Script Kiddie
A script kiddie is an inexperienced attacker who uses existing hacking tools or scripts created by others without fully understanding how they work.
“A person who executes security attacks that have been created by other hackers rather than creating one's own attacks.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Script Kiddie?
Although they often lack advanced technical knowledge, script kiddies can still cause damage by exploiting publicly available tools.
Limited expertise: Relies on existing tools.
Security threat: Can exploit known vulnerabilities.
Testing relevance: Helps organizations understand common attack methods.
Real World Example
A small e-commerce site's web application firewall logs repeated, automated login attempts using a well-known, publicly downloadable SQL injection tool, with none of the default payloads modified.
The security team's first instinct is to treat this as a serious targeted attack, but the unmodified, off-the-shelf payloads and the lack of any adaptation when the first attempts are blocked point to a Script kiddie rather than a skilled attacker.
A tester uses that distinction to prioritize sensibly: confirming the defenses stop the well-known, unmodified payloads a script kiddie would run, but not stopping there — deliberately trying slightly altered or obfuscated payloads too, since assuming every attacker stays at that skill level would be a dangerous shortcut.
The basic automated attempts are confirmed blocked, but the extra testing with modified payloads turns up a gap the default tool never would have found — coverage that would have been missed if the team had stopped as soon as the script kiddie's attack failed.
Practice Questions
Question 1
A web application firewall logs repeated login attempts using a well-known, publicly downloadable SQL injection tool. The attacker never modifies the tool's default payloads, even after they are blocked. Which term BEST describes this type of attacker?
Question 2
Why should a security tester avoid assuming that every attacker targeting the application is a script kiddie?
Test your knowledge with real ISTQB-style questions
You’ve learned Script Kiddie. Test your understanding with topic-specific questions in our Mock Exams.