Cybersecurity glossary

An AST is a tree representation of the abstract syntactic structure of source code. Static analysis tools use ASTs to understand the program's struct…

ASLR is a memory protection technique that randomizes the memory addresses used by a process. This makes it more difficult for attackers to predict t…

Antivirus software is designed to detect, prevent, and remove malicious software, including cryptojacking scripts. Modern antivirus solutions often i…

API emulation mimics the behavior of specific APIs to analyze how software interacts with system resources or external services. This is useful for u…

The connection of different software systems through their Application Programming Interfaces (APIs). SIEM systems often use APIs to integrate with o…

Application blacklisting is a security measure that blocks the execution of specific applications known to be malicious or unwanted. It operates on a…

Application control restricts the execution of unauthorized applications on endpoints. While not always integrated into EDR, it complements EDR by pr…

An application firewall is a security system that monitors and controls network traffic based on the application protocol being used. It examines the…

Application hardening is the process of securing an application by reducing its attack surface and eliminating vulnerabilities. This includes removin…

An application layer firewall analyzes network traffic at the application layer (e.g., HTTP, SMTP) to identify and block malicious requests. It can p…

Capturing log data related to specific applications passing through the firewall. This provides insight into application usage, potential vulnerabili…

Application patching involves applying software updates to fix security vulnerabilities and improve application stability. Regular patching is crucia…

API security focuses on protecting APIs from unauthorized access and misuse. Contextualizing API requests with user authentication, authorization pol…

AST tools, including SAST and DAST, identify vulnerabilities in application code and runtime environments. Contextualizing these vulnerabilities with…

Application segmentation involves isolating applications from each other on the network to reduce the impact of a security breach. It restricts commu…

Application virtualization is a technology that allows applications to run in an isolated environment, separate from the underlying operating system…

Application whitelisting only allows pre-approved applications to run on a system, blocking all others by default. This is a strong defense against m…

Application-layer attacks target specific vulnerabilities in applications to exhaust server resources. These attacks often involve complex requests d…

AppLocker is a Microsoft Windows feature that provides application control functionality, allowing administrators to define rules for which applicati…

Mutation testing involves creating modified versions of the source code based on AST transformations to assess the effectiveness of security testing…

ASTs can be used to identify code clones or similar code fragments across different projects. This is useful for identifying potential vulnerabilitie…

This technique uses abstract syntax trees to analyze source code for potential vulnerabilities. By representing code structure, ASTs enable automated…

Audit Mode in AppLocker allows administrators to monitor application usage without enforcing the rules. This provides valuable insights into which ap…

Authentication hardening involves implementing strong authentication mechanisms to verify the identity of users and prevent unauthorized access. Mult…

A specific type of watermark designed to verify the authenticity and integrity of digital content. It helps detect tampering and ensure the content h…

ASTs are used in automated code review tools to enforce coding standards and identify potential security flaws. Automated reviews help catch errors e…

Implementing strict access controls to limit who can access and modify backup data. This prevents unauthorized users from deleting or altering backup…

Ensuring the security of data deduplication processes used in backups. Vulnerabilities in deduplication algorithms can lead to data corruption or una…

Implementing DLP measures to prevent sensitive data from being backed up to unauthorized locations. This helps protect against data breaches and comp…

While less direct, AST concepts are relevant to reverse engineering and analyzing compiled binaries. Decompilers attempt to reconstruct a high-level…

Blacklisting is a security mechanism where specific items are denied while everything else is allowed. While sometimes used to mitigate SSRF, it is l…

Blind SSRF occurs when an attacker cannot directly see the response from the server's internal request but can still trigger actions or observe side…

Broken authentication vulnerabilities allow attackers to compromise user credentials and impersonate users. Common causes include weak passwords, ses…

Browser emulation simulates the behavior of a web browser, allowing security analysts to test web applications for vulnerabilities. This is useful fo…

A browser extension is a small software program that adds functionality to a web browser. Malicious browser extensions can be used for cryptojacking…

A buffer overflow is a software vulnerability that occurs when a program attempts to write data beyond the allocated memory buffer. This can lead to…

Burp Extensions are plugins that extend the functionality of Burp Suite. These extensions can provide additional scanning capabilities, custom attack…

A popular web application security testing tool used to identify vulnerabilities in web applications. Penetration testers use Burp Suite to intercept…

Burp Intruder is a powerful tool for automating customized attacks against web applications. It allows users to perform fuzzing, brute-force attacks…

The Burp Suite Proxy acts as an intercepting proxy, allowing users to intercept, inspect, and modify HTTP/S traffic between their browser and web app…

Burp Repeater allows users to manually modify and resend individual HTTP requests. This is crucial for testing the behavior of web applications under…

Burp Scanner is an automated web vulnerability scanner that identifies a wide range of security flaws, such as SQL injection, cross-site scripting (X…

Business logic vulnerabilities are flaws in the design and implementation of an application's business rules. Burp Suite's manual testing capabilitie…

Linux capabilities are a set of fine-grained privileges that can be assigned to a process, providing a more granular control over access rights than…

A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a type of challenge-response test used to determine whether…

CERT (Computer Emergency Response Team) coding standards provide guidelines for developing secure and reliable software. Static analysis tools can he…

Certificate pinning is a security mechanism that allows an application to associate a specific certificate with a website or service. This prevents m…

A client honeypot actively searches for malicious servers by visiting websites and interacting with web services. It allows defenders to identify and…

Client-side emulation involves emulating the client-side components of a web application, such as JavaScript code. This allows security analysts to i…

Cloud DLP protects sensitive data stored or processed in cloud environments like AWS, Azure, or Google Cloud. It involves implementing DLP policies a…

Incorrectly configured cloud services used by shadow IT, leading to vulnerabilities like publicly accessible storage buckets or open databases. This…

Code coverage measures the extent to which a program's source code has been tested. While primarily used in dynamic testing, static analysis can help…

Code injection is a type of vulnerability where an attacker can inject malicious code into a running application. Zero-day exploits may utilize code…

Code obfuscation involves transforming code to make it more difficult for attackers to understand and reverse engineer. While not a perfect solution…

Code review is the systematic examination of computer source code, intended to find and fix mistakes overlooked in initial development phases. Static…

Code signing involves digitally signing software applications to verify the identity of the publisher and ensure the integrity of the code. This proc…

A code smell is a characteristic in the source code of a program that possibly indicates a deeper problem. While not always bugs, they can indicate p…

AST transformations can be used to automatically rewrite code to improve its security. Examples include adding security checks, sanitizing inputs, or…

Coinhive was a JavaScript miner that gained notoriety for enabling website owners to monetize their traffic by mining Monero using visitors' CPUs. Wh…

Command injection is an attack where an attacker executes arbitrary commands on the host operating system through a vulnerable application. This can…

Compilers leverage ASTs to apply security hardening techniques such as stack canaries and address space layout randomization (ASLR). These techniques…

Linux capabilities provide a finer-grained control over privileges than the traditional root/non-root model. Containers use capabilities to drop unne…

Container image scanning analyzes the layers of a container image for known vulnerabilities, malware, and configuration issues. This proactive approa…

Container runtime security focuses on securing the container runtime environment, which is responsible for running containers. This includes protecti…

Container security involves securing containerized applications and infrastructure. By default, containers should have limited access to the host sys…

A security context defines the security parameters for a container or pod, such as user ID, group ID, and capabilities. It controls the privileges an…

Content inspection is the process of analyzing the actual content of data, such as files, emails, or network traffic, to identify sensitive informati…

Watermarking can be used to track the origin and history of digital content, providing a means to establish content provenance. This is particularly…

CSP is a security standard that allows web developers to control the resources that a web page is allowed to load. By defining a whitelist of allowed…

Content-aware DLP analyzes the content of data to identify sensitive information based on predefined rules and patterns. This includes techniques lik…

Contextual analysis involves evaluating the surrounding context of data to determine its sensitivity and risk level. This helps DLP systems make more…

Control flow analysis examines the execution paths a program can take to find vulnerabilities related to incorrect logic or unexpected program states…

ASTs are used to generate Control Flow Graphs, which represent the execution paths within a program. CFGs are then analyzed for potential vulnerabili…

Cookies are used to store user-specific information on the client-side. Burp Suite allows testers to intercept and modify cookies to test for vulnera…

Using watermarks to identify unauthorized copies of digital content. The watermark acts as a unique identifier for the original source.

CORS is a mechanism that allows web pages from one origin to access resources from a different origin. While not directly related to JavaScript injec…

Counterfeit detection uses watermarks to verify the authenticity of products or documents. The presence and integrity of the watermark confirm that t…

An attack that forces a user to execute unwanted actions on a web application in which they're currently authenticated. Penetration testers will ofte…

XSS is a type of web security vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. These scripts c…

XSS prevention techniques aim to prevent attackers from injecting malicious scripts into web pages viewed by other users. This often involves encodin…

DEP is a security feature that prevents code from being executed in memory regions that are intended for data storage. This helps to mitigate buffer…

Data flow analysis tracks the movement of data through a program to identify potential vulnerabilities like uninitialized variables or tainted data u…

Data redaction involves permanently removing sensitive information from a document or file. DLP systems can automatically redact sensitive data befor…

DAM systems monitor database activity for suspicious behavior and policy violations. Contextualizing database queries with user roles, application co…

A database honeypot simulates a vulnerable database server. It allows defenders to monitor attempted database attacks, identify SQL injection attempt…

Logs generated by database management systems that record database operations, such as queries, updates, and authentication attempts. Analyzing datab…

This audit verifies the security of databases, including access controls, encryption, and data integrity. It helps protect sensitive data stored in d…

Database watermarking involves embedding watermarks into databases to protect against illegal copying or distribution of sensitive data. The watermar…

Dead code is code that is never executed, and its presence can indicate errors or unnecessary complexity. Static analysis can identify and remove dea…

A set of technologies used to control access to and use of digital content. Robust watermarking is often used as a component of DRM systems to track…

Directory traversal is a vulnerability that allows attackers to access restricted directories and files on a web server. By manipulating file paths…

Disk encryption is the process of encrypting an entire hard drive or storage device. Symmetric encryption algorithms are commonly used to protect the…

DLL hijacking is a technique where an attacker replaces a legitimate DLL (Dynamic Link Library) with a malicious one, which is then loaded by a progr…

DOM-based XSS vulnerabilities arise when the client-side JavaScript code processes untrusted data in a way that modifies the Document Object Model (D…

Analyzing a running program to identify vulnerabilities and runtime errors. Dynamic analysis involves testing the application with various inputs and…

DAST involves testing a running application to identify vulnerabilities by simulating real-world attacks. It focuses on identifying vulnerabilities t…

While primarily a runtime technique, Dynamic Taint Analysis can be informed by AST analysis to identify potential sources of tainted data. This allow…

Emulation is used in honeypots to mimic the behavior of real systems or applications. This can involve emulating specific protocols, services, or vul…

Endpoint DLP focuses on protecting data residing on individual devices like laptops and desktops. It monitors user activity, scans files, and prevent…

Enforcement Mode in AppLocker is the active state where rules are enforced, and unauthorized applications are blocked from running. This is the final…

Proper error handling and logging practices can help prevent information leakage and aid in identifying and responding to security incidents. Error m…

JavaScript event handlers (e.g., `onclick`, `onmouseover`) can be exploited in JavaScript injection attacks. Attackers can inject malicious code into…

File encryption involves encrypting individual files or folders to protect sensitive data. Symmetric encryption is often used for file encryption due…

A File Hash Rule in AppLocker allows or denies applications based on the cryptographic hash of the file. This is the most specific type of rule, ensu…

File Integrity Monitoring (FIM) involves monitoring critical system files and registry entries for unauthorized changes. EDR systems use FIM to detec…

Firmware emulation allows security researchers to analyze and test firmware images in a virtual environment. This is crucial for identifying vulnerab…

ASTs are used in formal verification tools to mathematically prove the correctness and security of code. This helps ensure that the code behaves as e…

A format string vulnerability occurs when a program uses user-supplied input as a format string in functions like printf. Attackers can exploit this…

A software testing technique that involves providing invalid, unexpected, or random data as inputs to a program. Fuzzing is used to identify vulnerab…

ASTs can be used to guide fuzzing efforts by generating valid code variations based on AST transformations. This helps improve the effectiveness of f…

Hardware emulation creates a virtual representation of hardware components, allowing software to run as if it were on the actual hardware. This is us…

A high-interaction honeypot is a complex system that provides attackers with a real operating system and applications. It allows for in-depth analysi…

HTML injection is a vulnerability where an attacker can inject arbitrary HTML code into a web page. While not directly JavaScript injection, it can b…

An HTTP flood attack overwhelms a web server with a large number of HTTP requests. These requests can be simple GET or POST requests, or more complex…

SSRF attacks can sometimes exploit HTTP redirects to bypass URL filtering or access restricted resources. If a server blindly follows redirects, it m…

HSTS forces browsers to communicate with the CDN over HTTPS, preventing man-in-the-middle attacks and ensuring secure communication. Enabling HSTS is…

Image registry security involves securing the repositories where container images are stored and managed. This includes access control, vulnerability…

In-browser mining refers to the execution of cryptocurrency mining scripts directly within a web browser, often embedded in websites without the user…

Input sanitization is the process of cleaning user-supplied data to remove potentially harmful characters or code before it is processed by the appli…

Input validation checks user-supplied data to ensure it conforms to expected formats and values. This helps prevent injection attacks and other vulne…