Cybersecurity glossary

Insecure Direct Object Reference (IDOR) is a vulnerability where an application exposes a reference to an internal implementation object, such as a f…

Instruction set emulation allows code compiled for one CPU architecture to run on a different architecture. This is often used in malware analysis to…

Interprocedural analysis analyzes the behavior of a program across multiple functions or procedures. It's important for detecting vulnerabilities tha…

Vulnerabilities in JavaScript frameworks like React, Angular, and Vue.js can be exploited to inject malicious JavaScript. Keeping these frameworks up…

JavaScript injection involves inserting malicious JavaScript code into a website or web application. This technique is commonly used in cryptojacking…

JSONP injection is a vulnerability that arises when a website uses JSONP (JSON with Padding) to retrieve data from a third-party API. If the API is c…

Kernel emulation simulates the core functionality of an operating system kernel. This is beneficial for analyzing rootkits and other low-level malwar…

A kernel exploit targets vulnerabilities in the operating system kernel, the core of the OS. Zero-day kernel exploits are particularly dangerous beca…

Kernel exploitation involves finding and exploiting vulnerabilities within the operating system's kernel to gain complete control over the system. Su…

A kernel-mode honeypot operates at the kernel level of the operating system, providing deeper insights into attacker activity. However, it is more co…

Keyword matching involves searching for specific words or phrases within data to identify potentially sensitive information. While less precise than…

By using intermediate representations like ASTs, vulnerability detection tools can be made more language-agnostic. This allows the same tools to be u…

LDAP injection is an attack technique used to exploit web applications that construct LDAP statements from user-supplied input. It allows attackers t…

The Least Known Publisher rule configuration within AppLocker helps to identify and manage applications from less established or unknown software pub…

LFI is a vulnerability that allows an attacker to include local files on a web server. Attackers exploit this by manipulating input parameters to inc…

A widely used open-source logging library for Java applications. Vulnerabilities in Log4j, such as Log4Shell, can allow remote code execution and hav…

Memory corruption vulnerabilities, such as buffer overflows and use-after-free errors, are frequently exploited in zero-day attacks. Attackers can le…

Memory emulation simulates the memory space of a system, allowing analysts to observe how programs manipulate data in memory. This is helpful for det…

Memory protection techniques, such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), make it more difficult for attac…

Cloud providers often expose meta-data APIs accessible from within the cloud instances, providing information about the instance itself. SSRF can be…

MISRA (Motor Industry Software Reliability Association) standards are a set of coding guidelines for critical systems, particularly in the automotive…

mXSS exploits the way browsers parse and render HTML, using quirks in the parsing engine to transform seemingly harmless input into executable JavaSc…

"No Coin" is a browser extension and filter list designed to block cryptocurrency miners on websites. It helps users prevent their computers from bei…

OCR technology is used in DLP to extract text from images and scanned documents. This enables DLP systems to analyze the content of images and preven…

Output encoding converts potentially dangerous characters into a safe format when displaying user-supplied data. This prevents injected JavaScript co…

A list of the ten most critical web application security risks. It provides developers and security professionals with awareness and guidance on addr…

An open-source web application security scanner. It is a free alternative to Burp Suite and is used to find vulnerabilities in web applications durin…

Parameter tampering involves modifying parameters in a web request to manipulate application behavior. Attackers can alter values in the URL or form…

A Path Rule in AppLocker allows or denies applications based on their file path. While easy to configure, Path Rules can be less secure than other ru…

Perceptible watermarking involves embedding a watermark that is visible or audible to the end-user, although ideally it should be minimally intrusive…

PowerShell Constrained Language Mode limits the features and functionality of PowerShell scripts that can be executed. This can be used in conjunctio…

PAM focuses on managing and controlling access to privileged accounts and resources. By limiting who has access to sensitive data and systems, PAM ca…

Users may gain excessive privileges on shadow IT systems, increasing the potential for abuse and data breaches. Proper privileged access management (…

Process emulation simulates the execution of a process, allowing security analysts to observe its behavior and interactions with other processes. Thi…

A Publisher Rule in AppLocker allows or denies applications based on their digital signature and publisher information. These rules are useful for al…

A race condition occurs when the output of a program becomes unexpectedly and critically dependent on the sequence or timing of other events. Exploit…

AST analysis can help identify code sections that need to be refactored for security reasons. This involves restructuring the code to improve its sec…

Reflected XSS occurs when user-supplied input is immediately outputted in the response without proper sanitization. An attacker can craft a malicious…

Regular expressions are patterns used to match specific text strings, making them useful for identifying sensitive data patterns like social security…

Regular expressions are used in DLP to define patterns for identifying sensitive data within files and network traffic. They allow for flexible and a…

A vulnerability that allows an attacker to execute arbitrary code on a remote server. RCE vulnerabilities are highly critical and are often targeted…

RDP is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network c…

RFI is a vulnerability that allows an attacker to include remote files on a web server. This can lead to arbitrary code execution if the included fil…

Reputation-based application control uses threat intelligence feeds and reputation services to assess the trustworthiness of applications. Applicatio…

HTTP Request Smuggling vulnerabilities can sometimes be chained with SSRF to amplify the impact or bypass certain protections. It involves manipulati…

Validating the response from the requested URL can help detect and prevent SSRF attacks. By inspecting the content or headers of the response, the ap…

Reverse engineering is the process of analyzing a software or hardware system to understand its functionality and design, often without access to the…

A reverse proxy server sits in front of web servers in the DMZ and retrieves resources on behalf of clients. This protects the origin web servers fro…

In AppLocker, rule collections are groups of rules that apply to specific file types (e.g., executables, scripts, Windows Installer files). Each rule…

Runtime Application Self-Protection (RASP) is a security technology that embeds protection directly into an application, allowing it to detect and pr…

Runtime emulation refers to emulating the execution of code during runtime, allowing for dynamic analysis and debugging. This is essential for unders…

The SOP is a web browser security mechanism that restricts scripts from one origin from accessing resources from a different origin. While it doesn't…

An isolated environment used to safely execute and analyze potentially malicious code. Sandboxes can be used to test suspicious files and identify ra…

The sandbox attribute on an `` element restricts the capabilities of the content within the iframe. This can be used to limit the impact of injected…

Sandboxing is a security mechanism that isolates applications or processes in a controlled environment. This prevents them from accessing sensitive s…

SAST tools analyze source code, bytecode, or binary code for security vulnerabilities without executing the code. SAST is a crucial part of the SDLC…

The process of capturing visual data from a computer display. Insiders may use screen scraping to extract sensitive information from applications or…

Seccomp is a Linux kernel feature that restricts the system calls a process can make. In container security, seccomp profiles are used to limit the s…

Secure coding practices include techniques to minimize vulnerabilities in software. Default deny principles are applied by validating inputs and expl…

Secure configuration management involves establishing and maintaining secure configurations for all components of an application and its environment…

Security headers are HTTP response headers that can be used to enable various security features in web browsers. These headers can help prevent attac…

A segmentation fault is a specific type of error caused by a program attempting to access memory that it is not allowed to access, possibly due to a…

Semantic code analysis leverages ASTs to understand the meaning and context of code. It goes beyond syntax to identify logical errors and security we…

SSRF is a vulnerability that allows an attacker to make requests to internal resources from a vulnerable server. This can be used to access sensitive…

Secure session management is crucial for maintaining the security of user sessions after authentication. This involves generating strong session IDs…

Session management vulnerabilities occur when an application fails to properly manage user sessions, leading to potential security breaches. Burp Sui…

Setuid (set user ID) and setgid (set group ID) are file permission flags that allow a program to be executed with the privileges of the file's owner…

SNMP amplification attacks exploit Simple Network Management Protocol (SNMP) servers to amplify traffic towards a target. Attackers send SNMP queries…

SCA tools use ASTs to analyze the dependencies of a software project and identify known vulnerabilities in third-party libraries. This helps ensure t…

Software Restriction Policies (SRP) are a Group Policy-based feature that allows administrators to control which software applications can run on a W…

Unpatched or outdated software used in shadow IT environments, creating exploitable vulnerabilities. Attackers can leverage these vulnerabilities to…

A spam honeypot is designed to attract and capture spam emails. It allows administrators to analyze spam trends, identify spammers, and improve spam…

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry fie…

SQL injection prevention involves sanitizing user input to prevent attackers from injecting malicious SQL code into database queries. Prepared statem…

Proper configuration of static analysis tools is critical to their effectiveness. This includes selecting appropriate rules, setting sensitivity leve…

Static analysis techniques can be enhanced by using emulation to resolve indirect calls and understand dynamic code behavior. This hybrid approach im…

SAST tools use ASTs to analyze source code without executing it, identifying vulnerabilities early in the development lifecycle. This helps developer…

Analyzing source code without executing the program to identify potential vulnerabilities and coding flaws. Static analysis can detect issues like bu…

Stored XSS, also known as persistent XSS, occurs when malicious JavaScript code is injected into a website's database or other persistent storage. Wh…

SRI is a security feature that allows browsers to verify that files fetched from a CDN or other third-party source haven't been tampered with. It hel…

Sudo is a program that allows users to run commands with the privileges of another user, typically the root user. Misconfiguration of sudo rules can…

Securing the process of creating synthetic full backups, which are created from incremental backups. Vulnerabilities in this process can lead to data…

System call emulation intercepts and simulates system calls made by a program. This allows analysts to understand how the program interacts with the…

Tainted data refers to data that originates from an untrusted source, such as user input or external APIs. Static analysis tools track tainted data t…

Trusted Execution Environment (TEE) emulation simulates the secure environment within a processor. This is critical for testing security-sensitive ap…

Applications often rely on third-party libraries and frameworks, which can introduce vulnerabilities if they are not properly managed. Regularly upda…

This type of SSRF exploits the time it takes for a server to respond to a request. By sending requests to resources that take varying amounts of time…

Token manipulation involves modifying or replacing access tokens in Windows to gain elevated privileges. This technique can be used to impersonate ot…

Token-based authentication can be used to secure access to CDN resources by requiring users to present a valid token before accessing content. This h…

This refers to employees using applications not approved by the IT department, potentially bypassing security controls and exposing sensitive data. I…

Unikernels are specialized, single-address-space machine images constructed by using library operating systems. They improve security by minimizing t…

Unquoted service paths are a vulnerability where a Windows service's executable path contains spaces and is not enclosed in quotes. This allows an at…

APIs used by shadow IT applications that lack proper authentication and authorization controls. This allows attackers to access sensitive data or per…

Using unapproved file-sharing services to share sensitive data, which can expose it to unauthorized access and data breaches. The lack of encryption…

Shadow IT often involves integrating unvetted third-party applications, which may have security vulnerabilities or malicious intent. These integratio…

Applications often implement URL filtering to prevent SSRF, but attackers can use techniques like URL encoding, IP address obfuscation, or DNS rebind…

USB blocking is a security measure that prevents the use of USB drives and other removable storage devices on company computers. This helps prevent d…

User Account Control (UAC) is a Windows security feature that prompts users for permission before allowing applications to make changes to the system…

Virtual Machine Introspection (VMI) is a technique that allows monitoring and analysis of a virtual machine's internal state from outside the VM. Thi…

A weakness or flaw in software, hardware, or a system that can be exploited by attackers. Ransomware often exploits vulnerabilities to gain access to…

When patching vulnerabilities, AST representations can help identify the exact code locations that need to be modified. This reduces the risk of intr…

Watermarking techniques can be used in the Internet of Things (IoT) to authenticate data from sensors and devices, ensuring data integrity and preven…

Weak file permissions allow unauthorized users to read, write, or execute sensitive files, potentially leading to privilege escalation. This can occu…

A WAF is a specialized firewall that protects web applications from various attacks, such as SQL injection, cross-site scripting (XSS), and cross-sit…

A web application security audit examines the security of web applications to identify vulnerabilities such as SQL injection and cross-site scripting…

A web application security scanner is a tool used to automatically identify vulnerabilities in web applications. These scanners can detect issues lik…

Web security headers are HTTP response headers that provide instructions to the browser on how to behave to enhance security. Headers like X-XSS-Prot…

Logs generated by web servers that record client requests, server responses, and errors. Analyzing web server logs helps identify website vulnerabili…

WebSockets provide real-time communication, and securing them within a CDN is crucial. This includes proper authentication, encryption, and protectio…

Whitelisting is a security mechanism where only specific items are allowed, and everything else is denied. In the context of SSRF, whitelisting invol…

Windows User Account Control (UAC) is a security feature that requires administrative approval for certain actions. Bypassing UAC allows an attacker…

XMRig is a popular open-source cryptocurrency mining software, frequently used to mine Monero (XMR). It is often employed by cryptojackers due to its…