Glossary

Every term the lessons use, defined in one place. Anything here also expands inline the first time a lesson uses it, so you never have to leave a page to find out what a word means.

343 terms

ABAC: Attribute-based access control. Instead of fixed roles, each request is decided from attributes: the user's department, the file's sensitivity, the time of day, the device. More precise than roles and much harder to reason about when something gets wrongly denied.; Identity and Access
1 lesson
access key: A long-lived username and password pair for a cloud API, made of a key id and a secret, used by scripts and tools instead of a login screen. Keys do not expire on their own, so one committed to a public code repository stays usable until somebody notices.; Cloud and Containers
5 lessons
access token: The badge Windows attaches to every process, listing the account's SID, its group memberships, and its special privileges. Every permission check reads that token, not the account name, so stealing a token from another process means inheriting that account's access without ever knowing its password.; Windows and Active Directory
7 lessons
Active Directory: Microsoft's directory service, abbreviated AD: the database of every user, computer, and group in a domain, plus the rules about who can do what. Most corporate networks run on it, so most corporate attacks are really attacks on it.; Windows and Active Directory
5 lessons
Administrator: The Windows account with full control of a machine, the equivalent of root on Linux. Membership of the local Administrators group grants the same power, and the built-in account always ends in -500 no matter what it has been renamed to.; Windows and Active Directory
29 lessons
AES: The Advanced Encryption Standard, the symmetric cipher behind almost all bulk encryption today: disk encryption, Wi-Fi, and the data phase of most secure connections. Common key sizes are 128 and 256 bits, and no practical break of the algorithm itself is known.; Cryptography
9 lessons
alert: A notification raised when activity matches a detection rule. An alert is a claim that something might be wrong, not proof. A human still has to look.; Blue Team and Defense
54 lessons
alert fatigue: What happens when a team gets so many alerts, most of them wrong, that people stop reading them carefully. It is how real attacks get closed as noise. Cutting false positives is defensive work, not housekeeping.; Blue Team and Defense
5 lessons
anomaly: Activity that departs from the baseline: a workstation suddenly talking to a server in another country, an account signing in at an hour it never has before. An anomaly is not the same as an attack. Plenty of them are just someone on vacation.; Blue Team and Defense
3 lessons
anti-analysis: Checks malware runs to work out whether it is being watched, such as looking for a debugger, counting CPU cores, or waiting to see if the mouse ever moves. If the answers look like a lab rather than a real desktop, the sample exits quietly and shows the analyst nothing.; Malware and Reverse Engineering
1 lesson
API: A doorway one program uses to ask another for data or actions, usually over HTTP and usually answering in JSON. APIs are built for machines, so they often skip the guardrails the human-facing site has.; Web and HTTP
83 lessons
ARP: The protocol that finds which hardware address belongs to a given IP address on the local network. It works by shouting to everyone and waiting for the owner to answer.; Networking
8 lessons
assembly: The lowest-level language a person can still read, where each line is one instruction the processor runs: move this value, add these two, jump there. It is what a disassembler produces, and it is tied to the processor family, so x86 assembly and ARM assembly look nothing alike.; Malware and Reverse Engineering
8 lessons
asset: Anything the organization owns and would miss: a customer database, a laptop, a domain name, a payroll system. Security work starts by listing assets, because a control with no asset behind it is protecting nothing.; Governance and Risk
20 lessons
asymmetric encryption: Encryption using a matched pair of keys, where whatever one key locks only the other can unlock. It solves the problem of talking secretly to someone met for the first time, at the cost of being far slower than symmetric encryption.; Cryptography
2 lessons
audit: A structured check by someone other than the team being checked, testing whether the written rules are actually followed and demanding proof. Auditors want evidence like logs, tickets, and screenshots, so "we always do that" is not an answer.; Governance and Risk
31 lessons
authentication: Proving who someone is, usually with a password, a key, or a code from a phone. It answers 'who are you', and nothing else about access makes sense until that is settled.; Web and HTTP
61 lessons
authorization: Deciding what an identified user is allowed to do. It answers 'may you'. Plenty of apps authenticate perfectly and then never check authorization, which is the hole IDOR walks through.; Web and HTTP
93 lessons
availability zone: One isolated cluster of data centers inside a region, with its own power and cooling. Spreading copies of a service across zones keeps it running when one building fails.; Cloud and Containers
backdoor: A hidden way back into a machine that skips the normal login. An attacker plants one after breaking in so the second visit costs nothing, even if the original hole gets patched.; Malware and Reverse Engineering
13 lessons
Base64: An encoding that rewrites any bytes using 64 printable characters, which is why it often ends in one or two equals signs. Attackers use it to move binary through text-only channels, and beginners mistake it for encryption constantly. It is not encryption.; Cryptography
20 lessons
baseline: A record of what normal looks like for a system: which programs run, which machines talk to which, how much traffic moves at 3 a.m. on a Sunday. Without one nothing can be called unusual, because there is nothing to be unusual against.; Blue Team and Defense
20 lessons
beacon: The malware's habit of contacting its command server on a schedule to ask for work, rather than holding a connection open. Defenders hunt beacons by looking for a host that talks to the same address every few minutes for days, which normal browsing never does.; Malware and Reverse Engineering
8 lessons
bearer token: A token with no extra proof attached, meaning whoever bears it gets in. It rides in an HTTP header as `Authorization: Bearer <token>`. Nothing checks that the sender is the person it was issued to, so protecting it in transit and at rest is the entire defense.; Identity and Access
2 lessons
biometrics: Authentication using a physical trait: fingerprint, face, iris. It is convenient and hard to guess, but a leaked fingerprint cannot be changed the way a password can, so it works best as one factor rather than the only one.; Identity and Access
1 lesson
block cipher: A cipher that encrypts fixed-size chunks at a time, such as the 16-byte blocks AES uses. Data that does not divide evenly into blocks gets padded, and how the blocks are chained together matters as much as the cipher itself.; Cryptography
1 lesson
BloodHound: A tool that pulls users, groups, sessions, and permissions out of Active Directory and draws them as a graph, then answers questions like 'what is the shortest path from this account to Domain Admin'. Defenders find their own broken paths with it; attackers find the same ones faster.; Windows and Active Directory
2 lessons
blue team: The people defending an organization's systems: watching for attacks, responding to the ones that land, and closing the holes that let them in. The name comes from military exercises where one side attacks and the other defends.; Blue Team and Defense
4 lessons
botnet: A collection of infected machines that all take orders from the same operator. One machine is worth little; the value is in having a hundred thousand of them send traffic, mine coins, or relay spam at once.; Malware and Reverse Engineering
2 lessons
breakpoint: A marker telling a debugger to freeze the program the moment it reaches a chosen instruction. The usual trick is patching a special one-byte instruction over the target, which is also a giveaway malware can go looking for.; Malware and Reverse Engineering
6 lessons
brute force: Trying every possible key or password until one works. It always works eventually, so security rests on making eventually longer than the attacker's lifetime: guessing a 256-bit key is not a matter of buying faster hardware.; Cryptography
17 lessons
buffer overflow: Writing more data into a chunk of memory than it was sized to hold, so the extra bytes spill into whatever sits next to it. When the thing next to it is the address a function will return to, the attacker picks where the program goes next.; Malware and Reverse Engineering
1 lesson
Burp Suite: The tool most web testers live in. It proxies browser traffic so every request can be paused, read, edited, and replayed, and it bundles a repeater, a request fuzzer, and a scanner. The free Community edition covers the core of it.; Web and HTTP
4 lessons
business impact analysis: A study of what actually breaks, and how fast, when a given system goes down: which work stops, how much money leaks per hour, whose phone rings. It is the input that makes recovery targets honest instead of wishful.; Governance and Risk
C2: Command and control: the server an attacker runs so their malware has somewhere to report to and take orders from. Cutting an infected machine off from its C2 usually leaves the malware sitting there doing nothing.; Malware and Reverse Engineering
14 lessons
certificate: A signed file a server presents that ties its name to a public key, vouched for by an authority the browser already trusts. It is what stops an attacker from impersonating example.com. A browser warning means this check failed, and clicking through hands the connection to whoever is on the other end.; Web and HTTP
31 lessons
certificate authority: An organization that checks who someone is and then signs their certificate, so software that trusts the authority also trusts the certificate. Browsers ship with a built-in list of them, which means a few dozen companies decide what the whole web treats as genuine.; Cryptography
5 lessons
chain of custody: The unbroken record of who handled a piece of evidence, when, and what they did with it. A gap in that record is the first thing an opposing lawyer attacks, and it can make otherwise solid findings worthless in court.; Blue Team and Defense
2 lessons
CIA triad: The three goals every security control serves: confidentiality, meaning only the right people can read it; integrity, meaning nobody changed it without permission; and availability, meaning it works when it is needed. The letters have nothing to do with the intelligence agency.; Governance and Risk
1 lesson
CIDR notation: The /24 in 192.168.1.0/24. The number counts how many leading bits of the address are fixed for the network, leaving the rest to number individual machines.; Networking
3 lessons
ciphertext: The scrambled output of encryption. It should look like random noise, and any pattern visible in it, such as identical chunks repeating, is a sign the encryption is being used badly.; Cryptography
15 lessons
claim: One statement inside a token, such as the user id, an expiry time, or a role. A claim is only worth as much as the signature over it, since an unverified token is just a string the sender chose.; Identity and Access
44 lessons
client: The side of a conversation that asks. A browser asking for a web page is a client.; Networking
106 lessons
cluster: The full set of machines Kubernetes manages as one pool, plus the software steering them. An engineer asks the cluster to run an application and the cluster picks which machine actually runs it.; Cloud and Containers
19 lessons
cmd: The old Windows command prompt, cmd.exe. It is clumsy compared to PowerShell, but it is on every Windows machine ever shipped, which is why attack write-ups still use it.; Windows and Active Directory
168 lessons
cmdlet: A PowerShell command, always named Verb-Noun: Get-Process, Get-Service, New-Item, Invoke-WebRequest. The naming is rigid on purpose, so a command's name tells the reader what it does before they run it.; Windows and Active Directory
8 lessons
collision: Two different inputs that produce the same hash value. Collisions always exist because inputs are unlimited and outputs are not, so the real question is whether an attacker can produce one on demand. For MD5 and SHA-1 the answer is yes.; Cryptography
7 lessons
compliance: Proving to an outside party that the organization follows a specific set of required rules, whether those come from a law, a contract, or a card network. Compliance is about evidence someone else accepts, which is why a compliant company can still be insecure.; Governance and Risk
15 lessons
container: A process that runs on a normal Linux machine but is fenced off so it sees its own files, its own processes, and its own network. It is not a separate computer: every container on a host shares that host's single kernel, which is why a container break is a host break.; Cloud and Containers
40 lessons
container escape: Getting out of a container and onto the host machine underneath it. Because containers share the host kernel, an escape usually turns one compromised application into control of every other container on that machine.; Cloud and Containers
4 lessons
containment: Stopping an attack from spreading while the investigation is still running: pulling a machine off the network, disabling an account, blocking a domain. It buys time. It is deliberately not cleanup, because the evidence still has to survive.; Blue Team and Defense
14 lessons
Content-Type: The header that says what format the data is in, like text/html, application/json, or image/png. Get it wrong and a browser may render an uploaded file as a page instead of downloading it.; Web and HTTP
16 lessons
control: Any deliberate measure put in place to reduce risk: a lock, a password rule, a nightly backup, a background check. Controls are what turn inherent risk into residual risk.; Governance and Risk
155 lessons
control plane: The brain of a Kubernetes cluster: the API server everything talks to, plus the components that decide what runs where and store the cluster's state. Whoever controls it controls every machine in the cluster.; Cloud and Containers
3 lessons
cookie: A small piece of text a server tells the browser to store and send back on every later request to that site. It is how a site remembers who is logged in. Steal a cookie and you are that user, no password needed.; Web and HTTP
32 lessons
corrective control: A control that limits the damage and gets things working again after something went wrong: restoring from backup, revoking a stolen password, rebuilding a server. It assumes the other kinds already failed.; Governance and Risk
CORS: The mechanism a server uses to grant specific other origins permission to read its responses, through Access-Control-Allow-Origin headers. It is a controlled hole in the same-origin policy. A server that reflects any origin back and allows credentials has opened its data to every site on the internet.; Web and HTTP
1 lesson
credential: Anything an actor presents to prove an identity: a password, a key file, a certificate, a fingerprint. Whoever holds a credential is treated as the person it belongs to, so a stolen one is as good as the real thing.; Identity and Access
114 lessons
CSRF: Cross-site request forgery. An attacker's page makes a victim's browser send a request to a site the victim is logged into, and the browser attaches the cookies automatically, so the request looks legitimate. The defense is a secret token in each form that the attacker's page has no way to read.; Web and HTTP
1 lesson
daemon: A program that runs in the background waiting to serve requests, rather than being started by a person each time. Names often end in d, such as sshd.; Systems and Linux
12 lessons
data classification: Sorting data into a few labeled tiers by how much harm its exposure would cause, such as public, internal, confidential, and restricted. The label carries the handling rules, so nobody has to argue file by file about what can be emailed out.; Governance and Risk
debugger: A tool that runs a program under control, letting an analyst pause it, step one instruction at a time, and read memory and registers as they change. It is how a reverse engineer watches packed malware unpack itself, since the unpacked code only exists while the program runs.; Malware and Reverse Engineering
10 lessons
decompiler: A tool that takes compiled instructions and reconstructs something close to the original C source, with loops and if statements instead of jumps. The output is an educated reconstruction, so it can be wrong, and analysts read it beside the raw instructions rather than instead of them.; Malware and Reverse Engineering
2 lessons
default gateway: The router a machine sends packets to when the destination is not on its own local network. It is the exit door out of the LAN.; Networking
7 lessons
detection engineering: Building, testing, and maintaining the rules that turn raw data into alerts. Good teams treat it like software: rules get version control, tests against real attack samples, and retirement when they stop earning the noise they make.; Blue Team and Defense
4 lessons
detection rule: The written logic that decides when to raise an alert, such as "flag any command shell launched by a Word document". Rules live in the SIEM or the EDR and run against data as it arrives.; Blue Team and Defense
4 lessons
detective control: A control that notices a bad thing is happening or already happened, such as an alarm, a log review, or a monthly check of who still has accounts. It stops nothing by itself, it just makes sure someone finds out.; Governance and Risk
DHCP: The protocol that hands a machine an IP address automatically when it joins a network, along with its gateway and DNS server.; Networking
11 lessons
Diffie-Hellman: A method where two parties each mix a private number with public values, swap the results, and independently arrive at the same shared secret. An eavesdropper sees the whole exchange and still cannot compute that secret, because the key itself never crosses the wire.; Cryptography
2 lessons
digital forensics: Examining machines and data to reconstruct what happened, in a way that holds up if someone challenges it later. The evidence includes deleted files, browser history, leftover traces of programs that ran, and timestamps. The whole discipline is in not changing the evidence while reading it.; Blue Team and Defense
1 lesson
digital signature: A value produced from data plus a private key that anyone can verify with the matching public key. It proves two things at once: the data came from the key's owner, and nobody changed a byte of it along the way.; Cryptography
2 lessons
directory: The central database of accounts, groups, and machines an organization runs, queried whenever something needs to check who a user is or what group they belong to. Active Directory is the common one, and taking it over means owning everything that trusts it.; Identity and Access
39 lessons
disassembler: A tool that turns a compiled program's raw bytes back into readable processor instructions. It is a faithful translation, not a guess, but the result is thousands of one-line instructions with no variable names and no comments.; Malware and Reverse Engineering
1 lesson
disk image: A bit-for-bit copy of an entire drive, including deleted files and the unused space a normal file copy skips. Investigators work on the image and never the original, and they hash both to prove the copy matches.; Blue Team and Defense
7 lessons
DNS: The system that turns a name like example.com into an IP address. Nothing on the network routes by name, so this lookup happens before almost every connection.; Networking
49 lessons
Dockerfile: A text recipe for building an image, one instruction per line: which base image to start from, which files to copy in, which command to run. Reading one tells an attacker what is inside a container before ever touching it.; Cloud and Containers
5 lessons
DOM: The live in-memory tree a browser builds from a page's HTML, which scripts can read and rewrite while the page is open. Cookies, form values, and page text all hang off it, which is why a script an attacker injects can reach every one of them.; Web and HTTP
6 lessons
domain: A group of Windows machines and users administered together, with one shared account database rather than separate local accounts on every box. One login works everywhere in it, which is convenient for staff and just as convenient for anyone who steals that login.; Windows and Active Directory
83 lessons
domain controller: The server that holds a copy of the domain's account database and answers logon requests, usually abbreviated DC. Its database file, NTDS.dit, contains the password hash of every account in the domain, so owning a DC is owning the domain.; Windows and Active Directory
15 lessons
dropper: A small first-stage program whose only job is to put the real malware on disk and run it. It carries that cargo inside itself, so it needs no network access to deliver it.; Malware and Reverse Engineering
4 lessons
due diligence: Checking, before signing or buying, that the other party is what it claims: reading their audit reports, their answers to a security questionnaire, their breach history. It matters because a vendor's breach lands on the customers whose data they were holding.; Governance and Risk
dwell time: How long an attacker was inside before anyone noticed, measured from first access to detection. It is the number defenders care about most, because everything an attacker wants to accomplish costs them time.; Blue Team and Defense
2 lessons
dynamic analysis: Running the program and watching what it actually does: files touched, processes started, addresses contacted. It cuts through packing and obfuscation, because code has to unwrap itself to execute, but it only shows the paths that one run happened to take.; Malware and Reverse Engineering
4 lessons
EDR: Endpoint detection and response. An agent installed on laptops and servers that records what programs do, flags suspicious behavior, and lets a responder cut the machine off the network remotely. It sees things the network never shows, like a document spawning a command shell.; Blue Team and Defense
16 lessons
encapsulation: Wrapping data in a new header at each layer on the way down, and unwrapping it on the way up. It is why one packet carries several nested sets of labels.; Networking
2 lessons
encoding: Rewriting data into a different format so a system can carry it safely, such as turning raw bytes into letters an email can survive. There is no secret involved and anyone can reverse it, so encoding protects nothing.; Cryptography
21 lessons
encryption: Scrambling data with a secret so only someone holding the right secret can read it back. The point is confidentiality, and it is reversible by design: whoever has the key gets the original data back exactly.; Cryptography
38 lessons
endpoint: One specific URL an API answers on, such as /api/v1/orders. Finding endpoints nobody linked to, like an old /api/v1/admin left in place, is a large part of testing a web app.; Web and HTTP
67 lessons
entropy: How much genuine unpredictability a value has, counted in bits. Keys, passwords, and session tokens are only as strong as their entropy, which is why software that seeds its random numbers from the clock gets broken fast.; Cryptography
12 lessons
enumeration: Systematically listing what a target exposes: hosts, ports, services, versions, users, shares. It is the step between finding a target and attacking it.; Offensive Security
27 lessons
eradication: Removing the attacker's foothold for good: deleting the malware, killing the accounts they made, and closing the hole they came in through. Skipping that last part is why organizations get hit twice by the same person.; Blue Team and Defense
3 lessons
event log: The record Windows keeps of what happened, stored as .evtx files under C:\Windows\System32\winevt\Logs and identified by numeric event IDs. Two worth memorising: 4624 is a successful logon and 4625 is a failed one, and a burst of 4625s from one source is what a password-guessing attack looks like from the defender's chair.; Windows and Active Directory
8 lessons
Event Viewer: The Windows app (eventvwr.msc) for reading the machine's logs. It splits them into channels, and the ones that matter for security are Security, System, and Application.; Windows and Active Directory
2 lessons
execution policy: The PowerShell setting that decides which script files are allowed to run, set to Restricted on Windows desktops by default. It is not a security control, it is a guardrail against accidents, and Microsoft says so: anyone can bypass it by pasting the script's contents straight into the shell.; Windows and Active Directory
2 lessons
exploit: Code or a technique that takes advantage of a specific vulnerability to gain access or control.; Offensive Security
59 lessons
false negative: An attack that happened and raised no alert at all. It is the most expensive kind of miss, because nobody knows to go looking.; Blue Team and Defense
1 lesson
false positive: An alert that fired when nothing bad happened. A backup tool reading thousands of files looks a lot like ransomware, and an admin's cleanup script looks a lot like an attacker's. Enough of these and people stop trusting the alerts.; Blue Team and Defense
20 lessons
federation: An arrangement where one organization accepts logins vouched for by another, so a contractor can use their own employer's account instead of getting a new one. It saves account sprawl, and it means trusting the other side's security as much as your own.; Identity and Access
1 lesson
file hash: A short fixed-length fingerprint calculated from a file's contents, such as a SHA-256 value. Change one byte and the hash changes completely, which is why a hash identifies one exact file, and why it is useless the moment an attacker rebuilds their tool.; Blue Team and Defense
5 lessons
file upload vulnerability: An upload feature that accepts a file it should not, then stores it somewhere the server will execute it. Upload a script, request its URL, and a photo form becomes code execution. Checking the file extension alone is not a defense.; Web and HTTP
firewall: Software or equipment that allows or blocks traffic against a set of rules. It explains why a port can be open on a host and still unreachable from elsewhere.; Networking
44 lessons
framework: A published, organized list of security practices an organization can adopt instead of inventing its own from scratch. A framework gives shared vocabulary and a checklist. It does not make any decision for the business.; Governance and Risk
24 lessons
GDPR: The European Union's General Data Protection Regulation, in force since 25 May 2018, governing how personal data about people in the EU is collected, used, and stored. It reaches companies outside the EU that handle that data, and fines can reach 20 million euros or 4 percent of worldwide annual revenue, whichever is higher.; Governance and Risk
1 lesson
GET: The method that asks for a resource without changing anything. Its input rides in the URL, so it lands in browser history, server logs, and proxy logs, which is why passwords should never travel in a GET.; Web and HTTP
283 lessons
Ghidra: A free, open-source reverse engineering suite the NSA released publicly in 2019. It ships with a decompiler, which is why it went from curiosity to the default starting point for anyone not paying for IDA.; Malware and Reverse Engineering
5 lessons
golden ticket: A forged TGT built with the stolen krbtgt key, claiming to be any user in any group, including Domain Admins. Domain controllers accept it because the signature checks out, and it survives password resets, so the only real fix is resetting krbtgt twice.; Windows and Active Directory
1 lesson
governance: The part of an organization that decides who is allowed to make security decisions, what the rules are, and who answers when something goes wrong. It is the layer above the tools: budgets, written rules, and named owners.; Governance and Risk
3 lessons
GPO: Group Policy Object. A bundle of settings a domain pushes down to machines and users, covering everything from password rules to which scripts run at startup. Anyone who can edit a GPO that applies to a machine can run code on that machine.; Windows and Active Directory
1 lesson
hash function: A function that turns any input, one byte or one gigabyte, into a fixed-length value such as a 64-character SHA-256 fingerprint. Change one bit of the input and the output changes completely, which is what makes it a tamper check.; Cryptography
5 lessons
hashing: Running data through a one-way function that produces a fixed-length fingerprint of it. Unlike encryption there is no key and no way back: the fingerprint proves data has not changed, but it cannot rebuild the data.; Cryptography
15 lessons
header: The labels attached to the front of a packet: source, destination, and bookkeeping fields. Everything that is not the header is the payload, meaning the actual data being carried.; Networking
64 lessons
heap: The region of memory a program asks for by hand when it cannot know in advance how much it needs, such as a file of unknown size. Nothing cleans it up automatically the way the stack is cleaned up, so leaks and reuse of already-freed memory live here.; Malware and Reverse Engineering
2 lessons
HIPAA: A US law from 1996 that sets rules for protecting patient health information. Its Privacy Rule covers who may see that data and its Security Rule covers how electronic copies must be protected, and both bind healthcare providers and the vendors handling data on their behalf.; Governance and Risk
3 lessons
hive: One of the top-level branches of the registry, each backed by its own file on disk. The two that matter most are HKEY_LOCAL_MACHINE (HKLM), which holds machine-wide settings, and HKEY_CURRENT_USER (HKCU), which holds settings for whoever is logged in.; Windows and Active Directory
7 lessons
HMAC: A hash of a message combined with a shared secret key, attached so the receiver can confirm the message is untouched and came from someone holding that key. A plain hash cannot do this: an attacker who rewrites the message simply recomputes the hash.; Cryptography
4 lessons
honeypot: A system left out to be attacked: valuable-looking, and holding nothing real. Any connection to it is suspicious by definition, since no legitimate user has a reason to touch it, which makes it a very quiet detection with almost no false positives.; Blue Team and Defense
2 lessons
host: Any machine attached to a network that can send or receive data. A laptop, a phone, a server, and a router are all hosts.; Networking
137 lessons
HTML: The markup that describes a web page: tags like <p> and <script> wrapped around content to say what each part is. The browser reads it and builds the page from it. Anything an app drops in unescaped becomes part of the page structure instead of text.; Web and HTTP
29 lessons
HTTP: The rules a browser and a web server follow to trade pages, images, and data. The browser sends a request describing what it wants, the server sends back a response, and the exchange ends there. Runs on port 80 by default.; Web and HTTP
70 lessons
HTTP header: A Name: value line carrying information about a request or response rather than the content itself, such as Host: example.com or Content-Type: application/json. Headers are ordinary text sent by the client, so a server that trusts one without checking it is trusting whoever sent it.; Web and HTTP
4 lessons
HTTP method: The verb at the start of a request that says what the client wants done: GET to fetch, POST to submit, PUT to replace, DELETE to remove, HEAD for headers only, OPTIONS to ask what is allowed. Some servers guard POST carefully and leave the same action wide open over GET.; Web and HTTP
4 lessons
HTTP request: The message a browser or tool sends to a web server. Its first line names a method and a path, then come the headers, then an optional body. Every attack against a web app is some version of a request the developer did not expect.; Web and HTTP
18 lessons
HTTP response: The message a web server sends back. It starts with a status code saying how it went, then headers, then usually the content itself, such as HTML or JSON.; Web and HTTP
3 lessons
HTTPS: HTTP with the traffic encrypted, so anyone sitting on the wire sees scrambled bytes instead of the page. Same requests and responses underneath, wrapped in TLS, on port 443 by default.; Web and HTTP
66 lessons
IaaS: Infrastructure as a service. A company rents out raw machines, disks, and networks by the hour, and the renter installs and runs everything on top. Amazon EC2 is the usual example: it hands over a bare Linux machine and nothing else.; Cloud and Containers
1 lesson
IAM: Identity and access management. The system in a cloud account that decides who exists and what each one is allowed to do. In cloud work, permissions are the perimeter: an attacker with the right IAM permissions does not need to break anything.; Cloud and Containers
11 lessons
IAM policy: A document listing which actions an identity may take on which resources, and whether each is allowed or denied. A policy granting the action s3:GetObject on one bucket is tight; one granting * on * is full account control.; Cloud and Containers
3 lessons
IAM role: A set of permissions nobody owns permanently. A machine, a function, or a person assumes the role and receives short-lived credentials that carry its permissions. Roles are the reason a stolen server can act as something far more powerful than itself.; Cloud and Containers
1 lesson
ICMP: The protocol networks use for status and error messages rather than carrying user data. Ping uses it to ask a host whether it is alive.; Networking
7 lessons
IDA: The Interactive Disassembler, sold by Hex-Rays, and for years the standard tool for taking programs apart. The full version with its decompiler is expensive commercial software, and a limited free build exists.; Malware and Reverse Engineering
2 lessons
identity: The record of who or what an actor is, as far as a system is concerned: a username, an employee, a script, a machine. A system only knows the identity it has been shown proof of, which is why stealing that proof is the point of most attacks.; Identity and Access
65 lessons
identity provider: The system that holds accounts and does the actual login, then vouches for the user to other applications. Okta, Microsoft Entra ID, and Google are common ones. The applications that trust it are called service providers or relying parties.; Identity and Access
5 lessons
IDOR: Insecure direct object reference. A request names a record by id, like /invoices/1041, and the server hands it over without checking whether this user owns it. Change the number, read someone else's data. It is one of the most common real bugs in web apps because nothing looks broken from the outside.; Web and HTTP
11 lessons
IDS: Intrusion detection system. Software that inspects traffic or activity and raises an alert when it matches something known to be bad. It watches and reports. It does not stop anything.; Blue Team and Defense
24 lessons
image: The frozen filesystem a container starts from, holding the application and every library it needs. Images are built in stacked layers, and a secret written into an early layer stays inside the image even if a later step deletes the file.; Cloud and Containers
IMDSv2: The hardened version of the AWS metadata service. A caller must first send a PUT request to get a short-lived token, then include that token as a header on every read. A plain GET, which is all most tricked servers can be made to send, gets nothing.; Cloud and Containers
3 lessons
impact: How much damage an event causes if it happens: money lost, hours of downtime, records exposed, customers gone. Impact is the half of risk that stays large no matter how unlikely the event is.; Governance and Risk
21 lessons
incident: A confirmed security event that needs a response: an attacker got in, data left, ransomware ran. The word marks the promotion from "an alert someone is looking at" to "we have a problem", and it usually pulls in more people.; Blue Team and Defense
46 lessons
incident response: The organized work of handling a confirmed attack: working out what happened, cutting the attacker off, cleaning up, and getting back to normal. It runs under time pressure with incomplete information, which is exactly why the steps get written down in advance.; Blue Team and Defense
7 lessons
incident response phases: The standard stages of handling an incident, as NIST lays them out: preparation, detection and analysis, containment, eradication and recovery, then post-incident review. The order is the point, because eradicating before containing lets the attacker walk straight back in.; Blue Team and Defense
inherent risk: How bad a situation would be with no protections in place at all. It is the starting number, counted before anyone credits the locks, backups, and alerts already installed.; Governance and Risk
1 lesson
initialization vector: A random starting value fed into a cipher so encrypting the same data twice produces different output. It travels in the clear beside the ciphertext, and reusing an IV with the same key leaks patterns that can unravel the messages.; Cryptography
instance metadata service: A small web server every cloud machine can reach at the address 169.254.169.254, which tells the machine about itself. It also hands out the credentials for any role attached to that machine, so anything able to make that one request can act as the server.; Cloud and Containers
1 lesson
intercepting proxy: A tool that sits between a browser and a server so every request stops there first and can be inspected or changed before it goes on. To do this over HTTPS it presents its own certificate, which is why the tester installs the proxy's CA certificate in the browser first. Validation done in the browser means nothing once one of these is in the path.; Web and HTTP
5 lessons
IOC: Indicator of compromise. A concrete artifact showing an attack touched a machine: a file hash, an IP address, a domain name, a registry key. Cheap to share and check, and cheap for the attacker to change, so a hit is a starting point rather than the whole story.; Blue Team and Defense
4 lessons
IP address: The numeric label that identifies a machine on a network, like 192.168.1.10. It answers 'which machine', the way a street address identifies a building.; Networking
27 lessons
IPS: Intrusion prevention system. It inspects the same things an IDS does, but it sits in the traffic path and can drop the connection instead of just reporting it. The tradeoff is that a wrong block breaks real work, so teams usually run it in report-only mode first.; Blue Team and Defense
26 lessons
IPv4: The older and still most common form of IP address, written as four numbers from 0 to 255 separated by dots, such as 10.0.0.5. There are about 4.3 billion of them, which is not enough, which is why IPv6 exists.; Networking
9 lessons
IPv6: The newer form of IP address, written as hexadecimal groups separated by colons, such as 2001:db8::1. It exists because the world ran out of IPv4 addresses.; Networking
7 lessons
ISO 27001: An international standard for running an information security management system: how an organization sets scope, assesses risk, picks controls, and keeps reviewing them. An accredited body can certify a company against it, and the current version is ISO/IEC 27001:2022.; Governance and Risk
1 lesson
JavaScript: The programming language browsers run. It handles clicks, fetches data in the background, and rewrites the page in place. It runs with the full privileges of whatever site served it, which is the entire reason XSS hurts.; Web and HTTP
27 lessons
JSON: A plain-text format for structured data, written as {"id": 42, "name": "ada"}. Nearly every modern API speaks it because a person can read it and a program can parse it in one line.; Web and HTTP
46 lessons
JWT: JSON Web Token. A token made of three base64 chunks separated by dots: a header, a set of statements about the user, and a signature. Those statements are encoded, not encrypted, so anyone holding the token can read what is inside it.; Identity and Access
12 lessons
Kali Linux: A Linux distribution that ships with security tools already installed. It is a convenience, not a requirement; the tools run anywhere.; Systems and Linux
2 lessons
Kerberoasting: Asking a domain controller for service tickets, which any domain user may do, then cracking them offline because each one is encrypted with the service account's password hash. It turns one weak service password into a domain account, and the cracking happens on the attacker's own hardware where nothing logs it.; Windows and Active Directory
6 lessons
Kerberos: The authentication protocol Active Directory uses by default. Instead of proving who they are to every server, a user proves it once to the domain controller and then presents time-limited tickets, which is why badly skewed clocks break Kerberos and nothing else.; Windows and Active Directory
8 lessons
key: The secret value that decides how data gets scrambled and unscrambled. The algorithm is usually public knowledge, so the key is the only thing standing between an attacker and the data.; Cryptography
key exchange: The problem of getting two parties to share one secret key while an eavesdropper watches every message they send. Solving it is what lets a browser and a server that have never met start encrypting within a fraction of a second.; Cryptography
3 lessons
keylogger: A program, or sometimes a small piece of hardware sitting inline with the keyboard, that records every keystroke. It is the cheapest way to collect passwords, since it reads them before any encryption touches them.; Malware and Reverse Engineering
kill chain: A model naming the stages of an intrusion in order, from researching the target through to acting on the objective. It is useful mainly as shared vocabulary for where you are in an attack.; Offensive Security
2 lessons
krbtgt: The hidden domain account whose password key signs every Kerberos ticket a domain controller issues. Steal its hash and tickets can be forged for anyone, which is why that one account's compromise means rebuilding trust in the whole domain.; Windows and Active Directory
1 lesson
kubelet: The agent running on each node that takes orders from the control plane and starts, stops, and watches the containers on that machine. An unauthenticated kubelet API is a direct route to running commands inside any pod on that node.; Cloud and Containers
3 lessons
Kubernetes: Software that runs containers across a fleet of machines, deciding where each one goes, restarting the dead, and wiring up their networking. Often shortened to k8s. It is a huge system with permissions of its own, so it is both the thing being defended and a target in itself.; Cloud and Containers
7 lessons
Lambda: Amazon's serverless service: upload a function, pick an event to trigger it, and it runs on demand. Each function assumes an IAM role, so a bug in a few lines of code can reach whatever that role is permitted to touch.; Cloud and Containers
7 lessons
LAN: Local area network. The small network shared by machines in one place, such as a home or an office, where hosts can reach each other directly.; Networking
14 lessons
LDAP: The protocol used to search and read a directory, listening on TCP port 389 in the clear and 636 encrypted. Any domain account can query Active Directory over LDAP and read the list of users, groups, and computers, which is why a single low-privilege login gives an attacker the whole map.; Windows and Active Directory
3 lessons
least privilege: Giving every account only the access it needs to do its job, and nothing spare. It does not stop a break-in, it limits how far the intruder gets, which is usually the difference between an incident and a disaster.; Identity and Access
7 lessons
likelihood: How probable it is that a given bad event actually happens, usually scored on a plain scale such as rare, possible, or likely. Most teams estimate it from past incidents and how easy the attack is, not from real math.; Governance and Risk
4 lessons
listening: A program's state when it has claimed a port and is waiting for connections. If nothing is listening on a port, connections to it are refused.; Networking
22 lessons
loader: A first-stage program that downloads the real malware from a server instead of carrying it. Attackers like loaders because the tiny file the victim runs looks harmless, and the actual payload can be swapped out any time without touching the victim again.; Malware and Reverse Engineering
3 lessons
log: A file or stream where software records what happened: who signed in, which file was opened, which connection was refused. Logs are the raw material of defense, because an attack nothing recorded is an attack nobody can prove.; Blue Team and Defense
155 lessons
loopback: The address 127.0.0.1, which always means 'this same machine'. A service bound only to loopback cannot be reached from any other host.; Networking
9 lessons
LSASS: Local Security Authority Subsystem Service, the process (lsass.exe) that checks logons and enforces security policy. It keeps password hashes and Kerberos tickets for signed-in users in its memory, which makes it the single most valuable target on a Windows host.; Windows and Active Directory
13 lessons
MAC address: A hardware address burned into a network interface, written as six hex pairs like 00:1a:2b:3c:4d:5e. It identifies a machine on the local network only and does not travel across routers.; Networking
9 lessons
machine code: The actual bytes a processor executes, with no names or symbols left in them. Assembly is a one-to-one readable spelling of those bytes, which is why turning one into the other is translation rather than guesswork.; Malware and Reverse Engineering
3 lessons
malware: Software written to do something the owner of the machine would never agree to: steal data, encrypt files for ransom, or hand control to someone else. The word is a category, not a technique, and it covers viruses, worms, trojans, and everything below.; Malware and Reverse Engineering
42 lessons
MD5: An old 128-bit hash function that is broken: two different files can be crafted to produce the same MD5 value, on a laptop, in seconds. It survives as a quick file checksum, and finding it used for passwords or signatures is a finding worth writing up.; Cryptography
10 lessons
memory dump: A copy of everything in a machine's RAM at one moment. It holds what never reaches the disk: encryption keys, passwords in plain text, malware that only ever ran in memory. Power the machine off and it is gone, which is why responders grab it first.; Blue Team and Defense
5 lessons
MFA: Multi-factor authentication. Requiring proof of more than one kind before a login succeeds: something known such as a password, something held such as a phone, something a person is such as a fingerprint. Stealing a password alone is then not enough.; Identity and Access
23 lessons
mimikatz: The tool, written by Benjamin Delpy, that made dumping credentials out of LSASS memory ordinary. It reads hashes and Kerberos tickets from a live machine and forges tickets, and every endpoint product on earth flags it by name, so real operators use rebuilt or renamed versions.; Windows and Active Directory
2 lessons
MITRE ATT&CK: A free public catalog of what attackers actually do once they are inside, organized into tactics (the goal, such as stealing credentials) and techniques (the specific method, such as reading passwords out of memory). Defenders use it as shared vocabulary and as a checklist of what they can and cannot currently detect.; Blue Team and Defense
5 lessons
namespace: A named partition inside a cluster that splits it into separate work areas, so one team's pods and secrets sit apart from another's. It is an organizational boundary with permissions attached, not a hard security wall: pods in different namespaces can still reach each other over the network unless something stops them.; Cloud and Containers
14 lessons
NAT: Network address translation. A router rewriting addresses so many machines on a private network can share one public address. It is why a home machine is not directly reachable from the internet by default.; Networking
10 lessons
network: A set of machines that can send each other messages. The messages travel as small labeled chunks of data, and equipment in between forwards them until they arrive.; Networking
185 lessons
NIST CSF: The Cybersecurity Framework published by the US National Institute of Standards and Technology, organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Version 2.0 landed in 2024 and added Govern. It is voluntary and free to read, which is why small teams reach for it first.; Governance and Risk
1 lesson
nmap: The standard port scanner. It sends probes to a host's ports and reports which are open, and often what software is answering.; Offensive Security
30 lessons
node: One machine in a Kubernetes cluster that actually runs containers. Nodes are where the work happens, so an attacker who reaches a node reaches every container currently on it.; Cloud and Containers
24 lessons
nonce: A number used once. Protocols mix a fresh nonce into each message so an attacker cannot record a valid message and replay it later, and reusing one usually breaks whatever it was protecting.; Cryptography
5 lessons
NT hash: The scrambled form of a Windows password, an MD4 digest of it, stored in the SAM on a workstation and in Active Directory on a domain controller. It is unsalted and fast to compute, so identical passwords produce identical hashes and cracking rigs chew through billions of guesses a second.; Windows and Active Directory
3 lessons
NTLM: The old Windows authentication protocol, still enabled almost everywhere for compatibility. The server sends a random challenge, the client answers with a value computed from the password hash, and the password itself never crosses the wire, which is exactly the flaw that makes pass-the-hash work.; Windows and Active Directory
9 lessons
OAuth 2.0: A standard for letting one application act on a user's behalf in another without ever seeing their password. The 'allow this app to read your calendar' screen is OAuth. It grants permission to act, not proof of who the user is.; Identity and Access
1 lesson
obfuscation: Deliberately making code hard to read while keeping it working: renamed functions, junk instructions, text assembled one character at a time. It does not stop an analyst, it just makes the job take hours instead of minutes.; Malware and Reverse Engineering
2 lessons
object storage: Storage that holds whole files, each with a name and its own permissions, reached over HTTP instead of mounted like a disk. It is cheap, effectively unlimited, and where most companies keep backups, logs, and uploads.; Cloud and Containers
2 lessons
OpenID Connect: A thin layer on top of OAuth 2.0 that adds proof of identity, since OAuth alone only grants permission. It is what 'Sign in with Google' actually uses, and what it returns is a signed token describing the user.; Identity and Access
1 lesson
order of volatility: The rule that evidence gets collected most-perishable-first: memory before live network connections, those before the disk, the disk before backups. Reboot a machine to check something and the most valuable evidence is already gone.; Blue Team and Defense
2 lessons
OSI model: A seven-layer map of networking, from physical wires up to applications. It is a teaching and troubleshooting vocabulary rather than a description of how any real stack is built.; Networking
3 lessons
PaaS: Platform as a service. The provider runs the machines and the operating system, and the customer supplies only application code. Less to patch, less to control.; Cloud and Containers
1 lesson
packer: A tool that compresses or encrypts a program and wraps it in a small stub that unpacks it back into memory at launch. It started as a way to shrink files and became a way to make malware unrecognizable to scanners, since the code sitting on disk looks like noise.; Malware and Reverse Engineering
3 lessons
packet: A small chunk of data with labels attached saying where it came from and where it is going. Data is chopped into packets because sending one giant block would hog the line and cannot be re-sent cheaply if it is damaged.; Networking
41 lessons
padding: Extra bytes added to data so it fills a whole cipher block, following a scheme that says how to strip them off again. It sounds like bookkeeping, but a server that reveals whether padding was valid can be pushed into decrypting messages for an attacker.; Cryptography
7 lessons
parameter: One named piece of input a request carries, like id=42. Parameters ride in the query string, in the request body, in cookies, and in headers, and every one of them is a spot where a server might trust data it should not.; Web and HTTP
44 lessons
pass-the-hash: Authenticating as a user with their NT hash instead of their password, because NTLM only ever asks for a value derived from the hash. Cracking is unnecessary: the hash itself is the credential, which is why dumping hashes is as good as stealing passwords.; Windows and Active Directory
6 lessons
pass-the-ticket: The Kerberos version of pass-the-hash: lift a live ticket out of a machine's memory and replay it from somewhere else. The ticket is proof on its own, so the thief becomes its owner until it expires, typically after about ten hours.; Windows and Active Directory
password: A secret string a person memorizes and types to prove who they are. It is the weakest common credential because people reuse it, pick guessable ones, and can be tricked into typing it into the wrong box.; Identity and Access
132 lessons
password hash: A scrambled version of a password, produced by a one-way function so the original cannot be worked back out. Systems store the hash instead of the password so a stolen database does not hand over everyone's login directly.; Identity and Access
8 lessons
path traversal: An app builds a file path out of user input, so input like ../../../../etc/passwd climbs out of the intended folder and reads files elsewhere on the server. The ../ means 'go up one directory', repeated until it hits the top.; Web and HTTP
3 lessons
payload: The actual data a packet carries, as opposed to the labels wrapped around it. In an attack context the word also means the code an exploit delivers.; Networking
74 lessons
PCI DSS: The Payment Card Industry Data Security Standard, the rules any organization must follow if it stores, processes, or transmits payment card data. It comes from the card brands rather than a government, so failing it means fines and losing the ability to take cards.; Governance and Risk
5 lessons
persistence: Anything malware does to survive a reboot: a scheduled task, a service, a registry entry, a line in a startup file. Without it an infection dies the next time the machine is turned off, so this is one of the first things an attacker sets up.; Malware and Reverse Engineering
19 lessons
PKI: Public key infrastructure: the machinery around keys, meaning who issues certificates, who trusts whom, and how a stolen key gets revoked. The math is the easy part. PKI is the part that fails in practice.; Cryptography
4 lessons
plaintext: The readable data before encryption, or after it has been decrypted. The word does not mean text specifically: an image or a database file is plaintext until it is encrypted.; Cryptography
33 lessons
playbook: A written procedure for one specific kind of incident, step by step: who to call, what to collect, what to shut off, in what order. It exists because judgment gets worse at 3 a.m. with an executive standing behind the desk.; Blue Team and Defense
4 lessons
pod: The smallest thing Kubernetes will run: one or more containers scheduled together on the same node, sharing an IP address and storage. Kubernetes never manages a container directly, only the pod wrapped around it.; Cloud and Containers
7 lessons
policy: A short, high-level document saying what the organization requires and why, signed off by leadership. A policy states the rule, for example that every company laptop must have its disk encrypted, and skips products and steps on purpose so it does not go stale.; Governance and Risk
46 lessons
port: A number from 0 to 65535 that identifies one specific service on a machine. The IP address picks the machine; the port picks which program on it should get the data.; Networking
77 lessons
port scanning: Probing a host's ports to learn which ones have something listening. It is usually the first useful thing done to a target, because you cannot attack a service you do not know exists.; Offensive Security
6 lessons
POST: The method that sends data to a server to be acted on, such as a login form or a new comment. The data rides in the request body rather than the URL, so it stays out of logs and history.; Web and HTTP
39 lessons
post-incident review: The session after an incident is closed where the team records what happened, what worked, and what changes. Done properly it is blameless: the goal is fixing the system that let the attack succeed, not finding a person to punish.; Blue Team and Defense
PowerShell: The modern Windows shell. Unlike cmd or bash it passes real objects between commands instead of lines of text, so `Get-Process | Where-Object CPU -gt 10` filters on an actual number rather than by chopping up a string.; Windows and Active Directory
29 lessons
preventive control: A control that stops the bad thing from happening in the first place, such as a locked door, a firewall rule, or requiring two people to approve a payment. Prevention is the cheapest kind when it works and useless once the event is already underway.; Governance and Risk
private key: The half of an asymmetric key pair that never leaves its owner. It decrypts what the public key encrypted and produces signatures nobody else can forge, so stealing one is usually game over for that identity.; Cryptography
18 lessons
privilege escalation: Turning the limited access already obtained into more of it. Local escalation goes from an ordinary account to SYSTEM on the same machine; domain escalation goes from one machine's user to control of the whole domain.; Windows and Active Directory
11 lessons
privileged container: A container started with its safety fences dropped, giving it near-total access to the host's devices and kernel. It is one flag in a config file, teams set it to make something work, and it turns an escape from a real exploit into a couple of commands.; Cloud and Containers
1 lesson
procedure: The numbered steps someone follows to actually do the thing, written so a new hire can run them without asking. Policy says what, standard says how strong, procedure says click here and then here.; Governance and Risk
4 lessons
process: One running program, with its own memory and its own number, the PID. Windows lists them in Task Manager, and the command `tasklist` prints the same set as text.; Windows and Active Directory
protocol: An agreed set of rules for a conversation: what each side may say, in what order, and what each message means. Both sides must follow the same one or neither is understood.; Networking
42 lessons
public key: Half of an asymmetric key pair, meant to be handed out to anyone. People use it to encrypt messages that only the matching private key can open, and to check signatures made by that private key.; Cryptography
9 lessons
query string: Everything after the ? in a URL, written as name=value pairs joined by &, such as ?sort=price&page=2. It carries input to the server, which makes it the first place an attacker tries changing values to see what breaks.; Web and HTTP
8 lessons
rainbow table: A precomputed lookup from hash values back to the passwords that made them, which turns cracking into a search instead of a computation. A salt kills the whole approach, since the attacker would need a separate table for every salt value.; Cryptography
4 lessons
ransomware: Malware that encrypts a victim's files and demands payment for the key to unscramble them. Modern crews also copy the files out first and threaten to publish them, so restoring from backup no longer ends the problem.; Malware and Reverse Engineering
11 lessons
RBAC: Role-based access control. Permissions are attached to named roles, and identities get a role rather than a hand-written list of rights. It is how Kubernetes decides who may read secrets, create pods, or delete a namespace.; Cloud and Containers
6 lessons
recovery: Putting systems back into normal service after an incident and watching them closely to be sure the attacker is really gone. It often means rebuilding a machine from a known-good image rather than trusting one that was owned.; Blue Team and Defense
9 lessons
redirect: A response, usually 301 or 302, telling the browser to go somewhere else, with the new address in a Location header. If an app builds that address out of user input without checking it, it will happily send visitors to an attacker's site.; Web and HTTP
22 lessons
reflected XSS: The kind of XSS where the malicious input rides in the request and comes straight back in that same response, typically from a search box echoing the query. Nothing is stored, so it needs a victim to click a crafted link.; Web and HTTP
2 lessons
refresh token: A long-lived token whose only job is getting fresh access tokens without making the user log in again. It is worth far more to an attacker than an access token, so it gets stored more carefully and is usually revocable.; Identity and Access
1 lesson
region: A geographic area where a cloud provider runs data centers, named like us-east-1 or eu-west-2. Resources in one region are separate from another region, so an account can hold machines in Ohio that are invisible to someone only looking at Ireland.; Cloud and Containers
26 lessons
register: A tiny storage slot inside the processor itself, holding a value while the processor works on it. There are only a handful, they are far faster than memory, and on 64-bit Intel and AMD chips they carry names like RAX, RSP, and RIP.; Malware and Reverse Engineering
28 lessons
registry: The tree of settings Windows and its programs read from, in place of the config files a Linux host keeps in /etc. Keys are folders and values are the settings inside them, browsed with regedit or read from a command line with `reg query`.; Windows and Active Directory
31 lessons
registry: A server that stores and hands out container images, such as Docker Hub. A registry left open lets anyone pull a company's private images and read the source, config, and credentials baked into them.; Cloud and Containers
request body: The chunk of data that comes after the headers in a request, used by methods like POST and PUT. Form fields and JSON documents travel here. It is invisible in the URL bar, which fools people into thinking it is protected.; Web and HTTP
12 lessons
residual risk: What is left over once the protections are applied. It never reaches zero, so the real question is whether the leftover is small enough that the organization agrees to live with it.; Governance and Risk
1 lesson
REST: A common style for building web APIs where each URL names a thing and the HTTP method says what to do with it: GET /users/42 reads that user, DELETE /users/42 removes them. Predictable by design, which also makes the URLs easy for an attacker to guess.; Web and HTTP
138 lessons
reverse engineering: Working out what a program does when nobody will hand over the source code. For malware that means reading the compiled instructions, watching the program run, and rebuilding its logic from the outside in.; Malware and Reverse Engineering
4 lessons
reverse proxy: A server that sits in front of other servers, takes requests from the internet, and passes them on to whichever machine should handle them. It hides the real servers, handles TLS, and spreads load. It also means the app behind it sees the proxy's address instead of the client's, unless a header carries the real one.; Web and HTTP
4 lessons
risk: The chance that something bad happens combined with how much it would hurt if it did. A weakness nobody can reach, in a system nobody depends on, is a low risk even though it is real.; Governance and Risk
69 lessons
risk appetite: How much risk an organization has decided in advance it will accept in exchange for getting work done. Writing it down settles arguments early, and a bank and a two-person startup draw that line in very different places.; Governance and Risk
risk assessment: The exercise of listing what could go wrong, estimating how likely each one is and how bad it would be, then ranking the list. The output is an ordered list of problems to work through, not a pass or fail verdict.; Governance and Risk
2 lessons
root: The all-powerful administrative account on a Unix or Linux system. Root can read, change, or delete anything, which is why gaining it is usually the goal of an attack.; Systems and Linux
69 lessons
rootkit: Malware that hides itself by tampering with the operating system, so a process list or a file listing simply never mentions it. The deepest ones live in the kernel, the core of the OS, which means the tools asking the questions are the ones being lied to.; Malware and Reverse Engineering
2 lessons
router: Equipment that forwards packets between different networks, choosing where to send each one next based on its destination address.; Networking
25 lessons
RPO: Recovery point objective. The most recent data the organization can afford to lose, measured in time. A one-hour RPO means backups run at least hourly, because everything newer than the last backup is gone.; Governance and Risk
RSA: The classic asymmetric algorithm, built on the fact that multiplying two huge prime numbers is easy while splitting the result back apart is not. It shows up in certificates and SSH keys, though newer elliptic-curve algorithms are replacing it because they get the same strength from much smaller keys.; Cryptography
6 lessons
RTO: Recovery time objective. The longest a system is allowed to stay down before the damage is unacceptable, so a four-hour RTO means the team has four hours to get it back.; Governance and Risk
S3 bucket: A named container for files in Amazon's object storage service. Buckets are private by default, but a misconfigured one serves its contents to anyone who knows the URL, which is how customer databases keep turning up on the open web.; Cloud and Containers
9 lessons
SaaS: Software as a service. Finished software someone else hosts and the customer just logs into, such as Gmail or Salesforce. The customer controls their accounts and their data, and nothing below that.; Cloud and Containers
7 lessons
salt: A random value stored next to a password and mixed in before hashing, so two people who picked the same password end up with different stored hashes. It does not need to be secret. It exists to make precomputed attack tables useless.; Cryptography
6 lessons
SAM: Security Account Manager, the database holding the local accounts of one Windows machine and their password hashes. It lives in C:\Windows\System32\config\SAM and is locked while Windows runs, so attackers copy it from a shadow copy or dump it out of memory instead.; Windows and Active Directory
10 lessons
same-origin policy: The browser rule that a script from one site cannot read data belonging to another site. Origin means the scheme, host, and port together, so https://a.example.com and https://b.example.com count as different origins. Without this rule any page could quietly read your mail.; Web and HTTP
1 lesson
SAML: An older single sign-on standard where the login provider hands the application a signed XML document saying who the user is. It is common in corporate apps, and the signature checking is where the bugs usually live.; Identity and Access
1 lesson
sandbox: A locked-down throwaway machine, usually a virtual one, where a suspicious file can be run and recorded without risking anything real. Good sandboxes are cut off from the network and reset to a clean snapshot after every sample.; Malware and Reverse Engineering
17 lessons
scope: The specific list of things an OAuth permission covers, such as read a calendar but not delete from it. An app asking for wider scopes than its job needs is a red flag, and a token with wide scopes is a bigger prize when stolen.; Identity and Access
116 lessons
secret: A Kubernetes object for holding passwords, tokens, and keys apart from application code. The name oversells it: by default a secret is only base64 encoded, which is an encoding anyone can reverse, not encryption.; Cloud and Containers
75 lessons
security group: A firewall attached to a cloud machine or service rather than to a network boundary. In AWS it holds allow rules only, and it is stateful, meaning a reply to an allowed request gets back out without its own rule. A group opening port 22 to 0.0.0.0/0 exposes SSH to the entire internet.; Cloud and Containers
6 lessons
separation of duties: Splitting a sensitive action so no single person can finish it alone, such as one person requesting a payment and a second approving it. Fraud and quiet mistakes then need a conspiracy rather than one bad day.; Identity and Access
server: The side of a conversation that listens and answers. The word means both the software that answers and the machine it runs on.; Networking
162 lessons
serverless: A model where code runs only when something triggers it and the provider handles every machine underneath. Servers still exist, the customer just never touches them. The trade is that permissions and the code itself become nearly the whole attack surface.; Cloud and Containers
service account: An identity meant for software rather than a person, used by a pod to call the cluster's API. Kubernetes mounts its token straight into the pod's filesystem, so anything that can read files inside that pod inherits whatever the account is allowed to do.; Cloud and Containers
26 lessons
service ticket: The ticket a user trades their TGT for when they want to reach one specific service, such as a file share on one named server. Also called a TGS. The target server checks the ticket's signature and never talks to the domain controller to do it.; Windows and Active Directory
2 lessons
session: The server's memory of one logged-in user across many requests. HTTP forgets everything between requests, so the server keeps the state on its own side and hands the browser an identifier that points at it.; Web and HTTP
session hijacking: Stealing a live session id or token and using it to act as that user, skipping the password entirely. MFA does not help here, because the login already happened before the theft.; Identity and Access
session ID: The random string that identifies one user's session, usually carried in a cookie. It has to be long and unpredictable, because anyone holding a valid one is treated as that user until it expires.; Web and HTTP
6 lessons
SHA: A family of hash functions published by NIST. SHA-1 is broken and being retired, SHA-256 and SHA-512 are the current workhorses, and SHA-3 is a newer design built on different math in case the others fall.; Cryptography
12 lessons
share: A folder on one machine that other machines can open across the network, reached by a path like \\fileserver01\finance. Windows also creates hidden administrative shares named C$ and ADMIN$ that only administrators can open, and reaching those remotely is as good as a shell.; Windows and Active Directory
109 lessons
shared responsibility model: The split of security work between a cloud provider and its customer. The provider secures the buildings, hardware, and the software that runs the cloud itself; the customer secures what they put on it, including their accounts, permissions, and data. Most cloud breaches land on the customer half.; Cloud and Containers
1 lesson
shell: The program that reads typed commands and runs them. When people say they 'got a shell' on a machine, they mean they can run commands on it.; Systems and Linux
80 lessons
shellcode: A short, self-contained blob of processor instructions an exploit drops into a program's memory and tricks it into running. The name comes from its classic goal, opening a command shell, though it may just as easily download a file or connect back to an attacker.; Malware and Reverse Engineering
4 lessons
SID: Security identifier. The long unique string, like S-1-5-21-1004336348-1177238915-682003330-500, that Windows actually uses to identify an account or group. Names are just labels on top of it, so renaming an account changes nothing about its access.; Windows and Active Directory
4 lessons
SIEM: Security information and event management. A system that pulls logs from every machine, application, and network device into one place, then runs rules against them to raise alerts. It is the screen a SOC analyst stares at all day.; Blue Team and Defense
21 lessons
Sigma: An open format for writing detection rules in plain YAML text, tied to no particular product. A rule written once in Sigma can be converted into the query language of whichever SIEM a team runs, which is how detections get shared publicly instead of locked inside one vendor.; Blue Team and Defense
6 lessons
signature: A cryptographic stamp on a token or message that proves who issued it and that nobody edited it since. If the receiving application skips checking it, an attacker can rewrite the contents freely. That is the classic JWT flaw.; Identity and Access
49 lessons
signature detection: Matching activity against a stored pattern of something already known to be malicious, such as a byte sequence inside a file or a specific request to a web server. Fast and precise on known threats, and completely blind to anything new.; Blue Team and Defense
1 lesson
silver ticket: A forged service ticket built with a single service account's hash, granting access to that one service only. It is quieter than a golden ticket because the target server validates it alone and the domain controller never sees the request.; Windows and Active Directory
SLA: Service level agreement. A contract promise about a measurable level of service, such as 99.9 percent uptime or a one-hour response to critical tickets, usually with a credit or penalty attached when it is missed.; Governance and Risk
3 lessons
SMB: Server Message Block, the Windows protocol for file and printer sharing, on TCP port 445. It also carries authentication and remote administration traffic, which is why it turns up in almost every Windows attack path and why port 445 exposed to the internet is a five-alarm finding.; Windows and Active Directory
14 lessons
SOC: Security operations center. The team, and often the room, that watches an organization's alerts and decides which ones are real attacks. Most SOCs run in shifts, because attackers do not keep office hours.; Blue Team and Defense
23 lessons
SOC 2: A report an outside accounting firm writes about whether a service company's controls actually work, measured against criteria from the AICPA covering security, availability, processing integrity, confidentiality, and privacy. Type I checks the design on a single date, Type II watches the controls operate over a period, commonly three to twelve months. Enterprise buyers ask for it before signing.; Governance and Risk
4 lessons
socket: One end of a network conversation, identified by an IP address plus a port together, such as 10.0.0.5:443. A connection is a pair of sockets talking.; Networking
23 lessons
spyware: Malware built to watch rather than to break: browsing history, screenshots, documents, camera and microphone. It is written to be boring and quiet, because a victim who notices nothing keeps producing data.; Malware and Reverse Engineering
SQL injection: An app pastes user input straight into a database query, so input like ' OR '1'='1 changes what the query means instead of being treated as a value. A working one can read every row in the database and sometimes write files or run commands. The fix is parameterized queries, not filtering quotes.; Web and HTTP
20 lessons
SSH: Secure Shell. A protocol for logging in to another machine and running commands on it over an encrypted connection. It normally listens on port 22.; Systems and Linux
29 lessons
SSO: Single sign-on. Logging in once with one provider, then reaching many separate applications without typing a password again. It cuts password sprawl, and it also means one compromised login opens every app behind it.; Identity and Access
2 lessons
SSRF: Server-side request forgery. An app fetches a URL the user supplied, so an attacker points it at addresses only the server can reach, like 127.0.0.1 or an internal admin panel. The request comes from inside the network, so the firewall never sees anything wrong.; Web and HTTP
11 lessons
SSRF to cloud takeover: Server-side request forgery is a bug where an application can be tricked into fetching a URL an attacker chooses. Point it at the metadata service and the application fetches its own machine's role credentials, then prints them back. It is the single most reliable path from one web bug to control of a cloud account.; Cloud and Containers
stack: The region of memory a program uses for local variables and for remembering where to return once a function finishes. It grows and shrinks on its own as functions are called and exit, and that return address is exactly what an attacker wants to overwrite.; Malware and Reverse Engineering
76 lessons
standard: The specific, mandatory requirement that makes a policy measurable: which tool, which setting, which minimum. If the policy says laptop disks must be encrypted, the standard names the encryption and the key length.; Governance and Risk
84 lessons
static analysis: Examining a program without running it: its instructions, its readable text, the functions it borrows from the system. It is safe, and it sees every code path, including ones that would never trigger during a single run.; Malware and Reverse Engineering
8 lessons
status code: The three-digit number that starts every response and says how it went: 200 OK, 301 moved, 401 not authenticated, 403 forbidden, 404 not found, 500 server error. Watching how the code changes as inputs change is how testers find behavior the developer never meant to expose.; Web and HTTP
16 lessons
stored XSS: The kind of XSS where the malicious input gets saved, in a comment or a profile field, and fires for everyone who later views that page. No link to send and no click to engineer, which makes it the worse of the two.; Web and HTTP
5 lessons
stream cipher: A cipher that generates a keystream and combines it with the data one byte at a time, so nothing needs padding and the output is exactly as long as the input. It suits continuous traffic like voice, and it fails badly if the same keystream is ever used twice.; Cryptography
1 lesson
strings: A command that scans a file for runs of readable text and prints them, four characters or longer by default. It is the cheapest first look at an unknown program: web addresses, file paths, and error messages often fall right out, and a sample that returns almost nothing is usually packed.; Malware and Reverse Engineering
51 lessons
subnet: A slice of a larger network, defined by which leading bits of the address all its machines share. Machines in the same subnet can talk directly; anything else goes through a router.; Networking
24 lessons
switch: Equipment that forwards data between machines inside a single local network, using hardware addresses rather than IP addresses.; Networking
55 lessons
symmetric encryption: Encryption where the same key both locks and unlocks the data, like a house key that opens the door it locked. It is fast and handles bulk data well, but both sides must already share the secret, which is the hard part.; Cryptography
2 lessons
SYN: The first message of a TCP connection, meaning 'I would like to talk'. A reply proves something is listening, which is exactly what a port scanner is looking for.; Networking
8 lessons
SYSTEM: The built-in account NT AUTHORITY\SYSTEM, which the operating system's own components run as. It outranks Administrator on the local machine, has no password to steal, and is the usual finish line for a privilege escalation on a Windows host.; Windows and Active Directory
167 lessons
TCP: A protocol that sets up a connection before sending data, then guarantees the data arrives in order and re-sends anything lost. The reliability costs speed.; Networking
40 lessons
telemetry: The stream of events a defensive tool reports about what a machine is doing: processes started, files written, connections opened. It goes wider than ordinary logs, because much of it is collected purely for detection rather than being a byproduct of normal work.; Blue Team and Defense
10 lessons
temporary credentials: Cloud keys that come with an expiry time and a session token, handed out when an identity assumes a role. They limit the damage of a leak, because a set stolen today is dead in a few hours.; Cloud and Containers
6 lessons
TGT: Ticket Granting Ticket. The master ticket a domain controller issues after a user's first successful logon, proving the user is who they claim to be. Holding one lets its owner request tickets for individual services without typing a password again.; Windows and Active Directory
2 lessons
threat: Something or someone that could cause harm: a criminal group, a careless employee, a flood, a power cut. A threat exists whether or not the organization has any weakness for it to land on.; Governance and Risk
33 lessons
threat actor: The person or group behind an attack. Naming the actor changes the defense, because a bored teenager, a competitor, and a government-funded team bring very different budgets and patience.; Governance and Risk
1 lesson
threat hunting: Searching through collected data for attackers nobody alerted on, starting from a theory instead of a notification. A hunt begins with something like "if someone were using stolen credentials, we would see sign-ins from two countries an hour apart", then goes looking. It assumes the detections missed something, because they always do.; Blue Team and Defense
3 lessons
threat intelligence: Information about who is attacking, what they want, and how they operate, gathered from other people's incidents so a team can prepare before its turn comes. It ranges from a raw list of bad IP addresses to a written report on one group's habits.; Blue Team and Defense
1 lesson
three-way handshake: The three messages TCP exchanges before any data moves: SYN, then SYN-ACK, then ACK. It is how both sides agree they can hear each other.; Networking
6 lessons
timeline analysis: Putting every timestamped artifact from an investigation into one ordered list so the attack reads front to back. It is how a sign-in at 02:14 and a file written at 02:16 turn into a story instead of two loose facts.; Blue Team and Defense
TLS: The layer that encrypts a connection so eavesdroppers see nothing useful and tampering is detectable. The client and server agree on keys first, then everything after that is scrambled. HTTPS is plain HTTP running over it.; Web and HTTP
30 lessons
TLS handshake: The opening negotiation of a secure connection: both sides agree on which algorithms to use, the server proves who it is with a certificate, and the two derive a shared key. Only after that does real data move, and it moves under fast symmetric encryption.; Cryptography
1 lesson
token: A string that stands in for a login the user already did, presented on later requests so they do not re-authenticate every time. Anyone holding it is treated as that user, which is why tokens leaking into logs, URLs, and browser storage is such a problem.; Identity and Access
84 lessons
TOTP: Time-based one-time password. The six-digit code an authenticator app shows that changes every 30 seconds. The app and the server share a secret and both compute the same code from that secret plus the current clock, so the code itself never has to travel to the phone.; Identity and Access
2 lessons
triage: The first pass over an alert: is it real, how bad is it, and does someone need to act now. Triage exists because a team gets far more alerts than it can investigate deeply, so someone has to sort fast and be right most of the time.; Blue Team and Defense
22 lessons
trojan: Malware disguised as something the person wants: a cracked game, an invoice, a fake installer. It does the promised thing often enough to avoid suspicion while doing its real job in the background.; Malware and Reverse Engineering
true positive: An alert that fired and was right: something bad really did happen. It is what every detection rule is aiming for, and the count a team reports on.; Blue Team and Defense
7 lessons
TTPs: Tactics, techniques, and procedures. The way a particular attacker works: what they go after, the methods they use, and their habits right down to file names and timing. TTPs are far harder to change than an IP address or a file hash, which makes them the more durable thing to detect on.; Blue Team and Defense
5 lessons
tuning: Adjusting a detection rule so it keeps catching the bad thing and stops firing on the harmless one, usually by excluding known-good software or narrowing the conditions. Rules that never get tuned get muted, and a muted rule catches nothing.; Blue Team and Defense
15 lessons
UAC: User Account Control, the prompt that dims the screen and asks for approval before a program does something administrative. An admin's session actually runs with a stripped-down token most of the time, and clicking that prompt is what swaps in the full one.; Windows and Active Directory
2 lessons
UDP: A protocol that sends data without setting up a connection and without checking that it arrived. Faster and leaner than TCP, and used where a late packet is worse than a lost one, such as voice calls.; Networking
15 lessons
URL: The full address of a thing on the web, like https://shop.example.com:443/products/42?sort=price. It names the protocol, the host, an optional port, a path to the resource, and an optional query string.; Web and HTTP
62 lessons
User-Agent: The request header where a browser or tool names itself, such as Mozilla/5.0 or curl/8.4.0. It is self-reported and trivially faked, and any app that logs it and prints it back into a page has handed an attacker an input.; Web and HTTP
9 lessons
virus: Malicious code that attaches itself to an existing file or program and runs when that file is opened. It needs a person to launch the host file, which is what separates it from a worm.; Malware and Reverse Engineering
VPC: Virtual private cloud. A private network a customer defines inside a provider's data centers, with its own address ranges and routing, walled off from every other customer. It is the cloud version of the office LAN.; Cloud and Containers
2 lessons
vulnerability: A flaw that lets someone make software do something it should not. A flaw only matters if it is reachable, which is why mapping comes first.; Offensive Security
37 lessons
WAF: Web application firewall. Software in front of an app that inspects requests and blocks the ones matching known attack patterns, like a parameter containing UNION SELECT. It buys time against sloppy attacks and gets bypassed routinely by encoding or rewording the same payload.; Web and HTTP
3 lessons
WAN: Wide area network. A network that connects separate local networks across distance. The internet is the largest one.; Networking
1 lesson
web server: The program that listens for HTTP requests and answers them, such as nginx, Apache, or IIS. It either serves files straight off disk or hands the request to application code. Its version banner and error pages leak useful details about what is running.; Web and HTTP
35 lessons
web shell: A small script an attacker plants on a web server that takes commands over HTTP and runs them on the host. It turns an ordinary URL into a command prompt, and it keeps working as long as the file sits there.; Web and HTTP
3 lessons
well-known ports: Ports 0 through 1023, reserved by convention for common services so clients know where to look. Port 22 is SSH, 80 is HTTP, 443 is HTTPS.; Networking
3 lessons
Windows service: A program that starts with the machine and keeps running in the background with no window, the Windows version of a daemon. Services usually run as a powerful built-in account, so a service whose files an ordinary user can overwrite is a straight path to full control of the host.; Windows and Active Directory
2 lessons
worm: Malware that copies itself to other machines on its own, with nobody clicking anything. It usually spreads by attacking a flaw in a service already listening on the network, which is why one infected host can turn into thousands overnight.; Malware and Reverse Engineering
2 lessons
write blocker: A hardware device or software driver that lets a computer read a drive while physically refusing any write to it. Without one, simply plugging in a suspect drive can let the operating system touch timestamps and quietly damage the evidence.; Blue Team and Defense
1 lesson
XDR: Extended detection and response. EDR data joined with email, cloud, identity, and network data so one alert can tell a story across all of them. The point is that a phishing email, a strange sign-in, and a new process on a laptop are one incident, not three.; Blue Team and Defense
XSS: Cross-site scripting. An app takes attacker-supplied text and drops it into a page without escaping it, so the browser runs it as code coming from that site. The injected script can read cookies, rewrite the page, and act as the logged-in user.; Web and HTTP
10 lessons
YARA: A tool and rule language for identifying files by what is inside them: text strings, byte patterns, and file size, combined with and/or logic. Malware analysts write YARA rules so they can still recognize a family of samples after the attacker recompiles and every file hash changes.; Blue Team and Defense
3 lessons
zero trust: A design approach that stops treating the internal network as safe. Every request gets authenticated and authorized on its own, no matter where it came from, because being inside the office network proves nothing about who is asking.; Identity and Access
5 lessons