8. Penetration Testing and Exercises Flashcards
Gathering Information
Penetration testing
Initial phase of penetration testing where attackers collect information about the target system.
Rules of Engagement (ROE)
Penetration testing
Formal document specifying the scope and permitted techniques for a penetration test.
White-Box, Black-Box, Grey-Box Testing
Penetration testing
Different approaches in penetration testing based on the level of knowledge the attacker has about the system.
Discovery Phase
Penetration testing
Involves active and passive reconnaissance to identify potential vulnerabilities and attack paths.
Attack Phase
Penetration testing
The stage where penetration testers attempt to gain access to the target system and escalate privileges.
Lateral Movement
Penetration testing
The process of browsing through a network to find new systems and expand the attacker’s reach.
Pivoting
Penetration testing
A technique used in penetration testing where testers leverage a compromised system to attack other systems on the same network.
Persistence
Penetration testing
The practice of installing backdoors to maintain access to a system even after vulnerabilities are patched.
Cleanup and Restoration
Penetration testing
The final phase of a penetration test, involving the removal of traces of the attack and restoring systems to their original state.
Bug bounty program
Bug bounty
A formal process that encourages security researchers to responsibly report vulnerabilities in exchange for rewards.
Controlled environment
Bug bounty
A secure setting where organizations open their systems to inspection by researchers as part of bug bounty programs.
Automated scanning tools
Bug bounty
Programs used by opportunistic attackers to search for vulnerable systems on the internet.
Channeling attacker efforts
Bug bounty
Directing the skills of attackers towards identifying and reporting vulnerabilities through bug bounty programs.
Vendor assistance
Bug bounty
Specialized vendors who help design, implement, and operate bug bounty programs for organizations.
Validating vulnerability reports
Bug bounty
The process of verifying the accuracy and severity of reported vulnerabilities in bug bounty programs.
