Ethical Hacking Penetration Testing Syllabus

What does CVSS measure and what is its score range?

The Common Vulnerability Scoring System measures the severity of a vulnerability on a scale from $0.0$ to $10.0$, where higher scores indicate greater severity.

What are the CVSS qualitative severity rating bands?

None: $0.0$; Low: $0.1\text{–}3.9$; Medium: $4.0\text{–}6.9$; High: $7.0\text{–}8.9$; Critical: $9.0\text{–}10.0$.

What is the exploitation phase in penetration testing?

The phase where the tester actively leverages identified vulnerabilities to gain unauthorized access, execute code, or otherwise compromise the target to prove impact.

What is a proof-of-concept (PoC) exploit?

A demonstration that a vulnerability is genuinely exploitable, typically minimal code or steps that confirm the weakness without causing unnecessary damage.

What is privilege escalation, and what are its two types?

Gaining higher permissions than initially granted. Vertical escalation: moving to a higher privilege level (user to admin/root). Horizontal escalation: accessing another user's resources at the same privilege level.

What is the post-exploitation phase focused on?

Determining the value of the compromised system, maintaining access, escalating privileges, moving laterally, gathering sensitive data, and assessing the full business impact of the compromise.

What is lateral movement in post-exploitation?

The techniques an attacker uses to move from one compromised system to others within the network, expanding access toward high-value targets.

What is persistence in post-exploitation?

Establishing mechanisms (backdoors, scheduled tasks, new accounts) to maintain access to a compromised system across reboots or credential changes.

Why is 'covering tracks' handled carefully in authorized pen tests?

While real attackers erase logs, ethical pen testers document actions rather than destroy evidence; any cleanup of test artifacts must be agreed upon so the client can restore a clean state.

What is Metasploit Framework?

An open-source exploitation framework providing a large database of exploits, payloads, encoders, and auxiliary modules used to develop, test, and execute exploit code against targets.

In Metasploit, what is the difference between an exploit and a payload?

An exploit is the code that takes advantage of a vulnerability to gain access; a payload is the code that runs on the target after successful exploitation (e.g., a reverse shell or Meterpreter session).

What is Meterpreter in Metasploit?

An advanced, in-memory, dynamically extensible payload that provides an interactive shell with capabilities like file access, privilege escalation, keylogging, and pivoting, while minimizing disk footprint.

What is the difference between a bind shell and a reverse shell payload?

A bind shell opens a listening port on the target for the attacker to connect to. A reverse shell makes the target connect back to the attacker's listener, which better evades inbound firewall rules.

What is Burp Suite primarily used for?

Web application security testing; it acts as an intercepting proxy between browser and server, allowing inspection, modification, and replay of HTTP/HTTPS requests and responses.

What is the function of Burp Suite's Intruder tool?

Automating customized attacks such as fuzzing, brute-forcing credentials, and enumeration by inserting payloads into defined positions within requests.

What is the function of Burp Suite's Repeater tool?

Manually modifying and resending individual HTTP requests to observe how the application responds, useful for probing and validating vulnerabilities.

What is Nessus used for?

Nessus is a widely used automated vulnerability scanner that detects misconfigurations, missing patches, default credentials, and known vulnerabilities across networks and hosts.

Is Nessus an exploitation tool or a scanning tool?

A scanning/assessment tool—it identifies and reports vulnerabilities but does not exploit them; exploitation requires separate tools like Metasploit.

What is OWASP ZAP?

OWASP Zed Attack Proxy: a free, open-source web application security scanner and intercepting proxy used to find vulnerabilities through automated scanning and manual testing.

How does OWASP ZAP compare to Burp Suite?

Both are intercepting-proxy web app scanners; ZAP is fully free and open-source and beginner-friendly, while Burp Suite's Professional edition is commercial with more advanced automation and extensions.

What is the difference between ZAP's spider and its active scan?

The spider crawls the application to discover URLs and content (passive discovery); the active scan sends crafted malicious requests to those endpoints to detect exploitable vulnerabilities.

What are the essential sections of a penetration test report?

Executive summary, scope and objectives, methodology, findings with severity ratings, technical details/evidence, risk analysis, and remediation recommendations.

What is the purpose of the executive summary in a pen test report?

To communicate overall risk posture, key findings, and business impact in non-technical language for management and decision-makers who may not read the technical detail.

What should each documented finding in a report include?

A description, affected assets, severity/risk rating, evidence (screenshots, logs, payloads), steps to reproduce, potential business impact, and specific remediation guidance.

Why is reproducibility important when documenting findings?

Clear step-by-step reproduction lets the client's technical team confirm the vulnerability, understand it, and verify that remediation actually fixed the issue during retesting.

What makes a good remediation recommendation?

It is specific, actionable, prioritized by risk, feasible for the client, and addresses the root cause rather than just the symptom (e.g., patch a version, enforce input validation, apply least privilege).

How should findings be prioritized when providing recommendations?

By risk, typically a function of severity/impact and likelihood/exploitability, so that critical and easily exploitable issues are remediated first.

How is risk commonly expressed as a relationship in security reporting?

$$\text{Risk} = \text{Likelihood} \times \text{Impact}$$ combining how probable exploitation is with how damaging it would be.

What is retesting (validation) in the reporting cycle?

A follow-up test after the client applies fixes, confirming that reported vulnerabilities have been successfully remediated and no new issues were introduced.

Why should raw findings be tailored to different audiences in a report?

Executives need concise business-risk language and prioritization, while technical staff need detailed reproduction steps, evidence, and precise fixes—serving both improves the report's usefulness and drives remediation.