TyscorpaThe web application acronyms in the second table are lost more often than any others in the exam, and it is because the names rhyme rather than because the mechanisms are hard. The right-hand column says what runs where and with whose authority, which is the axis that separates them.
Threat actors and campaigns
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| APT | Advanced Persistent Threat | An actor pursuing continued access rather than a single outcome | Persistent is the defining word. Advanced describes resources, not technique - much of the work is done with stolen credentials and ordinary administrative tools precisely because that leaves less to detect. |
| TTP | Tactics, Techniques and Procedures | How a given actor tends to operate | Outlasts indicators. A hash or an address is changed cheaply; the way a group works is harder to alter. |
| IoC | Indicator of Compromise | Evidence that something has already happened | Past tense, which is what separates it from a vulnerability. A vulnerability could be exploited; an indicator says something was. |
| IoA | Indicator of Attack | Activity in progress rather than evidence left behind | |
| C2 / C&C | Command and Control | The channel an intruder uses to direct compromised hosts | Almost always outbound, initiated by the victim host, which is how it works through a firewall that blocks inbound connections. |
Application and web attacks
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| SQLi | SQL Injection | Input becomes part of the query rather than a value in it | Fixed by parameterised queries, not by filtering. The structure is sent first with placeholders, so input cannot alter the meaning. |
| XSS | Cross-Site Scripting | Attacker script runs in the victim browser on the vulnerable site | Runs in the victim session, so it can read the page and the responses. Fixed by contextual output encoding. |
| CSRF / XSRF | Cross-Site Request Forgery | The victim browser is made to send a request it did not intend | Runs nothing on the site. It causes a request and the attacker never sees the reply. Fixed by a synchroniser token and the SameSite cookie attribute. |
| SSRF | Server-Side Request Forgery | The server is made to fetch a URL the attacker chooses | The request comes from inside the network. In cloud environments it frequently reaches the instance metadata service and returns credentials. |
| XXE | XML External Entity | An XML parser is made to read files or make requests | |
| RCE | Remote Code Execution | Running attacker-chosen code on the target | The most severe outcome class, which is why CVSS scores reflecting it are high. |
| TOCTOU | Time-of-Check to Time-of-Use | A race condition between validating and acting | |
| OWASP | Open Worldwide Application Security Project | The body behind the Top 10 list of web application risks | A community project, not a regulator and not a standard anybody certifies against. |
| DOM | Document Object Model | The page structure a browser builds and scripts modify | DOM-based cross-site scripting never reaches the server, so server-side filtering and server logs both miss it entirely. |
| IDOR | Insecure Direct Object Reference | Changing an identifier in a request and receiving somebody else's data | A broken access control, not an injection. Nothing is malformed - the application simply never checked whether this user owns that record. |
| CSP | Content Security Policy | A header telling the browser which sources of script it may execute | Mitigates cross-site scripting at the browser. Collides with cloud service provider, and only the sentence around it says which is meant. |
| CAPTCHA | Completely Automated Public Turing test to tell Computers and Humans Apart | A challenge intended to separate a person from a script | Aimed at automation - credential stuffing, scraping, bulk registration - and not at a human attacker working by hand. |
Network and credential attacks
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| DoS | Denial of Service | Making something unavailable | |
| DDoS | Distributed Denial of Service | The same from many sources at once | Distribution is what removes the answer. There is no single address to block, and mitigation has to happen upstream because the capacity is consumed before it reaches you. |
| MITM | Man-in-the-Middle | Sitting between two parties who believe they talk directly | The exam increasingly says on-path attack. Defeated by authenticated encryption, which makes the certificate warning the last line of defence. |
| ARP | Address Resolution Protocol | Maps an IP address to a hardware address on a segment | Has no authentication at all, which is the whole of ARP poisoning. Defended with dynamic ARP inspection on the switch. |
| RAT | Remote Access Trojan | A general-purpose remote channel, installed willingly | Not one capability but a seat at the machine. A confirmed RAT means a person was present with the rights of that user. |
| PtH | Pass-the-Hash | Authenticating with a stolen hash, without the password | Nothing is cracked, so password length is irrelevant to it. |
| BEC | Business Email Compromise | Fraud conducted from or impersonating a legitimate mailbox | Carries no attachment and no link, so mail filtering has nothing to detect. The control is a payment process that verifies out of band. |
| LOTL | Living Off The Land | Attacking with the tools already installed on the host | PowerShell, WMI, certutil, scheduled tasks. Nothing malicious is written to disk, which is why signature scanning sees a clean machine. |
| WMI | Windows Management Instrumentation | The built-in Windows management and query interface | Both an administration tool and a favourite of living-off-the-land activity, which is what makes its use hard to alert on. |
| DLL | Dynamic Link Library | Shared code an application loads at run time | Injection and sideloading both abuse the loading order, so trusted signed software ends up executing the attacker's code. |
| ROP | Return-Oriented Programming | Building an exploit from fragments of code already present | The answer to DEP: nothing new is executed, so marking memory non-executable does not stop it. ASLR is what makes the fragments hard to locate. |
| MITRE ATT&CK | Adversarial Tactics, Techniques and Common Knowledge | A catalogue of what attackers actually do, by tactic and technique | Describes behaviour rather than indicators, so a technique stays valid after the addresses and hashes have all changed. |
| SYN | Synchronise | The TCP flag that opens a connection | A SYN flood sends the opening and never completes the handshake, so the server holds half-open connections until it can accept no more. |
| SUID | Set User ID | A Unix file bit making a program run as its owner | A legitimate mechanism and a standard escalation path: an unnecessary SUID binary owned by root turns a local account into administrative access. |
Vulnerabilities and mitigations
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| EOL / EOSL | End of Life / End of Service Life | The vendor no longer supports or patches it | Named as a hardware vulnerability type. The exposure is permanent, so the answer is compensating controls or replacement. |
| ASLR | Address Space Layout Randomisation | Randomising memory addresses so an exploit cannot predict them | |
| DEP / NX | Data Execution Prevention / No-Execute | Marking memory regions as non-executable | NX is the processor bit; DEP is the operating system feature built on it. Return-oriented programming is the answer attackers found to both. |
| ACL | Access Control List | The list of who may do what to a resource | Named as a mitigation in its own right. It limits what an attacker who already holds an account can reach, which is what still works after authentication has been defeated. |
| VM | Virtual Machine | A guest with its own operating system kernel | Stronger isolation than a container, because containers share the host kernel. |
| AI / ML | Artificial Intelligence / Machine Learning | Named on both sides of the syllabus | Attackers use it for convincing lures and deepfake voice; defenders use it for baselines and detection. The new risks of the defensive side are poisoned training data and a model that cannot explain a decision. |