Glossary

ACL Access Control List — a list of permissions attached to a resource, defining which users or processes can access it and how.

AD Active Directory — Microsoft's directory service for managing users, computers, and permissions across a Windows network domain.

AI Artificial Intelligence — software designed to perform tasks that normally require human reasoning, from generating text to detecting malware.

AJAX Asynchronous JavaScript and XML — a technique letting a web page send and receive data from a server in the background, without a full page reload.

AMSI Antimalware Scan Interface — a Windows interface that lets antivirus/EDR products inspect script content (like PowerShell) before it runs.

API Application Programming Interface — a defined way for one piece of software to request data or actions from another.

ASCII American Standard Code for Information Interchange — a character-encoding standard mapping letters, digits, and symbols to numeric byte values.

AV Antivirus — software that detects and blocks known malicious files based on signatures or behavior.

AWS Amazon Web Services — Amazon's cloud computing platform.

C2 Command and Control — the infrastructure and channel an attacker uses to communicate with and control a compromised host.

CISA Cybersecurity and Infrastructure Security Agency — the U.S. government agency that tracks actively exploited vulnerabilities and issues security advisories.

CLI Command-Line Interface — interacting with software by typing text commands rather than clicking through a graphical interface.

CMS Content Management System — software for building and editing website content (pages, posts, media) without hand-writing code for every page.

CPU Central Processing Unit — the processor that executes a computer's instructions.

CRLF Carriage Return Line Feed — the two control characters (\r\n) used to mark a new line in many network protocols, including HTTP and multipart form data.

CSRF Cross-Site Request Forgery — a web attack that tricks a logged-in user's browser into submitting a request they never intended to make.

CTF Capture The Flag — a security competition format where participants solve challenges to find hidden "flags" proving they exploited something.

CVE Common Vulnerabilities and Exposures — a unique public identifier assigned to a specific, disclosed software vulnerability.

CVSS Common Vulnerability Scoring System — a standardized 0–10 score representing how severe a vulnerability is.

DC Domain Controller — a server that manages authentication and security policy for an Active Directory domain.

DNS Domain Name System — the internet's system for translating human-readable domain names into IP addresses.

EDR Endpoint Detection and Response — security software that monitors a host's behavior in real time, not just known-bad file signatures.

FTP File Transfer Protocol — an older, typically unencrypted protocol for transferring files between a client and server.

GCP Google Cloud Platform — Google's cloud computing platform.

GPP Group Policy Preferences — an older Active Directory mechanism that, due to a since-patched flaw, sometimes leaves recoverable passwords in cached XML files.

GPU Graphics Processing Unit — a processor built for massively parallel math, used for both graphics and, increasingly, AI model training/inference.

GRC Governance, Risk, and Compliance — a career track and discipline focused on security policy, risk management, and regulatory frameworks rather than hands-on exploitation.

GUI Graphical User Interface — interacting with software through windows, icons, and clicks rather than typed commands.

HKCU HKEY_CURRENT_USER — the Windows Registry hive holding settings specific to the currently logged-in user.

HKLM HKEY_LOCAL_MACHINE — the Windows Registry hive holding system-wide configuration, not tied to any one user.

HTB Hack The Box — a popular platform for practicing penetration testing against intentionally vulnerable machines.

HTML HyperText Markup Language — the standard markup language used to structure content on web pages.

HTTP HyperText Transfer Protocol — the protocol web browsers and servers use to exchange requests and responses.

HTTPS HTTP Secure — HTTP encrypted with TLS, so traffic can't be trivially read or tampered with in transit.

ICMP Internet Control Message Protocol — the protocol behind diagnostic tools like ping, used for network-layer error and status messages.

IDOR Insecure Direct Object Reference — a flaw where an application lets a user access another user's data just by changing an ID in a request, with no permission check.

IP Internet Protocol — the addressing system that lets devices on a network find and send data to each other.

IR Incident Response — the process of detecting, containing, and recovering from a security breach.

ISO International Organization for Standardization — the body behind widely referenced standards like ISO 27001 (information security management).

JSON JavaScript Object Notation — a lightweight, widely used text format for structuring data, especially in APIs.

JWT JSON Web Token — a compact, signed token format commonly used to prove a user's identity to an API without a server-side session.

KDC Key Distribution Center — the Active Directory service that issues Kerberos tickets.

KEV Known Exploited Vulnerabilities — CISA's catalog of vulnerabilities confirmed to be actively exploited in the wild.

LDAP Lightweight Directory Access Protocol — the protocol used to query and modify directory services like Active Directory.

LLM Large Language Model — the type of AI model behind tools like ChatGPT and Claude, trained to predict and generate text.

LOLBAS Living Off the Land Binaries and Scripts — a catalog of legitimate, pre-installed Windows tools that can be repurposed for malicious ends.

LSA Local Security Authority — the Windows subsystem responsible for enforcing security policy and handling credential material in memory.

MSRPC Microsoft Remote Procedure Call — the protocol many Windows and Active Directory services use to communicate over the network.

NIST National Institute of Standards and Technology — the U.S. agency behind widely used cybersecurity frameworks and standards.

NSE Nmap Scripting Engine — Nmap's built-in scripting system for automating recon, vulnerability detection, and more during a scan.

NTDS NT Directory Services — the database file (ntds.dit) on a domain controller holding every domain account's password hash.

NTLM NT LAN Manager — an older Windows authentication protocol and hash format, still widely relevant to pass-the-hash attacks.

OPSEC Operational Security — the discipline of controlling what information about an operation is exposed, and to whom.

OS Operating System — the core software (Windows, Linux, macOS) that manages a computer's hardware and runs everything else.

OSCP Offensive Security Certified Professional — a hands-on penetration testing certification widely respected in the industry.

OSINT Open-Source Intelligence — gathering information from publicly available sources rather than hacking or insider access.

OWASP Open Worldwide Application Security Project — a nonprofit best known for the OWASP Top 10, a standard reference list of the most critical web application risks.

PNPT Practical Network Penetration Tester — a hands-on penetration testing certification from TCM Security.

PoC Proof of Concept — code or a demonstration showing a vulnerability is real and exploitable, without necessarily being a polished tool.

RAG Retrieval-Augmented Generation — an AI technique where a model retrieves relevant documents before generating an answer, rather than relying only on what it memorized during training.

RAM Random Access Memory — a computer's fast, temporary working memory, cleared when it powers off.

RCE Remote Code Execution — a vulnerability that lets an attacker run arbitrary commands on a target system.

RDP Remote Desktop Protocol — Microsoft's protocol for remotely controlling a Windows machine's full graphical desktop.

REST Representational State Transfer — a common architectural style for designing web APIs around standard HTTP methods.

SAM Security Account Manager — the Windows database storing local (non-domain) account password hashes.

SANS SANS Institute — a well-known cybersecurity training and certification organization.

SGID Set Group ID — a Linux file permission bit that runs a program with its group owner's privileges instead of the invoking user's.

SMB Server Message Block — the protocol Windows uses for file sharing and much of its network communication.

SOC Security Operations Center — the team (and often the room) responsible for monitoring and responding to security alerts around the clock.

SPA Single-Page Application — a web app that loads once and updates itself with JavaScript, rather than requesting a new page from the server on every click.

SPN Service Principal Name — the identifier a Kerberos service registers in Active Directory, and what Kerberoasting targets.

SQL Structured Query Language — the standard language for querying and manipulating relational databases.

SQLi SQL Injection — a vulnerability where attacker-controlled input gets interpreted as part of a database query instead of just data.

SSH Secure Shell — an encrypted protocol for remotely logging into and running commands on another machine.

SSL Secure Sockets Layer — the predecessor to TLS; the two terms are still often used interchangeably even though SSL itself is obsolete.

SUID Set User ID — a Linux file permission bit that runs a program with its file owner's privileges instead of the invoking user's, a common privesc target.

SYSVOL System Volume — a shared folder replicated across all domain controllers, historically a source of leaked Group Policy Preferences credentials.

TCP Transmission Control Protocol — the connection-oriented protocol underlying most reliable internet traffic, including HTTP.

TGS Ticket Granting Service — the Kerberos component that issues service tickets, which Kerberoasting extracts and cracks offline.

TGT Ticket Granting Ticket — the initial Kerberos ticket proving a user authenticated, used to request further service tickets without re-entering a password.

THM TryHackMe — a beginner-friendly platform for learning cybersecurity through guided, hands-on rooms.

TLS Transport Layer Security — the encryption protocol that secures HTTPS and most other modern encrypted internet traffic.

TOCTOU Time-Of-Check to Time-Of-Use — a race-condition bug class where a resource is validated, then used slightly later, leaving a window to swap it out in between.

UDP User Datagram Protocol — a fast, connectionless network protocol with no delivery guarantees, used where speed matters more than reliability.

URI Uniform Resource Identifier — the general standard for identifying a resource, of which a URL is one specific kind.

URL Uniform Resource Locator — a web address, specifying both where a resource is and how to retrieve it.

USB Universal Serial Bus — the standard connector and protocol for external devices, from flash drives to hardware security keys.

UUID Universally Unique Identifier — a 128-bit identifier designed to be unique across systems without central coordination.

VM Virtual Machine — a software-emulated computer running inside a real one, isolated from the host.

VPN Virtual Private Network — an encrypted tunnel that routes your traffic through another server, hiding it from your local network and masking your IP.

VPS Virtual Private Server — a rented virtual machine running in someone else's data center, commonly used to host labs, tools, or C2 infrastructure.

WAF Web Application Firewall — a filter sitting in front of a web app that tries to block malicious-looking requests before they reach it.

WMI Windows Management Instrumentation — a Windows framework for querying and managing systems, frequently abused for remote execution and lateral movement.

XML Extensible Markup Language — a structured, tag-based text format used for configuration files, data exchange, and more.

XSS Cross-Site Scripting — a vulnerability that lets an attacker inject and run their own JavaScript in another user's browser session.