Ethical Hacking: Penetration Testing and Security Assessment

Penetration Testing Methodology

Penetration testing: authorized simulated attacks to identify security weaknesses. Methodologies: OWASP Testing Guide, PTES (Penetration Testing Execution Standard), OSSTMM. Phases: 1) Planning and scoping (rules of engagement, legal authorization), 2) Reconnaissance, 3) Scanning and enumeration, 4) Exploitation, 5) Post-exploitation, 6) Reporting. Types: black box (no prior knowledge), white box (full access to source code/architecture), gray box (partial knowledge). Scope: network, web application, mobile, wireless, social engineering, physical. Frequency: annual minimum, after major changes, compliance-driven (PCI DSS quarterly). Certifications: OSCP (OffSec), CEH (EC-Council), GPEN (GIAC), CREST.

Reconnaissance and Scanning

Passive reconnaissance: no direct interaction with target. OSINT: Shodan (internet-connected devices), Censys, Google dorking, WHOIS, DNS records, social media. Subdomain enumeration: Subfinder, Amass, certificate transparency logs. Active scanning: Nmap (port scanning: TCP SYN, UDP, service version detection, OS fingerprinting). Web scanning: Nikto, Nuclei (template-based), Burp Suite (proxy-based). Directory brute-forcing: Gobuster, Feroxbuster. Vulnerability scanning: Nessus, Qualys, OpenVAS — automated detection of known vulnerabilities (CVEs). API discovery: Postman collections, Swagger/OpenAPI endpoints. Cloud reconnaissance: S3 bucket enumeration, Azure/GCP misconfiguration scanning.

Web Application Security

OWASP Top 10 (2021): 1) Broken Access Control, 2) Cryptographic Failures, 3) Injection, 4) Insecure Design, 5) Security Misconfiguration, 6) Vulnerable Components, 7) Authentication Failures, 8) Data Integrity Failures, 9) Logging Failures, 10) SSRF. SQL Injection: manipulating database queries — parameterized queries prevent it. XSS (Cross-Site Scripting): injecting malicious scripts — CSP headers, output encoding. CSRF: forcing authenticated users to perform unwanted actions — anti-CSRF tokens. IDOR (Insecure Direct Object Reference): accessing other users' data by manipulating IDs. SSRF: server-side requests to internal resources. JWT attacks: algorithm confusion, weak signing keys.

Network and System Exploitation

Metasploit Framework: exploit modules, payloads, auxiliary tools. Common exploitation: buffer overflows (stack, heap), format string vulnerabilities, race conditions. Post-exploitation: privilege escalation (kernel exploits, misconfigurations, SUID binaries). Lateral movement: pass-the-hash, Kerberoasting, token impersonation. Active Directory: BloodHound for attack path mapping, Mimikatz for credential extraction. Wireless: WPA2 cracking (PMKID attack, handshake capture + dictionary), evil twin AP. Social engineering: phishing (Gophish), pretexting, USB drops. Physical: lock picking, badge cloning (Proxmark), tailgating. Command and control (C2): Cobalt Strike, Sliver — maintaining persistent access for red team operations.

Reporting and Responsible Disclosure

Penetration test report: executive summary (for management), technical findings (for security team), remediation recommendations. Finding severity: CVSS (Common Vulnerability Scoring System) 0-10 scale. Evidence: screenshots, proof-of-concept code, affected URLs/IPs. Remediation priorities: critical/high → patch immediately, medium → scheduled fix, low → accept or fix when convenient. Responsible disclosure: report to vendor, allow reasonable time to patch (typically 90 days), then public disclosure. Bug bounty platforms: HackerOne, Bugcrowd, Intigriti. VDP (Vulnerability Disclosure Policy): organization's policy for receiving reports. Legal protection: Computer Fraud and Abuse Act (US), written authorization essential. Purple teaming: red and blue teams collaborate to improve detection and response.

Try it live

Everything above runs in your browser — open Network Packet Routing and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.