Exploitation Glossary

Browse 47 exploitation terms defined in plain English, from the cultural dictionary of computing.

47 Exploitation Terms

Attack Vector
The path or method an attacker uses to reach and exploit a target, such as phishing, exposed services, supply-chain compromise, or malicious files....
Blind Command Injection
A command-injection vulnerability where attacker-supplied commands execute on the server, but the results are not returned directly in the application...
Bypass
A method of circumventing a security control, policy, or expected validation path without directly disabling it. Bypasses matter because a control can appear...
Client-Side Attack
An attack that targets software running on the victim's device, such as browsers, document readers, or local applications, rather than directly attacking the...
Container Escape
An exploit or misconfiguration that allows code running inside a container to break isolation boundaries and interact with the host or other containers more...
Crash Exploitation
The process of turning a crash, often caused by memory corruption or malformed input, into a usable exploit with controlled behavior such as code execution....
Custom Exploit
An exploit developed for a specific target, vulnerability, or campaign rather than taken directly from public kits or common tooling. Custom exploits are often...
Custom Shellcode
Shellcode written or modified for a particular exploit context, architecture, or defensive environment instead of relying on generic public samples. Custom...
Encoded Payload
Encoded Payload is a payload transformed into another representation so it bypasses filters, transports safely, or evades inspection. Security teams use it to...
Exploit Development
Exploit Development is the process of turning a vulnerability into reliable code or steps that achieve controlled impact. Security teams use it to enforce...
Exploit Kit
Exploit Kit is a packaged collection of exploits, delivery logic, and tracking used to compromise targets at scale. Security teams use it to enforce trust,...
Firmware Exploitation
Firmware Exploitation is the abuse of weaknesses in firmware to gain persistence, bypass higher-level controls, or subvert boot trust. Security teams use it to...
Heap Exploitation
The process of turning a bug in heap memory management, such as corruption of allocator metadata or object layouts, into controlled program behavior like...
Heap Spray
An exploitation technique that fills heap memory with repeated attacker-controlled data to increase the chance that execution or references land on a useful...
Hypervisor Escape
A vulnerability or exploit that allows code running inside a virtual machine to break out of guest isolation and interact with the host hypervisor or other...
Local Exploit
An exploit that requires code execution or account access on the target system already, typically to escalate privileges, escape restrictions, or gain...
Local Privilege Escalation
A technique or vulnerability that lets someone with limited access on a system gain higher privileges such as administrator, root, or SYSTEM. Local privilege...
Malicious Payload
The harmful code or content delivered by an exploit, document, script, or malware stage to perform the attacker's intended action. A malicious payload may...
Memory Corruption
Memory Corruption is incorrect memory handling that changes data or control flow in unsafe ways, often enabling crashes or exploitation. Security teams use it...
Metasploit
Metasploit is an exploitation framework used to validate exposures, develop payloads, and emulate attacker tradecraft. Security teams use it to enforce trust,...
Overwrite Attack
An attack that succeeds by replacing existing data, code, metadata, or control values with attacker-chosen content. Overwrite attacks appear in contexts...
Phishing Kit
A security concept covering phishing kit and its role in protecting systems, users, data, or operations. It shows up in application security, identity,...
Post-Exploitation
A security attack or exploit technique associated with post-exploitation in real-world systems and networks. It shows up in application security, identity,...
Proof of Concept Exploit
A demonstration exploit built to show that a vulnerability can be triggered or weaponized, often without being fully polished for stealth or large-scale use....
Race Condition Exploit
A security attack or exploit technique associated with race condition exploit in real-world systems and networks. It shows up in application security,...
Ransomware Attack
A security attack or exploit technique associated with ransomware attack in real-world systems and networks. It shows up in application security, identity,...
RCE
Remote code execution, a class of vulnerability that lets an attacker run arbitrary code on a target system. It shows up in application security, identity,...
Remote Access Trojan
A security attack or exploit technique associated with remote access trojan in real-world systems and networks. It shows up in application security, identity,...
Remote Execution
The ability to run commands or code on a target system from another system or location. In security discussions, remote execution usually refers either to...
Replay Attack
A security attack or exploit technique associated with replay attack in real-world systems and networks. It shows up in application security, identity,...
Rootkit Detection
A defensive security practice involving rootkit detection to measure exposure, improve controls, or find malicious activity. It shows up in application...
Serialization Attack
A security attack or exploit technique associated with serialization attack in real-world systems and networks. It shows up in application security, identity,...
Session Hijacking
A security attack or exploit technique associated with session hijacking in real-world systems and networks. It shows up in application security, identity,...
Side-Channel Attack
A security attack or exploit technique associated with side-channel attack in real-world systems and networks. It shows up in application security, identity,...
Smishing
A security concept covering smishing and its role in protecting systems, users, data, or operations. It shows up in application security, identity,...
Social Engineering Attack
A security attack or exploit technique associated with social engineering attack in real-world systems and networks. It shows up in application security,...
Spyware
A security attack or exploit technique associated with spyware in real-world systems and networks. It shows up in application security, identity,...
Subdomain Takeover
A security attack or exploit technique associated with subdomain takeover in real-world systems and networks. It shows up in application security, identity,...
SYN Flood
A security attack or exploit technique associated with syn flood in real-world systems and networks. It shows up in application security, identity,...
TCP Reset Attack
A security attack or exploit technique associated with tcp reset attack in real-world systems and networks. It shows up in application security, identity,...
Time-of-Check Time-of-Use
A race condition where a resource changes between the time it is checked and later used. It shows up in application security, identity, infrastructure, or...
Trojan Horse
A security attack or exploit technique associated with trojan horse in real-world systems and networks. It shows up in application security, identity,...
UAC Bypass
A security attack or exploit technique associated with uac bypass in real-world systems and networks. It shows up in application security, identity,...
WAF Bypass
A security attack or exploit technique associated with waf bypass in real-world systems and networks. It shows up in application security, identity,...
WebSocket Hijacking
A security attack or exploit technique associated with websocket hijacking in real-world systems and networks. It shows up in application security, identity,...
Worm Virus
A security attack or exploit technique associated with worm virus in real-world systems and networks. It shows up in application security, identity,...
Zip Bomb
A security attack or exploit technique associated with zip bomb in real-world systems and networks. It shows up in application security, identity,...

Related Topics