a software weakness, or another access path.
Appears in: Initial access and credentials
injection: Getting a system to treat your input as code or commands rather than data. SQL injection, command injection, and XSS are all this one idea in different targets.
Appears in: SQL injection · Command and argument injection · The words that make security clearer · Web applications
Instruction cycle: A conceptual account of obtaining an instruction, interpreting it, and performing its operation; modern processors overlap and reorder work internally.
Appears in: How computers got here
integration identity: An account or credential an application uses to reach another service.
Appears in: Securing common applications
integrity: Protecting information and systems against improper modification or destruction.
Appears in: The words that make security clearer
integrity level: A trust label used by mandatory integrity policy to constrain certain operations.
Appears in: Windows privilege escalation
Invariant: A condition that must remain true through every allowed state transition.
Appears in: Check and update must agree
inventory: A maintained record of products, versions, components, owners, and exposure.
Appears in: Securing common applications
IP address: The number that identifies a device on a network, like 10.10.11.5 or an IPv6 address. Where packets are sent; what a scan targets.
Appears in: Computers and networks · Reconnaissance: building an evidence-based map
IPS also: intrusion prevention system: An IDS placed inline so it can block what it detects, not only alert.
Appears in: Network architectures · Defenses and detection
Isolation: Controls that limit interaction or interference between execution contexts or resources.
Appears in: Operating systems · Privilege escalation
jailbreak: Coaxing an AI model past its safety rules with crafted prompts. Related to prompt injection but aimed at the model’s guardrails rather than an app’s instructions.
Appears in: AI reliability and privacy risks
JWT also: JSON Web Token: A signed, self-describing token carrying who you are and when it expires, checked without a server-side session. Weak or misused signing keys let attackers forge them.
Appears in: Authentication · Authentication and access
KDC: Key Distribution Center: the trusted service that issues Kerberos tickets.
Appears in: Kerberos without the alphabet soup
Kerberoasting: Requesting service tickets for accounts that run services, then cracking them offline to recover those accounts’ passwords. A quiet path to privileged credentials.
Appears in: Understanding identity access paths
Kerberos: The ticket-based authentication protocol Active Directory uses. You prove yourself once and get tickets that are bearer proofs; most AD attacks abuse how those tickets are issued.
Appears in: Active Directory · Understanding identity access paths
kernel: The core of the operating system that runs with full hardware privilege. A kernel exploit yields the highest level of control on a machine.
Appears in: Computers and networks · Privilege escalation · Operating systems
kill chain also: cyber kill chain: A model of an intrusion as a sequence of stages, from reconnaissance through delivery, exploitation, and action on objectives. Break any stage and the attack fails.
Appears in: Security frameworks: choose the right map · Find your way through the library
language model: A model trained to represent patterns in language; generative models produce text from context without guaranteeing truth.
Appears in: Why this is free · AI on offense
lateral movement: Moving from one compromised host or account to another to reach your goal, reusing credentials and trust. An ATT&CK tactic; pivoting is its network form.
Appears in: Movement, sessions, and lasting access · Pivoting, proxies, and network boundaries
layer 2 also: data link layer: The local-link layer where devices on one segment talk by hardware address and largely trust each other. Where switches, VLANs, and NAC live.
Appears in: Layer 2 and wireless
LDAP: The directory-query protocol Active Directory speaks. Enumerating users, groups, and computers is mostly LDAP queries.
Appears in: Reading an Active Directory environment
learning route: A suggested sequence of related lessons that can be adapted to your needs.
Appears in: Why this is free
least privilege: Giving every user and process only the access it needs to do its job. The control most privilege-escalation findings are a violation of.
Appears in: Privilege escalation · The words that make security clearer · Learn with care: permission, people, and AI · SQL injection · Command and argument injection · Designing layered AI defenses
listener: The attacker’s process waiting for a connection back from a target, such as netcat or a C2 server waiting for a reverse shell.
Appears in: Command and argument injection
load balancer: A device that spreads incoming requests across several servers. Often terminates TLS, which is why it is where certificates and some headers live.
Appears in: Network architectures
Loaded dependency: Library code selected by an application and executed within its process.
Appears in: DLL loading extends the trust boundary
log also: logging: A record of events a system writes as it runs. Defenders read logs to detect attacks; attackers try not to appear in them, or to read them for secrets.
Appears in: Defenses and detection · Reporting: turn evidence into useful improvements
MAC address: The hardware address of a network interface, used at layer 2. Easily changed, so it is not a security control.
Appears in: Layer 2 and wireless
machine also: box: On a practice platform, one deliberately vulnerable target system, with a user flag and a root flag to capture.
Appears in: The gym: practice one small idea
Machine learning: Methods that fit aspects of a model from data or experience rather than explicitly programming every decision.
Appears in: A short history of AI
malware: Software built to do harm: viruses, worms, trojans, ransomware, spyware, and the implants attackers plant after getting in.
Appears in: How antivirus and EDR protect endpoints
Managed identity: A workload identity whose credential management is handled by the platform; its permissions still require deliberate assignment.
Appears in: Cloud identity
Mandatory Integrity Control: An additional Windows access-control mechanism that compares integrity labels and applicable mandatory policy.
Appears in: Integrity levels are another input
mass assignment: Automatic binding lets a client influence properties it should not control.
Appears in: APIs and GraphQL
membership inference: Estimating whether a particular record was included in a model’s training data.
Appears in: AI reliability and privacy risks
memory corruption: Bugs that let input change memory the program did not intend, from buffer overflows to use-after-free. The path to running your own code inside a process.
Appears in: Memory safety: boundaries and lifetimes
Microprocessor: A processor implemented using integrated-circuit technology, commonly as a CPU on a single chip.
Appears in: How computers got here
minification: Size reduction through transformations such as shorter names and removed whitespace.
Appears in: Understanding client-side JavaScript
misconfiguration: A system set up in a way that weakens it: a default password, an open share, debug mode in production. One of the most common real-world findings.
Appears in: Reconnaissance: building an evidence-based map · Privilege escalation
mitigation: A protection that reduces a possible consequence without necessarily removing the underlying defect.
Appears in: Memory safety: boundaries and lifetimes
MITRE ATT&CK also: ATT&CK: A public knowledge base of attacker tactics (why) and techniques (how) observed in real intrusions, with IDs like T1078. The map this path’s units are labeled with.
Appears in: Security frameworks: choose the right map · Find your way through the library
multi-factor authentication also: MFA, 2FA: Requiring more than one kind of proof to log in: something you know, have, or are. Blunts stolen passwords, which is why attackers target its gaps.
Appears in: Authentication
multifactor authentication: Sign-in that checks more than one kind of evidence, such as a password and a security key.
Appears in: Stronger sign-ins
mutual TLS also: mTLS: A TLS connection where both client and server present a certificate, so each proves its identity. No password to phish; the private key is what must be protected.
Appears in: Authentication · Cryptography
NAC also: network access control: Making a device prove who it is before a switch port or Wi-Fi lets it onto the network, usually via 802.1X and a RADIUS server.
Appears in: Layer 2 and wireless
NAT also: network address translation: Rewriting addresses so many internal hosts share one public IP. The reason internal machines are usually not directly reachable from the internet.
Appears in: Computers and networks
NFS also: Network File System: The Unix file-sharing protocol. Exports that trust the client’s claimed user ID are a classic path to reading or writing files as root.
Appears in: Initial access and credentials
NIST also: National Institute of Standards and Technology: The US standards body whose Special Publications (SP 800 series) and FIPS documents define much of the security vocabulary and many of the controls organizations are measured against.
Appears in: Security frameworks: choose the right map
Not reproduced: The reported behavior was not observed in the performed follow-up; this alone does not verify correction.
Appears in: A retest answers a specific follow-up
NTLM: An older Windows authentication protocol still widely enabled. Its challenge-response can be captured and relayed, and its hashes used to log in without cracking.
Appears in: Initial access and credentials · Reading an Active Directory environment
NTLM relay also: relay attack: Capturing a victim’s NTLM authentication and forwarding it to another service to act as them, without ever cracking anything. Coercion tricks victims into starting it.
Appears in: Initial access and credentials · Reading an Active Directory environment
OAuth: The standard that lets an app get limited access to a user’s account elsewhere without their password, by exchanging tokens. OpenID Connect adds login on top.
Appears in: Authentication
obfuscation: Making code or data hard to read without changing what it does, to slow analysis or evade detection. Reversible in principle.
Appears in: Understanding client-side JavaScript · How antivirus and EDR protect endpoints
Object authorization: Deciding whether a subject may perform a particular action on a particular resource.
Appears in: Authorization: a decision for every object
observation: A recorded fact whose meaning must be interpreted in its context.
Appears in: Reporting: turn evidence into useful improvements
Observed impact: A consequence supported by evidence from the actual reviewed context, within its stated scope.
Appears in: Write findings people can understand and fix
open redirect: A redirect that sends users to any URL supplied in a parameter, useful for making phishing links look legitimate and for chaining into other attacks.
Appears in: Server-side trust boundaries
operating system also: OS: The software that manages a computer’s hardware and runs programs: Windows, Linux, macOS. Its permission model is what privilege escalation attacks.
Appears in: Computers and networks · Operating systems
Operational acceptance: Evidence that the intended updated state and required service behavior satisfy the agreed rollout criteria.
Appears in: Patch state includes restarts and recovery
organizational unit: An Active Directory container used to organize objects, delegate administration, and scope Group Policy.
Appears in: Reading an Active Directory environment
Origin: In the common web model, a combination of scheme, host, and port used as a browser security boundary.
Appears in: Browser boundaries: origins, CORS, and CSRF
OSINT also: open-source intelligence: Learning about a target from public sources: DNS, certificates, job postings, code repositories, social media. Reconnaissance without touching the target.
Appears in: Reconnaissance: building an evidence-based map
Output context: The browser interpretation surrounding a value, such as ordinary text, an HTML attribute, or a URL.
Appears in: Output safety depends on context
output encoding: Representing a value safely for a particular output context.
Appears in: Cross-site scripting
output handling: The application’s processing of generated content before displaying, storing, or acting on it.
Appears in: AI data, retrieval, and safe output
OWASP also: Open Worldwide Application Security Project: A nonprofit that publishes free application-security resources, including the OWASP Top 10 list of web risks and the Web Security Testing Guide.
Appears in: Security frameworks: choose the right map · Web applications
OWASP Top 10: OWASP’s periodically updated list of the ten most critical web application risk categories, such as injection and broken access control. A checklist, not a complete methodology.
Appears in: Security frameworks: choose the right map · Web applications
padding oracle: A server that reveals, directly or by timing, whether a decryption’s padding was valid. That yes/no leak lets an attacker recover plaintext without the key.
Appears in: Cryptography · Memory safety: boundaries and lifetimes
parameter: A named input in a request: a query string value, a form field, a JSON key. Most web vulnerabilities are a parameter the server trusts too much.
Appears in: Mapping a web surface · SQL injection
Parameterization: Keeping a query structure separate from the data values supplied to it.
Appears in: Keep data separate from instructions · Query structure and values are different
pass the hash also: PtH: Authenticating with a captured NTLM password hash directly, never needing the plaintext, because Windows accepts the hash as proof.
Appears in: Movement, sessions, and lasting access
pass the ticket: Using a stolen or forged Kerberos ticket to access services as its owner, without the password.
Appears in: Understanding identity access paths
passkey: A sign-in credential based on a cryptographic key pair, bound to the website or app it was created for.
Appears in: Stronger sign-ins
password cracking: Recovering a password from its hash by hashing guesses until one matches, using a wordlist or brute force. hashcat and john are the tools; the GPU does the work.
Appears in: Initial access and credentials
password hash: The one-way fingerprint of a password that a system stores instead of the password. Cracking it offline recovers the password; some can be used directly without cracking.
Appears in: Initial access and credentials · Cryptography
Password retrieval authority: Permission to obtain a managed credential from its configured backup location.
Appears in: Local administrator passwords need ownership
password spraying: Trying one common password against many accounts, staying under lockout thresholds. Quieter than hammering one account with many passwords.
Appears in: Initial access and credentials · Reading an Active Directory environment
patch also: patching: A vendor fix for a known vulnerability. Patch management, applying them promptly, closes most of the CVEs a scanner finds.
Appears in: Defenses and detection
path confinement: Keeping filesystem operations within the intended directory and object boundaries.
Appears in: Files, uploads, and path boundaries
path traversal also: directory traversal, LFI: Using …/ sequences to read files outside the intended directory, like /etc/passwd. Local file inclusion runs them when the path is included as code.
Appears in: Files, uploads, and path boundaries
payload: The part of an attack that does the work once a vulnerability is triggered: the command that runs, the script that executes, the shell that connects back.
Appears in: The words that make security clearer · Cross-site scripting · Memory safety: boundaries and lifetimes
penetration test also: pentest, penetration testing: An authorized, scoped simulation of an attack to find and demonstrate real weaknesses, ending in a report that lets the owner fix them.
Appears in: Security frameworks: choose the right map · Why this is free
permission: Access you grant to a capability, such as a site’s use of your camera or location.
Appears in: Safer browsing
persistence: Keeping access after the first foothold so a reboot or password change does not lock you out: a scheduled task, a service, a backdoor account, a forged ticket.
Appears in: Movement, sessions, and lasting access
phishing: Tricking someone into revealing credentials or running something by impersonating a trusted party, usually by email. Spear phishing targets one person specifically.
Appears in: Where hacking comes from · Authentication · Spot the message
Phreaking: Exploration or manipulation of telephone systems, including historical misuse of signaling and billing mechanisms.
Appears in: Where hacking comes from
pivot also: pivoting: Using a compromised host as a stepping stone to reach networks and hosts it can see and you cannot. ATT&CK files it under lateral movement.
Appears in: Pivoting, proxies, and network boundaries
pivoting: Using an intermediate system’s connectivity to reach another part of an environment, often discussed in incident analysis.
Appears in: Pivoting, proxies, and network boundaries
port: A number from 0 to 65535 that identifies which service on a host a connection is for: 80 for HTTP, 443 for HTTPS, 22 for SSH, 445 for SMB. An open port means a service is listening.
Appears in: Computers and networks · Reconnaissance: building an evidence-based map
port forwarding: Sending a connection to one port on one host through to a port on another, so a service you cannot reach directly becomes reachable via a host you control.
Appears in: Pivoting, proxies, and network boundaries
port scan also: port scanning: Probing a host’s ports to learn which services are listening. The first active step of reconnaissance; nmap is the standard tool.
Appears in: Reconnaissance: building an evidence-based map
post-exploitation: Everything after initial access: escalating, harvesting credentials, moving laterally, establishing persistence, and collecting the evidence a report needs.
Appears in: Movement, sessions, and lasting access · Reporting: turn evidence into useful improvements
post-quantum cryptography also: PQC: Cryptography designed to resist a future large quantum computer, which would break today’s asymmetric algorithms. Adopted now because recorded traffic can be decrypted later.
Appears in: Cryptography
practice: Applying an idea and using feedback to improve understanding.
Appears in: The gym: practice one small idea
practice scenario: A fictional situation where you can try a decision and learn from the explanation.
Appears in: Start with everyday security
Precision: The fraction of positive alerts that are true positives.
Appears in: Detection: why a good alert needs context · Thresholds trade workload and coverage
prediction: An explanation of what you expect before seeing a result.
Appears in: The gym: practice one small idea
prerequisite: Background knowledge that makes a later lesson easier to understand.
Appears in: Find your way through the library
private key: The secret half of a key pair, used to decrypt or to sign. Stealing one is stealing the identity it represents.
Appears in: Cryptography · Initial access and credentials
Privilege: Authority for a system operation that is distinct from permission on one specific file.
Appears in: User rights differ from file permissions
privilege escalation also: privesc: Going from limited access to higher privilege on a host or in a domain: user to root, user to SYSTEM, user to domain admin. Half of most engagements.
Appears in: Privilege escalation · Linux privilege escalation · Windows privilege escalation
process: A running program, with its own memory and the identity of the user who started it. Which user a process runs as decides what an exploit of it gets you.
Appears in: Computers and networks · Privilege escalation · Operating systems
process identity: The account and security context used when a program performs an operation.
Appears in: Command and argument injection
prompt injection: Feeding an AI system input that overrides its instructions, making it ignore its rules or act on attacker text hidden in data it reads. The XSS of language models.
Appears in: Prompt injection and instruction boundaries · AI on offense
proof of concept also: PoC: The minimal demonstration that a vulnerability is real and exploitable, used to prove a finding without causing harm.
Appears in: Reporting: turn evidence into useful improvements · Cross-site scripting
Protection state: Whether the configured storage protection is actively enforced, distinct from whether data has been encrypted.
Appears in: Boot integrity and disk secrecy differ
protocol: An agreed set of rules for how two programs talk: HTTP, DNS, SMB, Kerberos. Knowing the protocol tells you what a service will accept and how to speak to it.
Appears in: Computers and networks
Provenance: Information about the origin and handling of an item.
Appears in: Digital evidence: the story and its limits
proxy also: intercepting proxy: A tool like Burp Suite that sits between browser and server so you can see and change every request. The web tester’s workbench.
Appears in: HTTP and proxies · Pivoting, proxies, and network boundaries
PTES also: Penetration Testing Execution Standard: A community standard defining the phases of a pentest: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting.
Appears in: Security frameworks: choose the right map
public client: A client that cannot reliably protect a shared embedded application secret.
Appears in: Understanding client-side JavaScript
public key: The half of a key pair that can be shared freely, used to encrypt to you or verify your signatures.
Appears in: Cryptography
purple team: Red and blue working together in the open, running an attack and tuning detection for it in the same session.
Appears in: Defenses and detection
Quarantine: A restricted holding stage that separates accepted uploads from files approved for later use.
Appears in: Uploads are a lifecycle, not a checkbox
RADIUS: The protocol a switch, access point, or VPN uses to ask a central server whether a user or device may join and with what access. Cisco ISE is a common server.
Appears in: Layer 2 and wireless
RAG: Retrieval-augmented generation: supplying selected external information as context for a model’s response.
Appears in: AI data, retrieval, and safe output
ransomware: Malware that encrypts a victim’s data and demands payment for the key, often also stealing the data first to threaten publication.
Appears in: Where hacking comes from
RDP also: Remote Desktop Protocol: Windows graphical remote login on port 3389. With valid credentials it is a full interactive session; a common lateral-movement path.
Appears in: Movement, sessions, and lasting access · Pivoting, proxies, and network boundaries
Recall: Detected actual positives divided by all actual positives in the evaluated population.
Appears in: Thresholds trade workload and coverage
reconnaissance: Gathering and organizing information to understand an environment and its relevant boundaries.
Appears in: Reconnaissance: building an evidence-based map
recovery: The process of regaining control of an account or restoring access to your data.
Appears in: When things go wrong · Authentication and access
Recovery dependency: A resource, permission, or service required to turn a recovery copy into usable operation.
Appears in: Recovery copies need separate protection
Recovery exit criteria: Observable conditions that must be met before declaring a defined recovery stage complete.
Appears in: Define what makes recovery complete
Recovery point objective: The target limit on data loss expressed as time.
Appears in: Recovery: how much time and data can you lose?
red team: An exercise that emulates a real adversary end to end, testing detection and response rather than listing vulnerabilities. Broader and stealthier than a pentest.
Appears in: Security frameworks: choose the right map
reflection: A short review of what changed in your understanding and what remains uncertain.
Appears in: The gym: practice one small idea
Registry key: A securable Windows configuration object containing values and potentially subkeys.
Appears in: Registry settings have their own permissions
remediation: The fix for a finding. A good report gives one that the owner can actually do, ranked by how much risk it removes.
Appears in: Reporting: turn evidence into useful improvements
remote code execution also: RCE: Getting a target to run code of your choosing, usually the highest-impact outcome. Command injection, deserialization, and memory corruption all aim here.
Appears in: Command and argument injection · Memory safety: boundaries and lifetimes
Responder: A tool that answers local name-resolution requests to trick Windows hosts into authenticating to the attacker, capturing hashes to crack or relay.
Appears in: Initial access and credentials · Reading an Active Directory environment
responsible disclosure also: coordinated disclosure: Reporting a vulnerability privately to the owner and giving them time to fix it before any public discussion.
Appears in: Learn with care: permission, people, and AI
REST: A common style of HTTP API using URLs for resources and methods for actions. Predictable structure that makes endpoints easy to enumerate.
Appears in: APIs and GraphQL
Retest scope: The specific reported condition, version, cases, and expected control behavior covered by a follow-up.
Appears in: A retest answers a specific follow-up
Retrieval: Selecting information from external sources for use by an application; selection does not establish truth or authority.
Appears in: AI on offense · Prompt injection and instruction boundaries
retrieval practice: Trying to explain an idea from memory before checking the explanation.
Appears in: Find your way through the library
Retrieval-augmented generation: Generating with information retrieved from external sources, without automatically retraining the model on each retrieved item.
Appears in: Language models
Reverse connection: A connection initiated by the remote process toward a receiving system; direction does not determine process privilege.
Appears in: Initial access and credentials
reverse proxy: A server that sits in front of web apps and forwards requests to them, hiding the real servers and often adding TLS, caching, or a WAF.
Appears in: Network architectures · HTTP and proxies
reverse shell: A shell where the target connects out to the attacker’s listener, which works through firewalls that block inbound but allow outbound connections.
Appears in: Command and argument injection · Pivoting, proxies, and network boundaries
Revocation: Making an existing credential no longer accepted by the system that validates it.
Appears in: Protect local credential copies
risk: The combination of how likely a bad thing is and how bad it would be. Severity ratings in a report are a risk judgment, not just a technical one.
Appears in: Reporting: turn evidence into useful improvements · Security frameworks: choose the right map
robots.txt: Instructions for cooperating crawlers, not an access-control mechanism.
Appears in: Mapping a web surface
Role assignment: An association between a principal, a role, and a scope, interpreted with the provider’s other access policies.
Appears in: Cloud identity
root also: superuser: The all-powerful administrative account on Unix-like systems. On Windows the equivalents are SYSTEM and Administrator.
Appears in: Linux privilege escalation
Root-cause hypothesis: A proposed explanation of an underlying condition that produced an observed problem, awaiting sufficient supporting evidence.
Appears in: Fix the cause behind the visible symptom
router: The device that forwards packets between networks based on IP address. The default gateway is the router a host sends non-local traffic to.
Appears in: Computers and networks
Runtime identity: The account and security context under which service code performs its work.
Appears in: Service identities have different reach
SAE: Simultaneous Authentication of Equals, the password-authenticated exchange used by WPA3-Personal to resist offline dictionary attacks.
Appears in: Layer 2 and wireless
salt: Random data added to a password before hashing so identical passwords get different hashes, defeating precomputed lookup tables.
Appears in: Cryptography · Initial access and credentials
same-origin policy: The browser rule that a page may only read data from its own origin. The foundation CORS relaxes and XSS works around.
Appears in: Understanding client-side JavaScript · Web applications
SAML also: Security Assertion Markup Language: An older XML standard for single sign-on between an identity provider and applications. Signature-handling flaws in it have allowed full authentication bypass.
Appears in: Authentication
sandbox: An isolated environment where untrusted code can run without reaching the real system. Browsers, malware analysts, and some runtimes use them; escaping one is a serious bug.
Appears in: AI on offense · How antivirus and EDR protect endpoints
sanitization: Restricting permitted markup and attributes when rendering rich content.
Appears in: Cross-site scripting
SBOM: A software bill of materials: an inventory describing components in a software product.
Appears in: Software supply chains: know what you are shipping
scope also: rules of engagement, RoE: The written agreement of what may be tested, when, how, and by whom. Testing outside it is not a pentest; it is an intrusion.
Appears in: Security frameworks: choose the right map · Learn with care: permission, people, and AI · Reporting: turn evidence into useful improvements
screen lock: A device feature that requires an unlock method before someone can use it normally.
Appears in: A safer phone or computer
second-order injection: Input becomes unsafe when reused in a later operation.
Appears in: SQL injection
Security context: The identity, groups, privileges, and other attributes used in access decisions for a process or request.
Appears in: Privilege escalation
Security exception: An explicitly approved deviation from a required control, limited by a recorded scope and review conditions.
Appears in: Exceptions need an end condition
Security identifier (SID): An identifier Windows uses for a security principal in tokens and permission entries.
Appears in: SIDs identify security principals
Security requirement: A defined security behavior or property that a system must satisfy and that reviewers can evaluate.
Appears in: Secure development: requirements to evidence
security update: A software change that fixes a security weakness. Updates may also include features or other fixes.
Appears in: A safer phone or computer
segmentation also: network segmentation: Dividing a network into zones with controlled paths between them, so a foothold in one does not reach everything. What pivoting works around.
Appears in: Network architectures · Pivoting, proxies, and network boundaries · Defenses and detection · Segmentation: make every connection earn its place
service also: daemon: A program that runs in the background waiting for requests, usually on a network port. What a port scan finds and what most exploits target.
Appears in: Computers and networks · Reconnaissance: building an evidence-based map
service enumeration: Going beyond ‘port open’ to learn what software and version is listening and what it exposes: banners, shares, users, pages.
Appears in: Reconnaissance: building an evidence-based map
service identity: The account under which a Windows service runs.
Appears in: Windows privilege escalation
Service principal: A security identity representing an application or service in a particular Microsoft Entra tenant.
Appears in: Cloud identity
Service SID: An identifier associated with a Windows service that can participate in token and resource access decisions.
Appears in: Service SIDs make permissions more specific
session: The server’s memory that a user logged in, keyed by a random id in a cookie. Fixing, stealing, or guessing that id is session attack territory.
Appears in: Authentication · Authentication and access · When things go wrong · HTTP and proxies · Sessions: what happens after sign-in · Movement, sessions, and lasting access
session fixation: A pre-existing session identifier remains usable across authentication in a way that enables misuse.
Appears in: Authentication and access
Set-user-ID: An execution permission that can change the effective user ID to the file owner’s for supported executable files, subject to operating-system restrictions.
Appears in: Privilege escalation
severity: How serious a finding is, usually rated Critical, High, Medium, Low, or Informational, often backed by a CVSS score. Impact plus likelihood, argued in writing.
Appears in: Reporting: turn evidence into useful improvements
share also: network share: A folder exposed over SMB or NFS. Anonymous or over-permissioned shares leak credentials, scripts, and backups.
Appears in: Initial access and credentials · Reading an Active Directory environment
Shared cache: A cache that can reuse stored responses for multiple users.
Appears in: Caches must preserve privacy boundaries
Shared responsibility: A division of security responsibilities between a service provider and its customer that depends on the service used.
Appears in: Cloud security: who owns which problem?
shell: A program that takes commands and runs them: bash, sh, PowerShell, cmd. Getting a shell on a target is the usual definition of being in.
Appears in: Computers and networks · Command and argument injection
shell injection: Untrusted data becomes instructions interpreted by a command shell.
Appears in: Command and argument injection
single sign-on also: SSO: One identity provider authenticates a user once and issues tokens that many apps trust, so they log in once. Makes the provider and its tokens the prize.
Appears in: Authentication · Cloud identity
sink: An operation that consumes data, sometimes in a security-sensitive context.
Appears in: Understanding client-side JavaScript · Cross-site scripting
SMB also: Server Message Block: The Windows file- and printer-sharing protocol on port 445. Central to Active Directory attacks: shares, authentication, relaying, and remote execution all ride on it.
Appears in: Initial access and credentials · Reading an Active Directory environment
sniffing also: packet capture: Recording network traffic to read it. Plaintext protocols leak credentials this way; TLS is the defense.
Appears in: Initial access and credentials · Layer 2 and wireless
SNMP: A management protocol for network devices. With a guessable community string it hands over configuration, routes, and sometimes credentials.
Appears in: Reconnaissance: building an evidence-based map
social engineering: Manipulating people rather than systems: phishing, pretexting, tailgating. Often the cheapest way in.
Appears in: Where hacking comes from
SOCKS proxy: A generic proxy that forwards any TCP connection. Started on a compromised host, it lets your tools on the outside reach the inside network as if they were there.
Appears in: Pivoting, proxies, and network boundaries
source: The point where a value enters a data flow.
Appears in: Cross-site scripting
source map: Metadata connecting generated code positions to original sources; source content may be included.
Appears in: Understanding client-side JavaScript
SQL injection also: SQLi: Injecting into a database query so you can read, change, or bypass it: dump the users table, log in as admin, sometimes run commands. CWE-89, OWASP A03.
Appears in: SQL injection
SSH also: Secure Shell: Encrypted remote login and command execution, usually port 22. Keys and passwords for it are prime loot; a stolen private key is a login.
Appears in: Initial access and credentials · Pivoting, proxies, and network boundaries
SSRF also: server-side request forgery: Making the server send requests you choose, reaching internal systems and cloud metadata it can see and you cannot. A key pivot into cloud environments.
Appears in: Server-side trust boundaries
SSTI also: server-side template injection: Injecting into a server-side template engine so your input is evaluated as template code, often leading to remote code execution.
Appears in: Server-side trust boundaries
Standing privilege: Authority that remains available until it is explicitly removed.
Appears in: Privilege is a responsibility with an expiry date
Stored program: A program represented as instructions held in storage accessible to the computer for execution, rather than configured solely by rewiring.
Appears in: How computers got here
subdomain enumeration: Finding the hostnames under a domain, like dev.example.com, through DNS brute force, certificate logs, and search. Each one is more attack surface.
Appears in: Reconnaissance: building an evidence-based map
sudo: A program that applies policy when allowing a user to run an approved task with another identity.
Appears in: Linux privilege escalation
SUID: An executable mode bit that can change the effective user ID to the file owner’s ID on supported execution, subject to restrictions.
Appears in: Linux privilege escalation
surface map: An inventory of exposed features, data, identities, and dependencies.
Appears in: Mapping a web surface
switch: The device that connects hosts on a local network and forwards frames by hardware address. Modern switches enforce VLANs and, with 802.1X, decide who may join.
Appears in: Layer 2 and wireless
Symbolic AI: Methods that represent and manipulate explicit symbols, rules, or structured knowledge for tasks such as reasoning and planning.
Appears in: A short history of AI
symbolic link: A filesystem reference whose resolution may lead to another location.
Appears in: Files, uploads, and path boundaries
symmetric encryption: Encryption with one shared key that both locks and unlocks. Fast, so it does the bulk of real encrypting; the challenge is sharing the key safely.
Appears in: Cryptography
sync: Keeping locations up to date with changes, which may include deletions as well as new files.
Appears in: Keep what matters
SYSTEM also: NT AUTHORITY\SYSTEM, LocalSystem: The most privileged built-in account on Windows, used by the OS itself. Higher than Administrator; the usual goal of Windows privilege escalation.
Appears in: Windows privilege escalation
System call: A defined interface through which a program requests a kernel-provided operation.
Appears in: Operating systems
Tabletop exercise: A facilitated discussion using a fictional scenario to practice decisions and coordination.
Appears in: Tabletop: practice a security incident together
Task principal: The security identity and associated execution context selected for a scheduled task.
Appears in: Scheduled tasks need complete boundaries
TCP also: Transmission Control Protocol: The reliable, connection-based transport most services use. A TCP port scan asks each port whether anyone is listening.
Appears in: Computers and networks · Reconnaissance: building an evidence-based map
Telemetry: Recorded events and measurements about systems, identities, networks, or applications.
Appears in: Defenses and detection · How antivirus and EDR protect endpoints
Telemetry health: Evidence that expected observations are being produced, delivered, and interpreted within defined limits.
Appears in: Monitor the monitoring path
Tenant: A directory instance and administrative scope; its relationship to accounts and cloud resources is provider-specific.
Appears in: Cloud identity
threat model also: threat modeling: A structured answer to: what are we protecting, from whom, and what could go wrong. Decides which risks matter before anyone tests anything.
Appears in: Security frameworks: choose the right map
ticket also: Kerberos ticket: A time-limited proof from Kerberos that you are who you say and may reach a service. Whoever holds a ticket can use it, which is what pass-the-ticket abuses.
Appears in: Understanding identity access paths
TLS also: SSL, Transport Layer Security: The protocol behind HTTPS: it uses asymmetric cryptography to agree a shared key, then fast symmetric encryption for the traffic. SSL is its obsolete predecessor.
Appears in: Cryptography · HTTP and proxies
Token: A unit represented by a model’s tokenizer, such as a word piece, byte sequence, or special marker; it need not equal a word.
Appears in: Language models
Tool runner: The component that executes proposed tool operations under its own security context and applicable credentials.
Appears in: AI on offense
track: A group of lessons with a shared purpose, such as everyday security or foundations.
Appears in: Find your way through the library
Triage: An initial assessment that determines the priority, scope, and next handling of a potential incident.
Appears in: Triage is a decision under uncertainty
Trust boundary: A point where an identity or input must be evaluated before it influences a protected resource.
Appears in: Web application architectures · Linux privilege escalation · Threat modeling: ask before building
TTP also: tactics, techniques, and procedures: An attacker’s behavior described at three levels: the goal (tactic), the method (technique), and the specific way they do it (procedure). ATT&CK catalogs the first two.
Appears in: Security frameworks: choose the right map · Defenses and detection
tunnel also: tunneling: Carrying one connection inside another, so traffic that could not otherwise reach a network can. How a compromised host becomes a bridge into the next segment.
Appears in: Pivoting, proxies, and network boundaries
UDP also: User Datagram Protocol: The connectionless transport used by DNS, SNMP, and others. Harder to scan because a silent port and a filtered one look the same.
Appears in: Reconnaissance: building an evidence-based map · Computers and networks
upload: A feature that accepts and stores client-supplied content.
Appears in: Files, uploads, and path boundaries
use-after-free: Accessing an object through a reference after its allocated storage has been released.
Appears in: Memory safety: boundaries and lifetimes
vantage point: The location and context from which an observation is made.
Appears in: Reconnaissance: building an evidence-based map
virtual host: A site selected through names such as HTTP authority and TLS SNI.
Appears in: Mapping a web surface
Virtual machine: An execution environment presenting virtualized machine resources to a guest system, with isolation depending on its implementation and configuration.
Appears in: How computers got here
VLAN also: virtual LAN: A way to split one physical switch into separate networks, so devices on different VLANs cannot reach each other without crossing a router or firewall.
Appears in: Layer 2 and wireless · Network architectures
Volatile evidence: Information that may disappear or change as time passes, processes end, or power is removed.
Appears in: Some evidence disappears as systems change
VPN also: virtual private network: An encrypted tunnel that makes a remote device behave as if it were on the internal network. A common target because its credentials are a door.
Appears in: Network architectures
vulnerability: A weakness in a system that could be exploited: a bug, a misconfiguration, a missing check, a weak default. A vulnerability is potential; an exploit makes it real.
Appears in: The words that make security clearer · Security frameworks: choose the right map
WAF also: web application firewall: A filter in front of a web app that inspects HTTP requests for attack patterns like SQL injection and blocks them. A speed bump, not a fix; bypasses are routine.
Appears in: Network architectures · Web applications
walkthrough: An explanatory record of work on a lab; reading it does not itself grant access or testing permission.
Appears in: Why this is free
WinRM also: Windows Remote Management: Windows remote command execution over HTTP(S), ports 5985 and 5986. The PowerShell remoting transport and a standard way to move laterally with credentials.
Appears in: Movement, sessions, and lasting access
wordlist: A file of candidate names, paths, or passwords a tool tries in turn. SecLists is the standard collection; the right wordlist makes or breaks discovery and cracking.
Appears in: Mapping a web surface · Initial access and credentials
Workload identity: An identity used by software to authenticate and request access to resources.
Appears in: Machines need identities too
Worm: Self-replicating software that can propagate between systems without requiring a user to manually install each copy.
Appears in: Where hacking comes from
WPA2: The long-standing Wi-Fi security standard. With a single shared password, its handshake can be captured and the password cracked offline.
Appears in: Layer 2 and wireless
WPA3: The newer Wi-Fi security standard, with a handshake designed to resist offline password cracking.
Appears in: Layer 2 and wireless
XXE: XML external-entity processing permits unintended access to external resources.
Appears in: Server-side trust boundaries
zero trust: An architecture that trusts nothing by network location: every request is authenticated and authorized regardless of whether it comes from inside the perimeter.
Appears in: Network architectures
zero-day also: 0-day: A vulnerability the vendor does not yet know about or has not yet patched, so there are zero days of defense against it.
Appears in: Where hacking comes from

Definitions here are written for this path. For the formal standard wording, see the NIST Computer Security Resource Center glossary.