Skip to content

PenTest+ Glossary

🔁 This is the PenTest+ / penetration-testing methodology glossary. It deliberately does not repeat the broad offensive vocabulary already defined in the CEH glossary (malware, scanning, injection, etc.) or the PAM/identity terms in the WALLIX glossary. For acronym expansions, the Security+ acronyms reference is the master list — only PenTest+-specific terms are added here.

An alphabetical glossary of CompTIA PenTest+ (PT0-003) and penetration-testing methodology terms, each defined neutrally with a defensive framing. This is an educational, authorised-use reference: offensive techniques are described so you can scope them, detect them, and remediate them — never as weaponised recipes. Every engagement runs under a signed scope, Rules of Engagement, and written authorisation.

Cross-links point to the relevant PenTest+ domain page under ../domains/. Where a term is treated in more depth elsewhere, the link records where to read further.

Note for a sysadmin: many terms below (services, sessions, scheduled tasks, accounts) are everyday administration concepts seen from the tester's side. Read the definition, then ask "how would I detect, prevent, or remediate this on a box I run?"

A

  • Active reconnaissance — Information gathering that directly interacts with the target (scanning, banner grabbing), so it can be logged or detected. Contrast passive reconnaissance. See Reconnaissance & Enumeration.
  • Adversary emulation — Reproducing a specific real-world threat actor's tactics, techniques, and procedures (TTPs), typically mapped to MITRE ATT&CK, to test whether defences detect that adversary.
  • Attack narrative — The story-form section of a report that walks the reader step-by-step through how access was gained and escalated, with evidence, so defenders can reconstruct and break the chain.
  • Attack surface — The total set of points where a target could be entered or data extracted (open ports, services, inputs, accounts). Reducing it is a core defensive goal; mapped during recon. See Reconnaissance & Enumeration.
  • Authorisation (written) — The explicit signed permission ("get-out-of-jail" letter) that makes testing lawful; without it the same actions are crimes. See Engagement Management.

B

  • Beaconing — The periodic "check-in" traffic a compromised host sends to command-and-control (C2) infrastructure. Regular intervals and uncommon destinations make it a key detection signal for defenders.
  • Black-box testing — Testing with no prior internal knowledge, simulating an outside attacker (CompTIA's unknown-environment test). Contrast white-box, grey-box.

C

  • Command and Control (C2) — The channel and infrastructure used to direct compromised hosts during an engagement. Detecting and characterising C2 traffic is a primary blue-team task. Deeper: CEH glossary.
  • Cleanup (de-confliction) — Removing tools, test accounts, payloads, and artefacts left during testing so the environment is returned to its original state; documented in the report. Part of professional post-exploitation.
  • CVSS (Common Vulnerability Scoring System) — A standard 0.0–10.0 score for rating vulnerability severity, used to prioritise findings. A tester validates and adjusts it by business context.
  • CWE (Common Weakness Enumeration) — A categorisation of the underlying software weakness classes (e.g. buffer overflow) that give rise to specific CVEs.

D

  • Data exfiltration — Transferring data out of a target environment to demonstrate impact. In an authorised test it is simulated/limited and logged; detecting it (volume, destination, timing) is a core defensive control.

E

  • Enumeration — Actively extracting detailed information (users, shares, services, versions) from a target after scanning. See Reconnaissance & Enumeration.
  • Executive summary — The non-technical opening of a report aimed at leadership: business risk, overall posture, and priorities in plain language, separate from the technical findings.
  • Exfiltration — See data exfiltration.
  • Exploit — Code or a technique that takes advantage of a vulnerability to produce an unintended effect (e.g. code execution). The act of using one is exploitation. See Attacks & Exploits.

F

  • False negative — A real vulnerability that a scan or test missed — the dangerous kind, because it leaves exposure undetected. Manual validation reduces them.
  • False positive — A reported "finding" that is not actually exploitable. Pentesters validate manually to filter these before reporting, preserving credibility.
  • Foothold — The first persistent access obtained on a target, from which post-exploitation proceeds.
  • Fuzzing — Sending malformed or random input to provoke crashes and reveal vulnerabilities in software or web inputs.

G

  • Goal-based assessment — An engagement defined by an objective (e.g. "reach the customer database") rather than broad coverage, focusing effort on demonstrating a specific business risk.
  • Grey-box testing — Testing with partial internal knowledge (e.g. a standard user account); CompTIA's partially-known environment. Between black-box and white-box.

H

  • Horizontal privilege escalation — Gaining the access of another peer-level user rather than a higher tier. Contrast vertical privilege escalation.

L

  • Lateral movement — Moving from one compromised host to others inside a network to expand access. Detect via anomalous internal authentication and east-west traffic. See Post-exploitation & Lateral Movement. Related: pivoting.
  • Living off the land (LOTL) — Abusing legitimate, already-present tools (built-in OS utilities, signed binaries — "LOLBins") to operate without dropping detectable malware, frustrating signature-based defences.

M

  • MITRE ATT&CK — A curated knowledge base of real-world adversary tactics and techniques (TTPs), used to plan tests and map findings so defenders can prioritise detections. See ../exam-prep/cheat-sheet.md.
  • MSA (Master Service Agreement) — The umbrella contract of general legal and commercial terms; individual engagements are scoped under it by a Statement of Work.

N

  • NDA (Non-Disclosure Agreement) — A contract protecting confidential information a tester uncovers; findings and client data must not be disclosed outside agreed parties.
  • NIST SP 800-115 — The NIST Technical Guide to Information Security Testing and Assessment, a US-government reference methodology for security testing phases.

O

  • OSINT (Open-Source Intelligence) — Intelligence gathered from publicly available sources (records, search engines, social media, certificate logs) during passive recon — hard for the target to detect.
  • OSSTMM (Open Source Security Testing Methodology Manual) — A metrics-driven, repeatable operational security-testing methodology from ISECOM.
  • OWASP (Open Worldwide Application Security Project) — A community publishing web/app security guidance, including the Top 10 risks and the Web Security Testing Guide; the backbone of web exploitation testing.

P

  • Passive reconnaissance — Information gathering with no direct interaction with the target (public records, search engines), so it is hard to detect. Contrast active reconnaissance.
  • Payload — The part of an exploit that performs the intended action (e.g. a reverse shell, a beacon). See Attacks & Exploits.
  • Penetration test — An authorised, scoped, simulated attack to find and demonstrate exploitable weaknesses, delivered with evidence, a report, and remediation advice. Broader and more intrusive than a vulnerability assessment.
  • Persistence — Mechanisms that let access survive reboots and re-establish itself (scheduled tasks, services, accounts). Defenders hunt for unauthorised persistence; testers document and remove it. See Post-exploitation & Lateral Movement.
  • Pivoting — Using a compromised host as a relay to reach networks not directly accessible. Closely related to lateral movement.
  • Post-exploitation — Everything after the initial foothold: privilege escalation, lateral movement, persistence, data discovery, and demonstrating impact — all within scope. See Post-exploitation & Lateral Movement.
  • Pre-engagement — The first lifecycle stage: agreeing scope, Rules of Engagement, agreements (SOW/MSA/NDA), timing, contacts, and authorisation before any testing. See Engagement Management.
  • Privilege escalation — Gaining higher rights than initially granted — vertical (user → admin) or horizontal (a peer's access). See Post-exploitation & Lateral Movement.
  • Proof of Concept (PoC) — A minimal demonstration that a vulnerability is genuinely exploitable, short of full weaponisation; the evidence behind a finding.
  • PTES (Penetration Testing Execution Standard) — A seven-phase pentest process model (pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, reporting).

R

  • Reconnaissance — The information-gathering stage of an engagement, combining passive and active methods to profile the target. See Reconnaissance & Enumeration.
  • Remediation — The corrective actions a report recommends to fix or mitigate each finding; the whole point of testing is to drive remediation.
  • Retest — A follow-up engagement to verify that reported findings were actually fixed and that fixes did not introduce new issues. Closes the engagement lifecycle.
  • Risk appetite / tolerance — How much risk the client is willing to accept; shapes scope, prioritisation, and which findings demand urgent action.
  • Rules of Engagement (RoE) — The agreed scope, limits, permitted methods, timing windows, target list, emergency contacts, and stop conditions for an engagement. The operational rulebook that keeps testing authorised. See Engagement Management.

S

  • Scope — The explicit boundary of what may be tested (hosts, networks, apps, methods, times). Acting outside scope is unauthorised. Defined in pre-engagement.
  • Scope creep — The uncontrolled expansion of agreed scope during an engagement (extra targets, extra tasks). Managed via change control and an updated SOW/RoE — never assumed.
  • Statement of Work (SOW) — The document defining the specific deliverables, tasks, timeline, and scope of an engagement; sits under an MSA.

T

  • Threat modelling — Systematically identifying likely threats, assets, and attack paths to focus testing where business risk is highest; a planning step in PTES and secure design.
  • TTP (Tactics, Techniques, and Procedures) — The behavioural pattern of an adversary, mapped in frameworks like MITRE ATT&CK to plan tests and prioritise detections.

V

  • Validation (manual) — Confirming by hand that a scanner-reported issue is real and exploitable, eliminating false positives before it reaches the report.
  • Vertical privilege escalation — Gaining a higher privilege tier (e.g. standard user → administrator/root). Contrast horizontal privilege escalation.
  • Vulnerability assessment — A systematic review to identify and prioritise vulnerabilities; broader and less intrusive than a penetration test (it does not exploit). See Vulnerability Discovery & Analysis.

W

  • White-box testing — Testing with full internal knowledge (source, architecture, credentials); CompTIA's known-environment test. Maximises coverage. Contrast black-box, grey-box.

Where to go next

Sources

  • CompTIA — PenTest+ (PT0-003) exam objectives and terminology: https://www.comptia.org/en-us/certifications/pentest/
  • NIST — SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
  • PTES — Penetration Testing Execution Standard: http://www.pentest-standard.org/
  • OWASP — Top 10 and Web Security Testing Guide: https://owasp.org/www-project-top-ten/
  • OSSTMM — Open Source Security Testing Methodology Manual (ISECOM): https://www.isecom.org/OSSTMM.3.pdf
  • MITRE ATT&CK — adversary tactics, techniques, and procedures (TTPs): https://attack.mitre.org/
  • FIRST.org — Common Vulnerability Scoring System (CVSS): https://www.first.org/cvss/
  • NIST glossary of information-security terms (general definitions cross-checked): https://csrc.nist.gov/glossary