Exploitation Concepts
Overview
Exploitation is the authorized use of a vulnerability to demonstrate real impact — controlled, documented, and limited to what's necessary to prove the point.
Key concepts
- Exploit, payload, RCE, privilege escalation
- Lateral movement, persistence, C2, exfiltration, pivoting
How it works
Exploitation is the authorized use of a vulnerability to demonstrate that a weakness can affect a system, account, application, or network. In ethical testing, exploitation should be controlled, documented, and limited to what's necessary to prove impact.
Gaining and using access
| Term | Meaning |
|---|---|
| Exploit | Code, a method, or a technique that uses a vulnerability to produce an unintended result. |
| Payload | The action, code, or function delivered after an exploit succeeds. |
| Remote code execution | A vulnerability allowing an attacker to run commands or code on another system. |
| Privilege escalation | Gaining higher permissions than the user or process originally had. |
| Shell | A command-line interface used to interact with an operating system. |
Extending access
| Term | Meaning |
|---|---|
| Lateral movement | Moving from one compromised system to another system within a network. |
| Persistence | Maintaining access to a system after an initial compromise. |
| Command-and-control (C2) | Communication between a compromised system and an attacker-controlled system. |
| Exfiltration | The unauthorized removal or transfer of data from a system or organization. |
| Pivoting | Using one compromised system as a path to access other systems on an internal network. |