Master this deck with 90 terms through effective study methods.
Imported from Quizlet
Using methods and tools that directly engage a target to gather intelligence.
A passive reconnaissance tool and website used to discover, monitor, and analyze data about Internet‑accessible devices.
A database of cybersecurity flaws discovered in software and hardware.
A database of cybersecurity weaknesses in servers, applications, and hardware.
An organization providing cybersecurity information globally.
Navigating a website's structure to discover pages, links, and folders.
A Linux tool used to query and transfer DNS information.
A collection of user identities used to send messages to all members.
A hierarchical naming system resolving computer names into IP addresses.
An authority that controls and distributes domain names.
An authority managing domain distribution.
Analyzing and recording characteristics such as IPs, services, and operating systems.
Software for manipulating file metadata.
A tool analyzing file metadata.
A security device allowing or blocking network traffic.
A set of search terms revealing sensitive information via Google.
A router an IP packet travels through.
Oversees global IP address allocation and DNS root zone management.
Hardware/software distributing requests among servers.
An OSINT tool showing relationships between open‑source data.
Data describing other data.
A diagram of how network devices connect.
Free publicly available information.
Intercepting IP traffic with tools like Wireshark.
Gathering intelligence without direct engagement.
Collections of breached passwords used in attacks.
Determining active IP addresses using automated ping tools.
Library of freely accessible code.
A framework for open‑source web reconnaissance.
Retrieving information from websites.
Access‑control object assigning permissions.
A folder available remotely to other computers.
A search engine scanning Internet‑connected devices.
Collecting intelligence from social networks.
Following links to discover website content and structure.
Provides identification and encryption.
Tool discovering emails, ports, banners, and other data.
Linux command determining router paths.
Windows version of traceroute.
Scanning for wireless access points while moving.
Firewall protecting websites.
Ports 0-1023 assigned to standard services.
Tool for gathering domain name information.
Packet‑sniffing and analysis application.
Graphical front‑end for nmap.
DNS data sharing between servers.
A procedure proven to produce optimal results.
Test where the pen tester has zero knowledge.
Systems handling cardholder data.
Ensuring activities meet laws, regulations, and policies.
Testing mandated by compliance rules.
GDPR‑mandated data protection role.
U.S. federal computer system standards.
EU law governing personal data protection.
Testing focused on specific systems or processes.
Ensuring organizational activities align with goals.
U.S. law requiring financial institutions to safeguard data.
Test with partial knowledge.
U.S. law protecting patient health information.
Pretending to be someone else to gain access.
A now‑outdated pen‑testing standard.
Cloud service providing virtualized computing resources.
Threat originating from inside an organization.
International information security standard.
Governs the relationship between client and tester.
Global framework of threat behaviors and techniques.
Legal agreement preventing information disclosure.
Peer‑reviewed security testing methodology.
Web application security community and resources.
Payment card data security standard.
Penetration Testing Execution Standard.
Fraudulent messages to steal data.
Cloud platform allowing user‑installed apps.
Removing personal identifiers from stored data.
Simulated targeted attack.
Following required rules or laws.
Potential loss of confidentiality, integrity, or availability.
Defines boundaries for a pen test.
U.S. law regulating corporate finances.
The limits and definitions of a project.
Uncontrolled growth of project scope.
Agreement detailing service expectations.
Observing someone's activities to steal information.
Manipulating people into compromising security.
Access to hosted cloud applications.
Targeted phishing aimed at a specific group.
Contract defining project details.
Identifying and prioritizing threats.
Phishing targeting high‑level executives.
Test with full system knowledge.