Penetration testing
Appendix E. Glossary — Terms with Korean Equivalents and Definitions
You have a saved reading position.
- Target reader: All levels (especially useful for readers cross-referencing Korean security documents)
- Purpose: A reading dictionary, interview/exam term reference, and the standard spelling authority for the published edition
In this book, every term follows the principle of English original + Korean explanation. Security documentation is primarily published in English, so learning by the original term rather than a translation serves you better in practice. This glossary is the book’s spelling standard.
E-1. Fundamentals
| Term | Korean | Core meaning |
|---|---|---|
| Information Security (InfoSec) | 정볼보안 | The field protecting confidentiality, integrity, and availability of information |
| Offensive Security | 공격적 보안 | Strengthening defense through the attacker’s perspective and techniques |
| Vulnerability | 취약점 | A weakness that can be leveraged in an attack |
| Exploit | 익스플로잇 | The act — or the code — that actually leverages a vulnerability |
| Payload | 페이로드 | The actual content executed once an attack succeeds |
| Attack Surface | 공격 표면 | The set of all points where an attack is possible |
| Threat Model | 위협 모델 | Assumptions defining who targets what, and how |
| Red Team / Blue Team | 레드팀 / 블루팀 | Adversary-simulation team / defense team |
| Pentest (Penetration Test) | 침투 테스트 | An assessment that actually penetrates a commissioned scope |
| Bug Bounty | 버그바운티 | Programs that pay rewards for vulnerability reports |
| CVE | 공통 취약점 식별자 | The standard identifier for known vulnerabilities (CVE-year-number) |
| CVSS | 취약점 심각도 점수 | The standard 0–10 severity scoring for vulnerabilities |
| 0-day / 1-day | 제로데이 / 원데이 | Unpatched vulnerability / analysis and abuse of a disclosed, patched one |
| CTF (Capture The Flag) | 플래그 쟁탈전 (CTF) | Security competitions where you solve challenges to find flag strings |
| Write-up | 라이트업 (풀이) | A documented walkthrough of how a challenge was solved |
E-2. Systems & Networks
| Term | Korean | Core meaning |
|---|---|---|
| Shell | 쉘 | The interface that takes and runs commands; “getting a shell” is an attacker’s first goal |
| Reverse Shell / Bind Shell | 리버스 쉘 / 바인드 쉘 | Victim connects out to the attacker / victim opens a port and waits |
| Privilege Escalation (PrivEsc) | 권한 상승 | Climbing from a regular user to root/admin |
| Enumeration | 열거 | Systematically gathering information about a target |
| Reconnaissance (Recon) | 정찰 | The entire pre-attack information-gathering phase |
| Post-Exploitation | 후속 침투 | Expansion activities after the shell is obtained |
| Pivoting | 피벗팅 | Moving through a compromised machine into the internal network |
| Lateral Movement | 수평 이동 | Expanding to other systems at the same privilege level |
| Persistence | 지속성 | Mechanisms that keep access alive across reboots |
| Port | 포트 | The number distinguishing services on one machine (0–65535) |
| TCP / UDP | 전송 제어 / 사용자 데이터그램 프로토콜 | Connection-oriented / connectionless transport |
| Three-way Handshake | 3방향 악수 | SYN → SYN-ACK → ACK: how TCP opens a connection |
| NAT | 주소 변환 | Translating between private and public IP addresses |
| DNS | 도메인 이름 체계 | The internet’s phone book: names to IPs |
| OSI Model | OSI 7계층 | A reference model dividing communication into seven layers |
| MITM (Man-in-the-Middle) | 중간자 공격 | Inserting yourself into a communication to read or alter it |
| Spoofing | 스푸핑 | Forging addresses or identities |
| Tunneling | 터널링 | Carrying one protocol inside another |
E-3. Web Hacking
| Term | Korean | Core meaning |
|---|---|---|
| SQL Injection (SQLi) | SQL 인젝션 | Manipulating queries through input to control the database |
| Blind SQLi | 블라인드 SQLi | Extracting data through true/false reactions when output is invisible |
| XSS (Cross-Site Scripting) | 크로스사이트 스크립팅 | Running scripts in other users’ browsers |
| Reflected / Stored XSS | 반사형 / 저장형 XSS | Reflected immediately in the response / stored on the server for persistent execution |
| CSRF (Cross-Site Request Forgery) | 사이트 간 요청 위조 | Making the victim’s browser send requests unknowingly |
| SSRF (Server-Side Request Forgery) | 서버 측 요청 위조 | Making the server issue requests to reach internal networks |
| SSTI (Server-Side Template Injection) | 템플릿 인젝션 | Injecting template syntax to execute server-side code |
| XXE (XML External Entity) | XML 외부 개체 | Reading files via the XML parser’s external entity feature |
| IDOR (Insecure Direct Object Reference) | 안전하지 않은 직접 객체 참조 | Accessing others’ resources by simply changing an identifier |
| Command Injection | 명령어 인젝션 | Input being executed as an operating-system command |
| LFI / RFI | 로컬 / 원격 파일 포함 | Manipulating which file the server includes |
| File Upload Attack | 파일 업로드 공격 | Uploading a webshell or similar to take over the server |
| Webshell | 웹쉘 | An uploaded script that executes commands over the web |
| Deserialization Attack | 역직렬화 공격 | Executing code by tampering with object restoration |
| JWT (JSON Web Token) | 제이슨 웹 토큰 | A signed JSON authentication token |
| Session Hijacking | 세션 하이재킹 | Stealing a session identifier to impersonate a user |
| Rate Limiting | 속도 제한 | A defense that throttles repeated requests |
E-4. Binary (Pwn & Reversing)
| Term | Korean | Core meaning |
|---|---|---|
| Buffer Overflow | 버퍼 오버플로우 | Input overflowing a buffer and overwriting adjacent memory |
| Stack / Heap | 스택 / 힙 | The call workspace / the dynamic-allocation area |
| Stack Frame | 스택 프레임 | The unit one function call pushes onto the stack |
| Return Address | 복귀 주소 | Where a function returns to; the target of overwrites |
| Shellcode | 셸코드 | A machine-code snippet that spawns a shell |
| ROP (Return-Oriented Programming) | 리턴 지향 프로그래밍 | Chaining existing code fragments (gadgets) into an attack |
| Gadget | 가젯 | A short machine-code fragment ending in ret |
| NX (Non-Executable) | 실행 방지 | A protection blocking code execution on stack/heap |
| ASLR | 주소 공간 무작위화 | A protection randomizing addresses on every run |
| Stack Canary | 스택 칼나리 | A guard value before the return address; detects tampering |
| PIE | 위치 독립 실행 파일 | Randomizes the binary’s own addresses too |
| Format String Attack | 포맷 스트링 공격 | Reading/writing memory through printf-family argument abuse |
| GOT / PLT | 전역 오프셋 표 / 절차 연결 표 | Tables linking calls to external functions |
| Use-After-Free (UAF) | 해제 후 사용 | A vulnerability using memory after it was freed |
| Disassembler | 디스어셈블러 | Translates machine code to assembly (Ghidra, IDA) |
| Debugger | 디버거 | Pauses and inspects a running program (gdb, x64dbg) |
| Anti-Debugging | 안티디버깅 | Techniques that detect or obstruct debuggers |
| Packing / Unpacking | 패킹 / 언패킹 | Compressing/obfuscating executables, and reversing it |
E-5. Crypto, Forensics & Others
| Term | Korean | Core meaning |
|---|---|---|
| Encryption / Decryption | 암호화 / 복호화 | Making unreadable / restoring |
| Symmetric / Asymmetric Key | 대칭키 / 비대칭키 | Same key for both directions / a public-private key pair |
| RSA | RSA (알에스에이) | Public-key cryptography resting on the hardness of factoring |
| AES | 고급 암호 표준 | The de facto standard block cipher |
| Hash Function | 해시 함수 | A one-way function mapping arbitrary length to fixed length |
| Collision | 충돌 | Two different inputs producing the same hash |
| Padding Oracle | 패딩 오라클 | Decrypting ciphertext through padding-error reactions |
| Diffie-Hellman | 디피-헬만 키 교환 | Creating a shared secret over an eavesdropped channel |
| ECC | 타원곡선 암호 | Public-key cryptography based on elliptic-curve operations |
| Forensics | 포렌식 | Collecting and analyzing digital traces to reconstruct events |
| Steganography | 스테가노그래피 | Hiding data inside files |
| Memory Dump | 메모리 덤프 | A copy of the entire memory of a running system |
| Artifact | 아티팩트 | Trace data left on a system |
| Timeline Analysis | 타임라인 분석 | Reconstructing events by lining traces up in time order |
| OSINT | 공개 출처 정보 | Collecting and analyzing publicly available information |
| Social Engineering | 사회공학 | Attacking people rather than technology |
| Phishing | 피싱 | Luring credentials with fake pages or emails |
| Brute Force | 브루트포스 (무차별 대입) | Trying every possible value |
| Credential Stuffing | 크리덴셜 스터핑 | Trying leaked account lists on other sites |
| Password Spraying | 패스워드 스프레이 | Spraying a few common passwords across many accounts |
| OSCP | OSCP (오에스씨피) | OffSec’s hands-on penetration-testing certification — the goal of Level 4 |
In Closing
Terms are not for memorizing by definition — the goal is recognizing them in context. When you meet an unknown term, come back to these tables; if it is not here, make a habit of finding its official documentation. That habit is half of studying security.
ONE STEP FURTHER
Finished this lesson?
Check the completion criteria, then mark your progress.