VAPT Glossary

Plain-language definitions of the vulnerability assessment and penetration testing terms used across OpenVAPT and the Academy.

ASLR

Address space layout randomisation: the kernel places code and data at unpredictable memory addresses, which makes memory-corruption exploits harder.

Account Lockout

Temporarily blocking an account after repeated failed logins to stop password guessing.

Asset

Anything of value that needs protection, such as data, a service, a system or a reputation.

Attack Surface

All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.

Audit Log

A record written by the kernel's audit system of security-relevant events, such as a file opened or a privilege used.

Audit Rule

One line in the Linux audit configuration that tells the kernel which file writes or system calls to record, with the user, process and time attached.

Audit Trail

The ordered record of security-relevant events (logins, privilege use, changes to key files) that lets an investigator reconstruct what happened and who did it.

Authentication

Proving who a user or program is, for example with a password, a key or a one-time code.

Authorisation

Deciding what an authenticated user or program may do, such as which files it may read or which commands it may run.

Authorized Keys Options

Prefixes in an SSH authorized_keys line, such as from=, command= and restrict, that limit where a key may log in from and what it may do.

Baseline

A previous report or known-good state used for comparison, so changes and regressions can be seen.

Boundary Value

An input at the edge of a group, such as the largest allowed number; mistakes often appear exactly there.

Brute Force

Trying many passwords or keys in turn until one works.

CIA Triad

Confidentiality, integrity and availability: the three properties information security protects.

CSRF

Cross-site request forgery: tricking a logged-in user's browser into sending an unwanted request to another site.

CVE

Common Vulnerabilities and Exposures: an identifier for one specific, publicly known vulnerability in a product.

CVSS

Common Vulnerability Scoring System: a standard way to rate how severe a vulnerability is, from 0.0 to 10.0.

CWE

Common Weakness Enumeration: a catalogue of weakness types, such as incorrect permission assignment.

Capability

One of the separate privileges that together make up root's power, which can be granted or dropped individually.

Certificate

A signed digital document that binds a public key to names such as a website's domain, used by TLS to prove identity.

Change Management

A controlled process for making changes to systems, with testing, approval and a way to roll back.

Cipher

An algorithm that encrypts and decrypts data.

Cipher Suite

The named combination of key exchange, authentication, encryption and integrity algorithms a TLS connection agrees on; weak suites let recorded traffic be decrypted.

Cleartext

Data sent or stored without encryption, readable by anyone who can see it.

Clickjacking

Tricking a user into clicking something on a hidden, framed copy of another site.

Container

A group of processes isolated from the host and from each other by kernel namespaces, cgroups and capabilities.

Content Security Policy

An HTTP response header that tells browsers which sources of scripts and other content a page may load.

Content Trust

Verifying a signature on an image before pulling or running it, so a substituted image is refused.

Cookie Flags

Attributes such as Secure, HttpOnly and SameSite that control when and how a browser sends or exposes a cookie.

Core Dump

A file holding a crashed program's memory, written for debugging; it can contain passwords and keys the program held.

Correlation

Putting events from several logs or machines together in time order to see one incident as a whole.

Cross-Site Scripting

XSS: injecting script into a web page so it runs in other users' browsers.

DNS Recursion

A DNS server resolving names on behalf of clients; open to everyone, it can amplify denial-of-service attacks.

DNSSEC

Digital signatures on DNS records that let a resolver verify answers came from the zone owner and were not altered in transit.

Debug Mode

A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.

Default Credentials

User names and passwords that ship with a product or appear in its documentation, which attackers try first.

Default Deny

A firewall or access policy that blocks everything except what is explicitly allowed.

Defence in Depth

Using several independent layers of protection so that one failure does not lead to compromise.

Detection Logic

The exact rules a check uses to decide whether a weakness is present.

Directory Listing

A web server feature that shows every file in a folder when there is no index page.

Downgrade Attack

Forcing a connection to use a weaker protocol or no encryption, for example from HTTPS to HTTP.

Dry Run

Previewing what an operation would do without performing it.

End of Life

The date after which a product no longer receives security fixes from its maintainer.

Environment File

A .env or similar file of KEY=value settings that an application reads at start, usually holding secrets and the debug and environment switches.

Equivalence Partitioning

Grouping inputs that a system should treat the same way, then testing one representative of each group.

Evidence

The observed data, such as a configuration line, that supports a finding.

False Negative

A real problem that a tool fails to report.

False Positive

A reported problem that is not real.

File Integrity Monitoring

Recording hashes, permissions and owners of important files as a baseline and comparing against it on a schedule to detect unexpected changes.

Fingerprinting

Identifying the exact software and version a system runs, for example from banners, headers or version files.

Firewall

Software or hardware that allows or blocks network traffic according to rules.

HSTS

HTTP Strict Transport Security: a header that tells browsers to use only HTTPS for a site.

Hardening

Reducing a system's attack surface and weaknesses through configuration.

Idle Timeout

Closing an interactive session automatically after a period without input (TMOUT in the shell), so an unattended logged-in terminal does not stay open.

Immutable Audit Configuration

The -e 2 flag at the end of the audit rules, which locks them until the next reboot so that even root cannot switch auditing off quietly.

Information Disclosure

Exposing information, such as versions, paths or secrets, that helps an attacker.

Intrusion Prevention

Automatically blocking a source after repeated suspicious behaviour, for example failed logins seen in the log.

Kernel Module

A piece of kernel code loaded at run time, such as a driver or filesystem; loading one gives full control of the kernel, so loading is restricted on hardened systems.

Key Exchange

The method two parties use to agree on encryption keys over an untrusted network.

Known Exploited Vulnerability

A vulnerability that CISA has confirmed is being used in real attacks, listed in its KEV catalogue.

Least Privilege

Giving every account and process only the access it needs, nothing more.

Legacy Service

A network service such as Telnet, rsh, TFTP or NIS that predates modern encrypted alternatives and is rarely needed, but is still packaged and easy to leave installed.

Limitations

A report's honest statement of what was not tested or could not be determined.

Lock File

A file such as composer.lock or package-lock.json that pins the exact versions of every dependency an application installs.

Log Forwarding

Sending a copy of log messages to another machine as they are written, so an intruder who edits the local logs does not reach the only copy.

Log Rotation

Regularly closing, compressing and eventually deleting old log files so logs stay readable and never fill the disk.

Login Shell

The program started when an account logs in; a nologin or false shell means the account cannot be used interactively.

Loopback

The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6.

MAC

Message authentication code: a value that proves a message was not altered and came from someone with the key.

Model Server

A program that loads an AI model and answers requests over a network port, such as Ollama or LM Studio.

Mount Option

A flag applied when a filesystem is mounted, such as nodev, nosuid or noexec, that limits what files on it may do.

NIST SP 800-115

A NIST guide describing how to plan, perform and report technical security testing and assessment.

Namespace

A Linux kernel feature that gives processes their own view of resources such as process ids, network or mounts.

OCSP Stapling

The web server fetching a signed, time-limited statement that its certificate is not revoked and attaching it to the TLS handshake, so browsers need not ask the certificate authority.

Open Relay

A mail server that forwards mail from anyone to anyone, which spammers abuse.

PAM

Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d.

PATH Interception

Planting a program in a folder that appears early in PATH, or in a writable PATH folder, so a privileged job runs it instead of the intended command.

Password Hashing

Storing a one-way, salted, deliberately slow transformation of a password instead of the password itself.

Password History

Remembering a user's recent password hashes so that a changed password cannot be changed straight back to an old one.

Patch Management

The process of finding, testing and installing software updates, especially security fixes.

Path Interception

Getting a privileged user to run an attacker's program by placing it in a directory that appears on their PATH before the real command, for example through a . or empty PATH entry.

Penetration Testing

Authorised testing that tries to exploit weaknesses to demonstrate real impact.

Persistent Journal

A systemd journal stored on disk (Storage=persistent, under /var/log/journal) rather than only in memory, so it survives a reboot.

Port

A number that identifies a network service on a machine, such as 22 for SSH or 443 for HTTPS.

Privilege Escalation

Gaining higher privileges than intended, for example turning a normal user account into root.

Public-Key Authentication

Logging in by proving possession of a private key instead of typing a password.

Rate Limiting

Capping how many requests one client may send in a period, so a flood or a password guessing run slows down.

Regression Testing

Re-running tests after a change to catch things that used to work and broke again.

Remediation

Fixing a weakness or reducing its risk to an acceptable level.

Report Signing

Adding a digital signature to a report so recipients can confirm it was not edited.

Repository Signing

The digital signature over a package repository's index that apt and dnf verify before trusting any package in it; disabling the check lets a tampered mirror install code as root.

Reverse Proxy

A web server such as nginx or Apache that receives requests from the internet and forwards them to an application server listening on loopback.

Risk

The combination of how likely harm is and how serious it would be.

Rootless Mode

Running the container daemon and its containers inside a user namespace as an ordinary account, so a breakout does not land in root.

Rules of Engagement

The agreed rules for a security test: what may be tested, when, how and by whom.

SARIF

Static Analysis Results Interchange Format: an OASIS standard JSON format for tool findings.

SCRAM-SHA-256

A password authentication method that stores a salted, iterated verifier and proves knowledge of the password without sending it; the PostgreSQL default since version 14.

STARTTLS

An extension by which a plaintext mail session upgrades to TLS; opportunistic unless the server requires it.

SUID

Set-user-ID: a file permission that makes a program run with its owner's privileges, often root.

Sandboxing

Running a program with restricted access to files, devices and privileges, so a compromise of it does less damage.

Scope

The exact systems and activities an assessment is allowed to cover.

Seccomp Profile

A list of system calls a process may make; a container runtime applies a default profile that blocks dangerous calls, and unconfined removes it.

Secret Sprawl

Secrets copied into configuration files, backups, scripts and environment files where more people and processes can read them than intended.

Secrets Management

Keeping passwords, keys and tokens out of code and public places, and rotating them safely.

Secure Boot

A UEFI firmware feature that refuses to run boot loaders and kernels that are not signed by a trusted key.

Security Misconfiguration

A weakness caused by insecure settings rather than a software bug.

Separation of Duties

Splitting a sensitive task between people or roles so that no single account can both make and approve a change unseen.

Service Unit

A systemd configuration file that describes how to start, stop and run a background service, including its program and user account.

Severity

How serious a finding is, often expressed as Critical, High, Medium or Low.

Shadow File

/etc/shadow, the root-only file that holds password hashes and ageing data for the accounts listed in /etc/passwd.

Shift Left

Moving testing earlier in development, so problems are found close to the change that caused them.

Slowloris

An attack that opens many requests and sends them very slowly, keeping every web server worker busy.

Software Inventory

A list of installed packages and libraries with their exact versions, the starting point for vulnerability matching.

Stale Rule

A firewall rule that no longer matches a running service and so leaves an unexplained opening.

Sticky Bit

A permission on shared directories such as /tmp that stops users deleting each other's files.

Sysctl

The kernel's run-time settings, each one a file under /proc/sys; the sysctl command reads and writes them and /etc/sysctl.d makes a value permanent.

TLS

Transport Layer Security: the protocol that encrypts connections such as HTTPS.

Test Fixture

Prepared data or a simulated environment used to test software repeatably.

Threat

Anything that could cause harm to an asset, such as an attacker or a failure.

Time Synchronisation

Keeping a machine's clock in step with trusted time servers, so events on different systems can be ordered correctly.

Traceability

Links between requirements, the tests that check them and the findings that break them.

Triage

Sorting findings by importance and validity to decide what to handle first.

Trusted Host

A setting that lists the host names an application accepts in the Host header, so attackers cannot make it build links to their own domain.

Umask

The permission bits removed from every new file a process creates; 027 keeps new files unreadable to other users, 022 does not.

VAPT

Vulnerability Assessment and Penetration Testing: finding and rating weaknesses, then proving their impact.

Vector Database

A database that stores numeric representations of documents for AI search; it often holds copies of private text.

Verification

Confirming that a fix actually removed the weakness.

Vulnerability

A weakness that a threat could use to cause harm.

Vulnerability Assessment

Finding and rating known weaknesses without exploiting them.

Web Application Firewall

A filter in front of a web application that inspects requests against rules and blocks or logs attacks; a defence-in-depth layer, not a substitute for fixing the application.

umask

The default permission mask applied to every new file and directory; a stricter mask keeps new files private.

Offline: openvapt learn glossary or openvapt learn --term CVSS.