Security glossary

Every technical term used in our courses, explained in Arabic, French and English. The English term is always shown first — that is the word you will meet in a terminal and in a job interview.

12 terms

IDOR

A flaw where changing an identifier in a request grants access to another user's data, because the server never checks ownership.

Also called: insecure direct object reference

SQL injection

Injecting SQL syntax into a query because user input was concatenated instead of parameterised.

Also called: SQLi

SUID

A Unix file permission bit that makes a program run as its owner rather than the user who launched it.

Also called: set-user-ID

XSS

Getting a victim's browser to execute attacker-controlled script in the context of a trusted site.

Also called: cross-site scripting

buffer overflow

Writing data past the end of an allocated memory region, corrupting adjacent memory.

Also called: buffer overrun

encapsulation

Each network layer wrapping the data above it with its own header.

false positive

An alert that fires on benign activity. The main cost of a noisy detection rule, because it trains analysts to ignore alerts.

firewall

A control that permits or denies network traffic according to a rule set.

hash

A fixed-length fingerprint of data, designed to be impractical to reverse.

packet

The unit of data handled at layer 3, carrying a source and destination IP address.

Also called: datagram

payload

The part of a transmission that carries the actual content, as opposed to headers; in offensive security, the code that runs after an exploit succeeds.

privilege escalation

Moving from limited access to higher permissions on a system you already have a foothold on.

Also called: privesc