Hacking Terms: 78 Definitions, Grouped by Attack Stage (2026)

Last updated: September 2026. Written by Josh Hutcheson, OnlineCourseing editor. See our review methodology.

HOW TO USE THIS GLOSSARY

Security vocabulary is not decoration. The difference between a threat and a vulnerability decides how a finding is scored; the difference between a virus and a worm decides how an incident is contained; and the difference between authorized and unauthorized testing decides whether the work is a profession or an offense. Getting a term wrong in a report is how a competent piece of testing loses its credibility.

This glossary defines the terms in current professional use, grouped by the stage of an attack they belong to. Where a definition is commonly muddled, we say what the term is not as well as what it is. Where terms have quietly fallen out of use, and several widely-copied glossaries still list them, we say so rather than passing it on. Formal definitions are cross-checked against the NIST CSRC glossary.

1. Who is doing it: threat-actor terms

Every incident report starts by naming the actor. These are the labels the industry uses, and the distinctions between them are legal as much as technical.

White hat

A security professional who tests systems with written permission from the owner. The permission is what makes the work lawful, not the intent or the job title. That distinction is worth reading properly in our guide to when ethical hacking is and is not legal. A point worth reading properly in our guide to when ethical hacking is and is not legal.

Black hat

Someone who breaks into systems without authorization, usually for money, data or disruption. In formal writing you will more often see “threat actor” or “adversary”; “black hat” survives mostly in training material and conference names.

Grey hat

Someone who probes systems without permission but discloses what they find rather than exploiting it. The category is real in practice and legally hazardous: unauthorized access is still unauthorized under the Computer Fraud and Abuse Act (18 U.S.C. §1030) regardless of what you do with the findings.

Threat actor

The neutral, modern umbrella term for anyone conducting an attack, whether individual, gang or state. Preferred in incident reports precisely because it carries no assumption about motive or skill.

Advanced persistent threat (APT)

A well-resourced adversary that establishes long-term access and stays quiet, typically state-sponsored or organized crime. The defining trait is persistence and patience, not any single clever technique. Public APT groups are cataloged in MITRE ATT&CK.

Script kiddie

A low-skill attacker running tools and exploits written by other people. Dismissive, but operationally meaningful: it predicts noisy, untargeted, easily-detected activity.

Hacktivist

An attacker motivated by a political or ideological cause rather than money. Typical methods are defacement, data leaks and denial-of-service, chosen for visibility over stealth.

Insider threat

Misuse of legitimate access by an employee, contractor or partner. It defeats most perimeter defenses by definition, which is why access control and logging matter more than firewalls here.

2. Finding the way in: weakness and reconnaissance terms

Before anything is attacked, it is measured. This vocabulary is about locating and scoring weakness, and it is the half of the glossary that defenders use most.

Vulnerability

A flaw in software, configuration or process that could be used to compromise a system. A vulnerability is a property of the system; it exists whether or not anyone has noticed it.

Threat

A potential cause of harm: the actor or event that could exploit a vulnerability. Threat and vulnerability are routinely confused: the flawed lock is the vulnerability, the burglar is the threat.

Risk

What you get when a threat meets a vulnerability that matters. Risk is the term that carries business impact, which is why it is the one that appears in board reports rather than the other two.

Attack surface

The full set of points where an attacker could try to interact with a system: every open port, endpoint, form, API, third-party script and employee inbox. Reducing it is cheaper than defending it.

Exploit

Working code or a technique that turns a vulnerability into actual access or execution. A vulnerability with no known exploit is a very different operational problem from one with a public exploit.

Exploit kit

A packaged toolkit that automatically probes a visitor’s browser and plugins for known vulnerabilities and delivers a payload against whichever one lands. Sold and rented as a product.

Zero-day

A vulnerability the vendor has no patch for. “Zero” refers to the number of days defenders have had to fix it. Widely misused as a synonym for “serious”. A bug is only a zero-day until a patch exists, after which it is simply unpatched.

CVE

Common Vulnerabilities and Exposures, the public catalog that gives each disclosed vulnerability a unique identifier such as CVE-2024-3094, so everyone is provably discussing the same flaw. Run by MITRE at cve.org.

CVSS

The Common Vulnerability Scoring System, a 0–10 severity score maintained by FIRST. The current version is CVSS v4.0. Treat it as a starting point rather than a priority list: a high CVSS on software you do not run matters less than a medium one that is being actively exploited.

Known Exploited Vulnerabilities (KEV)

CISA’s catalog of vulnerabilities with confirmed real-world exploitation. For prioritization it is often more useful than a severity score, because it answers “is this actually being used against people?” See the CISA KEV catalog.

OSINT

Open-source intelligence, meaning reconnaissance that uses only publicly available information: employee names on LinkedIn, DNS records, code pushed to public repositories, metadata in published documents. No system is touched, which is what makes it the quiet first phase.

Footprinting

The structured mapping of a target’s estate (domains, IP ranges, technologies, people) before any active testing. In engagements it is the step that defines what is in scope.

Enumeration

Actively querying a discovered service to list what is behind it: usernames, shares, subdomains, endpoints. Unlike OSINT, enumeration touches the target and appears in logs.

3. Getting in: initial-access and attack terms

These are the techniques that produce the first foothold. Most real breaches begin with one of the first three entries here rather than anything exotic.

Attack

Any deliberate attempt to compromise the confidentiality, integrity or availability of a system. Broad by design; the useful detail is always in which stage and which technique.

Social engineering

Manipulating a person into granting access or handing over information, rather than defeating a control technically. It remains the highest-yield category because it targets the one component that cannot be patched.

Phishing

A fraudulent message that impersonates a trusted sender to harvest credentials or deliver malware. Volume-based and untargeted.

Spear phishing

Phishing aimed at a named individual and written using real details about them: their manager, a live project, a recent invoice. Far lower volume and far higher success rate than bulk phishing.

Clone phishing

A specific variant in which the attacker copies a genuine email the victim has already received, swaps the link or attachment for a malicious one, and resends it from a lookalike address. The familiarity is the attack.

Brute force attack

Trying every possible credential until one works. Effective only where nothing limits the attempt rate, which is why rate limiting and lockouts defeat it far more reliably than password complexity does. We cover the distinction properly in password hacking techniques.

Credential stuffing

Replaying username-and-password pairs stolen from one breached service against many others, betting on password reuse. It is not guessing: the credentials are already valid somewhere.

Password spraying

Trying one or two very common passwords across a great many accounts, rather than many passwords against one account. Deliberately shaped to stay under lockout thresholds.

MFA fatigue

Repeatedly triggering multi-factor prompts until the target approves one to make the notifications stop. It defeats push-approval MFA specifically; number-matching and hardware keys do not fall to it.

SQL injection

Inserting database commands into an input the application passes to its database unchecked, letting an attacker read, alter or destroy data. Two decades old, still found, and still catastrophic.

Cross-site scripting (XSS)

Injecting script into a page that other users then load, so the attacker’s code runs in their browsers with their session. The victim is another user, not the server, which is what separates it from injection attacks against the backend. More in website hacking techniques.

Buffer overflow

Writing more data into a memory buffer than it was allocated, corrupting adjacent memory and potentially redirecting execution into attacker-supplied code. The classic memory-safety bug, and the reason memory-safe languages are now a policy topic.

Spoofing

Falsifying the origin of something so it appears trusted: email headers, a caller ID, a source IP address, an ARP or DNS response. The category, not a single technique.

Man-in-the-middle (MITM)

Positioning between two parties to read or alter traffic they believe is private. Properly validated TLS is the defense, which is why certificate warnings should never be clicked through.

Supply chain attack

Compromising a supplier, dependency or update channel so the malicious code arrives through a route the victim already trusts. It scales: one compromised package can reach thousands of downstream organizations.

Typosquatting

Registering names a hurried person mistypes: a lookalike domain, or a package named reqeusts instead of requests. Cheap, and effective against both users and build pipelines.

Backdoor

A hidden route into a system that bypasses normal authentication, left deliberately by an attacker (or, occasionally, shipped by a vendor). Its purpose is to survive the original entry point being closed.

4. What actually runs: malware and payload terms

Malware terms are the ones most often used loosely. The categories below are distinguished by how the code spreads and what it does, not by how damaging it is.

Malware

The umbrella term for any software written to damage, disrupt or gain unauthorized access. Every entry in this section is a type of malware.

Virus

Malicious code that attaches itself to a file or program and spreads when that host is run by a person. The defining trait is that it needs a host and a human action.

Worm

Malware that spreads across a network by itself, with no host file and no user action. That self-propagation is what makes worms the fastest-moving category.

Trojan horse

Malware disguised as something the user wants, relying on them to install it. It does not self-replicate; the deception is the delivery mechanism.

Remote access trojan (RAT)

A trojan that gives an attacker interactive remote control of the machine: files, webcam, keystrokes, and a foothold to move further into the network.

Rootkit

Malware that hides itself and other malicious activity from the operating system and security tools, often by loading early or running with kernel privileges. Detection usually requires looking from outside the compromised system.

Ransomware

Malware that encrypts data and demands payment for the key. Modern operations add “double extortion”, stealing the data first, so paying for decryption does not prevent publication.

Ransomware-as-a-service (RaaS)

A criminal business model in which developers rent their ransomware and infrastructure to affiliates for a share of proceeds. It is the reason ransomware capability no longer implies ransomware skill.

Spyware

Software that covertly collects information about a user (browsing, credentials, messages, location) and reports it to a third party.

Infostealer

A now-dominant class of malware built for one job: sweep saved passwords, session cookies and crypto wallets from a machine, then exit. Stolen session cookies are the reason an infostealer infection can defeat multi-factor authentication without ever touching the password.

Adware

Software that displays unwanted advertising, often bundled with free downloads. The mildest category here, but frequently a symptom of a wider unwanted-software problem.

Keystroke logging (keylogger)

Recording every key a user presses, in hardware or software, to capture credentials and messages as they are typed.

Payload

The part of an attack that performs the intended action, as distinct from the exploit that delivers it. The same exploit can carry very different payloads.

Bot

A single compromised machine under remote control. Also used for benign automation, so the security meaning depends entirely on context.

Botnet

A network of compromised machines controlled together, used for denial-of-service, spam, credential stuffing or mining. Scale is the product.

Command and control (C2)

The infrastructure and channel an attacker uses to issue instructions to compromised machines and retrieve data. Detecting C2 traffic is one of the highest-value defensive signals, because it persists after the initial compromise.

Living off the land (LOTL)

Attacking using tools already present on the system (PowerShell, WMI, certutil, scheduled tasks) instead of dropping recognizable malware. It defeats file-based detection by not introducing a file to detect.

Spam

Unsolicited bulk email. Relevant to security as the delivery vehicle for phishing and malware; address lists are typically assembled with automated scraping tools.

5. After the foothold: post-exploitation terms

A first foothold is rarely the objective. This vocabulary describes what happens between initial access and the actual damage, the window in which most breaches are still stoppable.

Privilege escalation

Moving from limited access to higher rights: standard user to administrator, or container to host. Split into local escalation on one machine and escalation across a domain.

Lateral movement

Spreading from the first compromised machine to others across the network, typically using stolen credentials rather than fresh exploits. The stage where a contained incident becomes a breach.

Persistence

Establishing a way back in that survives reboots, password changes and patching: a scheduled task, a service, a rogue account, a backdoor. It is why remediation means eviction, not just cleaning one machine.

Pivoting

Using a compromised machine as a relay to reach systems that are not directly reachable from outside, such as an internal network segment behind the initial host.

Exfiltration

Removing data from the environment. Often deliberately slow and disguised as ordinary traffic, since volume and timing are what detection looks for.

Denial of service (DoS)

Overwhelming a system so legitimate users cannot reach it. Note what it is not: a DoS attack degrades availability and compromises nothing. No data is read, altered or stolen.

Distributed denial of service (DDoS)

A denial-of-service attack launched from many machines at once, usually a botnet. Distribution makes it far harder to filter, because there is no single source to block.

6. How defenders answer: defensive and operational terms

Roughly half of any real security conversation is defensive vocabulary. If you are learning this glossary for an interview, this is the section that most often separates candidates.

Firewall

A control that permits or blocks traffic against a rule set, at the network edge or on the host. Necessary and badly oversold; it does nothing about a user who is phished or a credential that is reused.

Encryption

Encoding data so only holders of the correct key can read it, whether at rest or in transit. It protects confidentiality; it does not prevent intrusion.

HTTPS / TLS

Transport Layer Security, the protocol that encrypts and authenticates web traffic; HTTPS is HTTP running over it. SSL is its predecessor and has been deprecated for years, though the name persists in conversation and in product names long after the protocol was retired.

Multi-factor authentication (MFA)

Requiring more than one type of evidence to log in. The strongest widely-available form is a hardware security key or passkey, which resists phishing because the credential is bound to the real domain.

Zero trust

An architectural principle: never grant access based on network location alone; verify every request explicitly and grant the least privilege needed. It is a design stance, not a product, whatever vendors put on the box.

Patch management

The operational discipline of tracking, testing and deploying security updates. Unglamorous, and consistently the single highest-return defensive activity.

IDS / IPS

Intrusion detection systems alert on suspicious traffic; intrusion prevention systems also block it. The distinction is whether the tool is permitted to act on its own.

EDR / XDR

Endpoint detection and response monitors endpoint behavior for attack patterns and enables investigation and containment. Extended detection and response widens the same idea across email, identity, cloud and network telemetry.

SIEM

Security information and event management, the platform that centralizes logs from across an estate so activity can be correlated and alerted on. Its value is bounded by what you actually feed it.

SOC

The security operations center: the team and function that monitors, triages and responds to alerts, in-house or outsourced.

Incident response

The structured process for handling a confirmed security event: detect, analyze, contain, eradicate, recover, learn. The current US federal guidance is NIST SP 800-61r3.

Threat hunting

Proactively searching for adversaries already inside the environment, on a hypothesis rather than an alert. It assumes prevention has failed somewhere, which is a more realistic starting position than most controls admit.

Penetration test

An authorized, scoped, time-boxed assessment that attempts real exploitation and reports findings. Distinct from a vulnerability scan, which identifies possible weaknesses without exploiting them. The method is set out in our guide to penetration testing methodology.

Red team / blue team / purple team

Red team attacks, blue team defends, purple team is the practice of running both together so findings feed defensive improvement immediately rather than in a report months later.

Bug bounty

A program that pays external researchers for responsibly disclosed vulnerabilities, under published rules that make the testing authorized. The rules are what separate a bounty hunter from a grey hat with the same skills.

7. Terms that have quietly retired

Most hacking glossaries on the web are descended from the same early-2010s certification list, and they carry its vocabulary forward without checking whether anyone still uses it. Seven entries in that inherited list no longer mean what a reader would assume. This is the section we would want if we were learning from an older book:

None of these are wrong in a historical sense. They are simply not what a practitioner would say in 2026, and using them in an interview or a report signals that the vocabulary came from a dated source.

Hacking terms vs cyber security terms: is there a difference?

The two phrases are used interchangeably, and mostly that is fine, because the overlap is large. There is a real difference in emphasis, though, and it shows up in where each vocabulary is written down.

Hacking terminology is weighted toward offense: actors, techniques, tooling, the stages of an intrusion. It is the language of testing and of attack reporting, and much of it originated in practitioner culture rather than in standards bodies. Cyber security terminology is broader and more formal: it takes in governance, risk, compliance, architecture and assurance, and its canonical definitions live in reference works such as the NIST CSRC glossary, which runs to thousands of entries drawn from published standards.

For practical purposes: if you are learning to test systems or read an attack write-up, the vocabulary on this page is the working set. If you are writing policy, preparing for a governance audit or sitting an exam that references specific standards, you will need the formal glossaries too. They are authoritative, exhaustive and not designed to be read end to end.

Frequently asked questions

What is the difference between a white hat and a black hat hacker?

Authorization, not skill or intent. A white hat has the system owner’s documented permission to test; a black hat does not. The techniques can be identical. The permission is what separates lawful security work from an offense under the Computer Fraud and Abuse Act.

What do CVE and CVSS mean?

A CVE is the unique public identifier for one disclosed vulnerability, so everyone can be certain they are discussing the same flaw. CVSS is a separate 0-10 severity score for it, currently at version 4.0. One is a name, the other is a rating.

What is the difference between a virus, a worm and a trojan?

How they spread. A virus attaches to a host file and needs a person to run it. A worm spreads across a network by itself with no user action. A trojan does not self-replicate at all – it relies on the user choosing to install it because it looks like something desirable.

Does zero-day just mean a serious vulnerability?

No, and this is the most common misuse in the glossary. Zero-day means the vendor has had zero days to produce a fix, so no patch exists. Once a patch ships the flaw is no longer a zero-day, however severe it is – at that point it is simply unpatched, which is a different problem with a different remedy.

Is ‘cracker’ still used in the industry?

Rarely. It was coined to protect the older, constructive sense of ‘hacker’, and that battle was lost. Current reports use ‘threat actor’ or ‘adversary’. You will still meet it in older textbooks and certification material.

Which of these terms should a beginner learn first?

The defensive section and the six terms people most often confuse: threat, vulnerability, risk, exploit, payload and zero-day. Interviews probe those distinctions far more often than they ask for obscure malware families, because getting them wrong signals that the vocabulary was memorized rather than used.

Where to learn this properly

A glossary gets you through a conversation; it does not make you employable. The terms in sections 3 to 6 are only genuinely understood once you have used the tools that produce them, which means structured training and a lab, not a reading list.

We have ranked the options in two guides: the best ethical hacking courses for offensive-security paths, and the best cyber security courses for the broader defensive and governance track. Both rank on merit and say plainly which options are not worth the money.

See the ranked ethical hacking courses →

Related guides

• Hacking vs ethical hacking: the line that matters
• Is ethical hacking legal? Authorization and the CFAA
• Penetration testing methodology, stage by stage
• Website hacking techniques and how they are stopped
• Password hacking techniques: online, offline and bypass
• Common network security threats and how to fix them
• The best ethical hacking tools
• Windows pentesting tools
• Kali Linux tools
• Programming languages for hacking — what the tools are actually written in
• Best digital forensics courses — the post-incident investigation specialty
• Best Linux distros for hacking — the platforms these tools ship on