Asset Discovery, The process of identifying every device on a network using map scans and "fingerprinting" to determine what OS or hardware is running., credentialed scan, A scan uses a login to see "inside" the system, uncredentialed scan, scan looks from the "outside" (like open ports)., Device fingerprinting , The process of analyzing unique protocol responses (like TCP/IP stack behavior) to determine a host's OS version and hardware type without direct access., Fuzzing, An automated technique that injects semi-random, malformed data into an application's input fields to trigger unexpected crashes or memory corruption, exposing "zero-day" vulnerabilities., Static, Analysis inspects the source code or binaries for flaws without execution, Dynamic , Analysis tests the application in a running state, identifying memory leaks or session management flaws that only appear during runtime., CVSS, A standardized "risk score" (0–10) based on how easy an attack is and how much damage it does., False Negative, when a real vulnerability exists, but the scanner fails to find it, Context Awareness, Adjusting priority based on the environment; for example, an "old" bug on a public-facing web server is more critical than the same bug on an isolated offline machine, Server-Side Request Forgery, An attack where the vulnerable web application is tricked into making unauthorized requests to internal resources that are not normally accessible from the outside, Rollback, A critical contingency plan; the documented process for reverting a system to its previous state if the patch causes an unexpected failure, Cross-Site Scripting (XSS), An injection vulnerability where malicious scripts are executed within a victim's web browser, Reflected XSS, The most common form of XSS. It occurs when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way, Persistent XSS, Generally more dangerous because the malicious script is permanently stored on the target server., Data Poisoning , act of intentionally introducing "polluted" or malicious data into a training dataset to manipulate the behavior of a machine learning model, Exploitability, The theoretical ease of triggering a bug based on system requirements, Weaponization, The actual existence of a functional exploit tool, script, or framework.

Objective 2

由
打印
嵌入

排行榜

视觉风格

选项

切换模板

)
恢复自动保存：？