DEV Community

Rençber AKMAN
Rençber AKMAN

Posted on

Module 1: Ethical Hacking & Penetration Testing — Professional Reference Notes

#cybersecurity #ethicalhacking #tutorial #learning

A comprehensive, industry-grade knowledge base built from the Cisco Networking Academy "Ethical Hacker" curriculum, expanded with professional terminology, frameworks, tools, cloud concepts, career roles, and real-world practices used across the cybersecurity industry. This document is structured module-by-module, mirroring the official course outline, but goes significantly beyond it to provide the depth required for mid/senior-level practitioner readiness.

Table of Contents

MODULE 1: Introduction to Ethical Hacking and Penetration Testing

1.0 Introduction

1.0.1 Why This Module Matters

Before a security professional can run a single scan or write a single exploit, they must understand the legal, ethical, procedural, and conceptual foundation that separates a criminal hacker from a paid security professional. This single distinction — authorization — is the most important concept in the entire field of offensive security. Every tool, technique, and methodology covered in later modules is meaningless (and illegal) without it.

This module establishes:

  • What ethical hacking and penetration testing actually are (and are not)
  • The business and risk-management reasons organizations pay for these services
  • The different categories of threat actors and how they differ from ethical hackers
  • The formal methodologies/frameworks that govern professional engagements
  • How to build a safe, legal, isolated lab environment to practice in

1.0.2 Module Objectives Mapped to Course Topics

Topic Goal
Understanding Ethical Hacking and Penetration Testing Explain the importance of ethical cyber attacks and penetration testing
Exploring Penetration Testing Methodologies Explain different penetration testing methodologies and frameworks
Setting Up Your Own Lab Configure a virtual machine for your penetration testing learning experience

1.1 Understanding Ethical Hacking and Penetration Testing

1.1.1 Core Definitions

Hacking (neutral definition): The act of identifying and exploiting weaknesses in a computer system or network to gain access to data, functionality, or resources that were not intended to be accessible. The term itself is morally neutral — intent and authorization determine whether an act is criminal or professional.

Ethical Hacking: The practice of using the same tools, techniques, and mindset as malicious attackers (black-hat hackers), but doing so legally, with explicit written permission, for the purpose of identifying and helping remediate security weaknesses before criminals can exploit them. Ethical hackers are also called White-Hat Hackers.

Penetration Testing (Pen Testing / PenTest): A formal, authorized, simulated cyberattack against a computer system, network, web application, or organization, performed to evaluate the security of the system. Penetration testing is a subset of ethical hacking — it is the structured, scoped, contractually-defined engagement type, whereas "ethical hacking" is the broader philosophy/discipline.

Vulnerability Assessment (VA): A related but distinct discipline — the process of identifying, quantifying, and prioritizing (ranking) vulnerabilities in a system, typically via automated scanning, without actively exploiting them. A penetration test goes further by attempting to exploit findings to prove real-world impact.

Term Goal Exploitation? Depth
Vulnerability Assessment Find & list weaknesses No Broad, shallow
Penetration Testing Prove exploitability & impact Yes (controlled) Narrow, deep
Red Teaming Simulate full adversary campaign, test detection/response Yes, stealthy Very deep, organization-wide
Bug Bounty Crowdsourced vulnerability discovery Sometimes Varies, continuous
Security Audit Compliance/policy/configuration review No Broad, document-driven

1.1.2 Why Do We Need to Do Penetration Testing?

Organizations invest in penetration testing for several converging business and technical reasons:

  1. Proactive Risk Identification — Find and fix vulnerabilities before adversaries (criminal hackers, nation-state actors, insiders) exploit them. This is the core value proposition of offensive security: cost of a controlled, friendly breach simulation is always cheaper than the cost of a real breach.
  2. Regulatory & Compliance Requirements — Many laws, standards, and frameworks mandate periodic penetration testing:
    • PCI DSS (Payment Card Industry Data Security Standard) — Requirement 11.3 mandates annual and post-change penetration testing for any organization that stores, processes, or transmits cardholder data.
    • HIPAA (Health Insurance Portability and Accountability Act) — U.S. healthcare data protection law; encourages risk assessments including penetration testing.
    • GDPR (General Data Protection Regulation) — EU data protection law; Article 32 requires "regular testing, assessing and evaluating the effectiveness" of security measures.
    • SOC 2 (System and Organization Controls 2) — Trust Services Criteria audit common for SaaS companies; often requires evidence of pen testing.
    • ISO/IEC 27001 — International information security management standard; Annex A controls reference technical vulnerability management and testing.
    • NIST 800-53 / FedRAMP — U.S. federal government and cloud-service-provider security control frameworks requiring "Security Assessment" (CA family controls), including penetration testing for cloud authorization (ATO — Authority to Operate).
    • NYDFS Cybersecurity Regulation (23 NYCRR 500) — New York State financial regulation requiring annual penetration testing.
  3. Insurance Requirements — Cyber-insurance underwriters increasingly require proof of regular security testing to issue or renew policies, and may reduce premiums for organizations with mature testing programs.
  4. Validating Defensive Controls — Confirms that firewalls, IDS/IPS, EDR, SIEM, and detection/response processes actually work as intended ("trust but verify").
  5. Third-Party / Supply Chain Assurance — Enterprise customers (especially in B2B SaaS) routinely require vendors to provide a recent penetration test report before signing contracts.
  6. Incident Preparedness — A pentest engagement often doubles as a tabletop exercise, testing whether the Security Operations Center (SOC) and Incident Response (IR) team detect and respond to the simulated attack.
  7. Reputation and Trust Protection — A public breach can permanently damage brand trust and stock price; testing is a preventive investment.
  8. Mergers & Acquisitions (M&A) Due Diligence — Acquiring companies often commission penetration tests of target companies' infrastructure before finalizing a deal.

1.1.3 Threat Actors

Understanding who you are defending against (and who an ethical hacker is emulating) is essential. Threat actors are categorized by motivation, skill level, and resources.

Classification by Hat Color (Hacker Culture Terminology)

  • White Hat: Authorized, ethical security professional. Works for the organization or with explicit consent.
  • Black Hat: Malicious, unauthorized attacker motivated by personal gain, ideology, or destruction.
  • Grey Hat: Operates without authorization but typically without malicious intent — e.g., finds and discloses a vulnerability without permission, sometimes for recognition or to pressure a vendor to fix it. Still illegal in most jurisdictions even if well-intentioned.
  • Blue Hat (sometimes "Blue Team"): Often refers to external security consultants invited to test systems before launch (Microsoft's "BlueHat" conferences), or more broadly to defensive security practitioners.
  • Red Hat: Aggressive vigilantes who actively attack black-hat infrastructure (rare term, less standardized).

Classification by Type/Motivation

Threat Actor Description Typical Motivation Skill Level
Script Kiddie Uses pre-built tools/scripts without deep understanding Thrill, bragging rights Low
Hacktivist Politically/socially motivated attacker (e.g., Anonymous) Ideology, activism Varies
Cybercriminal (Organized Crime) Profit-driven, often part of organized groups; ransomware gangs, carding rings Financial gain Medium–High
Insider Threat Current/former employee, contractor, or partner misusing legitimate access Revenge, financial gain, negligence Varies
Nation-State / APT (Advanced Persistent Threat) State-sponsored groups with significant funding and patience (e.g., APT28/Fancy Bear, APT29/Cozy Bear, Lazarus Group) Espionage, sabotage, geopolitical advantage Very High
Cyberterrorist Seeks to cause fear, disruption, or harm for ideological/political ends via critical infrastructure attacks Ideology, terror Varies
Competitor / Corporate Spy Industrial espionage to steal trade secrets/IP Financial/competitive gain Medium–High
Gray Hat Researcher Unauthorized but non-malicious vulnerability discovery Recognition, curiosity Medium–High

Key APT/Threat Intel Concepts

  • TTPs (Tactics, Techniques, and Procedures): The behavioral "fingerprint" of a threat actor — used to attribute attacks and build detections. Cataloged formally in the MITRE ATT&CK Framework.
  • IOC (Indicator of Compromise): Forensic artifact (hash, IP, domain, registry key) showing a system was compromised.
  • IOA (Indicator of Attack): Behavior-based signal showing an attack is in progress (more proactive than IOC).
  • Kill Chain: A staged model of how attacks progress (see Lockheed Martin Cyber Kill Chain in 1.2).
  • Threat Intelligence (CTI): The discipline of collecting and analyzing information about threat actors to inform defense; sourced from feeds like MITRE ATT&CK, MISP, commercial vendors (Recorded Future, Mandiant, CrowdStrike Falcon Intelligence).

1.1.4 The Ethical Hacker's Code: Rules of Engagement (RoE)

A penetration test is only legal when governed by an explicit, signed agreement defining:

  • Scope: Exact systems, IP ranges, domains, applications included/excluded.
  • Authorization Letter / Get Out of Jail Free Card: Written permission from a person with legal authority over the systems, often required to show law enforcement if testing triggers an alert.
  • Rules of Engagement (RoE): Document specifying testing windows, allowed techniques, prohibited actions (e.g., no DoS), emergency contacts, and escalation procedures.
  • Statement of Work (SOW): Contractual deliverable describing the engagement, timeline, and cost.
  • NDA (Non-Disclosure Agreement): Protects confidentiality of findings and client data.
  • Legal Frameworks Relevant to Authorization:
    • Computer Fraud and Abuse Act (CFAA) — primary U.S. federal anti-hacking law; unauthorized access is a federal crime.
    • Computer Misuse Act 1990 (UK) — UK's equivalent legislation.
    • Convention on Cybercrime (Budapest Convention) — international treaty harmonizing cybercrime laws.

Golden Rule: No authorization = no penetration test. It's a crime. Always operate under signed scope documents.

1.1.5 Careers in Penetration Testing (Industry Roles & Titles)

Role Description
Penetration Tester / Pentester Conducts authorized simulated attacks against defined scope.
Red Teamer Conducts long-term, stealthy, full-scope adversary simulation testing detection & response, not just vulnerabilities.
Security Consultant Broader advisory role, often includes pentesting plus architecture/compliance guidance.
Vulnerability Analyst / Vulnerability Researcher Specializes in discovering new vulnerabilities (sometimes 0-days) in software/hardware.
Exploit Developer Writes weaponized code (exploits) to leverage vulnerabilities; deep low-level/reverse engineering skill.
Application Security Engineer (AppSec) Focuses specifically on securing software (SAST/DAST, secure code review, SDLC integration).
Cloud Security Engineer/Pentester Specializes in AWS/Azure/GCP misconfigurations, IAM abuse, container/Kubernetes security.
Social Engineer Specializes in human-focused attacks: phishing, vishing, physical pretexting.
Red Team Operator Senior red teamer using advanced tradecraft, C2 frameworks, OPSEC.
Purple Team Engineer Bridges Red and Blue teams — validates detections collaboratively.
SOC Analyst (Tier 1/2/3) Defensive (Blue Team) monitoring role; understanding this helps red teamers evade/test detection.
Incident Responder (DFIR) Investigates and contains breaches; Digital Forensics and Incident Response.
CISO (Chief Information Security Officer) Executive owning organizational security strategy; consumer of pentest reports.
Bug Bounty Hunter Independent researcher submitting vulnerabilities through platforms like HackerOne, Bugcrowd, Synack, Intigriti for monetary rewards.
OSINT Analyst Specializes in Open-Source Intelligence gathering for reconnaissance/investigations.

Common Industry Certifications (Career Roadmap Context)

  • Entry-Level: CompTIA Security+, CompTIA PenTest+, eJPT (eLearnSecurity Junior Penetration Tester), Cisco Ethical Hacker (this course)
  • Mid-Level: OSCP (Offensive Security Certified Professional) — the most respected hands-on pentest cert, CEH (Certified Ethical Hacker, EC-Council) — more theory-based, GPEN (GIAC Penetration Tester)
  • Advanced/Senior: OSCE3/OSEP/OSWE (Offensive Security Experienced Penetration Tester / Web Expert), CRTO (Certified Red Team Operator), GXPN (GIAC Exploit Researcher and Advanced Penetration Tester), OSED (Offensive Security Exploit Developer)
  • Cloud-Specific: AWS/Azure/GCP security certifications, CCSK (Certificate of Cloud Security Knowledge)
  • Management/GRC: CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager)

Where Pentesters Work

  • Consulting firms: NCC Group, Mandiant (Google Cloud), Trustwave SpiderLabs, Bishop Fox, IOActive, Coalfire, Rapid7
  • Big 4/Advisory: Deloitte, PwC, EY, KPMG (security advisory arms)
  • In-house Red Teams: at large tech companies (Google, Microsoft, Meta, Amazon — internal red teams)
  • MSSPs (Managed Security Service Providers): provide outsourced security services to multiple clients
  • Government/Defense: NSA, CISA, GCHQ, military cyber commands
  • Freelance/Independent: Bug bounty platforms, independent consulting

1.2 Exploring Penetration Testing Methodologies

1.2.1 Why Do We Need to Follow a Methodology?

A methodology provides:

  • Consistency & Repeatability across engagements and testers
  • Completeness — ensures no critical attack surface is missed
  • Legal Defensibility — demonstrates testing was systematic and professional, not reckless
  • Communication — gives clients and auditors a recognizable, standardized structure for reports
  • Quality Assurance — enables peer review and benchmarking

Without a methodology, testing becomes ad hoc, inconsistent, and risks both missing critical vulnerabilities and causing unintended damage.

1.2.2 The Generic Penetration Testing Phases

While specific frameworks vary in naming, nearly all converge on this generalized lifecycle:

  1. Pre-Engagement / Planning and Scoping — Define scope, RoE, goals, legal docs, timeline (this is Module 2's focus).
  2. Reconnaissance / Information Gathering — Passive and active collection of target information (OSINT, DNS, WHOIS, etc.).
  3. Scanning and Enumeration — Identifying live hosts, open ports, services, versions (Nmap, etc.) and extracting detailed information (users, shares, banners).
  4. Vulnerability Analysis / Assessment — Mapping discovered services/versions to known vulnerabilities (CVE lookups, vulnerability scanners like Nessus, OpenVAS).
  5. Exploitation — Actively attempting to leverage vulnerabilities to gain unauthorized access (Metasploit, manual exploits, custom payloads).
  6. Post-Exploitation — Privilege escalation, lateral movement, persistence, data exfiltration simulation, pivoting — proving full business impact.
  7. Reporting — Documenting findings, severity (often via CVSS — Common Vulnerability Scoring System), evidence (screenshots/logs), and remediation recommendations.
  8. Remediation Validation / Retesting — Confirming fixes were correctly applied (often a follow-up engagement).

1.2.3 Major Industry Standards and Frameworks

PTES — Penetration Testing Execution Standard

A community-driven standard defining seven phases: Pre-engagement Interactions, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting. Widely referenced as a baseline professional methodology.

OSSTMM — Open Source Security Testing Methodology Manual

Developed by ISECOM. Focuses on a scientific, metrics-driven approach to security testing ("rigor" via the RAV — Risk Assessment Values). Covers operational security, including human, physical, wireless, telecommunications, and data network channels. Emphasizes measurable, auditable testing rather than checklist-based testing.

OWASP Testing Guide / OWASP WSTG (Web Security Testing Guide)

Produced by the Open Web Application Security Project (OWASP) — the most widely referenced standard specifically for web application penetration testing. Closely tied to the OWASP Top 10, a regularly updated list of the most critical web application security risks (e.g., Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Identification/Authentication Failures, Software/Data Integrity Failures, Logging/Monitoring Failures, SSRF). Also produces OWASP MASTG (Mobile Application Security Testing Guide) and OWASP ASVS (Application Security Verification Standard).

NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment

U.S. government standard defining testing techniques: review techniques, target identification/analysis techniques (e.g., network discovery, vulnerability scanning), and target vulnerability validation techniques (password cracking, penetration testing, social engineering). Often required for federal/government-adjacent engagements.

ISSAF — Information Systems Security Assessment Framework

An older but historically influential framework correlating each step with specific tools.

MITRE ATT&CK Framework

Not strictly a "pentest methodology" but a knowledge base of real-world adversary Tactics, Techniques, and Procedures (TTPs) organized into a matrix (Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact). Used extensively by red teams to plan realistic attack simulations and by blue teams to map detection coverage. Companion frameworks: MITRE ATT&CK for Cloud, ATT&CK for ICS (industrial control systems), MITRE D3FEND (defensive countermeasure mapping), MITRE CALDERA (automated adversary emulation tool).

Lockheed Martin Cyber Kill Chain

A 7-stage model of a cyberattack: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Useful conceptually but criticized as overly linear/perimeter-focused compared to ATT&CK's matrix model.

Unified Kill Chain

A more modern, 18-phase model merging Cyber Kill Chain and ATT&CK concepts to better represent modern, non-linear, multi-stage attacks (especially relevant for internal network compromise/lateral movement scenarios).

Diamond Model of Intrusion Analysis

An analytical framework mapping four core features of any intrusion event: Adversary, Capability, Infrastructure, Victim — used heavily in threat intelligence to understand attacker relationships.

1.2.4 Types of Penetration Tests (By Knowledge Level)

Type Definition Use Case
Black Box Tester has zero prior knowledge of target (mimics outside attacker) Most realistic external attacker simulation
White Box (Crystal/Clear Box) Tester has full knowledge: source code, architecture diagrams, credentials Deep, thorough internal review; common in AppSec
Gray Box Tester has partial knowledge (e.g., a standard user account) Most common real-world approach — balances realism and efficiency
Double-Blind Neither testers nor the defending blue team know the test is occurring Tests true detection/response capability
Blind Testers have no information; organization's security team is aware testing will occur Standard scheduled engagement

1.2.5 Types of Penetration Tests (By Target/Scope)

  • Network Penetration Testing: External (internet-facing) and Internal (assumed breach/insider perspective)
  • Web Application Penetration Testing: Targets web apps per OWASP WSTG/Top 10
  • Mobile Application Penetration Testing: iOS/Android apps (OWASP MASTG, static/dynamic analysis, jailbreak/root bypass)
  • Wireless Penetration Testing: Wi-Fi (WPA2/WPA3 attacks), Bluetooth, RF
  • Cloud Penetration Testing: AWS/Azure/GCP — IAM misconfig, storage bucket exposure, serverless, container escape
  • Physical Penetration Testing: Testing physical access controls (badge cloning, tailgating, lock picking)
  • Social Engineering Assessment: Phishing campaigns, vishing (voice phishing), pretexting, USB drops
  • IoT Penetration Testing: Embedded devices, firmware analysis
  • API Penetration Testing: REST/GraphQL/SOAP API-specific testing (OWASP API Security Top 10)
  • Red Team Engagement: Full-scope, multi-vector, objective-based, stealth-focused (vs. vulnerability-focused)
  • Purple Team Exercise: Collaborative red+blue exercise to tune detections in real time

1.2.6 Environmental Considerations

Professional testers must account for environment-specific constraints:

  • Production vs. Non-Production Systems: Testing production risks outages; some tests are restricted to staging/QA environments.
  • Fragile/Legacy Systems: Older systems (e.g., SCADA/ICS, medical devices) may crash under aggressive scanning — requires gentler techniques.
  • Cloud vs. On-Premises: Cloud providers (AWS, Azure, GCP) have their own penetration testing policies — e.g., AWS allows testing of most services without prior approval as of their current policy, but prohibits certain actions (DDoS simulation, DNS zone walking against Route 53 in certain configs); Azure requires adherence to Microsoft's "Rules of Engagement for Penetration Testing." Violating CSP (Cloud Service Provider) testing policies can result in account suspension.
  • Third-Party Hosted Components: CDNs (Cloudflare, Akamai), SaaS integrations may be out of scope since the client doesn't own them.
  • Compliance Boundaries (PCI scope, HIPAA scope): Some environments require restricting testing to cardholder-data-environment (CDE) boundaries.
  • Time Zone / Business Hours Windows: Testing windows are often restricted to avoid impacting business operations.
  • Safety-Critical Systems: ICS/SCADA/OT (Operational Technology) environments require extreme caution — exploitation could cause physical harm (e.g., power grid, water treatment, manufacturing).

1.3 Setting Up Your Own Lab

1.3.1 Requirements and Guidelines for Penetration Testing Labs

Building a personal, isolated lab is essential for safe, legal hands-on practice. Core principles:

  • Isolation: The lab network must be logically and ideally physically separated from production/home networks to prevent accidental scanning of real-world systems (which would be illegal without authorization) and to prevent malware/exploits from escaping into your real network.
  • Snapshot/Rollback Capability: Virtual machines allow you to take "snapshots" of a clean state and instantly revert after intentionally breaking a system.
  • Legally-Owned/Licensed Targets Only: Only attack systems you own or that are explicitly designed for legal practice (see vulnerable VM platforms below). Scanning or attacking any system without authorization — even "just to learn" — is illegal under the CFAA and equivalent laws worldwide.
  • Resource Planning: CPU virtualization extensions (Intel VT-x/AMD-V) must be enabled in BIOS/UEFI; sufficient RAM (16GB+ recommended for running multiple VMs simultaneously) and disk space (SSD strongly preferred for VM performance).

1.3.2 Virtualization Concepts

Hypervisor: Software that creates and runs virtual machines (VMs) by abstracting physical hardware.

  • Type 1 (Bare-Metal) Hypervisor: Runs directly on hardware, no host OS required. Examples: VMware ESXi, Microsoft Hyper-V (server mode), Proxmox VE, Citrix Hypervisor (XenServer). Used in enterprise/production environments and dedicated lab servers.
  • Type 2 (Hosted) Hypervisor: Runs as an application atop a host operating system. Examples: VirtualBox (free, Oracle), VMware Workstation/Fusion (commercial), Parallels Desktop (macOS). Most common choice for personal labs.

Virtual Machine (VM): An emulated computer system running its own OS, isolated from the host, allowing multiple "computers" to run on one physical machine.

Virtual Network Modes (critical for lab isolation):

  • NAT (Network Address Translation): VM shares host's IP for outbound traffic; not directly reachable from outside — common default, decent isolation.
  • Bridged: VM appears as its own device on the physical network — dangerous for lab use as it exposes the VM (and any attacks) to the wider home/corporate network.
  • Host-Only / Internal Network: VMs can only communicate with the host (host-only) or only with each other (internal network) and not the wider internet — the recommended mode for an isolated attack lab.

Snapshots: Point-in-time saved states of a VM's disk/memory, allowing instant rollback after testing destructive exploits.

Cloning: Creating duplicate VMs (full clone = independent copy; linked clone = references a parent disk, saves space) to rapidly redeploy lab environments.

1.3.3 What Tools Should You Use in Your Lab? (Attacker & Target Systems)

Attacker Platforms

  • Kali Linux: Debian-based Linux distribution maintained by Offensive Security, purpose-built for penetration testing with hundreds of pre-installed tools (Nmap, Metasploit, Burp Suite, Wireshark, John the Ripper, Hashcat, Aircrack-ng, etc.). The de facto industry-standard attacker OS.
  • Parrot Security OS: Debian-based alternative to Kali, also focused on pentesting/forensics, marketed as slightly more lightweight and privacy-focused.
  • BlackArch Linux: Arch-based pentest distro with an even larger tool repository, generally for more advanced users.
  • Commando VM / FLARE-VM: Windows-based offensive security distributions (Mandiant/FireEye) used for AD-focused or Windows-native tooling and malware analysis.

Vulnerable/Practice Target Systems (Legal Practice Platforms)

  • Metasploitable 2 / Metasploitable 3: Intentionally vulnerable Linux/Windows VMs built by Rapid7 for safe exploitation practice.
  • OWASP Juice Shop: Modern, intentionally insecure web application (Node.js/Angular) covering OWASP Top 10 vulnerabilities.
  • DVWA (Damn Vulnerable Web Application): PHP/MySQL web app with adjustable difficulty levels for practicing web vulnerabilities.
  • VulnHub: Free repository of downloadable vulnerable VMs for offline practice.
  • Hack The Box (HTB): Online platform with retired/active vulnerable machines, requires VPN connection to their lab infrastructure; widely respected in the industry for skill-building and even recruiting.
  • TryHackMe (THM): Guided, beginner-friendly gamified learning platform with rooms covering specific concepts.
  • PortSwigger Web Security Academy: Free, extremely respected resource for web app vulnerabilities, built by the creators of Burp Suite.
  • PentesterLab: Paid platform with exercises tied closely to real CVEs.
  • Damn Vulnerable GraphQL Application (DVGA), WebGoat (OWASP), bWAPP: additional purpose-built vulnerable apps.
  • Active Directory Labs: GOAD (Game of Active Directory), DetectionLab — for practicing enterprise Windows domain attacks.

Core Tool Categories You Will Encounter Throughout the Course (Preview)

  • Reconnaissance/OSINT: theHarvester, Maltego, Shodan, Recon-ng, SpiderFoot
  • Scanning/Enumeration: Nmap, Masscan, Rustscan, enum4linux, SMBclient
  • Vulnerability Scanning: Nessus (Tenable), OpenVAS/Greenbone, Qualys, Nexpose (Rapid7)
  • Exploitation Frameworks: Metasploit Framework, Cobalt Strike (commercial C2, common in red teaming), Sliver, Empire
  • Web App Testing: Burp Suite (Community/Professional), OWASP ZAP, sqlmap, ffuf/gobuster (fuzzing/directory brute-force)
  • Password Attacks: John the Ripper, Hashcat, Hydra, CrackMapExec/NetExec
  • Wireless: Aircrack-ng suite, Wifite, Kismet
  • Packet Analysis/Sniffing: Wireshark, tcpdump
  • Post-Exploitation/AD: BloodHound, Mimikatz, PowerSploit, Rubeus, Impacket suite
  • C2 (Command and Control) Frameworks: Cobalt Strike, Sliver, Mythic, Brute Ratel — infrastructure attackers/red teamers use to maintain remote control of compromised systems

1.3.4 What If You Break Something?

Key operational practices when something goes wrong in your lab (or, contextually, during a real engagement when something unexpectedly breaks at a client site):

  • Always have a documented rollback plan (snapshots).
  • In real engagements: immediately notify the designated point of contact per the RoE if a system crashes, becomes unstable, or unexpected impact occurs — transparency is a core ethical and contractual obligation. Pentesters are NOT supposed to hide accidental damage.
  • Maintain detailed logs/timestamps of all actions taken (most professional tooling like Cobalt Strike, Burp Suite, and terminal logging via script/tmux logging/CherryTree/Obsidian notes support this) so any incident can be correlated and explained.
  • Have a "Get Out of Jail Free" / emergency contact card with phone numbers of the client's technical and legal points of contact during live engagements.

1.3.5 Deploying and Investigating Kali Linux (Practical Skills Covered)

  • Downloading official Kali Linux VM images (VirtualBox/VMware pre-built appliances) from kali.org only (to avoid trojanized/backdoored images from third-party sources).
  • Importing an OVA/OVF appliance into a hypervisor.
  • Default credentials awareness (modern Kali enforces a custom-set password during first boot — no longer ships with default kali:kali for security reasons in current releases; legacy versions used root:toor).
  • Updating the system: apt update && apt full-upgrade.
  • Exploring the Kali menu structure, organized by attack phase: Information Gathering, Vulnerability Analysis, Web Application Analysis, Database Assessment, Password Attacks, Wireless Attacks, Reverse Engineering, Exploitation Tools, Sniffing & Spoofing, Post Exploitation, Forensics, Reporting Tools, Social Engineering Tools.
  • Verifying network configuration in isolated/host-only mode, confirming the VM cannot reach unintended networks.
  • Familiarity with the Linux command line (Bash), filesystem hierarchy (/etc, /var, /usr, /root), package management (apt, dpkg), permissions (chmod, chown), and process management — foundational skills required before any tool usage makes sense.

1.4 Summary

Key Takeaways from Module 1

  • Ethical hacking is defined by authorization. The same technical actions are a federal crime (under laws like the CFAA) or a paid professional service depending solely on documented, signed permission.
  • Penetration testing is a structured subset of ethical hacking, governed by Rules of Engagement, Statements of Work, and legal authorization documents.
  • Organizations conduct pentests for risk reduction, regulatory compliance (PCI DSS, HIPAA, GDPR, SOC 2, ISO 27001, NIST), insurance, and trust validation.
  • Threat actors range from low-skill script kiddies to highly resourced nation-state APT groups; understanding their motivations and TTPs (cataloged in MITRE ATT&CK) shapes how realistic simulations are designed.
  • Methodologies (PTES, OSSTMM, OWASP WSTG, NIST SP 800-115, ISSAF) ensure testing is consistent, complete, and legally defensible — never ad hoc.
  • Tests vary by knowledge level (black/white/gray box) and target type (network, web, mobile, cloud, wireless, physical, social engineering, red team).
  • Environmental considerations (production risk, legacy/OT systems, cloud provider policies, compliance scope) must shape testing approach to avoid unintended damage.
  • A safe, isolated virtual lab (via Type 2 hypervisors like VirtualBox, using host-only/internal networking, with snapshot capability) is mandatory for legal hands-on practice — using platforms like Kali Linux as the attack platform and Metasploitable, DVWA, OWASP Juice Shop, VulnHub, or Hack The Box as legal targets.
  • Career paths in this field range from junior pentester to red team operator, AppSec engineer, cloud security specialist, and beyond — supported by a recognized certification roadmap (Security+ → PenTest+/eJPT → OSCP → OSEP/OSWE/OSCE3).

— End of Module 1 —

Top comments (0)