TryHackMe Terms Flashcards
XXXXX XXX XXXXXXXX (XXX) is a comprehensive cloud computing platform offered by Amazon. It provides a wide range of services such as computing power, storage, databases, networking, analytics, and more, delivered over the internet on a pay-as-you-go basis.
AWS
Amazon Web Services
xxxxxxxxx is a Windows feature that allows administrators to control which applications and scripts users are allowed to run on a system.
AppLocker
xxxxxx is the most widely used web server software. Developed and maintained by xxxxxx Software Foundation, xxxxxx is an open source software available for free.
Apache
—————————————— is responsible for finding the MAC (hardware) address related to a specific IP address. It works by broadcasting an — query, “Who has this IP address? Tell me.” And the response is of the form, “The IP address is at this MAC address.”
Address Resolution Protocol (ARP)
——————————- is a list of permissions that determine who can access a specific resource in a computer network. It is used to grant or deny access to files, folders, printers, and other network resources.
An Access Control List (ACL)
—————————– is a program or set of programs that are designed to prevent, search for, detect, and remove software viruses, and other malicious software like worms, trojans, adware, and more.
AV
Antivirus software
——————————– is a symmetric block encryption algorithm. It can use cryptographic keys of sizes 128, 192, and 256 bits.
The Advanced Encryption Standard (AES)
A low-level programming language that uses symbolic code as a direct representation of machine code. It enables a programmer to write instructions that the computer’s processor can execute directly. Each line corresponds to a specific machine operation, often based on a sequence of numbers, letters, and symbols.
ASM
——————————— is a set of rules and protocols for building software and applications. An — allows different software programs to communicate with each other. It defines methods of communication between various components, including the kinds of requests that can be made, how they’re made, the data formats that should be used, and conventions to follow.
API, which stands for Application Programming Interface,
—————– serves as a standardized interface enabling Windows applications to seamlessly communicate with any existing anti-malware solutions present on the system.
The Windows Anti-malware Scan Interface (AMSI)
——————- is a guideline for classifying and describing cyberattacks and intrusions.
The Adversarial Tactics, Techniques, and Common Knowledge or MITRE ATT&CK
—————————- is a directory service developed by Microsoft for Windows domain networks. It stores information about network objects such as computers, users, and groups. It provides authentication and authorisation services, and allows administrators to manage network resources centrally.
AD Active Directory
————————— is a stealthy threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period.
An advanced persistent threat (APT)
——————— is included in the response from one website to a request originating from another website, and identifies the permitted origin of the request. A web browser compares the Access-Control-Allow-Origin with the requesting website’s origin and permits access to the response if they match.
ACOA The Access-Control-Allow-Origin header
———————— is a managed Kubernetes service from the Azure Cloud Service Provider.
Azure Kubernetes Service (AKS)
—————- is an authenticated encryption algorithm that combines the AES encryption with the GCM mode of operation. It provides both confidentiality (encryption) and integrity (authentication) by generating an authentication tag to verify the authenticity of the encrypted data
AES-GCM (Advanced Encryption Standard - Galois/Counter Mode)
——————– is an authenticated encryption mode that combines AES encryption with the Counter (CTR) mode for confidentiality and the CBC-MAC (Cipher Block Chaining Message Authentication Code) for integrity. It ensures both data encryption and authentication, protecting against tampering and providing data authenticity.
AES-CCM (Advanced Encryption Standard - Counter with CBC-MAC)
——————– is a study of real-world software security initiatives and reflects the current state of software security.
Building Security In Maturity Model (BSIMM)
——————- is a technology used in certain computer operating systems for programs that need to, among other things, analyze network traffic. BPF supports filtering packets, allowing a userspace process to supply a filter program that specifies which packets it wants to receive.
The Berkeley Packet Filter (BPF)
—————- comprises cyber security and technology professionals whose aim is to protect an information system from impending cyber threats by performing and implementing defensive actions.
A blue team
————————————- is the term given for devices that are owned by an employee but are usually used for work-related activities. For example, an employee uses their personal device to access emails. A BYOD policy outlines what type of devices are acceptable, what behaviour is acceptable, as well as any necessary steps to secure the device (for example, requiring anti-virus)
Bring Your Own Device BYOD
————————— is a boot firmware that provides runtime services for the operating system (OS). The BIOS starts, checks specific hardware components, and loads the OS depending on boot priority.
The Basic Input/Output System (BIOS)
——————– is a set of compiled code written in a C-language that interacts with the Windows API to enable additional functionality within a C2 agent.
Beacon Object Files (BOF)
————- is an integrated platform for performing security testing of web applications. It includes various tools for scanning, fuzzing, intercepting, and analysing web traffic. It is used by security professionals worldwide to find and exploit vulnerabilities in web applications.
Burp Suite
————- , this term is given to a publicly disclosed vulnerability
Common Vulnerabilities and Exposures (CVE)
————————–. These web applications are used to manage content on a website. For example, blogs, news sites, e-commerce sites and more!
Content Management System (CMS)
——————— is the opposite of Disclosure, Alternation, and Destruction (DAD).
Confidentiality, Integrity, and Availability (CIA)
Common Vulnerability Scoring System
CVSS
—————- is evidence-based knowledge about adversaries, including their indicators, tactics, motivations, and actionable advice against them.
CTI
Cyber Threat Intelligence
————— is a software development practice that involves automatically building, testing and implementing changes to an application’s source code
CI Continuous Integration
——————- is a set of guidelines and measures for organisations to manage and improve their cybersecurity posture by identifying, assessing, and managing their cybersecurity risks.
Cyber Security Framework (CSF)
——————- are computer programs designed to be used from a text interface; think of it as if you’re using an application without a user interface.
CLI Command-line applications
A hairy, bear-like creature that performs Quality Analysis in DevOps
ChewBa-QA
——————— is a software development term for deploying code to production environments automatically without any interaction from a human. For example, the automation of tests and then deployment of the code.
CD Continuous Deployment
They are a set of practices and principles that enable automated software releases.
CI/CD CI/CD stands for Continuous Integration/Continuous Delivery.
——————– are a set of programs used to communicate with a victim machine. This is comparable to a reverse shell, but is generally more advanced and often communicate via common network protocols, like HTTP, HTTPS and DNS.
Command and Control (C2) Infrastructure
——————- is a vulnerability that occurs when an attacker manipulates input fields to inject malicious commands into a vulnerable application. This can lead to unauthorised execution of arbitrary commands on the targeted server, potentially resulting in data breaches, system compromise, or unintended operations.
Command Injection
———————- is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.
Cross-site request forgery (also known as CSRF)
———————– is the most important processor in a given computer. Its electronic circuitry executes instructions of a computer program, such as arithmetic, logic, controlling, and input/output (I/O) operations. This role contrasts with that of external components, such as main memory and I/O circuitry,[1] and specialized coprocessors such as graphics processing units (GPUs).
A central processing unit (CPU)—also called a central processor or main processor—
—————————— is the person that is responsible for an organisations technology. Working together with the CIO, they run a company’s IT infrastructure.
CTO Chief Technology Officer
—————-are incredible ML structures that have the ability to extract features that can be used to train a neural network. In essence, —————— are normal neural networks that simply have the feature-extraction process as part of the network itself.
Convolutional Neural Networks (CNNs)
CLI
Command Line Interface
——————- are packages of software that bundles up code, and all its dependencies so it can be run reliably in any environment.
Containers
—————— is a mechanism for integrating applications. CORS defines a way for client web applications that are loaded in one domain to interact with resources in a different domain.
Cross-origin resource sharing (CORS)
——————- is a company which offers scalable cloud computing resources on demand. The cloud resources ———— offer include computing power, data storage and applications.
A Cloud Service Provider CSPs
———————– is a non-profit organisation that helps collect and define standards that can be implemented as preventative measures against cyber attacks
CIS CIS (Centre for Internet Security)
The process of securing a Kubernetes cluster following best security practices.
Cluster Hardening
————— is the opposite of Confidentiality, Integrity, and Availability (CIA).
Disclosure, Alternation, and Destruction (DAD)
DPI
Deep Packet Inspection
————– is the protocol responsible for resolving hostnames, such as tryhackme.com, to their respective IP addresses.
Domain Name System (DNS)
—————– is a symmetric encryption block encryption algorithm which uses a cryptographic key size of 56 bits. AES became the new standard in 2001.
The Data Encryption Standard (DES)
DAST
Dynamic Application Security Testing scans running applications for vulnerabilities
A computer operating system that provides a file system for operations such as reading, writing, and erasing data on a disk. It is a non-graphical line-oriented command-driven computer operating system designed for the IBM PC. Several variations of ———— were developed, such as MS——– (Microsoft) and PC———— (IBM).
DOS
DFIR
Digital Forensics and Incident Response
Reporting, and Conformance, or DMARC, is a technical standard that helps protect email senders and recipients from spam, spoofing, and phishing.
DMARC Domain-based Message Authentication,
for packet I/O. The ——– replaces direct calls to libpcap functions with an abstraction layer that facilitates operation on a variety of hardware and software interfaces without requiring changes to Snort.
DAQ Data Acquisition library,
—————– are used by Windows systems to specify who can access a given resource. While they are often referenced when talking about files, they also apply to other components as registry keys, services and scheduled tasks.
DACL Discretionary Access Control Lists
——————— is a perimeter network that protects and adds an extra layer of security to an organization’s internal local-area network from untrusted traffic. The end goal of a demilitarized zone network is to allow an organization to access untrusted networks, such as the internet, while ensuring its private network or LAN remains secure
A DMZ or demilitarized zone
————— is a set of practices, tools, and a cultural philosophy that automate and integrate the processes to build software.
DevOps
—————– is an email security standard designed to make sure messages aren’t altered in transit between the sending and recipient servers.
DKIM (DomainKeys Identified Mail)
————————- is a library that contains code and data that can be used by more than one program at the same time. For example, in Windows operating systems, the Comdlg32 DLL performs common dialog box related functions. Each program can use the functionality that is contained in this DLL to implement an Open dialog box. It helps promote code reuse and efficient memory usage.
A DLL file, short for Dynamic Link Library,
———————- software detects potential data breaches/data ex-filtration transmissions and prevents them by monitoring,[1] detecting and blocking sensitive data while in use (endpoint actions), in motion (network traffic), and at rest (data storage).
Data Loss Prevention (DLP)
The process of analyzing malware by running it in a controlled environment like a sandbox.
Dynamic Analysis
————– is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
The Dynamic Host Configuration Protocol (DHCP)
A system used by microsoft to assess risk to computer security threats
DREAD
———— is an attack on the target’s availability to make the target service/system unavailable to legitimate users.
Denial of Service (DoS)
———— attacks the target’s availability. It is “distributed” because it is launched from many sources, usually a botnet.
Distributed Denial of Service (DDoS)
———————- is a server that manages security authentication requests in a Windows Server network. It stores user account information and controls access to resources on the network. It is a critical component for managing and securing a network infrastructure.
DC A domain controller
———————- is a free and open-source web application security scanner. It can be used to find hidden directories and files on web servers. It can use various techniques to brute-force directories and files, including dictionary attacks, brute-force attacks, and hybrid attacks.
DirBuster
Fosters the same culture and principles as ———- with the addition of security into the development process, ensuring security is integrated from an early stage.
DevSecOps
——————- is a framework used to handle the Incident Response process. It is mapped on the NIST Incident Response Lifecycle
DAIR - Dynamic Approach to Incident Response
—————– is a series of tools that monitor devices for activity that could indicate a threat.
Endpoint detection and response (EDR)
It is a file format used to store event logs generated by the Windows Event Logging system.
An EVTX file is a Windows XML event log file.
———– is a solution deployed on endpoint devices to prevent file-based malware attacks, detect malicious activity, and provide the investigation and remediation capabilities needed to respond to dynamic security incidents and alerts.
An endpoint protection platform (EPP)
——————– is a service provided by Amazon Web Services (AWS) that allows you to rent virtual PCs on the cloud. The machines can be used just as any regular PC, and their specs can be dimensioned according to your specific needs.
Elastic Compute Cloud (EC2)
The measure of randomness of data in a file is known as ————–. ————– is very useful in identifying compressed and packed malware. Packed or compressed files usually have a high ————-.
Entropy
—————- is a security information and event management (SIEM) platform that helps organisations collect, analyse, and respond to security threats. It can collect data from various sources, including logs, events, network traffic, and cloud metadata. It can use machine learning to identify and prioritise threats. It can automate response actions, such as blocking malicious traffic or isolating infected hosts.
Elastic SIEM
These are three open-source tools that are commonly used together to collect, store, analyse, and visualise data.
ELK stands for Elasticsearch, Logstash, and Kibana.
——————- is a distributed, scalable, and highly available search engine. It is used to store and index data so that it can be quickly searched and analysed.
Elasticsearch
———————- is a broad concept that includes public or private information stored in an electronic or digital medium, such as data available from computers (including email), CD-ROM discs, DVDs, Internet, cloud storage, personal digital assistants (PDAs), smart phones, tablets, GPS systems, satellites, and drones. ESI includes writings, drawings, graphs, charts, photographs, sound recordings, images, video recordings, data compilations, computer-aided design files such as blueprints or maps, metadata, equipment/process control and data logging system files, and any other data that is stored electronically.
Electronically Stored Information (ESI)
———————- is a managed Kubernetes service from the Amazon Web Services Cloud Service Provider.
Elastic Kubernetes Service (AKS)
——————- is a way to encrypt data using smaller keys while still providing strong security. It is based on the math of elliptic curves.
ECC
Images store metadata (date and time, camera settings, GPS coordinates, etc.) within them. This metadata of image files is stored in a standardized format known as Exchangeable Image File Format
EXIF
———- is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats. ——— was signed into law part of the Electronic Government Act of 2002.
FISMA is an acronym that stands for the Federal Information Security Modernization Act.
A security tool, hardware or software that is used to filter network traffic by stopping unauthorized incoming and outgoing traffic.
Firewall
————————- is a protocol designed to help the efficient transfer of files between different and even non-compatible systems. It supports two modes for file transfer: binary and ASCII (text).
File Transfer Protocol (FTP)
is a form of user interface that allows users to interact with electronic devices through graphical icons and audio indicators such as primary notation, instead of text-based UIs, typed command labels or text navigation. GUIs were introduced in reaction to the perceived steep learning curve of command-line interfaces (CLIs),which require commands to be typed on a computer keyboard.
The graphical user interface, or GUI,
—————- is a free and open-source directory and file enumeration tool. Penetration testers and security professionals use it to find hidden directories and files on web servers.
Gobuster
————— is a distributed version control system used for tracking changes in files and coordinating work among multiple contributors. It provides efficient branching, merging, and collaboration capabilities for software development projects.
Git
It is a free and open-source encryption software that uses public-key cryptography. —————- can be used to encrypt files and messages, and to sign files and messages. Encryption makes it so that only the intended recipient can decrypt the file or message while signing makes it so that the recipient can verify that the file or message was sent by the person it claims to be from.
GPG stands for GNU Privacy Guard.
A software reverse engineering framework developed by the National Security Agency (NSA) in the United States. Comprising of a suite of software analysis tools. ———— disassembles executables into code that humans can understand.
Ghidra
—————– is a feature in Windows Server that allows administrators to control user and computer settings across the network. It provides a centralised way to manage and configure operating systems, applications, and user settings.
Group Policy Object (GPO)
It is available from the GNU project and is a common bootloader shipped with many Linux distributions.
GRUB stands for Grand Unified Bootloader.
———– protects workstations and servers through software that resides on the system. It catches suspect activity on the system and then either allows or disallows the event to happen, depending on the rules. Finally, it can also monitor data requests and read or write attempts and network connection attempts, potentially allowing it to be used as a compensating control for other requirements.
Host Intrusion Prevention System (HIPS)
The primary law in the United States that governs the privacy of healthcare information
Health Information Portability and Accountability Act (HIPAA).
————– files are files that contain HTML, JScript, and or VBScript code that can be executed on client system. This can to lead to more dynamic applications or remote code execution on a client or victim.
HTML Application (HTA)
—————– analyzes system state, system calls, file-system modifications, application logs, and other system activity.
Host Intrusion Detection System (HIDS)
——————– is a form of “on the ground” information gathering using human sources to collect information. In the context of Threat Intelligence, this can include infiltrating and engaging with threat actors on underground crime networks, forums and marketplaces, chat platforms, and other target environments, to include the dark web.
Human Intelligence (HUMINT)
————— is the protocol that specifies how a web browser and a web server communicate. Your web browser requests content from the TryHackMe web server using the —- ——– as you go through this room.
Hypertext Transfer Protocol (HTTP)
———- is a free and open-source password-cracking tool. It can try numerous passwords till the correct password is found. It can be used to crack passwords for various network services, including SSH, Telnet, FTP, and HTTP.
Hydra
—————– is a powerful, object-oriented query language similar to SQL but designed specifically for Hibernate ORM framework. — abstracts the database-specific SQL and allows developers to write queries using the entity objects defined in the Hibernate mappings, rather than directly interacting with the database tables.
Hibernate Query Language (HQL)
———————– is a structured approach to managing and addressing the aftermath of a security breach or cyberattack, also known as an IT incident, computer incident, or security incident. It involves identifying, investigating, handling, and learning from security events or incidents to prevent a similar occurrence.
Incident Response (IR)
———————- is a protocol for receiving email. Protocols standardize technical processes so computers and servers can connect with each other regardless of whether or not they use the same hardware or software.
The Internet Message Access Protocol (IMAP)
—————————- is a standards organization for the Internet and is responsible for the technical standards that comprise the Internet protocol suite.
The Internet Engineering Task Force (IETF)
—————- refers to the network of physical objects, or “things”, that are embedded with sensors and software which allow them to collect and exchange data over the Internet. These objects can include various devices, from everyday household items like thermostats, refrigerators, and lightbulbs, to industrial equipment, vehicles, and more.
IoT (Internet of Things)
——– denotes systems responsible for overseeing and conducting functions that support critical infrastructure, such as water, power, transportation, and manufacturing.
ICS
It is a security principle that is used to protect systems and data. IAAA ensures that only authorized users can access a system and that their actions can be tracked.
IAAA stands for Identification, Authentication, Authorization, and Accountability.
—————- is a device or application that detects and stops intrusions attempts proactively. They are usually deployed in front of the protected asset and block any potential threat from reaching their target.
Intrusion Prevention System (IPS)
———– combines SAST and DAST and scans source code as well as running applications
Interactive Application Security Testing
————— are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. The term IDOR was popularized by its appearance in the OWASP 2007 Top Ten.
Insecure direct object references (IDOR)
Indicator of Compromise is a forensic artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
IOC
The mitigation of violations of security policies and recommended practices.
Incident Handling (IH).
IRC
Internet Relay Chat
—————— is a standards organization that oversees global IP address allocation, autonomous system number allocation, root zone management in the Domain Name System (DNS), media types, and other Internet Protocol-related symbols and Internet numbers
The Internet Assigned Numbers Authority (IANA)
