75 Ethical Hacking Terminologies Flashcard Deck & CTF Speed Quiz (2026)

A **Vulnerability** is the underlying flaw or weakness in software, hardware, or configuration (e.g., an unescaped SQL string concatenation or a stack buffer overflow). An **Exploit** is the weaponized mechanism or input sequence that triggers that vulnerability to hijack control flow. A **Payload** is the code or action executed *after* the exploit succeeds (e.g., spawning a reverse shell or deploying a Meterpreter beacon).

**Pass-the-Hash** uses a captured NTLM password hash directly to authenticate over SMB/WMI without ever cracking the plaintext password. **Kerberoasting** can be performed by any regular domain user: you request a Kerberos Service Ticket (`TGS-REP`) for an account with a Service Principal Name (`SPN`), extract the ticket (which is encrypted with the service account's NTLM hash), and crack it offline on GPUs with Hashcat (`-m 13100`).

**Lateral Movement** refers to expanding access from one compromised host to other hosts across an internal network (e.g., via SMB, WinRM, or SSH). **Pivoting** specifically means routing network traffic *through* a compromised multi-homed host (via SOCKS proxies, Chisel, Ligolo-ng, or SSH `-D` dynamic port forwarding) to reach an isolated internal subnet that isn't directly routable from the attacker's machine.

**CSRF** tricks a *victim user's web browser* into sending an authenticated state-changing request to a web app using cached session cookies. **SSRF** tricks the *backend web server itself* into making arbitrary HTTP/TCP requests on the attacker's behalf—often targeting cloud instance metadata services (`http://169.254.169.254/latest/meta-data/`) or internal Redis/database ports behind the firewall.

LOLBins (on Windows, e.g., `certutil.exe`, `mshta.exe`, `rundll32.exe`) and GTFOBins (on Linux, e.g., `find`, `vim`, `tar`, `python` with `sudo` or `SUID` bits) are legitimate, Microsoft- or OS-signed system binaries that attackers repurpose to download payloads, bypass AppLocker/EDR, or escalate privileges without dropping custom malware executables to disk.