Learn

Ethical hacking, also called penetration testing or white-hat hacking, is the practice of testing systems, networks and applications for vulnerabilities with explicit permission from the owner. Unlike criminals, ethical hackers are hired to find and help fix weaknesses before someone else exploits them. Strong technical skills matter, but what separates a professional from a nuisance is discipline: written authorization, respect for scope, protection of sensitive findings and responsible disclosure.

Before any testing, understand the legal framework. The Computer Fraud and Abuse Act in the US, and similar laws globally, criminalize unauthorized access to computer systems. Authorization is everything. Valid sources: employment contracts authorizing internal testing, signed engagement letters for penetration tests, bug bounty program rules granting permission on specific assets, or written consent from device owners for hardware research. Even with authorization, respect scope: which systems are in, which are out, and which actions (e.g. data destruction, DoS) are prohibited. Professional testers use detailed contracts and rules-of-engagement documents to make expectations explicit.

The attack surface is the sum of all points where an unauthorized user could try to enter or extract data from a system. Network surfaces include exposed ports, wireless, VPN and infrastructure devices. Application surfaces cover web apps, APIs, mobile apps and authentication. Human surfaces include social engineering targets and insider threats. Physical surfaces include building access, hardware tampering opportunities and unlocked workstations. Comprehensive assessments examine all of these: attackers exploit the weakest link regardless of what else is defended.

Security vulnerabilities fall into common categories. Injection (SQLi, command injection) occurs when untrusted data flows into interpreters. Authentication flaws include weak passwords, missing MFA, session hijacking and credential stuffing. Authorization flaws let users perform actions they shouldn't. Cross-site scripting (XSS) lets attackers run scripts in other users' browsers. Cryptographic failures: weak algorithms, insecure storage, bad certificate validation. Security misconfigurations, such as insecure defaults and verbose errors, are some of the most common and most fixable bugs in production systems.

' OR '1'='1' -- 

Open Source Intelligence (OSINT) is intelligence collected from publicly available sources: public records, social media, news, academic publications, government datasets, website metadata, DNS records and archived pages. OSINT is valuable for assessments, threat intelligence and investigations. The skill is in finding, correlating and analyzing efficiently, not in accessing secret information. It is legal when used on public data, though ethical questions about privacy still apply.

Search engines index billions of pages, but most people only use the basics. Advanced operators turn Google into a reconnaissance tool, and combining them creates powerful queries. Time filters, cached pages and Boolean logic extend your reach further.

site:edu filetype:pdf "internal use only"

intitle:"admin login" -inurl:example.com

Social media platforms hold enormous amounts of freely shared personal and organizational information. Effective SOCMINT requires understanding each platform: LinkedIn reveals employment and org structure; Twitter/X offers real-time signals and geotags; GitHub shows developer skills and sometimes leaked credentials; Reddit and forums hold niche technical discussions. Specialized tools help: Maltego visualizes relationship graphs, theHarvester aggregates emails and subdomains, Social-Searcher tracks mentions. Ethical OSINT practitioners respect privacy boundaries, use genuinely public data, avoid fake profiles and don't exploit privacy misconfigurations.

Before touching a target network, gather public infrastructure data. WHOIS reveals registration details. DNS enumeration finds subdomains via Certificate Transparency logs (crt.sh), brute forcing and passive DNS archives (SecurityTrails). Shodan and Censys are search engines for internet-exposed devices, revealing services and vulnerable versions worldwide. Reverse IP lookup finds co-hosted domains. ARIN and RIPE show IP allocations. All of this is legal and invisible to the target: you only query public databases.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

Professional tests begin with planning long before any technical work. Scoping defines in-scope systems (IP ranges, domains, apps), excluded systems, testing types (black, gray or white box), permitted methods, time windows, success criteria, communication protocols and legal protections. A rules-of-engagement document formalizes all of this into a signed contract. Poor scoping leads to misunderstandings, legal issues and inadequate assessments.

Passive reconnaissance uses publicly available information without touching targets: OSINT, search engines, job postings revealing tech stacks, DNS records, archived versions. Active reconnaissance interacts directly: Nmap port scans, service enumeration, web app spidering, network mapping, banner grabbing, vulnerability scanning. The goal: understand the target's attack surface, technologies, potential vulnerabilities and security controls before exploitation.

nmap -sV -sC -oA recon/target 10.0.0.0/24

After recon, vulnerability assessment identifies specific weaknesses. Automated tools (Nessus, OpenVAS, Qualys) check thousands of known CVEs quickly, but they produce false positives and miss business-logic flaws. Manual testing covers configuration review, authentication, authorization and privilege escalation, input handling, error message leaks and cryptographic implementation. CVSS standardizes severity. Risk-based prioritization weighs business context: a medium finding on a payment processor outranks a critical one on an isolated dev box.

Exploitation proves vulnerabilities are real. It may mean SQL injection to extract data, RCE to gain a shell, privilege escalation, authentication bypass, or XSS to show account compromise. Post-exploitation demonstrates the full impact: lateral movement, admin privilege escalation, (simulated) data exfiltration, persistence mechanisms, pivoting. Professional testers stop once impact is proven, minimize access to real data, document everything and notify the client immediately about critical findings.

The report translates technical findings into business intelligence. It should include an executive summary without jargon, technical findings with reproduction steps and evidence, CVSS or risk ratings, remediation recommendations and strategic suggestions for the overall security posture. Prioritize by business risk, not just technical severity. Remediation verification means retesting after the fixes are in, to confirm they work and nothing regressed. The value of a test is in the improvements it drives, not in the shells.

Responsible (coordinated) disclosure means reporting issues privately to the vendor and giving them reasonable time to patch before details go public. It protects users, gives vendors room to fix, and maintains trust. The alternatives fail: full disclosure helps attackers first, indefinite non-disclosure leaves users silently exposed, and selling to criminal or nation-state buyers enables harm. Most researchers and major vendors treat coordinated disclosure as the ethical standard.

Start by checking for a published disclosure policy or /.well-known/security.txt. Many companies run bounty programs on HackerOne, Bugcrowd or Intigriti. If neither exists, contact security@<domain>. Your report should include a clear description, reproduction steps, an impact assessment, a proof of concept, your contact details and a request for acknowledgment. Use PGP for exploit code. Be patient, and follow up politely after one to two weeks of silence. Keep detailed records of all communication.

Contact: mailto:security@example.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

90 days from report to public disclosure is the common baseline, adjusted to the circumstances: faster if the bug is critical and actively exploited, longer for architectural issues when the vendor is cooperating. Public disclosure should warn users, provide mitigations if no patch is available, credit everyone fairly, and avoid more exploit detail than defenders need. The goal is protecting users, not punishing vendors or chasing headlines.

Bug bounty programs offer structured disclosure with rewards. The major platforms host programs for thousands of companies. Each program defines its scope, excluded issues (e.g. self-XSS, DoS), reward ranges and rules of engagement. For researchers they mean money, legal clarity, real-world targets and reputation. For companies: continuous coverage, diverse perspectives and good community relations. Taking part successfully means reading the rules carefully, respecting scope, writing high-quality reports, and accepting that not every finding qualifies.