// ~/glossary $ man hacking

Glossary

104 terms you will run into constantly, explained in a sentence or two. Terms in the tutorials link here the first time they appear.

A

Active Directory: Microsoft's directory service for Windows networks. It stores users, computers, and groups, and decides who can log in to what. Most corporate internal assessments revolve around it.
APIApplication programming interface: A contract that lets one program request work or data from another. Most modern web apps are APIs with a user interface on top.
AS-REP roasting: Requesting Kerberos authentication data for accounts that have pre-authentication disabled, then cracking it offline. Fixed by requiring pre-authentication on every account.
ASNAutonomous System Number: An identifier for a network operated by one organization on the internet. Looking up a company's ASN can reveal IP ranges it owns, which helps define scope during recon.
Attack surface: Everything an attacker can reach and interact with: hosts, ports, web endpoints, APIs, people, and third parties. Recon is the process of mapping it.
Authentication: Proving who you are, for example with a password, key, or passkey. Compare with authorization, which decides what you are allowed to do.
Authorization: Deciding what an authenticated user may do. Broken authorization, such as IDOR, is consistently among the most common and impactful web bugs.

B

Base64: An encoding that represents binary data using 64 printable characters. It is not encryption: anyone can decode it instantly.
BloodHound: A tool that graphs Active Directory relationships to show paths from one account to high privilege. Defenders use it to find and remove those paths first.
Blue team: The defenders: people who monitor, detect, respond to, and harden against attacks.
BOLABroken Object Level Authorization: The API name for IDOR: the server returns or changes an object without checking that the caller may access it. Number one in the OWASP API Top 10.
Brute force: Trying many candidate values, such as passwords, until one works. Online brute force hits a live service and is noisy. Offline brute force runs against captured hashes.
Bug bounty: A program where an organization invites researchers to find and report vulnerabilities in exchange for rewards, under published rules and scope.
Burp Suite: An intercepting web proxy from PortSwigger. It sits between your browser and a site so you can inspect, modify, and replay requests.

C

C2Command and control: Infrastructure an operator uses to communicate with compromised systems. Red teams run C2 frameworks in authorized engagements, and defenders hunt for its traffic patterns.
CORSCross-Origin Resource Sharing: Browser rules that let a server allow specific other origins to read its responses. Overly permissive CORS can let a malicious site read a logged-in user's data.
CSPContent Security Policy: A response header that tells the browser which sources of scripts, styles, and other content are allowed. A strict CSP turns many XSS bugs into dead ends.
CSRFCross-Site Request Forgery: Tricking a logged-in user's browser into sending a request they did not intend. SameSite cookies and anti-CSRF tokens prevent it.
CTFCapture the Flag: A security competition where you solve challenges to find hidden strings called flags. The safest, most fun way to practice offensive skills.
CVECommon Vulnerabilities and Exposures: A public identifier for a specific known vulnerability, written like CVE-2024-3400. It names the bug; it does not describe how severe it is.
CVSSCommon Vulnerability Scoring System: A standard for scoring vulnerability severity from 0.0 to 10.0 based on how it is exploited and what it impacts.
CWECommon Weakness Enumeration: A catalog of weakness types, like CWE-79 for XSS. A CVE is one bug; a CWE is the category of mistake behind it.

D

Defense in depth: Layering several independent controls so a single failure does not lead to compromise.
DKIMDomainKeys Identified Mail: Email signing. The sending domain publishes a public key in DNS so receivers can verify messages were not forged or altered.
DMARC: A DNS policy telling receivers what to do with mail that fails SPF or DKIM checks: deliver, quarantine, or reject, and where to send reports.
DNSDomain Name System: The system that maps names like example.com to IP addresses. DNS records are a rich source of subdomains, mail providers, and third-party services during recon.
DNSSEC: Signatures on DNS answers that let resolvers verify they have not been tampered with, preventing cache poisoning.
Domain controller: A server that runs Active Directory and handles authentication for a Windows domain. Compromising one usually means controlling the whole domain.

E

EDREndpoint Detection and Response: Security software on hosts that records activity and detects or blocks malicious behavior. Modern EDR watches what programs do, not only what files look like.
Encoding: Transforming data into another format for transport, such as URL or Base64 encoding. Encoding is reversible by anyone and provides no secrecy.
Encryption: Transforming data so only someone with the right key can read it. Unlike encoding or hashing, it is designed to be reversed, but only with the key.
Enumeration: Systematically listing what exists on a target: users, shares, services, directories, versions. Most of a successful assessment is careful enumeration.
Exploit: Code or a technique that takes advantage of a vulnerability to cause unintended behavior.

F

False positive: A finding that looks like a vulnerability but is not. Verifying every finding by hand before reporting it is what separates professionals from scanner output.
Fuzzing: Sending large numbers of unexpected or malformed inputs to a program to find crashes or odd behavior. Also used loosely for brute forcing web paths and parameters.

G

GraphQL: An API style with a single endpoint where clients request exactly the fields they need. Every field needs its own authorization check.
GTFOBins: A curated list of Unix binaries and the ways their legitimate features can be misused when they run with elevated permissions. Defenders use it to audit sudo rules and SUID files.

H

Hash: A one-way fingerprint of data with a fixed length. Passwords should be stored as slow, salted hashes so a database leak does not reveal them directly.
Hashcat: A fast password recovery tool that uses GPUs to test candidate passwords against hashes. Each hash type has a mode number, set with -m.
HSTSHTTP Strict Transport Security: A response header that tells browsers to only ever connect over HTTPS, preventing downgrade attacks on later visits.
HttpOnly: A cookie flag that hides the cookie from JavaScript, so an XSS bug cannot read the session token directly.

I

IDORInsecure Direct Object Reference: An authorization bug where changing an identifier, such as /invoice/1001 to /invoice/1002, returns someone else's data.
IOCIndicator of Compromise: An artifact that suggests a system was compromised, such as a file hash, domain, or IP address. Useful but easy for attackers to change.

J

JWTJSON Web Token: A signed, Base64url-encoded bundle of claims used as access tokens, ID tokens, and sessions. Its contents are readable by anyone holding it.

K

Kerberoasting: Requesting Kerberos service tickets for accounts with service principal names, then cracking them offline. Long random passwords and managed service accounts defeat it.
Kerberos: The ticket-based authentication protocol used by Active Directory. Understanding its tickets is essential for both attacking and defending Windows domains.
KEVKnown Exploited Vulnerabilities: CISA's catalog of vulnerabilities confirmed to be exploited in the wild. A practical, prioritized patch list.

L

Lateral movement: Moving from one compromised system to others in the same network. Network segmentation and credential hygiene limit it.
Least privilege: Giving every user and process only the access it needs. It limits how far any single compromise can spread.
LFILocal File Inclusion: A bug where user input controls which local file an application reads or includes, potentially exposing configuration or source code.
LOLBinsLiving off the land binaries: Legitimate system tools that attackers abuse to avoid dropping their own malware. Defenders monitor how these tools are used, not just whether they run.

M

MFAMulti-factor authentication: Requiring more than one proof of identity, such as a password plus a hardware key. Phishing-resistant MFA like passkeys stops most account takeover.
MITRE ATT&CK: A public knowledge base of real-world attacker tactics and techniques. A shared language for red teams writing reports and blue teams building detections.

N

Nmap: The standard network scanner for discovering hosts, open ports, and service versions.
NTLM: An older Windows authentication protocol still widely enabled. Its hashes and challenge-response messages are frequent targets in internal assessments.

O

OAuth: A framework for delegated access: letting one application act on your behalf at another service without sharing your password.
OIDCOpenID Connect: An identity layer on top of OAuth that adds an ID token proving who logged in. The basis of most modern single sign-on.
OSINTOpen-source intelligence: Gathering information from public sources: search engines, records, social media, code repositories. Ethical OSINT respects privacy and scope.
OWASPOpen Worldwide Application Security Project: A nonprofit that publishes free application security resources, including the OWASP Top 10 and the Web Security Testing Guide.

P

Pass-the-hash: Authenticating with an NTLM hash instead of the plaintext password. Credential Guard and limiting admin reuse reduce its impact.
Payload: The part of an input or exploit that does the work, such as the script inside an XSS test string.
Penetration test: An authorized, time-boxed assessment where testers attempt to find and exploit vulnerabilities and then report how to fix them.
Persistence: Techniques for keeping access across reboots or credential changes. Red teams demonstrate it so defenders can learn to detect it.
Phishing: Tricking people into revealing credentials or running something malicious, usually via email. Still the most common initial access method.
Pivoting: Using a compromised host to reach networks you could not reach directly.
PKCEProof Key for Code Exchange: An OAuth extension that binds an authorization code to the client that requested it, so a stolen code cannot be redeemed.
Port: A numbered endpoint on a host where a network service listens, such as 22 for SSH or 443 for HTTPS.
Privilege escalation: Going from limited access to higher access, such as from a normal user to root or administrator. Usually caused by misconfiguration rather than exotic bugs.
Proof of concept: A minimal demonstration that a vulnerability is real. A good PoC proves impact without causing harm.
Purple team: Red and blue teams working together in the open: attackers run a technique, defenders check whether they saw it, and both improve detections on the spot.

R

RBACRole-based access control: Granting permissions to roles and roles to users. Simple and common, but it struggles when access depends on who owns the data.
RCERemote Code Execution: A vulnerability that lets an attacker run their own code on a target over the network. Usually the most severe class of finding.
Recon: The information gathering phase of an assessment. Thorough recon finds the forgotten assets where most real bugs live.
Red team: An authorized team that emulates real adversaries to test an organization's detection and response, not just its vulnerabilities.
Responsible disclosure: Reporting a vulnerability privately to the owner and giving them time to fix it before any public details are shared.
REST: An API style that models data as resources at URLs and uses HTTP methods as verbs. Its predictability makes endpoints easy to discover.
Reverse proxy: A server that sits in front of applications and forwards requests to them. Differences in how the proxy and app parse requests cause a whole family of bugs.
Rules of engagement: The written agreement that defines what testers may test, when, how, and who to call if something goes wrong. Never start without it.

S

Salt: Random data added to each password before hashing so identical passwords produce different hashes and precomputed tables become useless.
Same-origin policy: The browser rule that stops scripts from one origin (scheme, host, and port) reading responses from another. CORS deliberately relaxes it.
SameSite: A cookie attribute that controls whether the cookie is sent on cross-site requests. Lax or Strict blocks most CSRF.
SAMLSecurity Assertion Markup Language: An XML-based single sign-on standard common in enterprises. The identity provider sends a signed assertion that the application must validate carefully.
Scope: The exact set of systems, domains, and techniques you are authorized to test. Anything outside it is off limits, no matter how tempting.
Shodan: A search engine for internet-connected devices and the banners their services return.
SIEMSecurity Information and Event Management: A platform that collects logs from across an organization so analysts can search, correlate, and alert on them.
Sigma: An open, vendor-neutral format for writing detection rules that can be converted to many SIEM query languages.
Single sign-on: Logging in once at an identity provider and being trusted by many applications.
SMBServer Message Block: The Windows file sharing protocol. Open shares and weak SMB settings are common internal findings.
Social engineering: Manipulating people rather than technology to gain access. Only ever tested with explicit written authorization.
SPFSender Policy Framework: A DNS TXT record listing which servers may send email for a domain. Missing or permissive SPF makes spoofing easier.
SQL injection: A bug where user input is treated as part of a database query, letting an attacker read or change data. Parameterized queries prevent it.
SSRFServer-Side Request Forgery: Making a server send requests on your behalf, often to internal services or cloud metadata endpoints it can reach and you cannot.
Subdomain takeover: Claiming an abandoned cloud resource that a company's DNS still points at, letting you serve content on their subdomain.
SUID: A Unix permission bit that makes a program run as its owner, often root. Unusual SUID binaries are a classic privilege escalation finding.

T

Threat model: A structured look at what you are protecting, from whom, and how it could be attacked. It decides where security effort goes.
TLSTransport Layer Security: The encryption protocol behind HTTPS. It protects data in transit and proves the server's identity with a certificate.
TTPsTactics, techniques, and procedures: How an adversary operates. Detecting behavior at the TTP level is far more durable than blocking individual IOCs.

V

VPNVirtual Private Network: An encrypted tunnel into another network. CTF and training platforms use VPNs to connect you to their lab networks.
Vulnerability: A weakness that can be exploited to violate security. Not every bug is a vulnerability, and not every vulnerability is exploitable.

W

WAFWeb Application Firewall: A filter in front of a web application that blocks requests matching attack patterns. It reduces noise but does not fix the underlying bug.
Wordlist: A list of candidate values for brute forcing: passwords, directories, subdomains, or parameters. SecLists is the standard collection.

X

XSSCross-Site Scripting: A bug that lets an attacker run JavaScript in another user's browser in the context of a trusted site. Output encoding and CSP prevent it.
XXEXML External Entity: A bug where an XML parser resolves external entities from user input, potentially reading local files or making network requests.

Z

Zero-day: A vulnerability unknown to the vendor, so no patch exists yet.