---
title: "VAPT Glossary"
canonical: https://openvapt.com/glossary.html
html: https://openvapt.com/glossary.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# VAPT Glossary

Plain-language definitions of the vulnerability assessment and penetration testing terms used across OpenVAPT and the Academy.

- **ASLR**: Address space layout randomisation: the kernel places code and data at unpredictable memory addresses, which makes memory-corruption exploits harder.
- **Account Lockout**: Temporarily blocking an account after repeated failed logins to stop password guessing.
- **Asset**: Anything of value that needs protection, such as data, a service, a system or a reputation.
- **Attack Surface**: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.
- **Audit Log**: A record written by the kernel's audit system of security-relevant events, such as a file opened or a privilege used.
- **Audit Rule**: One line in the Linux audit configuration that tells the kernel which file writes or system calls to record, with the user, process and time attached.
- **Audit Trail**: The ordered record of security-relevant events (logins, privilege use, changes to key files) that lets an investigator reconstruct what happened and who did it.
- **Authentication**: Proving who a user or program is, for example with a password, a key or a one-time code.
- **Authorisation**: Deciding what an authenticated user or program may do, such as which files it may read or which commands it may run.
- **Authorized Keys Options**: Prefixes in an SSH authorized_keys line, such as from=, command= and restrict, that limit where a key may log in from and what it may do.
- **Baseline**: A previous report or known-good state used for comparison, so changes and regressions can be seen.
- **Boundary Value**: An input at the edge of a group, such as the largest allowed number; mistakes often appear exactly there.
- **Brute Force**: Trying many passwords or keys in turn until one works.
- **CIA Triad**: Confidentiality, integrity and availability: the three properties information security protects.
- **CSRF**: Cross-site request forgery: tricking a logged-in user's browser into sending an unwanted request to another site.
- **CVE**: Common Vulnerabilities and Exposures: an identifier for one specific, publicly known vulnerability in a product.
- **CVSS**: Common Vulnerability Scoring System: a standard way to rate how severe a vulnerability is, from 0.0 to 10.0.
- **CWE**: Common Weakness Enumeration: a catalogue of weakness types, such as incorrect permission assignment.
- **Capability**: One of the separate privileges that together make up root's power, which can be granted or dropped individually.
- **Certificate**: A signed digital document that binds a public key to names such as a website's domain, used by TLS to prove identity.
- **Change Management**: A controlled process for making changes to systems, with testing, approval and a way to roll back.
- **Cipher**: An algorithm that encrypts and decrypts data.
- **Cipher Suite**: The named combination of key exchange, authentication, encryption and integrity algorithms a TLS connection agrees on; weak suites let recorded traffic be decrypted.
- **Cleartext**: Data sent or stored without encryption, readable by anyone who can see it.
- **Clickjacking**: Tricking a user into clicking something on a hidden, framed copy of another site.
- **Container**: A group of processes isolated from the host and from each other by kernel namespaces, cgroups and capabilities.
- **Content Security Policy**: An HTTP response header that tells browsers which sources of scripts and other content a page may load.
- **Content Trust**: Verifying a signature on an image before pulling or running it, so a substituted image is refused.
- **Cookie Flags**: Attributes such as Secure, HttpOnly and SameSite that control when and how a browser sends or exposes a cookie.
- **Core Dump**: A file holding a crashed program's memory, written for debugging; it can contain passwords and keys the program held.
- **Correlation**: Putting events from several logs or machines together in time order to see one incident as a whole.
- **Cross-Site Scripting**: XSS: injecting script into a web page so it runs in other users' browsers.
- **DNS Recursion**: A DNS server resolving names on behalf of clients; open to everyone, it can amplify denial-of-service attacks.
- **DNSSEC**: Digital signatures on DNS records that let a resolver verify answers came from the zone owner and were not altered in transit.
- **Debug Mode**: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.
- **Default Credentials**: User names and passwords that ship with a product or appear in its documentation, which attackers try first.
- **Default Deny**: A firewall or access policy that blocks everything except what is explicitly allowed.
- **Defence in Depth**: Using several independent layers of protection so that one failure does not lead to compromise.
- **Detection Logic**: The exact rules a check uses to decide whether a weakness is present.
- **Directory Listing**: A web server feature that shows every file in a folder when there is no index page.
- **Downgrade Attack**: Forcing a connection to use a weaker protocol or no encryption, for example from HTTPS to HTTP.
- **Dry Run**: Previewing what an operation would do without performing it.
- **End of Life**: The date after which a product no longer receives security fixes from its maintainer.
- **Environment File**: A .env or similar file of KEY=value settings that an application reads at start, usually holding secrets and the debug and environment switches.
- **Equivalence Partitioning**: Grouping inputs that a system should treat the same way, then testing one representative of each group.
- **Evidence**: The observed data, such as a configuration line, that supports a finding.
- **False Negative**: A real problem that a tool fails to report.
- **False Positive**: A reported problem that is not real.
- **File Integrity Monitoring**: Recording hashes, permissions and owners of important files as a baseline and comparing against it on a schedule to detect unexpected changes.
- **Fingerprinting**: Identifying the exact software and version a system runs, for example from banners, headers or version files.
- **Firewall**: Software or hardware that allows or blocks network traffic according to rules.
- **HSTS**: HTTP Strict Transport Security: a header that tells browsers to use only HTTPS for a site.
- **Hardening**: Reducing a system's attack surface and weaknesses through configuration.
- **Idle Timeout**: Closing an interactive session automatically after a period without input (TMOUT in the shell), so an unattended logged-in terminal does not stay open.
- **Immutable Audit Configuration**: The -e 2 flag at the end of the audit rules, which locks them until the next reboot so that even root cannot switch auditing off quietly.
- **Information Disclosure**: Exposing information, such as versions, paths or secrets, that helps an attacker.
- **Intrusion Prevention**: Automatically blocking a source after repeated suspicious behaviour, for example failed logins seen in the log.
- **Kernel Module**: A piece of kernel code loaded at run time, such as a driver or filesystem; loading one gives full control of the kernel, so loading is restricted on hardened systems.
- **Key Exchange**: The method two parties use to agree on encryption keys over an untrusted network.
- **Known Exploited Vulnerability**: A vulnerability that CISA has confirmed is being used in real attacks, listed in its KEV catalogue.
- **Least Privilege**: Giving every account and process only the access it needs, nothing more.
- **Legacy Service**: A network service such as Telnet, rsh, TFTP or NIS that predates modern encrypted alternatives and is rarely needed, but is still packaged and easy to leave installed.
- **Limitations**: A report's honest statement of what was not tested or could not be determined.
- **Lock File**: A file such as composer.lock or package-lock.json that pins the exact versions of every dependency an application installs.
- **Log Forwarding**: Sending a copy of log messages to another machine as they are written, so an intruder who edits the local logs does not reach the only copy.
- **Log Rotation**: Regularly closing, compressing and eventually deleting old log files so logs stay readable and never fill the disk.
- **Login Shell**: The program started when an account logs in; a nologin or false shell means the account cannot be used interactively.
- **Loopback**: The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6.
- **MAC**: Message authentication code: a value that proves a message was not altered and came from someone with the key.
- **Model Server**: A program that loads an AI model and answers requests over a network port, such as Ollama or LM Studio.
- **Mount Option**: A flag applied when a filesystem is mounted, such as nodev, nosuid or noexec, that limits what files on it may do.
- **NIST SP 800-115**: A NIST guide describing how to plan, perform and report technical security testing and assessment.
- **Namespace**: A Linux kernel feature that gives processes their own view of resources such as process ids, network or mounts.
- **OCSP Stapling**: The web server fetching a signed, time-limited statement that its certificate is not revoked and attaching it to the TLS handshake, so browsers need not ask the certificate authority.
- **Open Relay**: A mail server that forwards mail from anyone to anyone, which spammers abuse.
- **PAM**: Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d.
- **PATH Interception**: Planting a program in a folder that appears early in PATH, or in a writable PATH folder, so a privileged job runs it instead of the intended command.
- **Password Hashing**: Storing a one-way, salted, deliberately slow transformation of a password instead of the password itself.
- **Password History**: Remembering a user's recent password hashes so that a changed password cannot be changed straight back to an old one.
- **Patch Management**: The process of finding, testing and installing software updates, especially security fixes.
- **Path Interception**: Getting a privileged user to run an attacker's program by placing it in a directory that appears on their PATH before the real command, for example through a . or empty PATH entry.
- **Penetration Testing**: Authorised testing that tries to exploit weaknesses to demonstrate real impact.
- **Persistent Journal**: A systemd journal stored on disk (Storage=persistent, under /var/log/journal) rather than only in memory, so it survives a reboot.
- **Port**: A number that identifies a network service on a machine, such as 22 for SSH or 443 for HTTPS.
- **Privilege Escalation**: Gaining higher privileges than intended, for example turning a normal user account into root.
- **Public-Key Authentication**: Logging in by proving possession of a private key instead of typing a password.
- **Rate Limiting**: Capping how many requests one client may send in a period, so a flood or a password guessing run slows down.
- **Regression Testing**: Re-running tests after a change to catch things that used to work and broke again.
- **Remediation**: Fixing a weakness or reducing its risk to an acceptable level.
- **Report Signing**: Adding a digital signature to a report so recipients can confirm it was not edited.
- **Repository Signing**: The digital signature over a package repository's index that apt and dnf verify before trusting any package in it; disabling the check lets a tampered mirror install code as root.
- **Reverse Proxy**: A web server such as nginx or Apache that receives requests from the internet and forwards them to an application server listening on loopback.
- **Risk**: The combination of how likely harm is and how serious it would be.
- **Rootless Mode**: Running the container daemon and its containers inside a user namespace as an ordinary account, so a breakout does not land in root.
- **Rules of Engagement**: The agreed rules for a security test: what may be tested, when, how and by whom.
- **SARIF**: Static Analysis Results Interchange Format: an OASIS standard JSON format for tool findings.
- **SCRAM-SHA-256**: A password authentication method that stores a salted, iterated verifier and proves knowledge of the password without sending it; the PostgreSQL default since version 14.
- **STARTTLS**: An extension by which a plaintext mail session upgrades to TLS; opportunistic unless the server requires it.
- **SUID**: Set-user-ID: a file permission that makes a program run with its owner's privileges, often root.
- **Sandboxing**: Running a program with restricted access to files, devices and privileges, so a compromise of it does less damage.
- **Scope**: The exact systems and activities an assessment is allowed to cover.
- **Seccomp Profile**: A list of system calls a process may make; a container runtime applies a default profile that blocks dangerous calls, and unconfined removes it.
- **Secret Sprawl**: Secrets copied into configuration files, backups, scripts and environment files where more people and processes can read them than intended.
- **Secrets Management**: Keeping passwords, keys and tokens out of code and public places, and rotating them safely.
- **Secure Boot**: A UEFI firmware feature that refuses to run boot loaders and kernels that are not signed by a trusted key.
- **Security Misconfiguration**: A weakness caused by insecure settings rather than a software bug.
- **Separation of Duties**: Splitting a sensitive task between people or roles so that no single account can both make and approve a change unseen.
- **Service Unit**: A systemd configuration file that describes how to start, stop and run a background service, including its program and user account.
- **Severity**: How serious a finding is, often expressed as Critical, High, Medium or Low.
- **Shadow File**: /etc/shadow, the root-only file that holds password hashes and ageing data for the accounts listed in /etc/passwd.
- **Shift Left**: Moving testing earlier in development, so problems are found close to the change that caused them.
- **Slowloris**: An attack that opens many requests and sends them very slowly, keeping every web server worker busy.
- **Software Inventory**: A list of installed packages and libraries with their exact versions, the starting point for vulnerability matching.
- **Stale Rule**: A firewall rule that no longer matches a running service and so leaves an unexplained opening.
- **Sticky Bit**: A permission on shared directories such as /tmp that stops users deleting each other's files.
- **Sysctl**: The kernel's run-time settings, each one a file under /proc/sys; the sysctl command reads and writes them and /etc/sysctl.d makes a value permanent.
- **TLS**: Transport Layer Security: the protocol that encrypts connections such as HTTPS.
- **Test Fixture**: Prepared data or a simulated environment used to test software repeatably.
- **Threat**: Anything that could cause harm to an asset, such as an attacker or a failure.
- **Time Synchronisation**: Keeping a machine's clock in step with trusted time servers, so events on different systems can be ordered correctly.
- **Traceability**: Links between requirements, the tests that check them and the findings that break them.
- **Triage**: Sorting findings by importance and validity to decide what to handle first.
- **Trusted Host**: A setting that lists the host names an application accepts in the Host header, so attackers cannot make it build links to their own domain.
- **Umask**: The permission bits removed from every new file a process creates; 027 keeps new files unreadable to other users, 022 does not.
- **VAPT**: Vulnerability Assessment and Penetration Testing: finding and rating weaknesses, then proving their impact.
- **Vector Database**: A database that stores numeric representations of documents for AI search; it often holds copies of private text.
- **Verification**: Confirming that a fix actually removed the weakness.
- **Vulnerability**: A weakness that a threat could use to cause harm.
- **Vulnerability Assessment**: Finding and rating known weaknesses without exploiting them.
- **Web Application Firewall**: A filter in front of a web application that inspects requests against rules and blocks or logs attacks; a defence-in-depth layer, not a substitute for fixing the application.
- **umask**: The default permission mask applied to every new file and directory; a stricter mask keeps new files private.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/glossary.html. Part of OpenVAPT. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.