AAA
Authentication, authorisation and accounting: who you are, what you may do, and what you did.
Confusing the first two is common and costly. Proving identity is not the same as granting permission.
Read the lessonGlossary
Every term this course uses, defined
275 words from cybersecurity, IT and computer science. Each one gets a definition you can act on and, where the course covers it, a link to the lesson that teaches it properly.
Showing all 275 terms
A
Abstraction
Hiding detail behind a simpler interface.
Every layer of a computer is one. The skill is knowing which layer to work at rather than which to avoid.
ACL access control list
A list attached to an object saying who may do what to it.
Access control lists are precise and hard to audit at scale, which is why they are often paired with roles.
Read the lessonActive Directory AD · domain controller
The directory Microsoft domains use to hold users, groups, machines and policy.
It is the usual goal of an internal assessment, because control of the directory is control of everything joined to it.
Read the lessonAES Advanced Encryption Standard
The standard symmetric block cipher, with 128, 192 or 256 bit keys.
It is fast in hardware, which is why it is everywhere from disk encryption to TLS.
Read the lessonAir gap
Physically separating a system from every network.
It is the strongest isolation available and it still fails to removable media, which is how several famous worms crossed one.
Read the lessonAlgorithm
A finite sequence of steps that solves a problem.
It must terminate and it must be unambiguous. A procedure that might never finish is not an algorithm.
API Application Programming Interface
A defined way for one piece of software to ask another to do something.
An API is a contract. Breaking it breaks callers you have never met, which is why versions and deprecation exist.
Read the lessonAPT Advanced Persistent Threat
An advanced persistent threat: an attacker with resources who stays hidden and works slowly toward a goal.
The persistence is the defining part. They are not looking for a quick win, they are looking for a place to wait.
Read the lessonArchive tar
Several files packed into one file for storage or transfer.
An archive is not compression. tar packs, gzip squeezes, and .tar.gz does both.
Read the lessonArray
Elements stored contiguously, reached by position.
Indexing is O(1) because the address is arithmetic. Inserting in the middle is O(n) because everything after it moves.
AST abstract syntax tree
A tree representing the structure of code, with syntax stripped away.
Compilers and linters work on this rather than on text, because structure is what the rules are about.
Asymmetric encryption public key cryptography
Encryption with a key pair, where what one key locks only the other unlocks.
Slow, so it is used to exchange a symmetric key rather than to carry the data itself.
Read the lessonAtomic
An operation that cannot be observed halfway through.
If two threads both do count = count + 1, one increment can vanish. Atomic operations remove that possibility.
Attack surface
Every point where somebody could try to get in.
Removing features shrinks it. That is more reliable than defending each feature you keep.
Read the lessonAuthentication bypass
Getting in without valid credentials.
It covers everything from a default password to a logic flaw that treats a missing field as a match.
Read the lessonB
Bandwidth
How much data can move per second, as opposed to how long it takes to start.
Adding bandwidth fixes a slow download and does nothing for a laggy game, because those are different problems.
Read the lessonBanner grabbing
Reading the greeting a service sends, which often names the software and its version.
Good practice is to suppress it. Most systems do not, which makes it the cheapest finding in any test.
Read the lessonBaseline
A record of what normal looks like, taken while everything is fine.
You cannot spot the anomaly until you have written down the ordinary. That is why baselines come first.
Read the lessonBFS and DFS breadth-first search · depth-first search
Breadth-first explores level by level; depth-first follows one branch to the end.
BFS finds the shortest path in an unweighted graph. DFS is cheaper on memory and better for exhaustively walking a structure.
Big O complexity · asymptotic complexity
How the cost of an algorithm grows as the input grows.
It describes the shape of the curve, not the seconds. An O(n log n) sort beats an O(n squared) one once the list is long enough.
Binary search
Halving a sorted range until the target is found.
It is O(log n), and it only works on sorted data. Getting the boundary conditions right is the hard part.
Bind shell
A shell on the target that listens for the attacker to connect in.
Simple, and usually blocked by any firewall doing its job.
Read the lessonBlock cipher mode CBC · GCM · ECB
The rule for applying a block cipher to data longer than one block.
CBC needs padding and is easy to get wrong. GCM adds authentication, which is why it is the modern default.
Read the lessonBotnet
A collection of compromised machines controlled together.
Each one is small. Together they are the capacity behind most large denial of service attacks.
Read the lessonBroken access control
The application knows who you are and still lets you do the wrong thing.
It is the most common serious web flaw, because it is invisible to any scanner checking for syntax.
Read the lessonBrute force
Trying every possibility until one works.
It is a matter of arithmetic: the defence is length and rate limiting, not complexity rules.
Read the lessonBug bounty
A programme that pays people for reporting vulnerabilities in your systems.
It buys many pairs of eyes, and it only works if the scope and the payout rules are clear in advance.
Read the lessonBurp Suite Burp · intercepting proxy
A proxy that sits between a browser and a server so you can read and change every request.
The repeater is where most web findings come from: send the same request again with one thing altered.
Read the lessonBytecode
An intermediate form between source and machine code, run by a virtual machine.
Python compiles to bytecode and then interprets it, which is why the same source behaves identically on any platform.
C
C2 C&C · command and control
Command and control: the channel an attacker uses to give instructions to compromised machines.
It is usually designed to look like normal web traffic for exactly that reason.
Read the lessonCache
A copy of something kept close by so the next request is cheaper.
Every cache needs a rule for when it goes stale, and getting that rule wrong is a reliable source of strange bugs.
Read the lessonCapture the flag CTF
A challenge where the goal is to find a hidden string that proves you got in.
It is a safe way to practise real technique, because the environment is designed to be broken into.
Read the lessonCDN Content Delivery Network
A network of servers spread geographically that serves copies of content from somewhere near the reader.
It shortens the physical distance, which is why it helps latency far more than it helps bandwidth.
Read the lessonCertificate
A signed statement binding a public key to a name.
It is how your browser knows the key it received belongs to the site it asked for.
Read the lessonCertificate authority CA · root CA
An organisation whose signature on a certificate is trusted by browsers and systems.
Trust is delegated: your browser trusts a few roots, and those roots vouch for everything else.
Read the lessonChain of trust
The path from a server certificate up through intermediates to a root the client already trusts.
Any missing link makes the chain fail, which is the usual cause of a browser warning on a correctly configured server.
Read the lessonChecksum
A short value computed from data so you can tell whether it changed.
It catches corruption and accidental damage. It does not catch deliberate tampering unless the checksum itself is signed.
Read the lessonCIA triad
The three properties security is usually defined as protecting: confidentiality, integrity and availability.
Every control you add trades some of one for some of another, which is why "secure" without a context means nothing.
Read the lessonCipher
The algorithm that turns plaintext into ciphertext and back.
A cipher is the method, not the key. Modern ciphers are public and the key is the only secret.
Read the lessonCiphertext
The unreadable output of encryption.
Good ciphertext is indistinguishable from random without the key, which is why encrypted data does not compress.
Read the lessonClickjacking
Putting an invisible frame over a page so your clicks land on something else.
The header X-Frame-Options exists to stop a page being framed at all.
Read the lessonCollision
Two different inputs that produce the same hash.
Collisions exist for any fixed length hash. A broken hash is one where finding them is practical, as with MD5.
Read the lessonCommand injection
Getting a shell command into something that builds a command line.
A filename containing a semicolon is enough if the program passes it to a shell unquoted.
Read the lessonCompiler
A program that translates source code into something else before it runs.
It can spend time finding problems, because it sees the whole program rather than one line at a time.
Compression
Encoding data in fewer bytes by removing redundancy.
Lossless compression restores the original exactly; lossy compression does not, which is why a re-saved JPEG degrades.
Read the lessonConcurrency
Several tasks making progress without one waiting for the others to finish.
It is not the same as parallelism. Concurrency is about structure, parallelism is about doing two things at the same instant.
Container Docker
A process isolated by the kernel so it sees its own filesystem and network, without a second kernel.
Cheaper than a VM because it shares the host kernel, which is also its main security boundary.
Read the lessonContainment
Stopping an incident from spreading, before you try to remove it.
It comes before eradication for a reason. Cleaning one machine while the attacker moves to the next achieves nothing.
Read the lessonCookie flags HttpOnly · SameSite · Secure
Attributes that restrict how a browser may use a cookie.
HttpOnly hides it from JavaScript, Secure keeps it off plain HTTP, SameSite stops it being sent from other sites.
Read the lessonCORS Cross-Origin Resource Sharing
The browser rule that decides whether one origin may read a response from another.
It is enforced by the browser, not the server, so it protects users from websites rather than servers from callers.
Read the lessonCredential dumping
Extracting stored passwords or hashes from a compromised machine.
Hashes are still useful to an attacker, because some authentication protocols accept the hash itself.
Read the lessonCron crontab · cron job
The service that runs commands on a schedule.
Each user has a crontab, and a scheduled job inherits almost no environment, which is why cron jobs fail where the same command worked by hand.
Read the lessonCSP Content-Security-Policy
Content Security Policy: a header listing which sources a page may load and run from.
A good policy makes XSS much harder. A policy containing unsafe-inline mostly does not.
Read the lessonCSPRNG cryptographically secure random
A random number generator built to be unpredictable rather than merely evenly distributed.
Python has two: random for simulation and secrets for anything a person will use as a credential.
Read the lessonCSRF cross-site request forgery
Cross-site request forgery: making a logged-in user browser send a request they did not intend.
The attacker never sees the response. They only need the request to happen, which is enough for a password change or a transfer.
Read the lessonCVE Common Vulnerabilities and Exposures
A public identifier for a specific known vulnerability.
The format is CVE-year-number. Having an ID does not mean there is a patch, only that the flaw is catalogued.
Read the lessonCVSS Common Vulnerability Scoring System
A scoring system for how severe a vulnerability is, from 0 to 10.
It describes the flaw in the abstract. Whether it matters to you depends on whether you are exposed to it.
Read the lessonD
Daemon
A process that runs in the background with no terminal attached.
Usually a service waiting for something to do, which is why daemons often end in d, such as sshd or crond.
Read the lessonData structure
A way of organising data so that particular operations are cheap.
There is no best one. Each makes something fast by making something else slower.
Deadlock
Two or more tasks each waiting for something the other holds, so none can continue.
The usual cause is taking two locks in different orders in different places.
Defence in depth
Layering independent controls so one failure does not become a breach.
The layers must be independent. Two controls that both fail to the same mistake are one control.
Read the lessonDenial of service DoS · DDoS
Making a service unavailable rather than taking data from it.
Distributed denial of service uses many sources at once, so blocking one address does nothing.
Read the lessonDependency
Another piece of software that something needs in order to work.
Dependency trees are why one package install pulls in twenty, and why supply chain attacks aim at the popular ones.
Read the lessonDeserialisation flaw
Handing untrusted bytes to something that rebuilds objects from them.
Some formats can instantiate classes, so the input stops being data and becomes a way to run code.
Read the lessonDHCP
The protocol that hands a device its address, gateway and DNS servers when it joins a network.
It has no authentication, so whoever answers first can hand out a gateway of their choosing.
Read the lessonDictionary attack
Trying a list of likely passwords instead of every combination.
It works because people choose predictable words, which is why a long passphrase beats a short scramble.
Read the lessonDigest
The output of a hash function.
SHA-256 gives 32 bytes, written as 64 hex characters. That fixed length is what makes comparison easy.
Read the lessonDigital signature
A value that proves a message came from the holder of a private key, and that it has not changed.
It gives integrity and origin, not secrecy. A signed message can still be read by anyone.
Read the lessonDNS Domain Name System
The system that turns a name like example.com into an IP address.
It is a distributed hierarchy, and it is usually unencrypted, so anyone on the path can see which names you look up.
Read the lessonDynamic programming
Solving a problem by storing the answers to subproblems instead of recomputing them.
It applies when a problem has overlapping subproblems and an optimal substructure. Otherwise it is just memoisation with a grander name.
E
ECB
The simplest block cipher mode, where identical blocks encrypt identically.
It leaks the shape of the data. The famous demonstration is an encrypted image where the outline is still visible.
Read the lessonEDR endpoint detection and response
Software on endpoints that records behaviour and can act on it.
It watches what processes do rather than what files look like, which is how it catches malware that has no known signature.
Read the lessonElliptic curve ECC · ECDSA
A family of public key algorithms that reach the same strength as RSA with much shorter keys.
A 256 bit curve key is roughly a 3072 bit RSA key, which is why mobile and embedded systems prefer it.
Read the lessonEncapsulation
Keeping an object state private and reachable only through its own methods.
It lets the implementation change without breaking anything that uses it.
Encoding
Representing data in a particular form so it survives a medium that expects that form.
Base64 makes bytes safe for text channels. It hides nothing and compresses nothing.
Read the lessonEntropy
A measure of how unpredictable a value is, in bits.
A password made of predictable words has far less entropy than its length suggests, which is why length alone misleads.
Read the lessonEnumeration
Asking an identified service what it knows: users, shares, versions, configuration.
It comes after scanning. Finding the door is scanning; finding out who has a key is enumeration.
Read the lessonEnvironment variable
A named value passed into a process when it starts.
A child process inherits them, which is how PATH and configuration reach everything you run without being written into any file.
Read the lessonExfiltration exfil
Getting data out of a network once it has been taken.
Often disguised as ordinary traffic, because a large upload at three in the morning is easy to notice.
Read the lessonExit code return code · status
The number a process returns when it finishes, where zero means success.
Every other number is a failure of some kind. Scripts branch on it, which is why a command that reports errors in its output can still exit zero.
Read the lessonExploit
The technique or code that turns a vulnerability into an effect.
A vulnerability can exist for years without an exploit. Once one is public, the clock starts on patching.
Read the lessonExploit chain
Several flaws used together, where each one makes the next possible.
Most serious intrusions are chains rather than single holes, which is why fixing only the last one does not help.
Read the lessonF
False flag
Evidence planted to make an attack look like somebody else did it.
It is why attribution from a single artefact is unreliable, and why real investigations look for agreement across several.
Read the lessonFalse positive false negative
An alert about something that turns out to be harmless.
Too many and the alerts get ignored, which is how a real one gets missed. Tuning matters as much as detection.
Read the lessonFile descriptor fd
A small number a process uses to refer to an open file, socket or pipe.
Every process starts with three: 0 for input, 1 for output, 2 for errors. That is what the numbers in 2>&1 refer to.
Read the lessonFilesystem
The way an operating system organises names, directories and the data behind them.
Linux presents one tree that everything hangs off. Extra disks are mounted into that tree rather than appearing as separate drives.
Read the lessonFirewall
A filter that decides which network traffic is allowed in or out.
It enforces a policy you wrote. An open port you forgot about is a hole in the policy, not the firewall.
Read the lessonForward secrecy
A property where stealing the long term key later does not decrypt past sessions.
It works by using a fresh key exchange for every session and throwing the keys away.
Read the lessonFuzzing
Sending malformed or random input to find the cases the developer did not consider.
It finds crashes rather than logic flaws, which is still a very productive way to spend an afternoon.
Read the lessonG
Garbage collection
Reclaiming memory automatically once nothing refers to it.
It removes use-after-free bugs and adds pauses. A memory leak in a collected language means you kept a reference by accident.
Gateway default gateway
The address a machine sends traffic to when the destination is outside its own subnet.
If the gateway is wrong, local traffic still works and everything else silently fails.
Read the lessonGet out of jail free
Informal name for the letter that says the holder is authorised to be doing this.
In practice it is a signed scope document with contact numbers, because the first responder to notice you is not reading your email.
Read the lessonGlob wildcard · filename expansion
A pattern the shell expands into matching filenames before the command ever sees them.
That is why rm *.log is dangerous: the shell builds the list, so an unexpected match becomes an unexpected argument.
Read the lessonGraph
Nodes connected by edges, used for anything with relationships.
Networks, dependencies, social connections and route finding are all graphs once you stop being scared of the word.
Greedy algorithm
Taking the best option now at every step and never reconsidering.
Fast, and only correct for some problems. When it is wrong it is usually confidently wrong.
H
Hardening
Removing what you do not need so there is less to attack.
Turn off the service, close the port, delete the account. Every one of those removes a whole class of problem.
Read the lessonHard link
A second name for the same file, sharing its inode.
Deleting one name leaves the data intact under the other. Only when the last name goes does the space come back.
Read the lessonHash function
A one-way function that turns any input into a fixed length output.
The same input always gives the same digest, and finding two inputs that collide should be impractical.
Read the lessonHash table hash map · dictionary
Key and value pairs stored by the hash of the key, giving average O(1) lookup.
It is the reason dictionaries and maps are fast. Collisions are handled by chaining or by probing for another slot.
HMAC
A hash combined with a secret key, so the digest also proves who made it.
A plain hash proves the data did not change. An HMAC also proves it came from somebody holding the key.
Read the lessonHoneypot
A decoy system whose only purpose is to be attacked.
Anything that touches it is interesting by definition, because nothing legitimate has a reason to.
Read the lessonHypervisor
The layer that runs and separates virtual machines.
A type 1 hypervisor runs on bare metal; a type 2 runs as an application on an ordinary operating system.
Read the lessonI
Idempotent
An operation that gives the same result whether you run it once or five times.
It is why a retried HTTP PUT is safe and a retried POST usually is not.
IDOR insecure direct object reference · BOLA
Insecure direct object reference: changing an identifier in a URL to reach somebody else data.
It is a missing authorisation check, not a broken identifier. Randomising IDs hides it and does not fix it.
Read the lessonIDS IPS · intrusion detection
A system that watches traffic or activity and raises an alert when something looks wrong.
An IPS also blocks. Detection without a response plan is just a log nobody reads.
Read the lessonImmutability
Data that cannot be changed after it is created.
It removes a whole class of bug, because nobody can alter a value you are still holding.
Incident
An event that has actually harmed, or is actively harming, the organisation.
An alert is a suspicion. An incident is a decision somebody made after looking.
Read the lessonInjection
Any flaw where data is interpreted as instructions by whatever consumes it.
SQL, shell, LDAP and template engines all have their own version, and the fix is the same: keep data out of the code path.
Read the lessonInode
The record that holds a file metadata: its owner, permissions, size and which disk blocks belong to it.
The filename is not stored in the inode, which is why a file can have several names and still be one file.
Read the lessonInput validation
Checking that data matches what the application expects before using it.
It reduces the problem. It does not replace output encoding, because a value that is valid here can still be dangerous there.
Read the lessonInsider threat
Risk from somebody who already has legitimate access.
No firewall helps, because the access is real. The controls that matter are least privilege, logging and separation of duties.
Read the lessonInterpreter
A program that reads and executes source code directly.
It starts fast and runs slower. Python and the shell are interpreters, which is why a syntax error only appears when that line is reached.
IoC indicator of compromise
An indicator of compromise: an artefact that suggests a system has been breached.
A strange file hash, an unexpected outbound connection, a new scheduled task. Indicators are evidence, not proof.
Read the lessonIP address
The number that identifies a machine on a network.
IPv4 is 32 bits, written as four numbers. IPv6 is 128 bits, written as eight groups of hex.
Read the lessonISO 27001
An international standard for running an information security management system.
It certifies that you have a process for managing risk, not that your systems are secure.
Read the lessonIV initialisation vector
Initialisation vector: the starting value that makes the same plaintext encrypt differently each time.
It does not need to be secret, but it must be unique. A fixed IV is a common and serious mistake.
Read the lessonJ
JIT just in time
Compiling hot code to machine code while the program runs.
It gets compiled speed with interpreted flexibility, at the cost of warm-up time and much more complexity.
JSON
A text format for structured data, made of objects, arrays, strings, numbers and booleans.
It is the default for web APIs because it is easy for machines to parse and for people to read.
Read the lessonJWT JSON Web Token
A signed token carrying claims about a user, usually in a request header.
It is signed, not encrypted, so anyone can read it. Putting something secret in the payload is a common mistake.
Read the lessonK
KDF PBKDF2 · bcrypt · Argon2 · key derivation
A key derivation function: something that turns a weak secret into a strong key, deliberately slowly.
bcrypt, scrypt and Argon2 are the password ones. Being slow is the feature, not a flaw.
Read the lessonKerberos Kerberoasting · ticket
A ticket based authentication protocol, and the default in Windows domains.
You prove identity once and receive a ticket, which other services accept. Stealing the ticket instead of the password is why Kerberoasting exists.
Read the lessonKernel
The core of an operating system, the part that talks to hardware and decides who gets the CPU.
Everything else, including the shell, is an ordinary program asking the kernel for favours through system calls.
Read the lessonKey exchange Diffie-Hellman
Two parties agreeing on a shared secret over a channel somebody may be listening to.
Diffie-Hellman is the classic method: both sides derive the same value without ever sending it.
Read the lessonKill chain
A model of an intrusion as a sequence of stages, from recon to exfiltration.
Breaking any one link stops the attack, which is why defence in depth maps neatly onto it.
Read the lessonL
Latency
The delay before a response starts arriving.
Latency is distance and round trips, not size. A small request across an ocean is slower than a large one next door.
Read the lessonLateral movement
Moving from one compromised machine to another inside the same network.
One laptop is rarely the goal. It is a place to stand while looking for the server that matters.
Read the lessonLDAP directory service
A protocol for reading and writing a directory of users, groups and machines.
It is how most organisations store identity, and an anonymous bind that returns more than it should is a classic finding.
Read the lessonLeast privilege
Giving each person and each process only the rights it needs to do its job.
It does not prevent a compromise. It limits what the compromise is worth.
Read the lessonLFI RFI · file inclusion
Local file inclusion: making the application load a file that already exists on the server.
It becomes serious when combined with something that can write a file, because then inclusion becomes execution.
Read the lessonLinked list
Elements scattered in memory, each holding a pointer to the next.
Insertion is cheap and indexing is expensive, which is the exact trade the array makes the other way round.
Load balancer
A server that spreads incoming requests across several backends.
It also terminates TLS and hides which machine actually answered, which changes what your logs can tell you.
Read the lessonLOLBin living off the land
A legitimate system binary abused to do something it was not meant for.
Because the binary is signed and expected, allow-listing tools often miss it entirely.
Read the lessonM
Malware
Software written to do something the owner of the machine would not agree to.
The category covers viruses, worms, trojans, ransomware, rootkits and spyware, which behave very differently.
Read the lessonMan in the middle MITM · on-path attack
An attacker positioned between two parties who can read and change what passes.
TLS exists to make this detectable. Without certificate checking, it is not.
Read the lessonMan page
The reference documentation installed with a command, read with man.
It is authoritative and offline, and it is usually faster than searching for the answer.
Read the lessonMemory leak
Memory that is still held after it is no longer needed.
In a long-running process a small leak becomes an outage, which is why the graph over days matters more than the number now.
Metasploit
A framework that packages exploits, payloads and post-exploitation steps together.
It makes known flaws easy to use, which is exactly why keeping software patched matters more than any tool.
Read the lessonMFA 2FA · multi-factor authentication
Requiring more than one kind of evidence to log in.
Kinds matter: two passwords are one factor twice. A password plus a code from another device is two.
Read the lessonMITRE ATT&CK ATT&CK
A public catalogue of real attacker techniques, each with an identifier.
It gives defenders a shared vocabulary, so a report can say which technique was seen rather than describing it from scratch.
Read the lessonMount
Attaching a filesystem at a directory so its contents appear inside the main tree.
Unmounting before removing a device is what stops writes being lost in the buffer.
Read the lessonMutex lock
A lock that only one task may hold at a time.
It protects shared state. A mutex held too long turns a fast program into a queue.
N
NAT Network Address Translation
Rewriting addresses as traffic passes a router, so many devices share one public address.
It is why a home network works with one IP, and why inbound connections need port forwarding.
Read the lessonNetcat nc
A tool that reads and writes raw network connections, useful for almost everything.
It is the swiss army knife of the field: banner grabbing, file transfer, and a listening shell in one binary.
Read the lessonNIST
The United States standards body whose security publications are used well beyond the US.
Its cryptography standards are the reason AES and SHA-256 are the defaults everywhere.
Read the lessonNmap
The standard port scanner, with service detection and scripting built in.
The flags matter more than the tool. Scanning without permission is the difference between a test and an offence.
Read the lessonNonce
A number used once, to stop a message being replayed or a key being reused.
Reusing a nonce with the same key in some modes leaks the plaintext outright, which is how WEP fell.
Read the lessonNTP Network Time Protocol · clock skew
The protocol that keeps clocks synchronised across machines.
Time is a security control. Certificates expire by it, logs are ordered by it, and a skew of minutes breaks both.
Read the lessonO
O(1)
Constant time: the cost does not change with input size.
Reading an array element by index is O(1). Looking something up in a hash table is O(1) on average.
OAuth OAuth 2.0 · OIDC · OpenID Connect
A protocol that lets an application act on your behalf without ever seeing your password.
It grants access, it does not prove identity. OpenID Connect is the layer on top that adds the identity part.
Read the lessonO(log n)
Logarithmic: doubling the input adds one step.
Binary search is the canonical example, and it is why sorted data is worth the trouble of sorting.
O(n)
Linear: the cost grows in step with the input.
One pass over a list is linear. Two passes are still linear, because constants drop out of the notation.
O(n squared)
Quadratic: doubling the input quadruples the cost.
A nested loop over the same list is the usual cause. It is fine for a hundred items and fatal for a million.
OSINT open source intelligence
Intelligence gathered from public sources: registrations, job adverts, code, social media.
It leaves no trace on the target at all, which is why it comes first in any assessment.
Read the lessonOutput encoding
Escaping data for the exact place it is about to appear.
HTML, an attribute, a URL and a JavaScript string each need different escaping. One function for all four is the bug.
Read the lessonOWASP
A foundation that publishes widely used guidance on application security, including a periodic top ten of web risks.
The top ten is awareness material rather than a checklist, and it is not a standard you can be certified against.
Read the lessonP
Package manager apt · pkg · dnf
The tool that installs, upgrades and removes software along with its dependencies.
On Termux it is pkg, which wraps apt. Installing from a repository you have not trusted is the same risk as running a script you have not read.
Read the lessonPadding oracle
An attack that uses the difference between two error messages to decrypt data without the key.
It is why decrypt failures should look identical from outside, however different they are inside.
Read the lessonPartition
A slice of a physical disk that the system treats as its own device.
Partitions divide the disk; filesystems organise what goes inside one.
Read the lessonPass the hash
Authenticating with a stolen password hash without ever cracking it.
It is why a hash leak is treated as a password leak, and why the two should not be compared casually.
Read the lessonPatch
An update that fixes a defect, often a security one.
The gap between a patch being published and being applied is the window most attackers actually use.
Read the lessonPATH
The list of directories the shell searches, in order, to find a command.
If a directory earlier in PATH holds a fake ls, that is what runs. It is a quiet way to hijack a command.
Read the lessonPath traversal directory traversal
Using ../ in a path to reach a file outside the directory the application meant to serve.
The defence is resolving the final path and checking it is still inside the allowed directory, not filtering the text.
Read the lessonPayload
The part of an exploit that does what the attacker wants once the flaw is triggered.
The exploit opens the door; the payload decides what happens after. A reverse shell is the common one.
Read the lessonPenetration test pentest
An authorised attempt to break into a system, with a report at the end.
The report is the product. An unrecorded finding helps nobody once the tester leaves.
Read the lessonPepper
A secret value added to every password before hashing, kept apart from the database.
A leaked database is then not enough on its own, which is the whole point of keeping it elsewhere.
Read the lessonPermission bits file mode · chmod
Nine flags on every file saying who may read, write or execute it.
They come in three sets, for the owner, the group and everybody else, which is why 755 and 644 are so common.
Read the lessonPersistence
Whatever an attacker leaves behind so access survives a reboot.
A cron job, a systemd unit, a modified shell profile. Finding persistence is often more useful than finding the process.
Read the lessonPhishing spear phishing · smishing · vishing
A message pretending to be from somebody you trust, designed to make you act.
It targets the person rather than the system, so no patch fixes it. Spear phishing is the same thing aimed at one individual.
Read the lessonPID process id
Process identifier, the number the kernel uses to name a running process.
PID 1 is the first process the kernel starts, and on most systems it is what adopts every orphan.
Read the lessonPipe
A connection that sends one program output straight into another program input.
The shell sets it up, so neither program knows the other exists. That is why small single-purpose tools combine so well.
Read the lessonPivot
Using one compromised host to reach networks you cannot see from where you started.
It is how a single foothold becomes access to an internal segment that was never exposed.
Read the lessonPKI Public Key Infrastructure
The whole apparatus of keys, certificates, authorities and revocation around public key cryptography.
It is the part of cryptography that is mostly policy and paperwork rather than mathematics.
Read the lessonPlaintext
The readable form of a message, before encryption and after decryption.
The same word describes the input to a hash, where there is no key and no way back.
Read the lessonPointer reference
A value holding a memory address.
It is what makes C fast and what makes C dangerous. Most later languages hide it behind a reference and a check.
Polymorphism
One interface, several implementations, chosen by the value it is called on.
It is what lets you write a loop over shapes without asking what kind of shape each one is.
Port
A number that says which service on a machine a connection is for.
One address can host many services at once because each listens on its own port. 22 is SSH, 443 is HTTPS, 80 is HTTP.
Read the lessonPost-mortem
The review after an incident that asks how it happened rather than who to blame.
A blameless post-mortem gets honest answers. A blaming one gets a shorter report and the same failure next year.
Read the lessonPrivate key
The half of a key pair that must never leave your control.
It is the whole of your identity in that system. A leaked private key cannot be revoked in the way a password can be reset.
Read the lessonPrivilege boundary
Any line where crossing it means gaining more rights.
User to root, container to host, one tenant to another. Each boundary is where a finding is worth reporting.
Read the lessonPrivilege escalation privesc
Gaining more rights than you were given, usually from a normal user to root.
Vertical escalation gains a higher level. Horizontal escalation gains another user at the same level.
Read the lessonProcess
A running program, with its own memory and its own identity number.
The same program can be several processes at once, each independent of the others.
Read the lessonProof of concept PoC
The smallest thing that demonstrates a finding is real.
A screenshot of a shell is more persuasive than a paragraph, and a reproducible command is better than both.
Read the lessonProtocol
An agreed format for two systems to exchange information.
Protocols are what let software written by strangers decades apart still talk to each other.
Read the lessonProxy
A server that makes a request on your behalf and returns the answer.
A forward proxy hides the client. A reverse proxy hides the server, which is what most load balancers are.
Read the lessonPublic key
The half of a key pair you may hand out freely.
Anyone can use it to encrypt to you or to check your signature. It cannot do the reverse.
Read the lessonPure function
A function whose output depends only on its arguments, and which changes nothing outside itself.
Pure functions are trivially testable and safe to run in parallel, which is why functional style keeps spreading.
Q
Queue FIFO
First in, first out.
Anything that must be handled in arrival order uses one: print jobs, message brokers, request buffers.
R
Race condition
A bug where the result depends on the order two things happen to run.
It hides in testing because the bad ordering is rare, and it appears in production under load.
RAID
Combining several disks so that one can fail without losing the data.
It is redundancy, not backup. Deleting a file deletes it from every disk in the array at once.
Read the lessonRainbow table
A precomputed table of hashes for common passwords.
Salting defeats it completely, which is why every password store should salt.
Read the lessonRansomware
Malware that encrypts your files and sells you the key.
Modern versions steal the data first, so restoring from backup no longer removes the blackmail.
Read the lessonRate limiting
Capping how often somebody may do something in a period.
It is what turns a brute force from minutes into years, and it costs almost nothing to add.
Read the lessonRBAC role based access control
Granting permissions to roles rather than to individuals.
People change jobs. Roles change less, and the access follows the role rather than the person.
Read the lessonRCE remote code execution
Remote code execution: running your own code on somebody else server.
It is the highest severity class in practice, because it usually ends the assessment.
Read the lessonReconnaissance recon · footprinting
Gathering information about a target before touching it.
Passive recon reads what is already public. Active recon sends traffic, which can be noticed.
Read the lessonRecursion
A function that calls itself on a smaller version of the problem.
It needs a base case that stops it. Every recursive solution has an iterative equivalent, and sometimes the loop is clearer.
Redirection
Sending a process output to a file, or a file into a process input.
A single > truncates the file and >> appends. Truncating the wrong file is a fast way to lose data.
Read the lessonRed team blue team · purple team
The attackers in an exercise, whose job is to find a way in.
A blue team defends, and a purple team makes sure the lessons actually reach the defenders.
Read the lessonRefactoring
Changing the structure of code without changing what it does.
The "without changing what it does" is the whole definition. Without tests you are only hoping.
Repository repo
A server holding packages and the index that describes them.
Adding a repository adds its owner to the set of people who can run code on your machine.
Read the lessonResponsible disclosure
Telling the owner about a flaw privately, and giving them time to fix it before you publish.
The alternative is selling it or publishing it, and both make the flaw worse for everyone who uses the software.
Read the lessonREST
A style of API built around resources addressed by URL and acted on with HTTP verbs.
GET reads, POST creates, PUT replaces, DELETE removes. The style is a set of constraints, not a standard.
Read the lessonReverse shell
A shell on the target that connects out to the attacker.
It beats a bind shell because outbound traffic is usually allowed while inbound is blocked.
Read the lessonRisk
The chance of harm multiplied by how bad the harm would be.
Risk is what you actually manage. You cannot remove all threats, so you decide which risks are worth the cost of reducing.
Read the lessonRoot superuser · uid 0
The account with every permission, and the top of the directory tree.
The word does both jobs, which confuses people. / is the root directory; root is the user.
Read the lessonRootkit
Software that hides its own presence, and often other malware, from the system it lives in.
A rootkit inside the kernel can lie to every tool you would use to find it, which is why detection may need a clean boot.
Read the lessonRSA
A public key algorithm whose security rests on how hard it is to factor large numbers.
Keys need to be long to stay safe, which makes it slow. It is mostly used for signatures and key exchange now.
Read the lessonRules of engagement
The written agreement on what a test may touch, when, and how.
Without it, the same actions stop being a test and become a crime, whatever the intent was.
Read the lessonS
Salt
Random data added to a password before hashing, stored alongside the result.
It makes precomputed tables useless, because the same password now hashes differently for every user.
Read the lessonSame-origin policy
The rule that a page from one origin cannot read data from another.
Origin means scheme, host and port together. A different port is a different origin.
Read the lessonSAML
An older XML based standard for single sign-on between an organisation and a service.
It is still everywhere in enterprise software. Signature validation mistakes in SAML implementations are a recurring source of bypasses.
Read the lessonSandbox
An isolated environment where code can run without reaching anything that matters.
It converts "will this file harm me" into "what does it try to do", which is a much easier question.
Read the lessonScanning
Probing a host or range to find which ports answer.
An open port is a service, and a service is a version, and a version is a list of known flaws.
Read the lessonScope
The exact set of systems a test is permitted to touch.
Anything outside it is out of bounds even if it is obviously related, and touching it ends the engagement.
Read the lessonSecurity header
A response header that tells the browser to behave more carefully.
Content-Security-Policy is the strongest and the hardest to write, because it requires knowing every source a page needs.
Read the lessonSemaphore
A counter that limits how many tasks may enter a section at once.
A mutex is a semaphore with a limit of one. A semaphore with a limit of four is how you cap concurrent requests.
Serialisation serialization · marshalling
Turning an in-memory structure into bytes that can be stored or sent.
Deserialising untrusted input is a classic vulnerability, because some formats can construct objects, not just data.
Read the lessonSession
The server-side record that you are logged in, identified by a cookie.
The cookie is only a reference. The trust lives on the server, which is why stealing the cookie is as good as stealing the login.
Read the lessonShadow IT
Systems and services people use without the organisation knowing.
It is usually well intentioned and it is always outside your patching, your logging and your backups.
Read the lessonShebang hashbang
The first line of a script, starting with #!, that names the interpreter to run it.
The kernel reads it, not the shell. That is why a script without one may run in the wrong interpreter when invoked directly.
Read the lessonShell bash · zsh · sh
A program that reads the commands you type and asks the kernel to carry them out.
Bash is the usual one on Linux and Termux. It is not the terminal, which is only the window the shell runs inside.
Read the lessonShellcode
Machine instructions written to be injected and run inside another process.
The name is historical: the first examples started a shell. Modern ones do whatever is useful.
Read the lessonSide effect
Anything a function does beyond returning a value.
Writing a file, changing a global, calling the network. They are not evil, but they are what makes code hard to reason about.
SIEM Security Information and Event Management
A system that collects logs from everywhere and correlates them into alerts.
Its value is the correlation. One failed login is noise; four hundred from thirty countries is a signal.
Read the lessonSMB Samba · CIFS
The Windows file sharing protocol, and a long history of serious vulnerabilities.
EternalBlue, the flaw behind WannaCry, was SMB. It should never be reachable from the internet.
Read the lessonSOC Security Operations Centre
The team that watches alerts and responds to them, usually around the clock.
Tiers separate triage from investigation, because most alerts are not incidents and somebody has to say so.
Read the lessonSocial engineering
Getting information or access by manipulating people rather than systems.
Pretexting is the usual method: a plausible story that makes the request seem routine.
Read the lessonSocket
The endpoint of a network connection, made of an address and a port.
A listening socket waits; an established one is a conversation already in progress.
Read the lessonSorting
Putting elements in order.
Comparison sorts bottom out at O(n log n). Knowing that stops you hunting for a faster general sort that does not exist.
Spyware
Software that records what you do and sends it somewhere.
Keyloggers are the narrow case: they record keystrokes, which captures passwords before any encryption happens.
Read the lessonSQL injection SQLi
Putting SQL into a field that the application then runs as code.
Parameterised queries fix it completely. Escaping input is the approach that keeps failing.
Read the lessonSSH Secure Shell
The protocol for a secure shell on another machine, encrypted end to end.
It replaced telnet, which sent everything in the clear. Port 22 by default, and it is the first thing to lock down on any server.
Read the lessonSSH key authorised_keys · id_rsa · id_ed25519
A key pair used to log in instead of a password.
The public half goes in the server authorised_keys file and the private half never leaves your device, which is why it beats a password outright.
Read the lessonSSO single sign-on
One login that grants access to many separate services.
It concentrates risk as well as convenience: one compromised identity now reaches everything that trusts it.
Read the lessonSSRF server-side request forgery
Server-side request forgery: making the server send a request of your choosing.
It reaches internal services that the internet cannot, which is why it is often the way into a private network.
Read the lessonStack LIFO
Last in, first out.
Function calls use one, which is why a runaway recursion produces a stack overflow.
Stack and heap
The stack holds call frames and local variables; the heap holds anything whose lifetime is not a function call.
Stack allocation is nearly free and heap allocation is not, which is behind a great deal of performance advice.
Staging environment
A copy of the system for testing before changes reach real users.
It only helps if it is configured like production. A staging server with debug on teaches you nothing.
Read the lessonStandard streams stdin · stdout · stderr
The three channels every process gets: stdin for input, stdout for output, stderr for errors.
Separating errors from output is what lets you throw away noise without losing the message explaining what broke.
Read the lessonStateless
A service that keeps nothing between requests.
Any server can answer any request, which is what makes horizontal scaling possible.
Subnet CIDR
A range of addresses that share a prefix and can reach each other without a router.
The prefix length says how many leading bits are fixed. A /24 leaves eight bits for hosts, so 254 usable addresses.
Read the lessonSUID setuid
A permission bit that makes a program run as the file owner rather than as the person who started it.
A root-owned SUID binary is a privilege escalation target, because anything it does wrong happens with root rights.
Read the lessonSUID hunt
Looking for programs that run as root regardless of who starts them.
One misconfigured binary is enough. The check is a single find command, which is why it is step one after a foothold.
Read the lessonSupply chain attack
Compromising something your project depends on rather than your project.
It scales, because one poisoned package reaches every application that installs it.
Read the lessonSymlink symbolic link · soft link
A file that points at another path instead of holding data.
Following a symlink to somewhere you did not expect is a classic way to make a program write outside its directory.
Read the lessonSymmetric encryption
Encryption where the same key locks and unlocks.
Fast, and the only practical choice for bulk data. The hard part is getting the key to both sides safely.
Read the lessonT
Technical debt
The future cost of a shortcut taken now.
It is a loan, not a moral failing. The problem is when nobody is tracking the interest.
Terminal TTY · console
The window or app that shows a shell and sends your keystrokes to it.
Close the terminal and the shell dies with it, which is why a long job started in one stops when you shut the window.
Read the lessonThread
A single path of execution inside a process, sharing that process memory.
Threads make a program faster on several cores and much harder to reason about, because they can read and write the same memory at the same time.
Read the lessonThreat
Anything that could cause harm, whether or not anybody intends it.
A threat is the possibility. A vulnerability is the weakness it would use. A risk is both together, weighted by likelihood.
Read the lessonThreat actor adversary
Whoever might attack you, described by motive and capability.
A curious teenager and a funded group need different defences, so naming the actor is the first step in choosing them.
Read the lessonThreat hunting
Looking for an intrusion that no alert has caught yet.
It starts from a hypothesis about how an actor would behave, not from a rule that fired.
Read the lessonThroughput
The rate data actually moves, once overhead and congestion are taken into account.
Always lower than the headline bandwidth, often by a third once protocol overhead is counted.
Read the lessonTiming attack
Learning a secret from how long an operation takes.
Comparing two values byte by byte stops at the first difference, and that tiny difference is measurable at scale.
Read the lessonTLS SSL · HTTPS
The protocol that encrypts and authenticates a connection, and the S in HTTPS.
It gives confidentiality, integrity and proof of the server identity, all three, on the same connection.
Read the lessonTree
Nodes with children and no cycles.
A balanced binary search tree keeps lookups at O(log n). An unbalanced one degrades to a list.
Trojan
Software that looks useful and does something else.
It relies on the user choosing to install it, so it defeats every defence that only inspects the network.
Read the lessonTTP tactics techniques procedures
Tactics, techniques and procedures: how an actor behaves rather than what they leave behind.
TTPs survive a change of tools, which is why detection built on behaviour outlasts detection built on a file hash.
Read the lessonTunnelling
Carrying one protocol inside another to get past a filter.
SSH port forwarding is the legitimate version of the same idea, and it is in every developer toolkit.
Read the lessonType system static typing · dynamic typing
The rules about what kinds of value may go where.
Static types are checked before running and dynamic ones during. Strong versus weak is a separate question about how readily values convert.
U
Uptime
How long a system has been running without a restart.
On a server it is a health signal. A high figure after a change you just made means the change did not take effect.
Read the lessonUTF-8
A way of writing characters as bytes that covers every script and stays compatible with ASCII.
A character is one to four bytes, which is why len in bytes and len in characters disagree on non-English text.
Read the lessonV
Virtual machine VM
A complete computer emulated in software, with its own kernel.
Strong isolation, heavy footprint, and the basis of most cloud infrastructure.
Read the lessonVirus
Malware that attaches itself to a legitimate file and spreads when that file runs.
It needs a host and a user action. A worm needs neither, which is why worms spread so much faster.
Read the lessonVPN Virtual Private Network
A tunnel that carries your traffic to another network, encrypted on the way.
It moves who can see your traffic, it does not remove them. The endpoint sees everything the network used to.
Read the lessonVulnerability vuln
A weakness that could let somebody do something the system was not meant to allow.
A vulnerability nobody can reach is not yet a risk, which is why exposure matters as much as severity.
Read the lessonW
WAF Web Application Firewall
A firewall that inspects web requests and blocks the ones that look like attacks.
It buys time and it is not a fix. A WAF in front of a SQL injection still leaves a SQL injection behind it.
Read the lessonWireshark tcpdump
A graphical tool for capturing and reading network traffic.
It shows you what actually went over the wire rather than what the documentation says should have.
Read the lessonWordlist
A file of candidate values used for guessing: passwords, usernames, paths, subdomains.
The quality of the list decides the outcome far more than the speed of the tool reading it.
Read the lessonWorm
Malware that copies itself across a network without any user doing anything.
The 2017 WannaCry outbreak was a worm using an unpatched SMB flaw, which is why it crossed the world in a day.
Read the lessonX
XSS cross-site scripting · stored XSS · reflected XSS
Cross-site scripting: getting your own JavaScript to run in somebody else page.
It runs with that page permissions, so it can read what the page can read and act as the user. Stored XSS lives in the database; reflected XSS comes back in a single response.
Read the lessonY
YAML
A configuration format built on indentation rather than brackets.
It is easier to read than JSON and easier to get wrong. Indentation that looks the same can mean different things.
Read the lessonZ
Zero-day 0day
A vulnerability with no patch available yet.
The name means the defender has had zero days to fix it. It says nothing about how long the attacker has known.
Read the lessonZero trust
Designing as though the network is already hostile, so every request is authenticated and authorised.
It replaces "inside the firewall means trusted", which stops working the moment somebody is inside.
Read the lessonNothing matches that. Try a shorter word, or clear the filter.
Definitions are written for this course rather than copied from a dictionary, so they say what a term means in the context you will meet it. If one is wrong or out of date, the repository link in the footer is where to say so.