Complete Guide to Ethical Hacking

Learn footprinting concepts, including passive and active recon, to understand how attackers gather system, network, and organizational information to assess vulnerabilities and bypass controls in ethical hacking.

Learn how Google dorks use advanced search operators to uncover sensitive information and potential vulnerabilities during the footprinting phase, empowering ethical hackers and pen testers to identify and report weaknesses.

Explore how Shodan, Censys, and Thingful help ethical hackers discover internet-connected devices, assess IoT exposure, and perform open-source intelligence gathering for footprinting.

Explore what sub-domains are and why ethical hackers enumerate them to shrink attack surfaces. Discover sub-domains manually with Google dorks and automatically with Netcraft and Sublist3r.

Master geolocation reconnaissance for ethical hacking by mapping target surroundings, identifying entrances and exits, guards, and cameras, using Google Maps and Street View for pre-attack analysis.

Explore how social networking reconnaissance uses platforms to reveal an organization's logos, locations, technologies, emails, and personnel, and learn to use automated tools like the harvester for targeted information gathering.

Perform job board recon to uncover target details—job roles, contact info, locations, and tech stacks like PHP, Angular, SQL, and MongoDB—revealing potential attack surfaces for ethical hacking.

Explore the surface web, deep web, and dark web distinctions and the role of dark nets. See how Tor access and encryption-based tools aid recon in ethical hacking.

Explore how metadata reveals sensitive information about targets and learn to automate the process with meta goo fill, and inspect files using exif and strings for reconnaissance.

Explore how threat actors use email tracking to collect target data, including IP, OS, read receipts, and 1x1 pixel tracking, with tools like Email Tracker Pro.

Explore whois and dns recon to footprint a domain, compare thick and thin models, and map dns records, ip addresses, and zone transfer details.

Learn how ethical hackers perform public network footprinting by gathering information via ARIN RDAP queries, NS look up, and trace route to map internet facing assets and assess scope.

Explore social engineering techniques like eavesdropping, shoulder surfing, dumpster diving, and impersonation to gain sensitive information and test security controls.

Explores footprinting and recon countermeasures to protect organizations. Discusses security controls, policy and procedure, training, encryption, privacy, whois redaction, and caution with location services.

Explore custom word lists for ethical hacking, from standard dictionaries to tailored one-line-per-entry files. Learn how cewl builds targeted word lists using depth, minimum length, and link following.

Explore widely used footprinting and recon tools, including FOCA for metadata recon, OSINT with the ascent framework, and one-stop platforms like Maltego, Recon-ng, and Recon dog to map targets.

Learn three network scanning types—host discovery, port and service scanning, and vulnerability scanning—and how they reveal live hosts, open ports, services, and known vulnerabilities for ethical hacking.

Explore TCP communications, focusing on the six control flags—SYN, ACK, FIN, RST, PSH, URG—and the three-way handshake that establishes and terminates a connection.

Explore network scanning tools led by Nmap, its host discovery, port scans, and scripting engine, with notes on Masscan and unicorn scan.

Identify live hosts on a target network as the first stop in host discovery, mapping the attack surface with ICMP ping, ARP, UDP, and Nmap options.

Port scanning reveals open ports and the services on a live host, linking port and service concepts to networking fundamentals and guiding vulnerability discovery.

Explore how a tcp connect scan uses the three-way handshake with nmap -sT to verify open ports and services, including its pros and cons.

Explore the stealth scan, also known as the half-open or syn scan, which probes ports with tcp handshake. Note that it can bypass some firewall rules but requires administrative privileges.

Explore Nmap inverse tcp, Xmas, and Maimon scans to uncover open, closed, or filtered ports using fin, push, and urg flags; gain practical ceh insights.

Explore how to map firewall rules with an ACK scan using Nmap, including TTL-based and window-based variations to distinguish filtered, open, and closed ports.

Explore how the Nmap idle IPID scan uses a zombie and IPID increments to detect open ports by spoofing the target and observing responses.

Discover how nmap's udp scan works, compare udp to tcp, and learn why open udp ports yield no response while closed ports send icmp unreachable, plus speed and root-privilege tradeoffs.

Learn to perform SCTP scans with Nmap, focusing on INIT and COOKIE ECHO handshakes, recognizing open, closed, and filtered ports and interpreting INIT ACK and COOKIE ACK responses.

Learn to use nmap for IPv6 and version scans, enabling IPv6 with -6 and using -sV to reveal service names and versions on target ports.

Learn to optimize Nmap scans by reducing unnecessary checks, using host discovery decisions, port chunking, and timing adjustments to speed up scans while targeting only open ports.

Utilize nmap OS detection and port analysis to identify target operating systems, distinguishing Windows, Linux, and macOS. Apply obfuscation and turn off banners to hinder OS identification by attackers.

Explore how intrusion detection systems and firewalls work and learn evasion techniques such as packet fragmentation, decoys, spoofing, source port manipulation, randomization, proxies, and anonymizers.

Master enumeration basics as a core hacking technique. Learn discovery, listing, and scanning methods to identify hosts, services, banners, and potential credentials.

Enumerate NetBIOS and SMB to map Windows file and printer shares, using nbstat, nbtscan, and nmap to reveal hosts, names, and open shares for assessment.

Explore snmp basics, including managers, agents, traps, and community strings; demonstrate enumeration of hosts using snmp versions 1/2, default public/private, mibs and oids, via tools on udp port 161.

Explore how LDAP enumeration accesses Active Directory to reveal user attributes—names, addresses, departments, and contact details—through LDAP search tools and queries on port 389.

Learn how network time protocol keeps a unified time across devices, enabling accurate Kerberos authentication, and explore practical NTP enumeration using tools like Shodan, ntpdate, ntpd, and ntpdc.

Explore how NFS enables remote file access by mounting shared directories over port 2049, and learn to enumerate, mount, and review permissions using nmap, rpcinfo, and show mounts.

Explore how SMTP and FTP enable enumeration, including user verification with VRFY, EHLO/HELO, anonymous FTP access, and file disclosure, then assess vulnerabilities with Nmap and Metasploit.

Identify weaknesses in systems through vulnerability assessments, and use CVSS 3.0 metrics, CVE, NVD, and CWE resources to prioritize and mitigate threats.

Explore the vulnerability management lifecycle from pre-assessment to post-assessment, covering baselines, asset scope, risk assessment, remediation, verification, and continuous monitoring.

Explore vulnerability classifications and how misconfigurations, default credentials, open services, and design flaws drive risk. Learn how patches, the SDLC, and compensating controls mitigate threats through vulnerability assessments.

Explore vulnerability assessment types, including active vs passive, external vs internal, host and network, application, database, and wireless assessments, plus credentialed, manual, and automated approaches.

Explore vulnerability assessment models and tools, distinguishing product-based vs. service-based approaches, and examine popular scanners like Nessus and Greenbone, plus web, database, and mobile scanning strategies.

Explore vulnerability assessment reports from a vulnerability scanner interface, including setting targets, credentials, and report formats, and learn to interpret CVE findings with severity and actionable recommendations.

Learn the CEH hacking methodology and its goals, covering recon and footprinting, scanning, vulnerability assessment, system hacking, gaining access, privilege escalation, maintaining access, and clearing logs.

Explore Windows authentication methods, including SAM for local accounts, NTLM as domain backup, and Kerberos for domain login, detailing password hashes, challenge–response, KDC, and ticket-granting tickets with timestamps.

Explore password cracking from non-technical methods like shoulder surfing and social engineering to online active and offline attacks, using tools such as hydra, medusa, ocl hashcat, and john the ripper.

Explore how password hashes are extracted from Windows and Linux, then cracked with pW dump, FG dump, Mimi cats, John the ripper, and hashcat.

Explore techniques to speed up password cracking in ethical hacking, including combinator attacks, Prince, combining dictionaries, toggle-case, Markov chain, and tools like Hashcat and John the Ripper.

Explore what buffer overflows are, how memory spills and allows arbitrary code execution, and learn common exploitation tools like fuzzers, spikes, and debuggers, plus protections like dep and aslr.

Learn privilege escalation in ethical hacking, comparing vertical and horizontal paths and techniques such as dll hijacking, unquoted service paths, unattended installations, and exploit db usage for Windows and Lennox.

Learn how attackers maintain access after breaching a system, using executing applications, backdoors, remote access trojans, and root kits, while defenders patch systems and deploy antivirus.

Explore steganography by hiding data in the unused space of cover files like images and text, and perform steganalysis with tools such as steg snow and stag hide.

Learn how attackers cover tracks by disabling auditing, clearing logs, and targeting Windows, Linux, and restore points, while defenders use CIS logs and SIEMs to detect it.

Define malware as malicious software, covering trojans, ransomware, viruses, worms, spyware, and rootkits; learn spread methods via email, downloads, and OS vulnerabilities, and understand hacker motivations like money.

Explore advanced persistent threats, their malware sophistication, group dynamics, and the six-stage lifecycle: preparation, initial intrusion, expansion, persistence, data exfiltration, and cleanup.

Discover how trojans hide malicious payloads inside legitimate software to install backdoors, botnets, or banking trojans, using droppers, downloaders, or trojans inside software, while evading antivirus with crypters and obfuscation.

Explore the differences between viruses and worms, including infection vectors and life-cycle stages, and examine common attack goals, symptoms, and types like ransomware and macro viruses.

Learn how fileless malware operates in memory, executing commands and injecting into processes without writing to disk, and explore its evidence-based and entry-point classifications, attack lifecycle, and evasion techniques.

Master malware analysis basics, including static and dynamic analysis, file hashes, VirusTotal, and live environments to discover and report IOCs and signatures.

Defend against malware by implementing updates and patches, deploying antivirus and EDR with real-time protection, conducting backups, logging and monitoring, and enforcing training, MFA, least privilege, blocking, and system hardening.

Explore how attackers use network sniffing to capture and analyze traffic, including passive vs active sniffing, promiscuous mode, and common sniffing attacks.

Explore how the dynamic host configuration protocol (dhcp) assigns network information and demonstrate rogue dhcp attacks, including dns and gateway manipulation, and the risks of sniffing and man-in-the-middle threats.

Explore how ARP works and how ARP cache poisoning and ARP spoofing enable man-in-the-middle attacks, denial of service, and session hijacking, with static ARP, DHCP snooping, and dynamic ARP inspection.

Examine DNS poisoning techniques and DNS cache poisoning, including hosts file manipulation and rogue DNS servers. See how Bettercap and Ettercap enable DNS spoofing demonstrations.

Defend against sniffing by enforcing encryption and secure protocols, and harden switches with port security and DHCP snooping; implement DNSSEC and DNS sinkhole to deter DNS poisoning.

Explore social engineering concepts by examining targets, four phases, and tactics like phishing, vishing, piggybacking, and dumpster diving to gain access or data.

Identify insider threats in organizations, from malicious and negligent insiders to professional and compromised insiders, and learn motives, detection indicators, and real-world incidents for ethical hacking.

Explore how identity theft works, from stolen IDs to impersonation driven by money. Identify methods used by thieves—hacking, dark web trade, social engineering, and keyloggers—and learn how to spot fraud.

Understand DoS and DDoS definitions, categories, and attack types. Examine volumetric, protocol, and application layer attacks with reflective and amplification techniques, plus common attack tools.

Explore volumetric denial-of-service attacks that saturate bandwidth using UDP and ICMP floods, reflection and amplification, and phenomena like ping of death, smurf, fraggle, and pulse wave.

Explore protocol based denial of service attacks on tcp, including syn floods and ack/push floods, using hping3 and fragmentation techniques to test firewall and ids/ips evasion.

Explore application layer attacks that target web applications, including http attacks using get and post, slowloris floods, and udp floods, causing resource starvation and denial of service to legitimate users.

Explore botnets as a network of compromised hosts controlled by attackers to enable denial-of-service attacks, crypto mining, and other cyber crimes, with toolkit delivery and centralized command channels.

Learn practical DoS and DDoS countermeasures, from detection methods like active profiling and wavelet-based analysis to mitigation strategies such as absorbing, degrading, deflecting, and filtering traffic.