By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

What is Penetration Testing (Ethical Hacking)

Penetration testing, also known as ethical hacking, is the practice of testing computer systems, networks, or applications to find security vulnerabilities that malicious attackers could exploit. Unlike actual hackers, penetration testers have explicit permission to probe systems and operate within legal and ethical boundaries.

What You'll Learn

  • The definition and purpose of penetration testing
  • Legal and ethical considerations
  • The phases of a penetration test
  • Types of penetration tests
  • Career paths and certifications

Why Penetration Testing Matters

Organizations face constant threats from cybercriminals, insider threats, and security vulnerabilities. Penetration testing helps companies:

  • Identify weaknesses before attackers do
  • Validate security controls and defenses
  • Meet compliance requirements (PCI-DSS, HIPAA, SOC 2)
  • Protect sensitive data and customer information
  • Prevent costly breaches and reputational damage

IBM's 2025 Cost of a Data Breach Report puts the global average breach cost at about $4.44 million, with U.S. breaches averaging much higher. Prevention through proactive testing is still significantly cheaper than dealing with a real breach.

⚠️ WARNING: Unauthorized access to computer systems is illegal in most jurisdictions. Always obtain written permission before conducting any penetration testing.

  1. Authorization: Always get explicit, written permission (Rules of Engagement)
  2. Scope: Only test systems you're authorized to test
  3. Laws to know:
    • Computer Fraud and Abuse Act (CFAA) in the US
    • Computer Misuse Act in the UK
    • Similar laws exist in most countries
  4. Data handling: Treat discovered data with confidentiality
  5. Responsible disclosure: Report vulnerabilities properly

The Hacker's Code of Ethics:

  • Respect privacy and confidentiality
  • Only access systems you have permission to test
  • Do not cause harm or disruption
  • Report findings responsibly
  • Keep learning and improving your skills

Types of Penetration Tests

1. Black Box Testing

  • No prior knowledge of the target system
  • Simulates an external attacker
  • Most realistic attack scenario
  • Takes longer to complete

2. White Box Testing

  • Full knowledge of the system (source code, credentials, architecture)
  • Simulates insider threat or thorough security audit
  • More comprehensive coverage
  • Faster to identify issues

3. Gray Box Testing

  • Partial knowledge of the system
  • Balance between black and white box
  • Common in real-world engagements
  • Simulates a malicious employee or compromised user

The Phases of Penetration Testing

1. Reconnaissance (Information Gathering)

Gathering information about the target without directly interacting with systems:

  • OSINT (Open Source Intelligence)
  • Domain/subdomain enumeration
  • Employee information
  • Technology stack identification

2. Scanning and Enumeration

Active probing to identify vulnerabilities:

  • Port scanning
  • Service detection
  • Vulnerability scanning
  • Network mapping

3. Gaining Access (Exploitation)

Attempting to exploit discovered vulnerabilities:

  • Password attacks
  • Social engineering
  • Exploiting software vulnerabilities
  • Web application attacks

4. Maintaining Access

Establishing persistent access for extended testing:

  • Installing backdoors
  • Creating new accounts
  • Privilege escalation
  • Lateral movement

5. Covering Tracks

  • Clearing logs (in authorized tests)
  • Removing artifacts
  • Understanding detection mechanisms

6. Reporting

  • Documenting findings
  • Risk assessment
  • Remediation recommendations
  • Executive summary for stakeholders

Penetration Testing Methodologies

Several industry-standard frameworks guide penetration testing:

PTES (Penetration Testing Execution Standard)

  • Comprehensive methodology
  • Seven main sections
  • Most widely adopted

OWASP Testing Guide

  • Focused on web applications
  • Extensive test cases
  • Regularly updated

NIST SP 800-115

  • US government standard
  • Technical security testing guide

OSSTMM (Open Source Security Testing Methodology Manual)

  • Scientific methodology
  • Peer-reviewed approach

Career Paths and Certifications

Entry-Level:

  • CompTIA Security+: Foundation security knowledge
  • CEH (Certified Ethical Hacker): Recognized entry-level cert
  • eJPT (eLearnSecurity Junior Penetration Tester): Practical skills

Intermediate:

  • OSCP (Offensive Security Certified Professional): Highly respected, hands-on
  • GPEN (GIAC Penetration Tester): SANS certification
  • PNPT (Practical Network Penetration Tester): Practical exam

Advanced:

  • OSEP (Offensive Security Experienced Penetration Tester): Advanced evasion
  • OSCE3 (Offensive Security Certified Expert): Master-level
  • GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)

Essential Skills for Penetration Testers

  1. Networking fundamentals: TCP/IP, DNS, routing, protocols
  2. Operating systems: Linux and Windows administration
  3. Programming/Scripting: Python, Bash, PowerShell
  4. Web technologies: HTTP, HTML, JavaScript, SQL
  5. Security tools: Metasploit, Burp Suite, Nmap
  6. Problem-solving: Critical thinking and persistence
  7. Communication: Writing clear reports, presenting findings

Common Tools

  • Kali Linux: Penetration testing distribution
  • Metasploit: Exploitation framework
  • Nmap: Port scanning and enumeration
  • Burp Suite: Web application testing
  • Wireshark: Network analysis
  • John the Ripper: Password cracking
  • SQLMap: SQL injection automation

Red Team vs. Penetration Testing

While related, there are key differences:

Penetration TestingRed Team
Limited time frame (1-4 weeks)Extended engagement (months)
Specific scopeBroad, realistic scenarios
Known to some staffCompletely covert
Technical focusFull attack simulation
Identify vulnerabilitiesTest detection and response

Try It Yourself

Beginner Practice:

  1. Set up a lab: Install VirtualBox/VMware and create a safe testing environment
  2. Download Kali Linux: Your primary pentesting operating system
  3. Try vulnerable VMs:
    • Metasploitable 2/3
    • DVWA (Damn Vulnerable Web App)
    • VulnHub machines
  4. Practice on legal platforms:
    • HackTheBox
    • TryHackMe
    • PentesterLab
    • OverTheWire

First Steps:

  1. Learn Linux command line basics
  2. Understand networking fundamentals
  3. Practice with basic security tools (Nmap, Wireshark)
  4. Study common vulnerabilities (OWASP Top 10:2025)
  5. Document everything you learn

Common Pitfalls to Avoid

❌ Testing without permission - Always illegal, can result in prosecution

❌ Skipping reconnaissance - Rushing into exploitation without proper information gathering

❌ Poor documentation - Not recording your steps makes report writing difficult

❌ Over-reliance on automated tools - Understanding manual techniques is crucial

❌ Ignoring scope - Testing systems outside your authorized scope

❌ Causing service disruptions - Some exploits can crash systems; be careful

Resources for Further Learning

Books:

  • "The Web Application Hacker's Handbook" by Dafydd Stuttard
  • "Penetration Testing: A Hands-On Introduction" by Georgia Weidman
  • "The Hacker Playbook 3" by Peter Kim

Online Platforms:

Application Security:

  • JustAppSec Training - Structured application security training covering secure coding, architecture, and offensive testing
  • JustAppSec Research - Deep-dive security research on vulnerabilities, threat models, and defensive controls
  • JustAppSec CVE Database - Searchable CVE intelligence with severity scoring and affected products

Communities:

  • r/netsec on Reddit
  • OWASP local chapters
  • BSides security conferences
  • Discord security communities

Blogs and Resources:

Next Steps

Now that you understand what penetration testing is, continue your journey:

  1. Next lesson: Learn about Linux, the primary operating system for penetration testing
  2. Set up your lab: Follow our Lab Setup guide to create a safe practice environment
  3. Join a community: Connect with other learners and professionals
  4. Start practicing: Begin with beginner-friendly platforms like TryHackMe

Remember: The best way to learn penetration testing is through hands-on practice in legal, authorized environments. Never test systems without permission!

"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts." - Gene Spafford

Up next

What is Linux

Introduction to the Linux operating system and its importance in cybersecurity.