Cybersecurity Glossary

A type of XSS where the malicious script is reflected off a web server via URL parameters or form submissions and immediately returned to the user.

Remote Code Execution. A critical vulnerability that allows an attacker to execute arbitrary code on a target system remotely, typically leading to full system compromise.

Remote File Inclusion. A vulnerability that allows an attacker to include remote files through the web application, potentially executing malicious code hosted on external servers.

Rivest-Shamir-Adleman. An asymmetric cryptographic algorithm widely used for secure data transmission, based on the mathematical difficulty of factoring large prime numbers.

A precomputed table of hash values for common passwords and their corresponding plaintext, used to crack password hashes by performing reverse lookups.

Malware that encrypts victim files or locks system access, demanding payment in cryptocurrency for the decryption key or restoration of access.

A collection of malicious tools that provides continued privileged access to a computer while actively hiding its presence from users and security software.

Remote Access Trojan. Malware that gives an attacker remote control over an infected system, enabling file access, screen capture, webcam activation, and command execution.

A cybercrime business model where ransomware developers lease their malware to affiliates who carry out attacks, sharing the ransom payments.

Role-Based Access Control. An access control method that assigns permissions to roles rather than individual users, simplifying management of user privileges.

An independent security team that simulates real-world attacks against an organization to test its defensive capabilities and identify security weaknesses.

The initial phase of penetration testing where information about the target is gathered through passive and active techniques to identify potential attack vectors.

A network tool that poisons LLMNR, NBT-NS, and MDNS responses to capture authentication hashes on local networks for offline cracking.

The formal document that defines the scope, methods, timing, and constraints of a penetration test, establishing legal and operational boundaries.

The incident response phase focused on restoring affected systems and services to normal operation while implementing additional monitoring to prevent recurrence.

The process of identifying, analyzing, and evaluating cybersecurity risks to determine their potential impact and likelihood of occurrence.

A vulnerability disclosure model where the discoverer reports the vulnerability privately to the vendor and allows a reasonable time for a fix before public disclosure.

A legal concept giving individuals the right to request deletion of their personal data from databases and search engine results.

The process of copying data from one RFID tag to another, potentially enabling unauthorized access to buildings or payment systems.

The process of gaining root access on Android devices, providing administrative control but potentially exposing the device to security risks.

An unauthorized wireless access point connected to a network, potentially installed by an attacker to intercept traffic or gain network access.

Remote Authentication Dial-In User Service. A networking protocol providing centralized authentication, authorization, and accounting for network access.

Runtime Application Self-Protection. A security technology that runs within an application to detect and block attacks in real time by analyzing application behavior.

A cryptocurrency scam where developers abandon a project and steal investor funds after artificially inflating the value of a token or NFT.

A comprehensive security assessment where skilled attackers simulate a real-world adversary to test an organization detection and response capabilities.

A documented set of procedures for responding to specific types of security incidents, providing step-by-step guidance for security operations teams.

Remote Desktop Protocol. A Microsoft protocol that allows users to remotely access and control Windows computers, frequently targeted in brute-force and ransomware attacks.

A shell session established from the target machine back to the attacker machine, bypassing firewall restrictions that block incoming connections.

A vulnerability that occurs when the outcome of a process depends on the timing of events, allowing attackers to exploit the gap between check and use operations.

The process of analyzing software or hardware to understand its design, architecture, and functionality, commonly used in malware analysis and vulnerability research.

An asymmetric cryptographic algorithm that uses the mathematical difficulty of factoring large prime numbers to secure data transmission and digital signatures.

A document that lists identified risks, their severity, likelihood, and planned mitigations, used to track and manage an organization's risk posture.

A USB device that emulates a keyboard when plugged in, rapidly executing pre-programmed keystroke sequences to compromise systems.

The technical infrastructure used by red teams during engagements, including C2 servers, redirectors, phishing domains, and payload hosting.

The legal right of individuals to obtain confirmation of whether their personal data is being processed and to access that data.

A technique that controls the number of requests a user can make to an API or service within a specified time period, preventing abuse and denial-of-service attacks.

An attack targeting Retrieval-Augmented Generation systems by injecting malicious content into the knowledge base that the AI retrieves and trusts.

A physical access control system using radio frequency identification technology to grant or deny entry based on credential proximity.

A category of attacks where an attacker induces a system to make requests to unintended locations, including both SSRF and CSRF variants.

An asymmetric encryption algorithm using large prime number factoring for key generation, widely used for secure data transmission.

Techniques and tools used to identify rootkits on compromised systems, including memory analysis, integrity checking, and behavioral detection.

Specialized incident response procedures for handling ransomware attacks, including containment, negotiation considerations, and recovery strategies.

Recovery Time Objective. The maximum acceptable time between a disruption and the restoration of a business process to an acceptable service level.

Recovery Point Objective. The maximum acceptable amount of data loss measured in time, determining how frequently backups must be performed.

The level of risk remaining after security controls have been applied, representing the gap between total risk and mitigated risk.

The amount and type of risk an organization is willing to accept in pursuit of its objectives.

A server that sits in front of web servers and forwards client requests to the appropriate backend, providing security and load balancing.

Regular Expression Denial of Service. An attack exploiting poorly written regex patterns that cause catastrophic backtracking and excessive CPU usage.

Using the Responder tool to capture authentication credentials by poisoning LLMNR, NBT-NS, and MDNS responses on a local network.

A Linux distribution designed for reverse-engineering malware, providing pre-installed tools for static and dynamic analysis.

An open-source reverse engineering framework providing disassembly, debugging, analysis, and patching of binary files.

Security measures that protect applications during execution, detecting and blocking exploitation attempts in real time.

The examination of radio frequency signals to identify, characterize, and potentially exploit wireless communications and devices.

Comprehensive adversary simulation engagements that test an organization entire security posture including people, processes, and technology.

A technique that loads a DLL directly from memory without using the Windows loader, avoiding detection by security tools.

Return-Oriented Programming chain. An exploitation technique that chains together small instruction sequences from existing code to execute arbitrary operations.

Exploiting the timing gap between a security check and the use of a resource to gain unauthorized access.

A digital signature that can be performed by any member of a group, providing anonymity as the actual signer is indistinguishable.

An authentication approach that dynamically adjusts security requirements based on assessed risk from factors like location and behavior.

The practice of developing and deploying AI systems that are fair, transparent, accountable, and respectful of privacy.

An HTTP header that controls how much referrer information is sent with requests, preventing sensitive URL leakage.

Modifying Windows registry keys to ensure malware automatically executes during system startup or user login.

Step-by-step instructions for restoring affected systems and data to normal operations after a security incident.

A systematic process for identifying the fundamental reason a security incident occurred, informing prevention measures.

Frameworks and tools that automate adversary simulation techniques for continuous security validation.

Service Level Agreements defining maximum time allowed to fix vulnerabilities based on their severity level.

The process of identifying unauthorized wireless access points connected to an organization network.

Techniques attackers use to circumvent request rate limiting including distributed requests, header manipulation, and endpoint variation.

The adherence to laws, regulations, guidelines, and specifications relevant to an organization business operations and data handling.

An organization published guidelines for security researchers to report vulnerabilities, including expected response times and safe harbor provisions.