CYBER SECURITY
GULL E ZULF NARGIS
Ethical Hacking & Penetration Testing
Ethicalhacking is the practice of legally
breaking into systems to find security
weaknesses before malicious hackers can
exploit them.
Ethical Hacking & Penetration Testing
Purpose:
Identify vulnerabilities
Improve system security
Protect data and users
Ethical Hackers (White Hat Hackers):
Work with permission
Follow legal guidelines
Report vulnerabilities responsibly
Common Activities:
Scanning systems
Testing passwords
Checking for software vulnerabilities
Simulating cyberattacks
Penetration Testing
Penetration testing is a controlled and authorized attack
simulation performed to evaluate the security of a system.
It is a specific method within ethical hacking
Objectives
Find exploitable vulnerabilities
Test security defenses
Measure risk level
Phases of Penetration Testing
Planning & Reconnaissance
Define scope and goals
Gather information (footprinting)
Scanning
Identify open ports, services, vulnerabilities
Gaining Access
Exploit weaknesses to enter system
Maintaining Access
Check if attacker can stay in system
Analysis & Reporting
Document findings and suggest fixes
Types of Penetration Testing
Black Box Testing
No prior knowledge of system
White Box Testing
Full knowledge (source code, network info)
Gray Box Testing
Partial knowledge
Difference Between Ethical Hacking &
Penetration Testing
Ethical Hacking Penetration Testing
Broad concept Specific testing method
Continuous process Time-bound project
Covers all security aspects Focuses on exploiting vulnerabilities
Footprinting & Reconnaissance
These are the initial phases of ethical
hacking or cyberattacks, focused on
gathering information about a target system
or organization.
Footprinting
Footprinting is the process of collecting detailed
information about a target before launching an attack.
Purpose:
Understand the target system
Identify possible entry points
Reduce effort in later attack stages
Footprinting
information Gathered:
Domain names & IP addresses
Company details (employees, emails)
Network infrastructure
Technologies (OS, servers, software)
Techniques:
Search engines (Google hacking)
WHOIS lookup
DNS queries
Social media analysis
Types
Passive Footprinting – No direct contact
(safe, hard to detect)
Active Footprinting – Direct interaction
(easier to detect)
Reconnaissance
Reconnaissance is a broader process that
includes footprinting and focuses on mapping
and probing لاتنپ چناجthe target system.
Footprinting = information collection
Reconnaissance = information + system
probing
Objectives:
Discover live hosts
Identify open ports
Detect services and vulnerabilities
Methods:
Network scanning
Port scanning
Packet sniffing
Enumeration
Differences
Footprinting Reconnaissance
Basic information gathering Detailed system probing
Mostly passive Passive + active
Early step Wider pre-attack phase
Scanning and vulnerability discovery
Scanning and vulnerability discovery are
core phases of cybersecurity assessment,
used to identify weaknesses in systems,
networks, or applications before attackers do.
Scanning
Scanning is the process of systematically probing a system or network to
gather information.
Types of Scanning:
Network scanning
Identifies active devices, open ports, and services (e.g., using tools like
Nmap).
Port scanning
Detects which ports are open and what services are running.
Service/version scanning
Determines software versions to check for known weaknesses.
Wireless scanning
Finds unsecured or weak Wi-Fi networks.
Vulnerability Discovery
Once scanning gathers information, vulnerability discovery
focuses on finding actual security weaknesses.
Methods:
Automated vulnerability scanning tools
Tools like Nessus or OpenVAS scan systems for known
vulnerabilities.
Manual testing
Security experts analyze systems more deeply to find
complex or logic-based flaws.
Database referencing
Vulnerabilities are often checked against databases like
Common Vulnerabilities and Exposures.
Exploitation techniques and tools :
Exploitation is the phase where identified
vulnerabilities are actually used to gain
access, escalate privileges, or extract data.
It comes after scanning and vulnerability
discovery, and it’s a critical part of
penetration testing—but only when done
with proper authorization.
What “Exploitation” Means
In cybersecurity, exploitation involves:
Taking advantage of a weakness (e.g., outdated
software, weak authentication)
Gaining unauthorized access or control
Demonstrating the real-world impact of a
vulnerability
Common Tools and How They’re Used
Nmap
Although primarily a scanning tool, it can support
exploitation:
Identifies open ports and services
Detects versions with known vulnerabilities
Uses scripting (NSE) to check for exploitable flaws
Example use: Finding a server running an outdated service
that can later be exploited.
Metasploit Framework
A powerful exploitation framework:
Contains a large database of exploits
Allows payload delivery (e.g., reverse shells)
Automates exploitation steps
Typical workflow:
Choose an exploit
Configure target details
Launch attack
Gain shell access (if successful)
.Wireshark
Not an exploitation tool directly, but very useful:
Captures and analyzes network traffic
Helps identify sensitive data in transit
Can reveal vulnerabilities like unencrypted credentials
Example: Detecting login data sent over HTTP instead of
HTTPS.
Common Exploitation Techniques
Remote Code Execution (RCE)
Running malicious code on a target system remotely
Privilege Escalation
Gaining higher access (e.g., user → admin/root)
Credential Attacks
Brute force, password spraying, or credential reuse
Man-in-the-Middle (MITM)
Intercepting communication between two systems
Injection Attacks
Such as SQL injection or command injection
Responsible disclosure and reporting
Responsible disclosure and reporting
(often called coordinated vulnerability
disclosure) is the process of reporting
security flaws in a way that gives the
affected organization time to fix the issue
before it becomes public.
What Responsible Disclosure Means
When you discover a vulnerability:
You privately inform the vendor or organization
You avoid public exposure until a fix is available
You work cooperatively to reduce risk to users
This approach balances transparency with safety.
Standard Disclosure Process
Report the issue clearly Include:
Description of the vulnerability
Steps to reproduce
Impact and severity
Suggested mitigation (if possible)
Many companies run bug bounty programs on platforms like HackerOne or
Bugcrowd.
Standard Disclosure Process
Verify the vulnerability
Reproduce the issue reliably
Collect evidence (logs, screenshots, proof of concept)
2. Identify the right contact
Look for a [Link] file or a “Security” page
Use official channels (email, bug bounty platforms)
Organizations like CERT Coordination Center can help if no
contact is found.
Standard Disclosure Process
Allow time for remediation
Common practice: 30–90 days before public disclosure
Stay responsive if the vendor asks for clarification
Public disclosure (optional)
After a fix is released, details may be published
Often assigned a CVE via Common Vulnerabilities and
Exposures
Writing a Good Vulnerability Report
A strong report is:
Clear and concise
Technically accurate
Reproducible
Impact-focused
Typical structure:
Title
Summary
Affected systems
Steps to reproduce
Proof of concept
Impact assessment
Recommendations