Glossary¶

Plain-language explanations of the technical terms that appear in the Alpha Strike Platform. Only terms that are not self-explanatory to a non-technical user are listed. Terms are grouped by where they matter and sorted alphabetically within each group.

Note on the examples

All IP addresses, domains, host names, organisations and certificate authorities used below are placeholders. They come from the address ranges and names that the internet standards reserve for documentation (192.0.2.0/24, 2001:db8::/32, AS64496, example.com) and never refer to a real system, customer or company.

Core platform concepts¶

All sources: A search scope setting meaning that every source available for this target type and company plan is active. For a domain or administrator-created TLD this can include Attack surface, Darknet, and Employees. For an email address it means Darknet and Employees; email addresses do not support Attack surface.
Assets: The confirmed inventory of a project: the hosts, services and domains that have been accepted as really belonging to the organisation. Everything here is treated as "yours".
Attack surface: Everything of an organisation that is reachable from the internet and could therefore be attacked. Servers, open ports, web applications, domains, certificates. Also used as a search scope setting, meaning "search internet-facing systems only".
Attack Surface Management (ASM / EASM): The continuous process the platform performs: find everything of yours that is exposed to the internet, identify weaknesses, and keep watching for changes.
Blacklist: A list of search terms that should be ignored during discovery. Used to suppress terms that produce mostly irrelevant results (e.g. a hosting provider or a certificate issuer name).
Discovery: The staging area. Everything the platform suspects could belong to the organisation lands here first, together with the reason it was found, so a person can review it before it is promoted to Assets.
False positive: A result that looks like a hit but is not actually yours or not actually a problem. Broader search settings find more, but also produce more false positives.
Finding: The result of a specific check run against a service. For example "Web Server Detection" or "TLS Library Detect". Findings describe what was observed; they are not necessarily a vulnerability (many are only Informational).
Mass manipulation: A rule of a project that writes information such as the company, sector or a classification into the custom data of every service matching a condition. It runs after every scan and monitoring run, and can be applied once on request. See Mass manipulation.
Match: The evidence that links a discovered item to one of your search terms. It tells you where the term was found. Common types: Banner Match (in the service's self-description), Domain Match (in a domain or host name), TLS Certificate Match (in a certificate), Autonomous System Match (in the name of the network operator), Body Match (in the content of a web page).
Monitoring: Recurring re-scanning of a project (Daily / Weekly / Monthly, or Inactive). Keeps the inventory current and mails updates about what changed.
Origin: The reason a discovered item ended up in the project, e.g. "Domain search" or "Keyword search", including the concrete term that triggered it.
Preset: A saved set of scan options that can be applied when creating a project, so the same configuration does not have to be reproduced by hand.
Raw: Tab on a service showing the unprocessed scan data exactly as it was collected. Intended for technical verification of a result.
Removed services: Services that were explicitly excluded from a project. They stay excluded on future scans instead of reappearing with every run.
Scope: The definition of what belongs to the project: the search terms (targets), the blacklist and the excluded services. The scope determines what the platform is allowed to look for.
Search job: One scan run. Job types are Monitoring Discovery (searching for new, possibly related assets) and Monitoring Asset (re-checking assets that are already confirmed). Each job has a status such as Completed or Completed (with errors).
Search term / Target: A single input that defines what to search for. Types are Domain, Keyword, Email, IPv4 Address, IPv4 Range, IPv6 Address, and IPv6 Range (see CIDR notation). Administrators can additionally classify a valid top-level domain as TLD.

Network and infrastructure terms¶

Autonomous System (AS / ASN): One or more IP ranges that are routed on the internet by a single operator (an ISP, a cloud provider, a university) under one number, e.g. AS64496 - Example Corp. Useful for judging who actually runs an IP address.
Banner path: The exact position inside the scan data where a value was read, e.g. banner.http.server.0. Shown so that a hit can be traced back to its source; it is technical evidence, not a setting.
CIDR notation: The short way of writing an IP range, e.g. 192.0.2.0/24. The number after the slash says how large the range is. A smaller number means more addresses (/24 = 256 addresses, /16 = 65,536).
Domain / Subdomain: example.com is a domain; vpn.example.com is a subdomain of it. Subdomains are frequently forgotten systems and therefore a common weak point.
FQDN (Fully Qualified Domain Name): The complete, unambiguous name of a system, e.g. web007.example.com - host name plus domain.
Host: A single machine reachable at one IP address. One host can offer several services.
IP address (IPv4 / IPv6): The numeric address of a machine on the internet. IPv4 looks like 192.0.2.45, the newer IPv6 like 2001:db8:0:65::100:475.
Nameserver / Email server: The servers that answer "which IP belongs to this name?" (nameserver, DNS) and that accept mail for a domain (email server, MX record). An entry for the email server suggests the domain is actually used for mail; nameservers exist for almost every registered domain and say little on their own.
openport (protocol value): An open port on which the platform could not identify what software answers. Something is listening, but the protocol is unknown. If a host has many such ports, they are hidden; see Hidden open ports.
Port: A numbered "door" on a host, each usually belonging to one service. E.g. 443 for encrypted web traffic (HTTPS), 80 for unencrypted (HTTP).
Protocol: The language a service speaks, e.g. http, https. Determines how the platform can interrogate the service.
Reverse DNS: The name stored in DNS for an IP address (PTR record), set by whoever operates the IP range. Often reveals the operator or purpose of a machine, but it can be missing or outdated.
Server banner: The self-description a service sends when contacted, e.g. ExampleServer/2.4.62 (ExampleOS) ExampleTLS/3.5.5 ExampleLang/3.9. It is the main source for identifying software and versions and often reveals more than intended.
Service: One specific offering on a host, identified by IP + port + protocol (e.g. https/443 on 192.0.2.45). The service is the actual unit that gets assessed.
Virtual host: Several websites sharing one IP address and port; which one you get depends on the name you asked for. Explains why one IP can carry many different sites.
Whois: The public registration database for IP ranges and domains. Supplies the registered owner, the net name (short label of the range, e.g. EXAMPLE-NET-1), the description, and the administrative, technical and abuse contacts (where misuse is reported).

Vulnerabilities and risk assessment¶

CPE (Common Platform Enumeration): A standardised identifier for a piece of software and its version, e.g. cpe:2.3:a:examplevendor:example_server:2.4.62:*:*:*:*:*:*:*. The platform uses it to match detected software against known vulnerabilities.
CVE (Common Vulnerabilities and Exposures): The worldwide unique ID of a publicly known vulnerability, made up of the year and a sequential number, e.g. CVE-2026-00000. Anyone can look up the same ID and get the same weakness.
CVSS score: Standardised severity rating of a vulnerability from 0.0 to 10.0. Roughly: 9.0–10.0 Critical, 7.0–8.9 High, 4.0–6.9 Medium, 0.1–3.9 Low, 0.0 = none (shown in the platform as Informational).
CVSS vector: The short formula behind the score, e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It encodes how the weakness is exploited. AV:N (Attack Vector: Network) for instance means it is attackable straight over the internet.
Exploit: Ready-made code or a documented method for actually abusing a vulnerability. If an exploit exists, the vulnerability becomes considerably more urgent.
Informational: The lowest severity level. Not a weakness, just a noteworthy observation (e.g. "this software version was detected").
Max CVSS score: The score of the most severe vulnerability found on a service. A quick indicator of how bad the worst case is.
Severity: The risk classification: Critical, High, Medium, Low, Informational.
Technology detection: Automatic recognition of the software stack behind a service (web server, programming language, frameworks, libraries). The platform uses fingerprinting and the tool Wappalyzer for this.
Vulnerability: A weakness in software or configuration that an attacker can abuse. In the platform, vulnerabilities are mostly derived from detected software versions (see CVE).

Certificates (TLS/SSL)¶

Certificate Authority (CA) / Issuer: The organisation that issued a certificate and vouches for it, e.g. Example Internal Certification Authority or Global Example CA. Shown as Issuer CN / Issuer organization.
Subject CN (Common Name): The primary host name a certificate was issued for. Modern certificates list all names they are valid for in the Subject Alternative Name field; the CN is only the first, historical entry. Certificates are a very reliable source for finding further systems of an organisation.
Subject organization / organization unit: The organisation and internal department named in the certificate. Helps confirm that a system really belongs to the company.
TLS / SSL certificate: The electronic identity card of an encrypted connection (the padlock in the browser). It states which name the server is allowed to use and who confirmed that.

E-mail security¶

DANE: TLSA records in a DNSSEC-signed zone that tell sending servers which certificate a mail server must present. Lets them verify the mail server without relying on certificate authorities.
DKIM (DomainKeys Identified Mail): A signature that the sending server adds to every mail. Receivers check it with a public key published in DNS, which shows that the mail really comes from the domain and was not changed.
DMARC: A DNS record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM: deliver it (none), put it into quarantine (quarantine), or reject it (reject). Without it, forged mail in your name is usually still delivered.
DNSSEC: Digital signatures on DNS records. They let a resolver detect forged answers, for example a wrong address for your mail server.
MTA-STS: A policy, published on a web server of the domain, that requires sending servers to deliver mail only encrypted and only to the listed mail servers. In testing mode, violations are only reported.
MX record: The DNS record that names the mail servers of a domain, each with a priority. Only domains with MX records are checked for e-mail security.
SPF (Sender Policy Framework): A DNS record that lists the servers allowed to send mail for a domain, e.g. v=spf1 mx -all. The ending says what happens to all other servers: -all rejects them, ~all only marks them as suspicious.
STARTTLS: The command with which a mail server switches an unencrypted connection on port 25 to TLS. A mail server that does not offer it receives mail unencrypted.

Intelligence and darknet¶

Affected data: The categories of data exposed in a leak. For example email address, password, name, address.
Darknet: Parts of the internet that are not reachable via normal search engines and are used, among other things, for trading stolen data. The platform searches these sources for data belonging to your organisation.
Darknet exposure risk: How severe an exposure in the darknet is, rated Very high through None.
Domain squatting: Registering domains that look deceptively similar to your own, usually to impersonate your organisation, for phishing, fake shops or fraudulent invoices.
Fuzzer: The technique by which a look-alike domain was generated. Examples: addition (extra character: example1.com), transposition (swapped characters: exapmle.com), vowel-swap (exchanged vowel: exemple.com), subdomain (dot inserted: exa.mple.com), various (mixed variants), *original (the genuine domain, for comparison).
Password (last characters): Only the final characters of a leaked password are shown. That is enough to recognise your own password without the platform storing it in full.
Password / Passwords (Employees): Indicates whether leaked credentials are known for this person. N/A means none found.

Scan options (project settings)¶

Add keyword search results to assets: Keyword hits go straight into Assets instead of being staged in Discovery first. Faster, but noticeably more false positives.
E-mail security checks: Rates how well each mail domain of the project is protected against forged senders and against interception, with seven checks (TLS, DNSSEC, SPF, DMARC, DKIM, MTA-STS, DANE). Available in Active mode only, because the platform queries DNS and connects to the mail servers. See Assets.
HTTP body / Keyword search in HTTP body: The body is the actual content of a web page. With this option enabled, the platform searches the first 32 KB of the home page as full text for your keywords, many more hits, but also many more false positives.
Subdomain enumeration: Systematically finding subdomains of a domain. Active means the platform queries name candidates from word lists itself; passive means it only queries external databases (quieter, but less complete).
Take screenshots of HTTP(S) services: Captures an image of every web page found. The fastest way to see what a system actually is (login page, error page, forgotten test system).
Transliteration: Automatic generation of spelling variants for words containing umlauts, e.g. Grün → Gruen, Grun. Catches systems that were registered without umlauts.
Wordlist: A prepared list of common names that active subdomain enumeration tries out (vpn, mail, test, dev, …).

Dashboard readings¶

Affected / Unaffected: Share of services or IP addresses on which at least one vulnerability was found, versus those without.
Applications (Vendor / Product / Version): Inventory of all detected software across the project. Which manufacturer, which product, which version, and how often it occurs.
Distribution: Breakdown of results by category (e.g. vulnerabilities by severity), optionally over 1, 2 or 12 months, which makes trends visible.
Services device categories: Classification of the found services by the type of device behind them. Useful for spotting equipment that ought not to be reachable from the internet at all.