BERRY9 IT Services, home

Penetration Testing and VAPT Glossary

Short, plain-English definitions of the terms that appear in penetration test reports, security questionnaires and tender documents, each linked to the BERRY9 page or article that covers the topic.

01 / A to C

Terms a to C

Active Directory
Microsoft's directory service for Windows networks. It holds the accounts, groups and permissions of a company, so an attacker who controls it controls most of the network. See Active Directory Penetration Testing.
API
Application programming interface: the way one piece of software asks another to do something, such as a mobile app asking a server for a user's orders. APIs are tested for broken authorization and abuse. See API Penetration Testing.
Attack surface
Everything an attacker can reach and try: web addresses, APIs, open network ports, apps, cloud accounts, staff and suppliers. A smaller and better-known surface is easier to defend. See external attack surface.
Authentication and authorization
Authentication proves who you are, for example with a password and a code. Authorization decides what you may do once the system knows who you are. Most serious web flaws are failures of authorization, not of login.
Black box, gray box and white box
Three levels of information given to a tester. Black box means no inside knowledge, gray box means test accounts and some documentation, and white box adds source code and design details. See black, gray and white box testing.
BOLA
Broken object level authorization: the name the OWASP API Security Top 10 uses for a missing ownership check on an object, so one user can read or change another user's record. It is the API form of IDOR. See IDOR and BOLA.
Brute force
Trying many passwords, codes or keys until one works. Limits on attempts, lockouts and strong second factors make it impractical.
CERT-In
The national computer emergency response team of India, the agency for cyber incidents. It issues directions on incident reporting and keeps the CERT-In panel of information security auditing organizations. See CERT-In reporting and log rules.
Certificate pinning
A mobile app setting that makes the app accept only a specific server certificate or key, so a proxy cannot read its traffic. It raises the cost of interception but does not replace server-side checks. See intercepting mobile API traffic.
CSRF
Cross-site request forgery: a trick that makes a signed-in user's browser send a request they did not intend. Anti-forgery tokens and SameSite cookies are the usual defenses. See CSRF and SameSite cookies.
CVE
Common Vulnerabilities and Exposures: a public identifier, such as CVE-2021-44228, given to one specific known flaw in a product so that everyone can refer to the same issue.
CVSS
Common Vulnerability Scoring System: a standard way to rate a flaw from 0 to 10 on how it can be attacked and how much damage it can do. A CVSS score says how severe a flaw is in general, not how likely it is to be used against you. See prioritizing findings.

02 / D to I

Terms D to I

DAST
Dynamic application security testing: testing a running application from outside by sending it requests, as an attacker would. It complements SAST. See SAST, DAST and IAST.
Egress filtering
Rules that limit what systems in your network may connect to on the internet. Good egress rules stop an intruder from reaching their own command server. See egress checks.
EPSS
Exploit Prediction Scoring System: a score from 0 to 1 that estimates how likely a published flaw is to be exploited in the near future. It helps decide what to fix first when many findings compete.
Exploit
Code or steps that take advantage of a flaw. In a penetration test, an exploit is used carefully, to prove a flaw is real, and not to cause damage.
False positive
A finding reported by a tool that is not a real flaw. Engineers remove false positives by checking each result by hand before a report is written. See vulnerability assessment.
Hash
A one-way scramble of data, such as a stored password. Slow, salted hashes make stolen password databases hard to use. A fast hash such as MD5 does not protect passwords.
IDOR
Insecure direct object reference: a flaw where changing an identifier in a request, such as an invoice number, returns someone else's data because the server did not check ownership. See IDOR and business logic flaws.
Injection
A class of flaws where input is treated as commands by an interpreter, such as a database, a shell or a template engine. SQL injection is the best-known kind. See SQL injection.

03 / J to P

Terms J to P

Kerberoasting
An attack on Windows networks where any domain user requests service tickets and tries to crack the service account's password offline. Long random passwords for service accounts defeat it. See the internal network playbook.
KEV
Known Exploited Vulnerabilities: a catalog kept by the US cybersecurity agency CISA of flaws that attackers are known to be using. A flaw on the list is a strong reason to fix it first.
Lateral movement
What an attacker does after the first foothold: moving from one system to another using stolen credentials and trusted connections, to reach valuable data.
MFA
Multi-factor authentication: proving identity with more than one kind of evidence, for example a password plus a code from an app or a hardware key.
OWASP
The Open Worldwide Application Security Project, a nonprofit that publishes free guides and lists, including the OWASP Top 10 for web applications. See OWASP Top 10:2025.
Payload
The data an attacker or tester sends to trigger a flaw, such as a crafted string in a form field. Testers use harmless payloads that show the flaw without causing damage.
Penetration test
An authorized, scoped attempt to break into a system, done by people, to find weaknesses and prove how far they reach. The result is a report with fixes. See VAPT and Penetration Testing.
Privilege escalation
Gaining more rights than you were given, for example from an ordinary user to an administrator, by abusing a flaw or a weak setting.
Prompt injection
Hidden or direct instructions in text that a language model reads, which make it ignore its rules or misuse its tools. See Penetration Testing LLM applications.

04 / Q to Z

Terms Q to Z

Race condition
A flaw that appears when two requests arrive at the same moment and the code assumed they would come one after the other, such as a voucher that can be used twice. See race conditions.
Red team
A group that simulates a real adversary pursuing a goal, to test an organization's detection and response as well as its defenses. See red team assessment.
Retest
A second check, after fixes, that confirms each reported flaw is closed. The retest terms are written into the proposal. See what happens after the report.
Rules of engagement
The signed document that sets what a tester may touch, when, from where, how far to go and whom to call. It protects both sides.
SAST
Static application security testing: analyzing source code or compiled code for flaws without running it. See source code review.
SBOM
Software bill of materials: a list of the components a piece of software is built from. See SBOM and the software supply chain.
SQL injection
A flaw where user input becomes part of a database query and changes its meaning. Parameterized queries remove it. See SQL injection.
SSRF
Server-side request forgery: a flaw that lets an attacker make a server send requests on their behalf, often to internal services or the cloud metadata address. See SSRF and cloud metadata.
Threat model
A structured description of what you protect, who might attack it, how, and what stops them. It guides what a test should focus on.
TLS
Transport Layer Security: the protocol that encrypts traffic between a browser or app and a server, and shows as HTTPS. Old versions and weak settings are still found in tests.
VAPT
Vulnerability assessment and Penetration Testing: a combined service where tools and engineers first find weaknesses, then try to exploit them to show real impact. See what VAPT is.
Vulnerability assessment
A systematic search for known weaknesses and unsafe settings, usually with scanners, followed by a check to remove false positives. It lists weaknesses and does not try to use them to break in. See vulnerability assessment services.
WAF
Web application firewall: a filter in front of a website that blocks common attack patterns. It reduces noise and does not remove the flaws behind it. See WAF and Penetration Testing.
XSS
Cross-site scripting: a flaw that lets an attacker run their own script in a visitor's browser, on your site. See cross-site scripting.
Zero-day
A flaw that is unknown to the vendor, or has no fix yet, and may already be in use. Patching cannot help until a fix exists, so layered defenses and detection matter.

Plan Your Next Security Test

Tell us what needs Penetration Testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp