Security Slang Decoder

The gap between how a thing is taught and what people call it at 2am in a chat channel. On the left is the term you meet in a course or a cert objective. In the middle is what practitioners, CTF players and the wider scene actually say. On the right is plain English.

Some of this “underground” slang is now just industry shorthand, and some of it is Hollywood. This sheet keeps the real meaning attached to every nickname, so you can read a write-up, a job description or a Discord thread and follow along. Slang shifts by crew, region and era, so treat this as the common core, not gospel.

Getting in

Textbook term	What people say	Plain English
Gain initial access	pop a box, get a foothold, land on a host, beachhead	first working access to a machine
Compromise a host fully	own it, pwn it, root it (Linux), SYSTEM it (Windows)	full control of the machine
Privilege escalation	privesc, user-to-root, escalate	low-priv access to admin or root
Remote code execution	RCE, popping a shell, getting a shell	run your commands on their box
Assume breach	assume breach	start as if the attacker is already inside
Interactive session on a target	a shell, a callback, a beacon	your live connection to the box

Credentials and the good stuff

Textbook term	What people say	Plain English
Credentials	creds	usernames plus passwords or keys
Password hashes	hashes	the stored form of a password
Credential dumping	dumping, looting, grabbing creds	pulling passwords or hashes off a box
Reuse a hash without cracking it	pass-the-hash (PtH)	authenticate with the hash itself
The domain password database (NTDS.dit)	the crown jewels, the hash dump, DCSync-ing	every credential in the AD domain
Domain Administrator	DA, getting DA	the win condition in most AD engagements
Most privileged assets	the keys to the kingdom	DCs, krbtgt, admins — game over if lost
Cracking hashes offline	cracking, running it through hashcat, on the GPU	brute or dictionary attack on captured hashes

Kerberos and Active Directory

Textbook term	What people say	Plain English
Kerberoasting	roasting, kerb-roasting	grab service tickets to crack service-account passwords offline
AS-REP roasting	asrep roasting	same idea, for accounts with pre-auth off
Golden Ticket attack	golden ticket, going golden	forge a domain-wide Kerberos ticket from the krbtgt key
Silver Ticket attack	silver ticket	forge a ticket for a single service
Directory enumeration	enum, running BloodHound	mapping users, groups and paths to admin
Attack-path mapping	the graph, shortest path to DA	the visual map of how to reach Domain Admin
Living off pre-installed tools	living off the land, LOLBins, LOLBAS	abusing legit built-in binaries so you drop no malware

Moving around

Textbook term	What people say	Plain English
Lateral movement	moving laterally, jumping boxes	hopping from one machine to the next
Pivoting through a host	pivoting, tunneling through	routing your traffic through a compromised box
Internal server-to-server traffic	east-west	movement inside the network
Client-to-internet traffic	north-south	traffic crossing the perimeter
Persistence	sticking around, a backdoor	keeping access after a reboot or password change

Recon

Textbook term	What people say	Plain English
Reconnaissance / enumeration	recon, enum, footprinting	learning the target before touching it
Open-source intelligence	OSINT	recon from public sources
Password spraying	spraying, spray and pray ⚠	one common password against many accounts
Search-engine dorking	dorking, Google dorking	crafted searches that surface exposed files or logins
Easy, obvious findings	low-hanging fruit, quick wins	the stuff you check first

Tooling and payloads

Textbook term	What people say	Plain English
Command-and-control	C2, callback infrastructure	the server your implants phone home to
Agent on a compromised host	implant, beacon, the agent, RAT	the code that gives you remote control
Malicious code that runs	payload, the drop, shellcode	what actually executes on the target
Small first-stage loader	stager, dropper	tiny code that pulls down the real payload
Weaponize an exploit	weaponize, make it a sploit	turn a proof-of-concept into a working attack
Proof-of-concept	PoC, a poc	a demo that a bug is real, not yet an attack
Tools by nickname	mimi (Mimikatz), cobalt (Cobalt Strike), BH / SharpHound (BloodHound), cme / nxc (CrackMapExec / NetExec), the framework (Metasploit)	shorthand you will hear constantly

Vulnerabilities and timing

Textbook term	What people say	Plain English
Zero-day	0-day, oh-day, a zero	a bug with no patch yet
Known-but-unpatched bug	n-day, one-day	patch exists; targets have not applied it
Actively exploited	in the wild, ITW	attackers are using it now
No user interaction needed	0-click	victim does not have to click anything
Monthly Microsoft patches	Patch Tuesday, and jokingly Exploit Wednesday	update day, and the day after when attacks appear

Web and bug bounty

Textbook term	What people say	Plain English
SQL injection	SQLi, sqli	injecting database commands through input
Cross-site scripting	XSS	injecting scripts into a page other users load
Server-side request forgery	SSRF	making the server fetch things for you
Insecure direct object reference	IDOR	change an ID in the URL, see someone else's data
Bug bounty program	bounty, hunting, on a program	getting paid to report bugs legally
A valid paid finding	a bounty, a crit, a dupe (already reported)	the outcomes of a hunt

People and teams

Textbook term	What people say	Plain English
Offensive team	red team, the red, operators	the attackers in an exercise
Defensive team	blue team, the blue, the SOC, analysts	the defenders
Combined exercise	purple team	red and blue working together — StashGrid's whole thing
Advanced persistent threat	APT, the adversary, a TA (threat actor)	a serious, funded attacker
Unskilled attacker using others' tools	script kiddie, skid ⚠	runs tools without understanding them
Newcomer	n00b, noob ⚠	beginner — often affectionate, sometimes not
Veteran	greybeard, old head	someone who has been doing it forever

Getting caught

Textbook term	What people say	Plain English
Detected by defenders	burned, caught, popped by EDR	your tool or infrastructure got flagged
Operational security	OPSEC, staying quiet, going loud ⚠	how careful you are about being seen
Endpoint detection tool	EDR, the AV, the agent	the thing on the host watching for you
Decoy to catch attackers	honeypot, honey account, canary, tripwire	a fake asset that is malicious to touch
Indicators of compromise	IOCs	the fingerprints an attack leaves
Tactics, techniques, procedures	TTPs	how an attacker operates, per MITRE ATT&CK

CTF culture

Textbook term	What people say	Plain English
Capture the Flag	CTF, playing a box, rooting the box	a hacking game or challenge
A target machine	a box	one machine to solve
The proof strings you submit	user and root, the flags, user.txt / root.txt	what you capture to score
A machine you have fully solved	rooted, owned	done, both flags

NyxHalf of these Steven learned last week. He called it “doing the hacking” until embarrassingly recently.

Go deeper

• The Cyber Kill Chain: where a lot of these terms sit in an actual attack.
• Shodan cheat sheet and the Nmap cheat sheet: the recon side, hands-on.
• The labs: where you go from knowing the word to doing the thing, in your own lab.

Written from common industry and community usage, checked 27 Sep 2026. Slang moves fast — if something here is off or missing, tell me and I will fix it.