Learmux Search

Search

Find a lesson, a tool or a glossary term by name, topic or tag.

Getting started with Termux Termux · 8 Jan 2026 Install Termux and take your first confident steps at the command prompt, one command at a time.
Navigating the filesystem Filesystem · 12 Jan 2026 Learn how paths really work and how to move around the filesystem with confidence in Termux.
Reading and searching text Text · 16 Jan 2026 Read files and search inside them line by line using cat, head, tail, less and grep.
Pipes and redirection Text · 21 Jan 2026 Chain commands together with pipes, and send their output into files with redirection.
File permissions Filesystem · 26 Jan 2026 Learn to read the ten-character mode string and set safe permissions on every file with chmod.
Managing packages Termux · 30 Jan 2026 Update, search, install and remove packages with pkg, and know where they land.
Shell config and aliases Termux · 1 Mar 2026 Shape the shell you get every time you open Termux with a few small edits.
Shell scripting basics Shell · 14 Feb 2026 Turn a string of typed commands into a script you can run again and again.
Processes and jobs Shell · 19 Feb 2026 Find what is running, stop it cleanly, and keep long tasks in the background.
Environment variables and PATH Shell · 30 Jan 2026 The values your shell remembers for you, and how PATH decides what runs.
Text processing with sed and awk Text · 4 Feb 2026 Two small tools that reshape text on the way through a pipe.
Archives and compression Filesystem · 9 Feb 2026 Bundle files into one, squeeze them smaller, and unpack them safely.
Scheduling work with cron Shell · 14 Feb 2026 Let the phone run your commands on a timer, even while you sleep.
Working with text in Python Python · 25 Oct 2026 Slicing, split, join, f-strings and a loop over lines, each a complete program rather than a one-liner.
Hashing and encoding in Python Python · 25 Oct 2026 Six complete programs: bytes, hex, sha256, base64, base64url, and a small tool that uses all of it.
Addresses in Python Python · 25 Oct 2026 Six complete programs, including the /31 that most calculators get wrong and the one call that will exhaust your memory.
Secrets and tokens in Python Python · 25 Oct 2026 Five complete programs, including the one call that looks right and quietly gives you half the token you wanted.
Networking basics Networking · 9 Feb 2026 Inspect your own network, fetch pages and connect over ssh from your phone.
DNS and addresses Networking · 19 Feb 2026 See how a name becomes an address on your phone and check the answer yourself with dig.
HTTP and APIs from the shell Web · 24 Feb 2026 Learn to send a request and read the reply from the shell with curl and python.
SSH and remote work Networking · 24 Feb 2026 Log in to another machine from your phone and move files over a secure link.
Moving files between machines Networking · 1 Mar 2026 Learn to copy files to another host with scp and rsync, and preview every change first.
The security mindset Security · 25 Oct 2026 There is no perfectly secure system, only different degrees of exposure. The aim is a smaller blast radius, not zero risk.
Thinking in threats: modelling a system Security · 25 Oct 2026 A threat model is four questions you can ask about anything. The output is a short list with a decision next to each item.
Encoding and hashes Text · 4 Feb 2026 Encode, decode and verify files with base64, xxd, strings and sha256sum on your phone.
Passwords, keys and secrets Security · 6 Mar 2026 How hashing, long passphrases and a protected SSH key keep your secrets yours, not someone else's.
Reading logs and spotting oddities Security · 11 Mar 2026 Learn what normal looks like, then find the failed logins and odd bursts hiding in plain text.
Hardening your Termux setup Security · 16 Mar 2026 Fewer open doors and tighter file permissions make a smaller target, and that is the whole game.
Safe habits and privacy Security · 21 Mar 2026 Anything you type or paste into a terminal can be written down, so plan for it being read later.
The phases of a security assessment Recon · 25 Oct 2026 Learn the order that security work happens in, and run the first steps on your own phone.
Taking inventory of your own devices Recon · 25 Oct 2026 Build a plain list of what your own device has, with commands that need no root.
Reading a port scan properly Recon · 25 Oct 2026 Run nmap against your own phone and learn what each line of the output is telling you.
Service versions and what they tell you Recon · 25 Oct 2026 Ask an open port what service and version is behind it, and read the banner it sends back.
Finding and judging a vulnerability Recon · 25 Oct 2026 Turn a version string into a decision, without overreacting to every old number you find.
How a web request is handled Web · 25 Oct 2026 Follow a single request end to end, then close the flaw in the path it carries.
Input you do not control Web · 25 Oct 2026 Take a value from the query string, crash a server with it, then validate it properly.
Injection: when data becomes code Web · 25 Oct 2026 Make a server run a command you did not write, then stop it doing that.
Cross-site scripting Web · 25 Oct 2026 Make a search page run your script, then make it show your script as text.
Broken access control and misconfiguration Web · 25 Oct 2026 Ask for another user's record and for the admin area, then make the server say no.
Hashing, encoding and encryption are three different things Cryptography · 25 Oct 2026 Hashing is one way, encoding is not secret, and encryption needs a key. See the difference in three short commands.
Symmetric and asymmetric keys Cryptography · 25 Oct 2026 One shared secret, or a pair of related keys? See how each works, and when to reach for which.
TLS and the chain of trust Cryptography · 25 Oct 2026 The padlock means more than encryption. See what a certificate says, and who vouches for it.
Signing and verifying a file Cryptography · 25 Oct 2026 A signature proves a file has not changed and came from the key holder. Sign one and check one with gpg.
Common crypto mistakes Cryptography · 25 Oct 2026 Five mistakes that keep turning up, and how to spot each one before it costs you.
Baselines: writing down what normal is Defence · 25 Oct 2026 You cannot notice a change if you never wrote down what normal was.
File integrity: noticing a change Defence · 25 Oct 2026 A hash turns a whole file into one short line, and that line is enough to tell you it changed.
Reading logs for a story Defence · 25 Oct 2026 A log is a list of events, and a list of events is a story once you put it in order.
Alerting on your own device Defence · 25 Oct 2026 Detection you have to remember to perform is detection you will forget, so make the phone tell you.
Incident response, in six steps Defence · 25 Oct 2026 When something looks wrong, a calm order of steps beats a rush, and the last step is the one most people skip.
Build a password generator Utilities · 25 Oct 2026 Build a password generator in the shell, step by step, and count the bits behind every secret it prints.
Build an encoder and decoder Utilities · 25 Oct 2026 Build an encoder and decoder in the shell, step by step, and learn to check a decode instead of trusting it.
Build a hash and checksum tool Utilities · 25 Oct 2026 Grow a one-line sha256sum into a real checksum tool, step by step, then copy the finished script.
Build a JWT inspector Utilities · 25 Oct 2026 Grow a single cut command into a token inspector, step by step, then copy the finished script.
Build a permissions calculator Utilities · 25 Oct 2026 Read a mode from stat, turn octal into rwx and back, get the special bits right, and finish with a complete script you can keep.
Build a subnet calculator Utilities · 25 Oct 2026 Convert an address to a number, build the mask, work out the network and broadcast with bitwise arithmetic, and finish with a complete script you can keep.
Project: a backup script Projects · 26 Mar 2026 Copy a chosen folder into a dated archive, skip repeat runs, and report the result with a status code.
Project: a log analyser Projects · 31 Mar 2026 Read a web server log, rank the top talkers, count the errors, and find the busiest hour of the day.
Project: a terminal dashboard Projects · 5 Apr 2026 Print a compact terminal dashboard with disk, memory, battery, packages, and the current time zone.
Rules of engagement and the law Career · 25 Oct 2026 Verbal permission is not authorisation. Write down the scope, the window and the limits before you touch anything.
Writing a finding someone can act on Career · 25 Oct 2026 A finding is a title, what was observed, why it matters, how to reproduce it, and what to do. In that order, every time.
Responsible disclosure Career · 25 Oct 2026 You will find a problem in something you do not own. Report it privately, give time for a fix, and keep a record of what you did.
Certifications, labs and what they actually prove Career · 25 Oct 2026 A certification proves you passed an exam. Hands-on work is what gets read. Build a portfolio of things you actually did.
Run your first Python Python · 25 Oct 2026 Not one-liners. Whole programs, six to ten lines, put together a piece at a time.
Tools
ls See what a folder holds, with sizes and permissions GNU Project
find Locate files by name, size, age or permissions GNU Project
fd A faster, friendlier take on the classic search command David Peter
tree Draw a directory hierarchy as an indented diagram Steve Baker
ranger A keyboard-driven file manager for the terminal Roman Zimbelmann
Midnight Commander An old-school dual-pane file manager for the terminal Miguel de Icaza
tar Pack many files into one archive, then unpack it GNU Project
unzip Extract and inspect ZIP archives from the terminal Info-ZIP
7-Zip Compresses hard, and reads and writes many formats Igor Pavlov
gzip Compress single files with the widespread deflate format GNU Project
rsync Synchronise directories over local or remote paths Andrew Tridgell
file Identify what a path really contains Ian Darwin
grep Search text line by line, printing every match GNU Project
ripgrep A very fast recursive search that honours ignore rules Andrew Gallant
sed Rewrite a stream of text with find-and-replace rules GNU Project
GNU Awk Process and total column-based text with a small language GNU Project
cut Pull chosen columns or character ranges out of lines GNU Project
sort Order lines alphabetically, numerically, or by a key GNU Project
uniq Collapse or count repeated lines that sit together GNU Project
tr Translate or delete single characters in a stream GNU Project
wc Count lines, words, characters and bytes GNU Project
less Page through long output with search and scroll Mark Nudelman
bat A colourful pager with syntax highlighting and line numbers David Peter
jq Slice, filter and reshape JSON from the terminal Stephen Dolan
Bash The default login shell on Termux and most Linux systems Free Software Foundation
Zsh Extended Bourne-style shell with smart completion and globbing Zsh Development Group
tmux Keep sessions alive and split one terminal into many panes Nicholas Marriott
GNU Screen A veteran terminal multiplexer for detaching and resuming sessions GNU Project
Zellij A modern terminal workspace with built-in layouts and hints Zellij contributors
Byobu Friendly wrappers and a status bar around a terminal multiplexer Dustin Kirkland
fzf Interactive fuzzy finder you can pipe anything into Junegunn Choi
Zoxide Jump to directories by typing part of their name Ajeet D'Souza
tldr Community cheat sheets that show the common uses of a command tldr-pages contributors
ps List running processes with their resource use procps-ng project
top Live view of CPU and memory with the busiest processes procps-ng project
htop Colourful interactive process viewer with scrolling and shortcuts Hisham Muhammad and contributors
btop Rich resource monitor with graphs for CPU, memory and network Aristocratos
procs Modern replacement for ps with colour and sensible defaults dalance
kill Send signals to processes to stop or reload them procps-ng project
strace Trace the system calls a program makes strace project
ncdu Browse disk usage interactively and delete from the tree Yorhel (Yoran Heling)
duf Colourful table of mounted filesystems and free space Christian Muehlhaeuser
dust Show which directories are using the most space bootandy
free Report how much memory is used, available and cached procps-ng project
uptime Show how long the device has been running and the load average procps-ng project
lsof List the files and sockets open processes are holding lsof project
Nmap Scan the hosts you own and see what answers Gordon Lyon (Fyodor) and the Nmap Project
tcpdump Watch the packets crossing an interface you control The Tcpdump Group
dig Ask any resolver for the DNS records you want Internet Systems Consortium
whois Look up who holds a domain or address block Marco d'Itri
ip Inspect and change addresses, routes and links Stephen Hemminger and the iproute2 maintainers
ping Check reachability and round-trip time to a host The iputils maintainers
traceroute Map the path packets take to a destination Dmitry Butskoy
mtr Continuous path and loss report in one view Roger Wolff
netcat Read and write raw TCP or UDP connections The OpenBSD project
socat Relay data between two addresses or channels Gerhard Rieger
curl Transfer data over HTTP, HTTPS, FTP and more Daniel Stenberg and the project contributors
wget Download without prompts, and mirror a whole site The GNU Project
aria2 Multi-connection downloader for HTTP, FTP and torrents Tatsuhiro Tsujikawa
axel Small download accelerator that splits one file Wilmer van der Gaast and contributors
OpenSSH Encrypted remote shell and file transfer suite The OpenSSH project
rclone Sync files between local storage and cloud remotes Nick Craig-Wood
Syncthing Peer-to-peer folder sync between your own devices The Syncthing Foundation
lftp Scriptable file transfer over FTP and SFTP Alexander V. Lukyanov
yt-dlp Download video and audio from many sites The yt-dlp project
OpenSSL Cryptography toolkit for keys, hashes and TLS The OpenSSL Project
GnuPG Encrypt, sign and verify files with public keys The GnuPG Project
age Small, modern file encryption tool Filippo Valsorda and contributors
pass Standard Unix credential store backed by GPG Jason A. Donenfeld
pwgen Generate pronounceable or fully random values Theodore Ts'o
hashcat Test hashes to audit how strong your secrets are Jens Steube (atom) and the hashcat project
John the Ripper Audit password hashes across many formats Openwall
hydra Test your own login services against candidates The Hacker's Choice (THC)
sqlmap Detect and exploit SQL injection in your own apps Bernardo Damele and Miroslav Stampar
nikto Web server checks for a site you control Chris Sullo and David Lodge
WireGuard Modern VPN tunnel with a small attack surface Jason A. Donenfeld
Tshark Wireshark on the command line, for reading packet captures The Wireshark Foundation
Binwalk Find files and file systems hidden inside firmware and blobs ReFirmLabs
ExifTool Read, write and strip the metadata inside media files Phil Harvey
Radare2 A framework for disassembling, inspecting and patching binaries The Radare2 developers
Strings Find the readable text hidden in any binary file The GNU Project
xxd Dump a file as hex, and turn a dump back into binary The Vim project
Apktool Unpack, inspect and rebuild Android app packages Connor Tumbleson
pkg Termux's package manager for installing software The Termux project
APT The package manager underneath Termux The Debian Project
dpkg Inspect and manipulate single Debian package files The Debian Project
pip Install and manage Python packages from PyPI The Python Packaging Authority
npm The package manager for JavaScript projects The npm project
Git Distributed version control for every change to your files The Git project
Python A readable general-purpose language with a rich library The Python Software Foundation
Node.js Run JavaScript away from the browser, on a server or the CLI The OpenJS Foundation
Go A compiled language for simple, fast and concurrent programs The Go team at Google
Clang A modern front end for C, C++ and Objective-C The LLVM Project
Make Automate builds from a description of file dependencies The GNU Project
ShellCheck Find bugs and pitfalls in shell scripts before you run them Vidar Holen
Vim A modal editor that runs on any server, even a slow one The Vim project
Neovim A modern take on Vim, with built-in language support The Neovim project
nano A small, friendly editor that keeps its shortcuts on screen Chris Allegretta and the nano contributors
micro A terminal editor with familiar shortcuts and mouse support Zachary Yedidia
FFmpeg Convert, trim, compress and stream audio and video The FFmpeg team
ImageMagick Create, edit and convert images in bulk ImageMagick Studio LLC
Pandoc Convert documents between markup formats, structure intact John MacFarlane
Tesseract Read the text inside images and scanned pages The Tesseract OCR community
mpv A compact media player, driven from the terminal The mpv project
FIGlet Turn short text into large banners of ordinary characters Glenn Chappell and Ian Chai
Glossary
AAA Authentication, authorisation and accounting: who you are, what you may do, and what you did.
Abstraction Hiding detail behind a simpler interface.
ACL A list attached to an object saying who may do what to it.
Active Directory The directory Microsoft domains use to hold users, groups, machines and policy.
AES The standard symmetric block cipher, with 128, 192 or 256 bit keys.
Air gap Physically separating a system from every network.
Algorithm A finite sequence of steps that solves a problem.
API A defined way for one piece of software to ask another to do something.
APT An advanced persistent threat: an attacker with resources who stays hidden and works slowly toward a goal.
Archive Several files packed into one file for storage or transfer.
Array Elements stored contiguously, reached by position.
AST A tree representing the structure of code, with syntax stripped away.
Asymmetric encryption Encryption with a key pair, where what one key locks only the other unlocks.
Atomic An operation that cannot be observed halfway through.
Attack surface Every point where somebody could try to get in.
Authentication bypass Getting in without valid credentials.
Bandwidth How much data can move per second, as opposed to how long it takes to start.
Banner grabbing Reading the greeting a service sends, which often names the software and its version.
Baseline A record of what normal looks like, taken while everything is fine.
BFS and DFS Breadth-first explores level by level; depth-first follows one branch to the end.
Big O How the cost of an algorithm grows as the input grows.
Binary search Halving a sorted range until the target is found.
Bind shell A shell on the target that listens for the attacker to connect in.
Block cipher mode The rule for applying a block cipher to data longer than one block.
Botnet A collection of compromised machines controlled together.
Broken access control The application knows who you are and still lets you do the wrong thing.
Brute force Trying every possibility until one works.
Bug bounty A programme that pays people for reporting vulnerabilities in your systems.
Burp Suite A proxy that sits between a browser and a server so you can read and change every request.
Bytecode An intermediate form between source and machine code, run by a virtual machine.
C2 Command and control: the channel an attacker uses to give instructions to compromised machines.
Cache A copy of something kept close by so the next request is cheaper.
Capture the flag A challenge where the goal is to find a hidden string that proves you got in.
CDN A network of servers spread geographically that serves copies of content from somewhere near the reader.
Certificate A signed statement binding a public key to a name.
Certificate authority An organisation whose signature on a certificate is trusted by browsers and systems.
Chain of trust The path from a server certificate up through intermediates to a root the client already trusts.
Checksum A short value computed from data so you can tell whether it changed.
CIA triad The three properties security is usually defined as protecting: confidentiality, integrity and availability.
Cipher The algorithm that turns plaintext into ciphertext and back.
Ciphertext The unreadable output of encryption.
Clickjacking Putting an invisible frame over a page so your clicks land on something else.
Collision Two different inputs that produce the same hash.
Command injection Getting a shell command into something that builds a command line.
Compiler A program that translates source code into something else before it runs.
Compression Encoding data in fewer bytes by removing redundancy.
Concurrency Several tasks making progress without one waiting for the others to finish.
Container A process isolated by the kernel so it sees its own filesystem and network, without a second kernel.
Containment Stopping an incident from spreading, before you try to remove it.
Cookie flags Attributes that restrict how a browser may use a cookie.
CORS The browser rule that decides whether one origin may read a response from another.
Credential dumping Extracting stored passwords or hashes from a compromised machine.
Cron The service that runs commands on a schedule.
CSP Content Security Policy: a header listing which sources a page may load and run from.
CSPRNG A random number generator built to be unpredictable rather than merely evenly distributed.
CSRF Cross-site request forgery: making a logged-in user browser send a request they did not intend.
CVE A public identifier for a specific known vulnerability.
CVSS A scoring system for how severe a vulnerability is, from 0 to 10.
Daemon A process that runs in the background with no terminal attached.
Data structure A way of organising data so that particular operations are cheap.
Deadlock Two or more tasks each waiting for something the other holds, so none can continue.
Defence in depth Layering independent controls so one failure does not become a breach.
Denial of service Making a service unavailable rather than taking data from it.
Dependency Another piece of software that something needs in order to work.
Deserialisation flaw Handing untrusted bytes to something that rebuilds objects from them.
DHCP The protocol that hands a device its address, gateway and DNS servers when it joins a network.
Dictionary attack Trying a list of likely passwords instead of every combination.
Digest The output of a hash function.
Digital signature A value that proves a message came from the holder of a private key, and that it has not changed.
DNS The system that turns a name like example.com into an IP address.
Dynamic programming Solving a problem by storing the answers to subproblems instead of recomputing them.
ECB The simplest block cipher mode, where identical blocks encrypt identically.
EDR Software on endpoints that records behaviour and can act on it.
Elliptic curve A family of public key algorithms that reach the same strength as RSA with much shorter keys.
Encapsulation Keeping an object state private and reachable only through its own methods.
Encoding Representing data in a particular form so it survives a medium that expects that form.
Entropy A measure of how unpredictable a value is, in bits.
Enumeration Asking an identified service what it knows: users, shares, versions, configuration.
Environment variable A named value passed into a process when it starts.
Exfiltration Getting data out of a network once it has been taken.
Exit code The number a process returns when it finishes, where zero means success.
Exploit The technique or code that turns a vulnerability into an effect.
Exploit chain Several flaws used together, where each one makes the next possible.
False flag Evidence planted to make an attack look like somebody else did it.
False positive An alert about something that turns out to be harmless.
File descriptor A small number a process uses to refer to an open file, socket or pipe.
Filesystem The way an operating system organises names, directories and the data behind them.
Firewall A filter that decides which network traffic is allowed in or out.
Forward secrecy A property where stealing the long term key later does not decrypt past sessions.
Fuzzing Sending malformed or random input to find the cases the developer did not consider.
Garbage collection Reclaiming memory automatically once nothing refers to it.
Gateway The address a machine sends traffic to when the destination is outside its own subnet.
Get out of jail free Informal name for the letter that says the holder is authorised to be doing this.
Glob A pattern the shell expands into matching filenames before the command ever sees them.
Graph Nodes connected by edges, used for anything with relationships.
Greedy algorithm Taking the best option now at every step and never reconsidering.
Hardening Removing what you do not need so there is less to attack.
Hard link A second name for the same file, sharing its inode.
Hash function A one-way function that turns any input into a fixed length output.
Hash table Key and value pairs stored by the hash of the key, giving average O(1) lookup.
HMAC A hash combined with a secret key, so the digest also proves who made it.
Honeypot A decoy system whose only purpose is to be attacked.
Hypervisor The layer that runs and separates virtual machines.
Idempotent An operation that gives the same result whether you run it once or five times.
IDOR Insecure direct object reference: changing an identifier in a URL to reach somebody else data.
IDS A system that watches traffic or activity and raises an alert when something looks wrong.
Immutability Data that cannot be changed after it is created.
Incident An event that has actually harmed, or is actively harming, the organisation.
Injection Any flaw where data is interpreted as instructions by whatever consumes it.
Inode The record that holds a file metadata: its owner, permissions, size and which disk blocks belong to it.
Input validation Checking that data matches what the application expects before using it.
Insider threat Risk from somebody who already has legitimate access.
Interpreter A program that reads and executes source code directly.
IoC An indicator of compromise: an artefact that suggests a system has been breached.
IP address The number that identifies a machine on a network.
ISO 27001 An international standard for running an information security management system.
IV Initialisation vector: the starting value that makes the same plaintext encrypt differently each time.
JIT Compiling hot code to machine code while the program runs.
JSON A text format for structured data, made of objects, arrays, strings, numbers and booleans.
JWT A signed token carrying claims about a user, usually in a request header.
KDF A key derivation function: something that turns a weak secret into a strong key, deliberately slowly.
Kerberos A ticket based authentication protocol, and the default in Windows domains.
Kernel The core of an operating system, the part that talks to hardware and decides who gets the CPU.
Key exchange Two parties agreeing on a shared secret over a channel somebody may be listening to.
Kill chain A model of an intrusion as a sequence of stages, from recon to exfiltration.
Latency The delay before a response starts arriving.
Lateral movement Moving from one compromised machine to another inside the same network.
LDAP A protocol for reading and writing a directory of users, groups and machines.
Least privilege Giving each person and each process only the rights it needs to do its job.
LFI Local file inclusion: making the application load a file that already exists on the server.
Linked list Elements scattered in memory, each holding a pointer to the next.
Load balancer A server that spreads incoming requests across several backends.
LOLBin A legitimate system binary abused to do something it was not meant for.
Malware Software written to do something the owner of the machine would not agree to.
Man in the middle An attacker positioned between two parties who can read and change what passes.
Man page The reference documentation installed with a command, read with man.
Memory leak Memory that is still held after it is no longer needed.
Metasploit A framework that packages exploits, payloads and post-exploitation steps together.
MFA Requiring more than one kind of evidence to log in.
MITRE ATT&CK A public catalogue of real attacker techniques, each with an identifier.
Mount Attaching a filesystem at a directory so its contents appear inside the main tree.
Mutex A lock that only one task may hold at a time.
NAT Rewriting addresses as traffic passes a router, so many devices share one public address.
Netcat A tool that reads and writes raw network connections, useful for almost everything.
NIST The United States standards body whose security publications are used well beyond the US.
Nmap The standard port scanner, with service detection and scripting built in.
Nonce A number used once, to stop a message being replayed or a key being reused.
NTP The protocol that keeps clocks synchronised across machines.
O(1) Constant time: the cost does not change with input size.
OAuth A protocol that lets an application act on your behalf without ever seeing your password.
O(log n) Logarithmic: doubling the input adds one step.
O(n) Linear: the cost grows in step with the input.
O(n squared) Quadratic: doubling the input quadruples the cost.
OSINT Intelligence gathered from public sources: registrations, job adverts, code, social media.
Output encoding Escaping data for the exact place it is about to appear.
OWASP A foundation that publishes widely used guidance on application security, including a periodic top ten of web risks.
Package manager The tool that installs, upgrades and removes software along with its dependencies.
Padding oracle An attack that uses the difference between two error messages to decrypt data without the key.
Partition A slice of a physical disk that the system treats as its own device.
Pass the hash Authenticating with a stolen password hash without ever cracking it.
Patch An update that fixes a defect, often a security one.
PATH The list of directories the shell searches, in order, to find a command.
Path traversal Using ../ in a path to reach a file outside the directory the application meant to serve.
Payload The part of an exploit that does what the attacker wants once the flaw is triggered.
Penetration test An authorised attempt to break into a system, with a report at the end.
Pepper A secret value added to every password before hashing, kept apart from the database.
Permission bits Nine flags on every file saying who may read, write or execute it.
Persistence Whatever an attacker leaves behind so access survives a reboot.
Phishing A message pretending to be from somebody you trust, designed to make you act.
PID Process identifier, the number the kernel uses to name a running process.
Pipe A connection that sends one program output straight into another program input.
Pivot Using one compromised host to reach networks you cannot see from where you started.
PKI The whole apparatus of keys, certificates, authorities and revocation around public key cryptography.
Plaintext The readable form of a message, before encryption and after decryption.
Pointer A value holding a memory address.
Polymorphism One interface, several implementations, chosen by the value it is called on.
Port A number that says which service on a machine a connection is for.
Post-mortem The review after an incident that asks how it happened rather than who to blame.
Private key The half of a key pair that must never leave your control.
Privilege boundary Any line where crossing it means gaining more rights.
Privilege escalation Gaining more rights than you were given, usually from a normal user to root.
Process A running program, with its own memory and its own identity number.
Proof of concept The smallest thing that demonstrates a finding is real.
Protocol An agreed format for two systems to exchange information.
Proxy A server that makes a request on your behalf and returns the answer.
Public key The half of a key pair you may hand out freely.
Pure function A function whose output depends only on its arguments, and which changes nothing outside itself.
Queue First in, first out.
Race condition A bug where the result depends on the order two things happen to run.
RAID Combining several disks so that one can fail without losing the data.
Rainbow table A precomputed table of hashes for common passwords.
Ransomware Malware that encrypts your files and sells you the key.
Rate limiting Capping how often somebody may do something in a period.
RBAC Granting permissions to roles rather than to individuals.
RCE Remote code execution: running your own code on somebody else server.
Reconnaissance Gathering information about a target before touching it.
Recursion A function that calls itself on a smaller version of the problem.
Redirection Sending a process output to a file, or a file into a process input.
Red team The attackers in an exercise, whose job is to find a way in.
Refactoring Changing the structure of code without changing what it does.
Repository A server holding packages and the index that describes them.
Responsible disclosure Telling the owner about a flaw privately, and giving them time to fix it before you publish.
REST A style of API built around resources addressed by URL and acted on with HTTP verbs.
Reverse shell A shell on the target that connects out to the attacker.
Risk The chance of harm multiplied by how bad the harm would be.
Root The account with every permission, and the top of the directory tree.
Rootkit Software that hides its own presence, and often other malware, from the system it lives in.
RSA A public key algorithm whose security rests on how hard it is to factor large numbers.
Rules of engagement The written agreement on what a test may touch, when, and how.
Salt Random data added to a password before hashing, stored alongside the result.
Same-origin policy The rule that a page from one origin cannot read data from another.
SAML An older XML based standard for single sign-on between an organisation and a service.
Sandbox An isolated environment where code can run without reaching anything that matters.
Scanning Probing a host or range to find which ports answer.
Scope The exact set of systems a test is permitted to touch.
Security header A response header that tells the browser to behave more carefully.
Semaphore A counter that limits how many tasks may enter a section at once.
Serialisation Turning an in-memory structure into bytes that can be stored or sent.
Session The server-side record that you are logged in, identified by a cookie.
Shadow IT Systems and services people use without the organisation knowing.
Shebang The first line of a script, starting with #!, that names the interpreter to run it.
Shell A program that reads the commands you type and asks the kernel to carry them out.
Shellcode Machine instructions written to be injected and run inside another process.
Side effect Anything a function does beyond returning a value.
SIEM A system that collects logs from everywhere and correlates them into alerts.
SMB The Windows file sharing protocol, and a long history of serious vulnerabilities.
SOC The team that watches alerts and responds to them, usually around the clock.
Social engineering Getting information or access by manipulating people rather than systems.
Socket The endpoint of a network connection, made of an address and a port.
Sorting Putting elements in order.
Spyware Software that records what you do and sends it somewhere.
SQL injection Putting SQL into a field that the application then runs as code.
SSH The protocol for a secure shell on another machine, encrypted end to end.
SSH key A key pair used to log in instead of a password.
SSO One login that grants access to many separate services.
SSRF Server-side request forgery: making the server send a request of your choosing.
Stack Last in, first out.
Stack and heap The stack holds call frames and local variables; the heap holds anything whose lifetime is not a function call.
Staging environment A copy of the system for testing before changes reach real users.
Standard streams The three channels every process gets: stdin for input, stdout for output, stderr for errors.
Stateless A service that keeps nothing between requests.
Subnet A range of addresses that share a prefix and can reach each other without a router.
SUID A permission bit that makes a program run as the file owner rather than as the person who started it.
SUID hunt Looking for programs that run as root regardless of who starts them.
Supply chain attack Compromising something your project depends on rather than your project.
Symlink A file that points at another path instead of holding data.
Symmetric encryption Encryption where the same key locks and unlocks.
Technical debt The future cost of a shortcut taken now.
Terminal The window or app that shows a shell and sends your keystrokes to it.
Thread A single path of execution inside a process, sharing that process memory.
Threat Anything that could cause harm, whether or not anybody intends it.
Threat actor Whoever might attack you, described by motive and capability.
Threat hunting Looking for an intrusion that no alert has caught yet.
Throughput The rate data actually moves, once overhead and congestion are taken into account.
Timing attack Learning a secret from how long an operation takes.
TLS The protocol that encrypts and authenticates a connection, and the S in HTTPS.
Tree Nodes with children and no cycles.
Trojan Software that looks useful and does something else.
TTP Tactics, techniques and procedures: how an actor behaves rather than what they leave behind.
Tunnelling Carrying one protocol inside another to get past a filter.
Type system The rules about what kinds of value may go where.
Uptime How long a system has been running without a restart.
UTF-8 A way of writing characters as bytes that covers every script and stays compatible with ASCII.
Virtual machine A complete computer emulated in software, with its own kernel.
Virus Malware that attaches itself to a legitimate file and spreads when that file runs.
VPN A tunnel that carries your traffic to another network, encrypted on the way.
Vulnerability A weakness that could let somebody do something the system was not meant to allow.
WAF A firewall that inspects web requests and blocks the ones that look like attacks.
Wireshark A graphical tool for capturing and reading network traffic.
Wordlist A file of candidate values used for guessing: passwords, usernames, paths, subdomains.
Worm Malware that copies itself across a network without any user doing anything.
XSS Cross-site scripting: getting your own JavaScript to run in somebody else page.
YAML A configuration format built on indentation rather than brackets.
Zero-day A vulnerability with no patch available yet.
Zero trust Designing as though the network is already hostile, so every request is authenticated and authorised.