Module 3: Ethical Hacking & Penetration Testing — Thinking Like an Attacker to Defend Like a Professional
Learn the full penetration testing lifecycle — from legal authorization and reconnaissance through scanning, exploitation, privilege escalation, and professional reporting — using the same tools, frameworks, and mindset real security teams rely on.
This module walks through an authorized, structured version of what attackers do: identifying vulnerabilities before malicious actors can exploit them, always within legal and ethical boundaries. It covers the complete methodology (PTES, NIST, OWASP, OSSTMM, MITRE ATT&CK), hands-on tool usage, and real breach scenarios across networks, web applications, and systems.
Module Overview
Module Type: Module — Part of the Cybersecurity Professional Diploma
Delivery Mode: Online (Self-paced)
Language: English, Arabic, Hindi, Urdu, Spanish, and Indonesian
Level: Beginner to Intermediate, building toward advanced technique
Prerequisites: Basic networking knowledge recommended (Module 2)
Module Features
- Full 5-phase pentest lifecycle: recon, scanning/enumeration, exploitation, post-exploitation, reporting
- Legal and ethical framework: authorization letters, NDAs, scope definition, rules of engagement
- Black box, white box, and gray box testing approaches
- Hands-on labs using DVWA and Juice Shop for safe, controlled exploitation practice
- Extensive tool coverage: Nmap, Nessus, OpenVAS, Metasploit, Burp Suite, OWASP ZAP, Wireshark, Mimikatz, BloodHound, and more
- CVSS scoring and vulnerability prioritization
- Professional report writing standards
Topics Covered
Foundations of Ethical Hacking — Legal vs. illegal hacking, vulnerability assessment vs. penetration testing vs. red teaming, black/white/gray box testing types, pentest categories (network, web app, mobile, wireless, cloud, social engineering, physical), required legal documentation (authorization letter, NDA, scope, exploitation limits, reporting expectations).
Pentest Methodology & Attack Lifecycle — Industry frameworks (PTES, NIST, OWASP, OSSTMM, MITRE ATT&CK); the seven-stage lifecycle: reconnaissance, scanning/enumeration, exploitation, privilege escalation, lateral movement, persistence, reporting. Passive recon sources (LinkedIn, DNS history, Shodan, certificate transparency logs, GitHub leaks) vs. active recon (network/port scanning, OS fingerprinting, DNS zone transfers). Exploitation examples: SQL injection, XSS, remote code execution, brute force (Hydra, Medusa), buffer overflows.
Scanning & Enumeration — Nmap command set (host discovery, full port scans, service/version detection, OS detection, aggressive scan, NSE vulnerability scripts); common ports and their risks (22, 80, 443, 3306, 3389); SMB enumeration (enum4linux, smbclient), SSH enumeration, DNS enumeration (nslookup, dig, dnsenum), SNMP enumeration (snmpwalk); building an attack path map from scan results.
Active Reconnaissance Deep Dive — Host discovery methods (ICMP, ARP, TCP/UDP scanning); port categories (well-known, registered, dynamic) and port states (open/closed/filtered/unfiltered); service and OS fingerprinting via TCP/IP behavior, TTL values, and window sizes; detecting firewalls, IPS, WAFs, and rate limiting through recon; DNS record types (A, MX, TXT, CNAME, PTR) and what they reveal; web server fingerprinting (server type, version, frameworks, exposed directories, login portals, source comments, response headers).
Vulnerability Scanning & Automated Assessment — The five-step scanning methodology: scoping, discovery, identification, verification, reporting. Scanner categories: network (Nessus, OpenVAS, QualysGuard), web application (Acunetix, OWASP ZAP, Burp Suite), cloud (Prisma Cloud, AWS Inspector), host-based (Microsoft Baseline Security Analyzer, Lynis). CVE database matching, compliance checks (CIS, PCI DSS), false-positive verification, CVSS scoring (0.1–10, critical/high/medium/low), and prioritization by exploitability, impact, and authentication requirements. Real-world cases: an outdated VPN’s SSL vulnerability caught before a ransomware attack; a WPA1 Wi-Fi upgrade to WPA3; a login-form SQL injection confirmed through Nikto, Nmap NSE, and manual testing.
Web Application Security — Web app architecture (client, server, database) and request/response flow. SQL injection: root causes, exploitable query examples, business impact, detection indicators. Cross-site scripting (reflected, stored, DOM-based) and its consequences (cookie theft, session hijacking, keylogging). CSRF: concept, common techniques (hidden forms, malicious links, image-based requests), a password-change attack example. Authentication and session management flaws (session fixation, tokens in URLs, missing MFA, predictable session IDs). A repeatable testing workflow: gather input points, map the application, test inputs safely, enumerate vulnerabilities, document findings, recommend fixes — practiced in DVWA and Juice Shop.
Privilege Escalation, Post-Exploitation & Reporting — Vertical vs. horizontal privilege escalation on Windows and Linux. Windows techniques: misconfigurations, weak passwords, unpatched services, kernel exploits (Windows Exploit Suggester, Metasploit exploit packs), credential exposure (plaintext scripts, config files, browser storage, Credential Manager — extracted via Mimikatz, LaZagne). Linux techniques: sudo misconfigurations, GTFOBins abuse, SUID binaries, writable files, cron job hijacking (LinPEAS, pspy). Post-exploitation goals: user and network enumeration, credential harvesting (LSASS dumping, /etc/shadow, browser credentials), domain mapping (PowerView, BloodHound, CrackMapExec, Responder). Persistence across Windows (registry run keys, scheduled tasks, malicious services, RDP, WMI event subscriptions), Linux (cron jobs, SSH key injection, systemd services, bashrc), and cloud environments (new IAM users, API keys, altered permissions). Lateral movement (pass-the-hash, pass-the-ticket), remote execution (WinRM, SMB, RDP, SSH), and pivoting (Metasploit routing, Chisel, Proxychains). Data exfiltration methods (HTTPS blending, cloud storage, DNS tunneling, encrypted archives, C2 channels) demonstrated safely using sample data only. Professional report structure: attack narrative and business impact, overall security rating, critical vulnerability summary, per-vulnerability technical breakdown (severity, description, discovery method, proof of exploitation, MITRE ATT&CK mapping, remediation steps), and core defensive recommendations (patch management, network segmentation, IAM hardening, monitoring improvements).
Practical Learning Approach
- Live Nmap scanning exercises (host discovery, port scans, service detection, NSE scripts)
- SMB, SSH, DNS, and SNMP enumeration practice
- Vulnerability scanning walkthroughs using Nessus/OpenVAS-style tools and CVSS-based prioritization
- Hands-on SQL injection, XSS, and CSRF exploitation in DVWA and Juice Shop
- Privilege escalation and post-exploitation technique review across Windows and Linux
- Attack-path mapping from raw scan data to actionable exploitation plans
- Professional report writing practice
Who This Is For
- Learners who completed Modules 1–2 and want hands-on offensive security skills
- Aspiring penetration testers, red teamers, or security analysts who need to understand attacker methodology to build stronger defenses
Learning Outcomes
- Distinguish vulnerability assessment, penetration testing, and red teaming, and apply the correct legal/ethical framework to each
- Execute the full pentest lifecycle from reconnaissance through reporting
- Perform scanning, enumeration, and vulnerability discovery using industry-standard tools
- Identify and exploit common web application vulnerabilities in a controlled lab environment
- Apply privilege escalation, persistence, and lateral movement techniques on Windows and Linux
- Write a professional, actionable penetration test report
Why Choose This Module?
- Covers the complete attacker lifecycle, not just isolated techniques
- Grounded in real breach case studies and hands-on lab practice
- Builds directly on Module 2’s networking foundation
- Prepares learners for later modules on incident response and security governance