Adversarial thinking
Learn the attacker’s perspective through authorized, isolated practice.
Acquire Infrastructure
Infrastructure acquisition obtains domains, servers, or other resources used to support operations.
Active Scanning
Active scanning probes target infrastructure to learn reachable services or weaknesses.
AI agent security
Constrain AI agents through tool-level authorization, bounded credentials, trusted approvals, and tests of malicious content across execution and memory.
API security testing
Test API permissions and workflow invariants using separate actors, expected outcomes, and minimal reproducible evidence within an authorized scope.
Attack surface
Identify the reachable interfaces and trust relationships that could be misused.
Bot management and anti-automation
Protect valuable workflows against abusive automation while preserving legitimate integrations, accessibility, and measurable false-positive handling.
Broken access control
An application allows an action or resource access that its policy should deny.
Business logic vulnerabilities
Model allowed workflow states and transaction invariants, then test repeated, reordered, and concurrent actions that remain syntactically valid.
Certificate transparency
Public certificate records can reveal names, with important interpretation limits.
Clickjacking and framing controls
Clickjacking tricks a person into interacting with a page through an unexpected or disguised frame.
Compromise Accounts
Account compromise for targeting takes over an existing online identity to support later operations.
Compromise Infrastructure
Infrastructure compromise uses third-party resources without their owners' authorization.
Content Security Policy (CSP)
Content Security Policy lets a site tell the browser which resources and execution patterns it permits.
Context-aware output encoding
Output encoding represents untrusted text safely for the context where it is displayed.
Cross-site request forgery
A browser may send ambient credentials with an unintended request.
Cross-site scripting
Untrusted content can become executable code in another user’s browser.
Develop Capabilities
Capability development creates tools or materials for later operations.
DOM clobbering
DOM clobbering uses specially named HTML elements to interfere with browser properties or application variables.
DOM-based cross-site scripting
DOM-based XSS arises when browser-side code moves untrusted data into a dangerous execution or markup sink.
DVWA
A deliberately vulnerable application for isolated, authorized learning.
Establish Accounts
Account establishment creates online identities that can later support targeting or communications.
Ethical hacking
Assess weaknesses under permission, scope, and a duty to handle findings responsibly.
Evasion and evidence of activity
Understand concealment from a defender’s perspective while preserving test evidence.
Exploits, payloads, and shells
Distinguish the weakness used from the behavior that follows.
File upload security
File upload security limits what content enters a service, how it is processed, and where it can be retrieved.
Gather Victim Host Information
Host-information gathering collects technical details about potential target systems.
Gather Victim Identity Information
Identity-information gathering collects details about people that can support targeting.
Gather Victim Network Information
Network-information gathering collects details about an organization's network footprint.
Gather Victim Org Information
Organizational-information gathering learns structures and relationships useful for targeting.
GraphQL security
GraphQL security protects resolver authorization, input handling, and the computational cost of flexible queries.
HTML sanitization
HTML sanitization removes or rewrites unsafe markup while retaining approved formatting.
Injection
Identify where untrusted values cross into interpreter syntax, then use suitable parameterized interfaces and constrained authority for the specific context.
Input validation
Input validation checks that incoming values satisfy the application's expected structure and meaning.
Insecure direct object references (IDOR)
IDOR occurs when an application accepts a reference to an object without checking whether the caller may access that object.
JavaScript prototype pollution
Trace unsafe JavaScript property writes to inherited values and their later consumers, using explicit schemas and appropriate data structures to reduce risk.
Kali Linux
A tool distribution is a platform for authorized work, not a substitute for fundamentals.
LDAP injection
LDAP injection occurs when untrusted values change a directory query or distinguished name.
LLM prompt injection
Recognize attempts to promote untrusted text into instructions, then protect data and tool actions through independent authorization and constrained execution.
Mass assignment vulnerabilities
Mass assignment happens when a framework binds untrusted request fields directly to internal objects that contain sensitive properties.
Metasploit
A modular assessment framework whose actions must remain explicitly scoped.
Multi-tenant application isolation
Enforce verified tenant context across APIs, storage, search, caches, jobs, and exports, including changes in membership and shared resource consumption.
Nmap
Explore authorized network services while understanding what each option does.
NoSQL injection
NoSQL injection occurs when an application allows untrusted input to alter a database query's operators or meaning.
Obtain Capabilities
Capability acquisition obtains tools, exploits, or other materials from outside the operator.
Open redirects
An open redirect lets untrusted input choose an unintended navigation destination through a legitimate service.
OS command injection
OS command injection occurs when untrusted input changes a system command an application executes.
OWASP Top 10
Use the OWASP Top 10:2025 as a versioned awareness guide, then turn relevant categories into application-specific requirements and evidence.
Parameterized queries and prepared statements
Parameterized queries keep supplied values separate from a command's SQL structure.
Path traversal
Constrain file selection to authorized objects and resolved storage boundaries, accounting for normalization, symbolic links, and independent ownership checks.
Penetration testing
Validate exploitability and impact within an agreed assessment.
Phishing for Information
Information-seeking phishing attempts to extract useful information through deceptive messages.
Port scanning
Observe service reachability from one network position at one time.
Port states
Open, closed, and filtered describe observations, not permanent truth.
Reconnaissance
Build a target model before choosing active assessment steps.
Red teaming
Evaluate the organization’s ability to detect and respond to an agreed adversary scenario.
Reporting security assessments
Translate a controlled finding into a fix that an owner can validate.
Responsible disclosure
Communicate a weakness through an appropriate coordinated process.
REST API security
REST API security combines transport protection, authentication, operation-level authorization, input handling, and resource limits.
Rules of engagement
Define exactly what testing is authorized and how to handle unexpected events.
Search Closed Sources
Closed-source research obtains targeting information from restricted or paid sources.
Search Open Technical Databases
Open technical database research uses public inventories and records to learn about targets.
Search Open Websites/Domains
Open-web research gathers publicly available information that can support targeting.
Search Victim-Owned Websites
Research of an organization's own websites uses its published information to build targeting context.
Secure cross-window messaging
Cross-window messaging lets browser documents exchange data through postMessage.
Secure error handling
Design safe failure paths with useful public messages, protected diagnostic evidence, clear partial-operation behavior, and deliberate authorization-outage handling.
Security misconfiguration
Maintain verified configuration baselines across environments, exposed interfaces, effective permissions, and deployment drift so fixes survive future releases.
Server-side request forgery (SSRF)
SSRF occurs when an attacker influences a server to send requests to unintended destinations.
Service enumeration and fingerprinting
Turn a listening endpoint into a better-supported model of the service.
Sessions and cookies
Follow a browser session from login to logout, and understand cookie protections, expiry, revocation, and server-side permission checks.
Software supply chain security
Trace software from source and dependencies through builds, signing, artifacts, and deployment, with constrained release identities and verifiable provenance.
SQL injection
SQL injection occurs when untrusted input changes the structure of a database command.
Stage Capabilities
Capability staging places tools or content where they can later support an operation.
The phases of a security assessment
Use an organizing model while recognizing that professional work is iterative.
Third-party JavaScript security
Assess external scripts by browser execution authority, update control, data exposure, vendor ownership, and the sensitive pages on which they run.
Unsafe deserialization
Deserialization turns stored or transmitted data into application structures.
Virtual security labs
Create an isolated environment for learning without exposing vulnerable systems.
Virtual-machine network modes
Networking choices determine which systems a lab can reach and expose.
Virtual-machine snapshots
A known checkpoint helps restore a lab, with limits.
Vulnerability management
Turn findings into owned, prioritized, verified improvements.
Vulnerability scanning
Identify potential weaknesses while validating the findings and operational context.
Web application architecture
Map browser, edge, application, data, and integration boundaries so each user action has a clear identity, authorization, and evidence path.
XML external entity (XXE) injection
XXE arises when an XML parser resolves external entities from untrusted documents.
XML processing security
XML processing involves parsing, schemas, namespaces, transformations, and sometimes external resource resolution.
XPath injection
XPath injection changes a query against XML data by introducing attacker-controlled query syntax.