🕵️♂️ Penetration Testing (Ethical Hacking) – Full Notes
🔐 What Is Penetration Testing?
● Penetration Testing (aka Ethical Hacking) is the authorized, legal simulation of
cyberattacks on a system to identify vulnerabilities before malicious hackers do.
● It is part of a broader cybersecurity strategy.
✅ Goals of Penetration Testing
● Identify security weaknesses.
● Test the effectiveness of security controls.
● Evaluate response capabilities.
● Improve overall security posture.
● Ensure compliance (e.g., PCI-DSS, HIPAA).
🧩 Types of Penetration Testing
Type Description
Black Tester has no prior knowledge of the system.
Bo
x
White Full knowledge of the system (code, architecture, etc.) is
Bo shared.
x
Gray Partial knowledge is provided to simulate insider threats.
Bo
x
Extern Tests from outside the network (e.g., targeting a web
al server).
Interna Tests from within the organization’s network.
l
🧭 The 5 Phases of a Penetration Test
🔹 1. Reconnaissance (Information Gathering)
● Goal: Gather as much information as possible.
● Types:
○ Passive Recon: No direct interaction (e.g., Google dorking, WHOIS, DNS info).
○ Active Recon: Involves scanning and probing systems.
Tools:
whois, nslookup, theHarvester, Google hacking, Shodan
🔹 2. Scanning and Enumeration
● Goal: Identify open ports, services, and detailed system information.
Scanning Types:
● Port Scanning – Find open ports (TCP/UDP).
● Vulnerability Scanning – Check for known vulnerabilities.
● Service Enumeration – Banner grabbing, OS detection.
Tools:
Nmap, Netcat, Nessus, Nikto, OpenVAS
🔹 3. Gaining Access
● Goal: Exploit vulnerabilities to gain unauthorized access.
Techniques:
● Exploiting misconfigurations
● Buffer overflows
● SQL injection
● Cross-site scripting (XSS)
● Brute force attacks
Tools:
Metasploit, sqlmap, Burp Suite, Hydra, John the Ripper
🔹 4. Maintaining Access
● Goal: Simulate how an attacker would create a backdoor to return later.
Techniques:
● Installing remote access trojans (RATs)
● Creating backdoors or persistence scripts
● Exploiting privilege escalation
Tools:
Netcat, Meterpreter, Empire, PowerSploit
🔹 5. Covering Tracks / Reporting
● Ethical hackers don’t hide their tracks maliciously, but they understand how attackers do.
Actions include:
● Clearing logs
● Modifying timestamps
● Removing tools and payloads
Then:
● Prepare a detailed report:
○ Vulnerabilities found
○ How they were exploited
○ Impact assessment
○ Recommendations for mitigation
⚙️ Common Tools Used in Pen Testing
Category Tools
Reconnaissanc theHarvester, Maltego,
e Recon-ng
Scanning Nmap, Nessus, OpenVAS
Exploitation Metasploit, sqlmap, Burp
Suite, XSSer
Password John the Ripper, Hydra,
Cracking Hashcat
Wireless Aircrack-ng, Kismet,
Testing Wireshark
Web App OWASP ZAP, Burp Suite, Nikto
Testing
Social SET (Social-Engineer
Engineerin Toolkit)
g
📚 Key Concepts to Understand
● Vulnerability vs Exploit: A flaw vs a method to take advantage of it.
● Payload: Code executed on the target (e.g., reverse shell).
● Post-Exploitation: Actions taken after initial access is gained.
● Privilege Escalation: Gaining higher-level access than originally obtained.
● Pivoting: Using one compromised machine to attack others.
🧠 Ethical and Legal Considerations
● Always have written permission before testing a system.
● Follow code of ethics (e.g., EC-Council's code for CEH).
● Misuse of skills can lead to criminal prosecution.
● Pen testing should aim to improve security, not damage systems.
🛡️ Certifications (Optional but Popular)
Cert Provider Level
CEH (Certified Ethical Hacker) EC-Council Entry-lev
el
OSCP (Offensive Security Certified Offensive Advance
Professional) Security d
CompTIA Pentest+ CompTIA Intermed
iate
CPT (Certified Penetration Tester) IACRB Intermed
iate
🧩 Resources for Practice
● TryHackMe – Guided labs for beginners.
● Hack The Box – Realistic CTF challenges.
● OverTheWire – Wargames for security concepts.
● OWASP Juice Shop – A vulnerable web app to practice on.
●
