Ethical Hacking Introduction to Ethical Hacking Syllabus

What is the standard five-phase methodology of ethical hacking / a penetration test?

1) Reconnaissance, 2) Scanning (and enumeration), 3) Gaining Access (exploitation), 4) Maintaining Access, 5) Covering Tracks / Clearing (followed by reporting).

What happens in the Reconnaissance phase?

Gathering information about the target—via passive means (public records, OSINT, WHOIS) or active means (direct probing)—to understand the attack surface before engaging.

Contrast passive and active reconnaissance.

Passive recon collects information without directly interacting with the target (e.g., search engines, social media, public databases). Active recon directly interacts with the target (e.g., pinging, port scanning), which is more detectable.

What is the Scanning phase and what does enumeration add?

Scanning identifies live hosts, open ports, and services (e.g., with Nmap). Enumeration extracts detailed information—usernames, shares, service versions—used to plan exploitation.

What occurs in the 'Maintaining Access' phase?

The hacker establishes persistence—such as backdoors, rootkits, or scheduled tasks—to retain access to the compromised system for continued testing (or, for attackers, ongoing exploitation).

Why is 'Covering Tracks' part of the methodology?

To test whether an organization can detect intrusions, attackers/testers attempt to erase logs and evidence. In an ethical engagement this is documented, and defenders evaluate whether the activity was caught.

What is the deliverable that concludes an ethical hacking engagement?

A penetration test report documenting scope, methodology, findings, risk ratings, proof-of-concept evidence, and prioritized remediation recommendations.

What U.S. law is the primary statute against unauthorized computer access?

The Computer Fraud and Abuse Act (CFAA) of 1986, which criminalizes accessing a computer without authorization or exceeding authorized access.

What UK law governs unauthorized computer access?

The Computer Misuse Act of 1990, covering unauthorized access, unauthorized access with intent to commit further offenses, and unauthorized modification/impairment of computer material.

What EU regulation heavily influences how ethical hackers must handle personal data?

The GDPR (General Data Protection Regulation), which governs the collection, processing, and protection of personal data of EU residents and imposes strict breach-notification and privacy requirements.

Name two other well-known security/privacy compliance frameworks an ethical hacker may encounter.

HIPAA (U.S. healthcare data) and PCI DSS (payment card data). Others include SOX, ISO/IEC 27001, and NIST frameworks.

What single legal document must be in place before any ethical hacking engagement begins?

Written authorization—commonly a signed scope-of-work with a 'Rules of Engagement' and often a 'Get Out of Jail Free' authorization letter—granting explicit permission to test the defined targets.

What is a 'Get Out of Jail Free' letter in penetration testing?

A signed authorization letter from the client naming the tester, the systems in scope, and the time window, which proves the testing is legally sanctioned if the tester is questioned by staff or law enforcement.

What is the difference between scope and Rules of Engagement (RoE) in a pentest agreement?

Scope defines what may be tested (IP ranges, apps, domains) and what is off-limits. Rules of Engagement define how testing is conducted—timing, methods allowed/forbidden, escalation contacts, and handling of sensitive data.

What does a Statement of Work (SOW) specify in a penetration testing agreement?

The specific deliverables, timeline, tasks, pricing, and responsibilities for the engagement, defining exactly what work will be performed.

Why is a Non-Disclosure Agreement (NDA) important in ethical hacking engagements?

Because testers gain access to sensitive systems and data; the NDA legally binds them to keep client information, vulnerabilities, and findings confidential.

What is the difference between black-box, white-box, and gray-box testing?

Black-box: tester has no prior knowledge of the target. White-box: tester has full knowledge (source code, architecture, credentials). Gray-box: tester has partial knowledge, simulating an insider or a user with limited access.

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment identifies and lists potential weaknesses (breadth, often automated) without exploiting them. A penetration test actively exploits vulnerabilities to demonstrate real-world impact (depth).

What is responsible (coordinated) disclosure?

The practice of privately reporting a discovered vulnerability to the affected vendor and giving them reasonable time to fix it before any public disclosure, minimizing harm to users.

What is a bug bounty program?

A program where organizations invite ethical hackers to find and report vulnerabilities in exchange for recognition and monetary rewards, under defined legal rules (a form of authorized testing).

State three core principles of an ethical hacker's code of conduct.

1) Obtain explicit authorization before testing; 2) Stay strictly within the agreed scope; 3) Protect confidentiality and report all findings honestly. (Also: do no harm and act with integrity.)

Why must an ethical hacker never exceed the agreed scope, even if they find an easy path elsewhere?

Because access beyond the authorized scope is unauthorized—legally it becomes illegal hacking and breaches the client's trust and the engagement contract, regardless of good intentions.

What ethical obligation does a hacker have upon accidentally discovering sensitive data (e.g., personal or medical records)?

To stop, avoid copying or misusing it, protect its confidentiality, document the exposure minimally, and report it responsibly to the client per the agreed handling procedures.

What is the flagship entry-level certification named directly for ethical hacking, and who issues it?

The Certified Ethical Hacker (CEH), issued by the EC-Council.

Which certification is known for its rigorous 24-hour hands-on exam and the motto 'Try Harder'?

The OSCP (Offensive Security Certified Professional), from Offensive Security (OffSec).

Name a widely respected vendor-neutral entry certification for general cybersecurity, often a starting point before specializing in ethical hacking.

CompTIA Security+ (with CompTIA PenTest+ as a more offense-focused follow-on).

Name two skill areas a beginner should build before penetration testing.

Networking fundamentals (TCP/IP, ports, protocols) and operating systems (especially Linux/Kali and Windows); plus at least one scripting language such as Python or Bash.

What is Kali Linux?

A Debian-based Linux distribution pre-loaded with hundreds of penetration-testing and security tools (e.g., Nmap, Metasploit, Burp Suite, Wireshark), widely used by ethical hackers.

How can an aspiring ethical hacker legally build practical, portfolio-worthy experience?

By practicing on intentionally vulnerable, sanctioned environments—CTF (Capture The Flag) competitions, platforms like Hack The Box and TryHackMe, home labs, and authorized bug bounty programs—then documenting write-ups.

What should a strong ethical hacking portfolio contain?

Documented CTF/lab write-ups, sample (sanitized) pentest reports, relevant certifications, personal projects or tools, blog posts, and evidence of bug bounty or open-source contributions—demonstrating both skill and clear communication.

Why are networking and community involvement valuable for an ethical hacking career?

Communities (conferences like DEF CON/Black Hat, local meetups, forums, Discords, CTF teams) provide mentorship, up-to-date knowledge, collaboration, reputation-building, and job opportunities in a fast-evolving field.