Cyber terms, plain English.

Active Directory (AD)

Microsoft's identity and access management system. Central target in most enterprise pentests.

ACL (Access Control List)

Per-object permission list. Misconfigured ACLs in AD are the source of many privilege escalation paths.

AS-REP roasting

Offline Kerberos password attack against accounts with pre-auth disabled.

Blue team

The defenders. Detection engineering, incident response, threat hunting.

BloodHound

Graph-based AD recon tool. Visualises attack paths from low-priv user to domain admin.

Buffer overflow

Writing past the end of a buffer to overwrite adjacent memory. The classic binary-exploitation primitive.

CTF (Capture The Flag)

Cybersecurity competition where you solve challenges to recover hidden flags.

CVE

Common Vulnerabilities and Exposures, a globally unique ID for a specific vulnerability.

CSRF

Cross-Site Request Forgery, tricking a user's browser into making a state-changing request on a site they're logged into.

DCSync

Replicating credentials from a domain controller using legitimate Active Directory protocols. Game-over once you can run it.

Detection engineering

The blue team craft of writing rules that fire when bad things happen, and don't fire too much otherwise.

EDR

Endpoint Detection and Response, agent on each machine that watches for malicious behaviour.

Exfiltration

Getting data out of a network you've compromised. Often the actual end goal of an attack.

Flag

A short string (usually flag{...}) hidden in a challenge. Submit it to prove you solved the thing.

Forensics

Recovering and analysing artefacts (disks, memory, network captures) to reconstruct what happened.

IDOR

Insecure Direct Object Reference, a web vuln where you change an ID in a URL to access someone else's data.

IOC

Indicator of Compromise, a hash, IP, domain, or filename associated with malicious activity.

IR (Incident Response)

The process of detecting, containing and recovering from a security incident.

Kerberoasting

Requesting service tickets for accounts with SPNs and cracking them offline. Yields service account passwords.

Lateral movement

Moving from one compromised machine to another inside the same network.

LOLBin

"Living off the land" binary, a legitimate Windows binary abused for malicious purposes.

MITRE ATT&CK

A public knowledge base of adversary tactics and techniques. The lingua franca of detection writing.

OSINT

Open Source Intelligence, investigation using publicly available information.

Pivot

Using one compromised machine as a stepping stone to reach another network segment.

Privilege escalation (privesc)

Going from low-privileged user to admin/root on the same machine.

Pwn

Binary exploitation. From "to pwn", to own, to compromise.

Red team

The attackers in a simulated engagement. Mimics real adversaries.

Reverse engineering

Taking a compiled binary apart to understand what it does. Ghidra, IDA, gdb.

SIEM

Security Information and Event Management, central log platform where detection rules run.

SOC

Security Operations Center, the team watching the SIEM. Where blue-team careers start.

SQLi

SQL injection, getting a web app to execute attacker-controlled SQL.

SSRF

Server-Side Request Forgery, making a server fetch a URL of the attacker's choice.

TTP

Tactics, Techniques and Procedures, how an adversary behaves, at three levels of granularity.

XSS

Cross-Site Scripting, injecting JavaScript that runs in another user's browser.

XXE

XML External Entity, abusing XML parsers to read local files or pivot.