EC-Council Glossary

A

Access Control

Policies and technical mechanisms that determine who or what can use a system, application, network or data resource.

Access Control List (ACL)

An ordered set of rules that permits or denies access or network traffic based on defined criteria.

Active Reconnaissance

Information gathering that directly interacts with a target, such as port scanning or service enumeration, and may therefore be detectable.

Advanced Persistent Threat (APT)

A capable and persistent threat actor that maintains long-term access to a target in pursuit of strategic objectives.

Adversary

An individual, group or organisation attempting to compromise systems, data or operations.

AES

Advanced Encryption Standard, a widely used symmetric encryption algorithm for protecting sensitive data.

AI-Assisted Ethical Hacking

The use of artificial intelligence to support authorised security testing tasks such as reconnaissance, analysis, vulnerability prioritisation or reporting.

Application Security

The practices and controls used to reduce vulnerabilities and protect software throughout development and operation.

ARP Spoofing

An attack that sends falsified ARP messages so traffic intended for another device is redirected through the attacker.

Asset

Anything of value to an organisation, including data, systems, applications, identities, infrastructure and intellectual property.

Attack

An intentional attempt to compromise the confidentiality, integrity or availability of a system or resource.

Attack Surface

The total set of exposed points through which an attacker could attempt to enter, influence or extract information from a system.

Attack Vector

The path or method used to reach and exploit a target, such as phishing, a vulnerable service or stolen credentials.

Authentication

The process of verifying the identity of a user, device or service.

Authorisation

The process of determining what an authenticated identity is permitted to access or do.

B

Backdoor

A hidden or unauthorised method of bypassing normal authentication or security controls to access a system.

Banner Grabbing

The collection of identifying information from network services, often to determine software type, version or configuration.

Bash

A Unix and Linux command shell and scripting language commonly used in administration and security testing.

Beaconing

Regular outbound communication from a compromised host to command-and-control infrastructure.

Black Hat Hacker

A person who attempts to compromise systems without permission for malicious, criminal or unauthorised purposes.

Blue Team

Defenders responsible for monitoring, protecting, detecting and responding to threats against systems and networks.

Botnet

A collection of compromised devices remotely controlled to perform coordinated malicious activity.

Brute-Force Attack

An attack that repeatedly tries passwords, keys or other values until a valid one is found.

Buffer Overflow

A software flaw where more data is written to memory than the allocated space can safely hold, potentially causing crashes or code execution.

Bug Bounty

An authorised programme that rewards security researchers for responsibly reporting valid vulnerabilities.

Business Email Compromise (BEC)

A social-engineering attack that impersonates trusted business contacts to trick victims into transferring money or information.

C

Command and Control (C2)

Infrastructure or communication channels used by an attacker to remotely direct compromised systems.

CCT

Certified Cybersecurity Technician, an EC-Council certification covering foundational defensive, offensive, forensic and incident-response skills.

CEH

Certified Ethical Hacker, EC-Council's ethical-hacking certification covering attack techniques, tools, vulnerability assessment and countermeasures. The current CEH v13 programme incorporates AI-related capabilities.

Certificate Authority (CA)

A trusted organisation or service that issues and validates digital certificates used in public key infrastructure.

CCISO

Certified Chief Information Security Officer, an EC-Council programme for experienced security leaders responsible for governance, risk, strategy and security management.

CHFI

Computer Hacking Forensic Investigator, an EC-Council certification focused on identifying, collecting, preserving and analysing digital evidence.

CIA Triad

Confidentiality, Integrity and Availability, three core objectives used to guide information-security design and decision-making.

Clickjacking

A web attack that tricks a user into clicking an element that is different from what appears to be on the screen.

Cloud Security

The controls and practices used to protect cloud identities, data, workloads, configurations and infrastructure.

CND

Certified Network Defender, an EC-Council certification focused on protecting, monitoring and responding to threats across network environments.

Code Injection

An attack in which untrusted input causes unintended commands or code to be executed by an application.

Compromise

A state in which the security of a system, account or data asset has been breached or can no longer be trusted.

Credential Stuffing

An attack that tests username and password pairs stolen from one service against other services where users may have reused them.

Cross-Site Request Forgery (CSRF)

A web attack that causes an authenticated user's browser to perform an unwanted action on a trusted site.

Cross-Site Scripting (XSS)

A web vulnerability that allows attacker-controlled script content to execute in another user's browser.

Cryptanalysis

The study and practice of analysing cryptographic systems to understand or defeat their protections.

Cryptography

The use of mathematical techniques to protect information through encryption, hashing, signatures and related methods.

CTIA

Certified Threat Intelligence Analyst, an EC-Council certification covering the collection, analysis and communication of cyber threat intelligence.

CVE

Common Vulnerabilities and Exposures, a public naming system assigning identifiers to disclosed security vulnerabilities.

CVSS

Common Vulnerability Scoring System, a standard method for describing the severity of a vulnerability.

D

Data Exfiltration

The unauthorised transfer of data out of an organisation or protected environment.

Data Loss Prevention (DLP)

Controls designed to identify sensitive information and prevent inappropriate disclosure or transfer.

Deauthentication Attack

A wireless attack that sends forged management frames to disconnect clients from a Wi-Fi network.

Defence in Depth

A security strategy that uses multiple independent layers of protection rather than relying on a single control.

Denial-of-Service (DoS)

An attack intended to make a service or system unavailable to legitimate users.

Digital Evidence

Information stored or transmitted in digital form that may be relevant to an investigation.

Digital Forensics

The disciplined identification, preservation, examination and analysis of digital evidence.

Digital Signature

A cryptographic mechanism that can demonstrate message integrity and provide evidence of the signer's identity.

Directory Traversal

A vulnerability that allows an attacker to access files or directories outside the intended application path.

Distributed Denial-of-Service (DDoS)

A denial-of-service attack generated from many distributed systems, often using a botnet.

DLL Injection

A technique that causes a process to load and execute code from a dynamic-link library chosen by an attacker or tester.

DMARC

Domain-based Message Authentication, Reporting and Conformance, an email-authentication policy that works with SPF and DKIM to reduce domain spoofing.

DNS Poisoning

The corruption or manipulation of DNS information so users are directed to an incorrect destination.

DNS Tunnelling

The use of DNS queries and responses as a covert channel to transfer commands or data.

Domain Escalation

Techniques used to move from limited access within a directory environment to more powerful domain-level permissions.

Drive-by Download

Malware or unwanted software downloaded through a website, sometimes without an obvious user action.

E

EC-Council

An international cybersecurity certification and training organisation whose programmes include CEH, CND, CHFI, CPENT, CCT, CTIA, ECIH and CCISO.

ECDE

EC-Council Certified DevSecOps Engineer, a certification focused on integrating security into development and delivery pipelines.

ECES

EC-Council Certified Encryption Specialist, a certification covering cryptography, encryption algorithms and secure implementation concepts.

ECIH

EC-Council Certified Incident Handler, a certification covering preparation, detection, containment, eradication, recovery and post-incident activity.

ECSS

EC-Council Certified Security Specialist, a foundational programme spanning information security, network security and computer forensics.

EDR

Endpoint Detection and Response, security technology that records endpoint activity and supports threat detection, investigation and containment.

Enumeration

The active collection of detailed information from a target, such as users, shares, services, groups or application resources.

Encryption

The transformation of readable information into a protected form that requires the correct key to recover.

Endpoint

A device connected to a network, such as a workstation, laptop, server or mobile device.

Ethical Hacker

A security professional authorised to use attacker-style techniques to identify vulnerabilities and help improve defences.

Evil Twin

A rogue wireless access point made to resemble a legitimate network so users connect to it unknowingly.

Exploit

Code or a technique that takes advantage of a vulnerability to trigger unintended behaviour.

Exploit Chain

A sequence of vulnerabilities or techniques combined to achieve a larger compromise.

Exploit Kit

A toolkit designed to identify and exploit vulnerabilities on target systems, often through malicious web content.

F

False Negative

A security result that incorrectly indicates no threat or problem is present when one actually exists.

False Positive

A security result that incorrectly flags legitimate activity as malicious or problematic.

Fileless Malware

Malware that relies heavily on memory, scripts or legitimate system tools rather than storing a conventional malicious executable on disk.

Firewall

A security control that filters network traffic according to defined rules and, in many cases, connection state or application context.

Footprinting

The early reconnaissance process of gathering information about a target organisation, systems, domains, technologies and exposure.

Forensic Acquisition

The controlled process of creating a defensible copy of digital evidence for examination.

Forensic Image

A bit-for-bit copy of digital storage created for forensic analysis while preserving the original evidence.

Fuzzing

A testing technique that feeds unexpected, malformed or random input into software to reveal crashes and security flaws.

Full-Disclosure Vulnerability

A vulnerability whose technical details have been made publicly available, potentially before all affected systems are patched.

G

GDPR

The UK and EU data-protection framework governing how personal data is collected, processed, secured and handled, with cybersecurity controls supporting compliance.

Golden Ticket

An attack technique in Active Directory that forges Kerberos Ticket Granting Tickets after highly privileged credential material has been compromised.

Governance

The policies, responsibilities and oversight used to direct security decisions and ensure cybersecurity supports organisational objectives.

Gray Hat Hacker

A person who may identify or explore security weaknesses without clear malicious intent but also without explicit authorisation.

Group Policy

A Microsoft technology used to centrally configure security and system settings for users and computers in Active Directory environments.

Guessing Attack

An attempt to discover credentials or secret values by trying likely passwords, answers or patterns rather than exhaustively testing every possibility.

H

Hacker

A person who uses technical knowledge to explore or manipulate computer systems; the term can describe authorised security researchers as well as malicious attackers.

Hash

A fixed-length value generated from input data by a one-way function and used for integrity checking, password storage and forensic verification.

Hash Cracking

The attempt to recover an original value, often a password, by comparing candidate inputs against a stored cryptographic hash.

Hashing

The process of transforming data into a fixed-length digest using a one-way mathematical function.

HIDS

Host-Based Intrusion Detection System, software that monitors an individual endpoint for suspicious activity.

Honeynet

A network of decoy systems designed to attract attackers and provide insight into their techniques.

Honeypot

A deliberately exposed or simulated system designed to attract malicious activity for detection, research or deception.

HTTP

Hypertext Transfer Protocol, the application protocol used for web traffic and frequently examined during web application testing.

HTTPS

HTTP protected by TLS encryption, providing confidentiality and server authentication for web communication.

Hydra

A security testing tool capable of performing authorised password-guessing attacks against many network services.

I

Identity and Access Management (IAM)

The processes and technologies used to create, authenticate, authorise and govern digital identities.

Indicator of Compromise (IoC)

An observable sign that may indicate malicious activity or a security breach, such as a suspicious file hash, domain or IP address.

Incident

An event that threatens or compromises the confidentiality, integrity or availability of systems, data or services.

Incident Response

The structured process of preparing for, detecting, analysing, containing, eradicating and recovering from cybersecurity incidents.

Information Gathering

The collection of target information before or during a security assessment, including technical, organisational and publicly available data.

Injection Attack

An attack where crafted input is interpreted as commands, queries or code by an application or system.

Insider Threat

A security risk originating from someone with legitimate access, whether acting maliciously, negligently or after their account is compromised.

Intrusion Detection System (IDS)

Technology that monitors traffic or system activity for suspicious patterns and generates alerts.

Intrusion Prevention System (IPS)

Technology that detects suspicious activity and can actively block or interrupt malicious traffic.

IoT Security

The protection of connected devices, their communications, management platforms and associated data.

IP Spoofing

The manipulation of packet source-address information to make network traffic appear to originate from another IP address.

IPsec

A suite of protocols for authenticating and encrypting IP traffic, commonly used in VPNs.

J

John the Ripper

A password-auditing tool used in authorised security assessments to test the strength of password hashes.

JSON

JavaScript Object Notation, a structured data format commonly encountered in APIs and web application security testing.

JWT

JSON Web Token, a compact format for digitally signed claims often used in web authentication and authorisation.

Jailbreak

The removal or bypass of manufacturer restrictions on a device, potentially increasing both administrative control and security risk.

Jitter

Variation in network packet delay, relevant when assessing network performance and certain denial-of-service conditions.

K

Kali Linux

A Linux distribution containing a large collection of security assessment, forensics and penetration-testing tools.

Kerberos

A network authentication protocol that uses encrypted tickets and is widely used in Active Directory environments.

Kerberoasting

An Active Directory attack technique that requests service tickets and attempts to crack their encrypted components offline to recover service-account passwords.

Key

A value used by cryptographic algorithms for encryption, decryption, authentication or digital signing.

Key Exchange

The process by which communicating parties securely establish cryptographic key material.

Keylogger

Software or hardware that records keystrokes and may be used maliciously to capture credentials or sensitive information.

Kill Chain

A model that divides a cyberattack into stages, helping defenders understand and interrupt adversary activity.

L

Lateral Movement

The techniques attackers use to move from one compromised system or account to other systems within an environment.

LDAP

Lightweight Directory Access Protocol, used to query and manage directory services and often encountered in enterprise security testing.

Least Privilege

The principle of giving users, applications and systems only the minimum access needed to perform their legitimate tasks.

Linux

An open-source operating-system family widely used on servers, security appliances and penetration-testing platforms.

Living off the Land

An attack approach that abuses legitimate system tools and built-in utilities to reduce reliance on obvious malicious binaries.

Local File Inclusion (LFI)

A web vulnerability that allows an attacker to make an application load a local file that should not be accessible.

Log

A time-ordered record of system, application or security events used for monitoring, investigation and forensics.

Logic Bomb

Malicious code designed to activate when a particular condition, event or time is reached.

M

MAC Spoofing

The alteration or imitation of a network interface's MAC address to appear as another device.

Malware

Malicious software designed to disrupt, spy on, damage or gain unauthorised control of systems.

Man-in-the-Middle (MITM)

An attack where an adversary secretly intercepts or alters communication between two parties.

Memory Forensics

The examination of volatile system memory to identify processes, credentials, malware artefacts and other evidence.

Metasploit

A penetration-testing framework used for authorised exploit development, validation, post-exploitation and security research.

MFA

Multi-Factor Authentication, requiring more than one category of evidence to verify an identity.

Mimikatz

A security research tool widely known for extracting or manipulating Windows authentication material in authorised testing and malicious attacks.

MITRE ATT&CK

A widely used knowledge base describing adversary tactics and techniques observed in real-world cyber operations.

Mobile Security

The protection of smartphones, tablets, mobile applications, wireless communications and associated data.

Multi-Stage Attack

An attack that combines several techniques or phases, such as initial access, privilege escalation, persistence and exfiltration.

N

Nessus

A widely used vulnerability scanner that identifies known weaknesses, misconfigurations and missing patches in authorised assessments.

Network Forensics

The capture and analysis of network traffic and related records to investigate security events.

Network Mapping

The process of identifying hosts, devices, relationships, addressing and services within a network.

Network Segmentation

The division of a network into separate areas to reduce attack paths and improve security control.

NIDS

Network Intrusion Detection System, a security system that monitors network traffic for suspicious activity.

Nmap

A network discovery and security assessment tool used to identify hosts, ports, services and other network characteristics.

Non-Repudiation

A security property providing evidence that an action or communication originated from a particular party.

NTLM

A family of Microsoft authentication protocols still encountered in Windows environments and frequently considered during credential-security assessments.

O

OAuth

An authorisation framework that lets applications obtain limited access to resources without receiving the user's password.

Obfuscation

The deliberate alteration of code, data or activity to make it harder for people or security tools to understand.

Open Redirect

A web weakness that allows an attacker to manipulate a trusted site into redirecting users to an unintended destination.

Open Source Intelligence (OSINT)

Information gathered legally from publicly available sources such as websites, registries, social media and published documents.

OWASP

The Open Worldwide Application Security Project, a nonprofit community that publishes widely used application-security guidance and tools.

OWASP Top 10

A widely referenced awareness document highlighting significant categories of web application security risk.

P

Packet Capture

The recording of network packets for troubleshooting, monitoring or security analysis.

Passive Reconnaissance

Information gathering that avoids direct interaction with the target, such as reviewing public records and internet-exposed information.

Password Cracking

The authorised or malicious attempt to recover passwords from hashes, encrypted data or captured authentication material.

Password Spraying

An attack that tests a small number of common passwords against many accounts to reduce the chance of lockout.

Payload

The part of an exploit, malware sample or attack that performs the intended action after delivery or successful exploitation.

Penetration Test

An authorised security assessment that attempts to exploit vulnerabilities to demonstrate realistic impact and identify remediation priorities.

Persistence

Techniques used by attackers to maintain access to a compromised environment across reboots, password changes or other disruptions.

Phishing

A social-engineering attack using deceptive messages or websites to steal information or persuade victims to take unsafe actions.

Pivoting

Using a compromised system as an intermediary to reach additional networks or targets that were not directly accessible.

Port Scan

The probing of network ports to determine which services are listening on a target system.

Privilege Escalation

The process of obtaining permissions beyond those originally available, often after exploiting a weakness or misconfiguration.

Proxy

An intermediary system that forwards traffic between a client and another service and may be used for privacy, filtering, monitoring or attack routing.

Public Key Infrastructure (PKI)

The technologies and processes used to issue, manage and validate digital certificates and public keys.

Purple Team

A collaborative approach in which offensive and defensive security teams work together to improve detection and resilience.

Q

QR Phishing

A phishing technique that uses malicious QR codes to direct victims to deceptive sites or actions.

Query Injection

A general class of attack where crafted input alters a query sent to a backend data service.

Quarantine

The isolation of a suspicious file, device, email or system so it cannot affect the wider environment while it is investigated.

Quishing

A common term for QR-code phishing attacks.

R

Rainbow Table

A precomputed lookup structure used to speed attempts to recover passwords from unsalted cryptographic hashes.

Ransomware

Malware that blocks access to data or systems, often through encryption, and demands payment or another concession.

RAT

Remote Access Trojan, malware that gives an attacker remote control of a compromised device.

Reconnaissance

The collection of information about a target before or during an attack or authorised penetration test.

Red Team

An authorised group that emulates realistic adversaries to test an organisation's prevention, detection and response capabilities.

Remote Code Execution (RCE)

A vulnerability or attack outcome that allows code to be executed on a target system from another location.

Reverse Engineering

The analysis of software, hardware or malware to understand its design and behaviour without relying on original source information.

Reverse Shell

A command shell initiated from a target system back to a remote listener, commonly used in authorised penetration testing and malicious compromise.

Risk

The potential for a threat to exploit a vulnerability and cause harm to an organisation or asset.

Risk Assessment

The process of identifying risks, estimating likelihood and impact, and deciding how they should be treated.

Rootkit

Malware or unauthorised software designed to maintain privileged access while hiding its presence.

Rules of Engagement

Agreed boundaries, permissions, targets, methods and communication procedures that govern an authorised security assessment.

S

Salting

The addition of unique random data before hashing a password to make precomputed attacks less effective.

Sandbox

An isolated environment used to run or analyse suspicious code while limiting its ability to affect production systems.

Script Kiddie

An informal term for an inexperienced attacker who relies heavily on tools or scripts created by others.

Session Hijacking

The takeover or misuse of a legitimate authenticated session by stealing or predicting session information.

SIEM

Security Information and Event Management, technology that centralises security logs and analyses events for suspicious activity.

Smishing

Phishing carried out through SMS or other mobile text messages.

Sniffing

The capture and inspection of network traffic, used legitimately for analysis and maliciously for information theft.

SOAR

Security Orchestration, Automation and Response, technology that coordinates security tools and automates investigation or response workflows.

SOC

Security Operations Centre, a team or function responsible for monitoring, detecting, investigating and responding to cyber threats.

Social Engineering

The manipulation of people into revealing information or performing actions that undermine security.

Source Code Review

The examination of application source code to identify security flaws, unsafe patterns and implementation weaknesses.

Spear Phishing

A targeted phishing attack tailored to a particular person, organisation or role.

SQL Injection

A vulnerability where attacker-controlled input changes the structure or meaning of a database query.

Spyware

Software designed to secretly collect information about a user, device or organisation.

SSRF

Server-Side Request Forgery, a web vulnerability that causes a server to make unintended requests chosen by an attacker.

Steganography

The concealment of information within another file, medium or communication so the existence of the hidden data is less obvious.

Supply Chain Attack

An attack that compromises a trusted supplier, dependency, update process or service to reach downstream targets.

T

Threat

Anything capable of exploiting a weakness and causing harm to an asset, service or organisation.

Threat Actor

An individual, group or organisation responsible for malicious cyber activity.

Threat Hunting

The proactive search for signs of attacker activity that may have bypassed automated security controls.

Threat Intelligence

Analysed information about adversaries, capabilities, infrastructure, vulnerabilities and campaigns used to improve security decisions.

Threat Modelling

A structured process for identifying likely threats, attack paths and appropriate controls before or during system design.

TLS

Transport Layer Security, the protocol used to encrypt many application communications such as HTTPS.

Token Theft

The theft of an authentication or session token that can allow an attacker to impersonate a legitimate user or application.

Trojan

Malicious software disguised as legitimate or desirable software to persuade a victim to install or execute it.

TTP

Tactics, Techniques and Procedures, a way of describing how threat actors plan and carry out operations.

Tunnelling

The encapsulation of one type of traffic inside another protocol, used legitimately for networking and sometimes abused to bypass controls.

U

Unauthorised Access

Access to a system, service or data without the required permission.

URL Manipulation

The modification of a web address or parameters to test whether an application exposes data or functions improperly.

USB Attack

An attack delivered through removable USB devices, malicious peripherals or deceptive storage media.

User Enumeration

The discovery of valid usernames or accounts through application responses, network services or directory information.

User Awareness

Training and communication that helps people recognise threats and apply safe security practices.

Utility Abuse

The misuse of legitimate system administration tools to perform malicious actions or evade security detection.

V

Virus

Malware that attaches to other files or programs and replicates when infected content is executed.

Vishing

Voice phishing, where attackers use telephone or voice communication to manipulate victims.

VPN

Virtual Private Network, an encrypted or logically isolated connection across another network such as the internet.

Vulnerability

A weakness in software, hardware, configuration, process or behaviour that could be exploited.

Vulnerability Assessment

A systematic process for identifying, analysing and prioritising security weaknesses without necessarily attempting full exploitation.

Vulnerability Scanner

A tool that checks systems and applications for known weaknesses, insecure configurations and missing patches.

Vulnerability Management

The ongoing process of discovering, prioritising, remediating and tracking security weaknesses.

W

WAF

Web Application Firewall, a security control that filters HTTP and HTTPS traffic to help protect web applications.

Web Shell

A malicious or unauthorised script installed on a web server that provides remote command or file access.

Whaling

A targeted phishing attack aimed at senior executives or other high-value individuals.

White Hat Hacker

A security professional who tests systems with authorisation and reports weaknesses so they can be fixed.

Wireshark

A network protocol analyser used to capture and inspect packets for troubleshooting and security analysis.

Wireless Attack

An attack targeting Wi-Fi or other wireless communications, such as rogue access points, deauthentication or credential capture.

Worm

Malware capable of self-replicating and spreading between systems without needing to attach to another program.

X

XML External Entity (XXE)

A vulnerability in insecure XML processing that may allow access to local files, internal services or other sensitive resources.

XML Injection

An attack in which crafted input alters the structure or meaning of XML processed by an application.

XSS

Cross-Site Scripting, a web vulnerability that allows attacker-controlled scripts to run in another user's browser.

Y

YARA

A pattern-matching language widely used by malware analysts and threat hunters to identify files or memory containing characteristic strings or structures.

YAML

A human-readable data format commonly used in configuration, automation and cloud environments and therefore relevant to security reviews.

Z

Zero-Day Vulnerability

A vulnerability for which defenders have had little or no opportunity to deploy a fix before exploitation or public disclosure.

Zero Trust

A security approach that requires continual verification of identities, devices and access context rather than automatically trusting network location.

Zombie Computer

A compromised device remotely controlled by an attacker, commonly as part of a botnet.

Zone

A logical or physical security area grouping systems with similar trust, access or policy requirements.