Ethical Hacking & Network Penetration Testing

Explore the five phases and methodology of penetration testing, and its scope. Compare it with vulnerability assessments and learn how tools enable privilege escalation to reveal weaknesses.

Explore black box, white box, and gray box penetration testing methods, including scope, costs, and practical tools, with emphasis on black box testing and its network exploration.

Explore the five phases of penetration testing—reconnaissance (information gathering), scanning, exploitation, maintaining access, and reporting—emphasizing active and passive methods, data centralization, and identifying vulnerabilities.

Explore passive scanning as a core reconnaissance phase in penetration testing, gathering information from publicly available sources such as Google and LinkedIn.

Explore google hacking as an information gathering technique that uses basic search operators to refine results and reveal sensitive data in public web applications and targeted sites.

Explore google advanced operators to map a target's structure and uncover login pages, admin panels, and sensitive bits by combining site, file type, intitle, inurl, and intext searches.

Explore the Google hacking database to craft precise Google operators that reveal publicly accessible WordPress backups, config files, and sensitive info, enabling targeted vulnerability assessment and audit.

Learn to use the harvester, a passive Kali tool for gathering domains, subdomains, emails, hosts, open ports, banners, and IP addresses from public sources like search engines and Shodan, with command examples.

Use dns enum, an open source reconnaissance tool, to enumerate subdomains, hostnames, and ip addresses via zone transfers and reverse resolution, with wordlists and -h options.

Master the active scanning approach to enumerate a target, discover open ports and services, perform fingerprinting with nmap, and uncover vulnerabilities, while noting a passive tool b0f for stealthy details.

Identify live hosts on the target network with Net Discover, which uses ARP requests to reveal active IPs and MAC addresses on the same network; use -P for passive scanning.

Learn to use Knit Discover for host discovery and ARP scanning with elevated privileges, identifying live hosts and practicing -I, -R, -L, and -p options.

Analyze Knit Discover ARP scan results to identify active hosts, IP addresses, MAC addresses, device vendors, and packet counts. Record these details for use in upcoming active scans with Nmap.

Learn to use Nmap for network discovery, reconnaissance, and security auditing, identifying live hosts, open services, operating systems, software versions, and network assets, plus tcp and udp basics.

Explore nmap's host discovery, port scanning, version and os detection, and scripting engine, while comparing scan types like tcp, udp, syn, and null scans for effective assessment.

Activate the solid state machine on hack the box via openvpn, note its ip, and prepare to explore nmap tools and options.

Identify live hosts with nmap using host discovery and -sn, then use tcp connect scans (-sT) to enumerate ports and services, saving results in text or xml formats (-oN, -oX).

Explore nmap scanning options with minus p for port ranges and specific ports, including udp and tcp scans, and the minus b flag for comprehensive service discovery on nonstandard boards.

Learn to perform stealthy Nmap scans, including SYN half-open, FIN and NULL scans, to reveal open ports and service versions, enabling exploitation planning for ethical hacking.

Explore how to conduct stealthier Nmap scans by selecting timing modes with the -T option, from paranoid to insane, balancing speed and stealth to avoid detection while mapping hosts.

Learn how the nmap scripting engine NSC enables writing and running scripts to automate networking tasks, using -sC or --script with integrated normal and XML outputs.

Learn to run nmap with --script to test http and smb-vuln-ms17-010 scripts against targets, analyze results on port 445, and manage scripts by downloading and updating the script database.

Explore p0f, a passive tcp/ip stack fingerprinting tool that identifies remote operating systems, browser details, and uptime by analyzing captured packets and http messages without generating traffic.

Explore the exploitation phase of penetration testing by learning to transfer exploits and files between Kali and the target using a simple http server, Apache, PowerShell, and Git.

Explore four file transfer methods between systems: PowerShell web client downloads, batch PowerShell, git transfers, and wget with a local http server for Windows and Linux targets.

Explore how exploits differ from bailouts, how payloads execute a reverse shell, and how to locate, analyze, modify, and transfer exploits from sources like Exploit DB.

Explore three methods to locate and download exploits—exploits on exploit db, a search exploit tool, and Google search—using git, locate, and copy commands to save and manage exploit files.

Netcat writes and reads data over tcp and udp, enabling a reverse shell between Kali and a target, port scanning, and banner grabbing as a cross-platform tool.

Use netcat to interact with web servers via HTTP requests and banners, then set up a reverse shell where the victim connects to Kali on port 4444 using /bin/bash.

Learn to perform advanced nmap scans, compare scans with and without -p, identify SSH, SMTP, POP3, Apache James, and a remote admin interface to assess outdated software for exploitation.

Identify the Apache James version and search for exploits to test remote code execution on the solid state machine, using exploit tools and related sources.

Explore gaining access to the remote admin service on port 4555 using default credentials with netcat, enumerate users, set passwords, and use smtp via telnet to reveal ssh credentials.

Gain SSH access using Mindy's credentials from 1.1.1.51, update the exploit payload to a reverse shell with netcat, and trigger remote shell access via a Kali listener.

Explore core web application vulnerabilities in network penetration testing, focusing on SQL injection and file upload, with hands-on labs to identify vulnerabilities and bypass techniques for remote access.

Explore dirb, a command-line tool that brute-forces directory paths using wordlists and HTTP requests to reveal hidden pages, with a default around 4000 words and technology-specific targets like WordPress.

Explore Feroxbuster, a brute-force web scanner using a wordlist to reveal unlinked and protected content, with practical lab commands on a hack the box lab target.

Explore Burp Suite and its features while using the magic machine to identify security weaknesses in web applications, after setting up vpn and scanning ports 2020 and 80.

Learn how Burp Suite, a Java-based proxy, intercepts and analyzes browser traffic to modify requests, test inputs, and support automated or manual web application penetration testing with repeater and intruder.

Configure Burp Suite proxy and browser settings to route traffic through Burp Suite, enable interception, and use repeater and intruder for manual request testing.

Explore how Burp Suite's intruder automates login-page testing, using target positions and payloads to detect SQL injection and other input vulnerabilities, and unveils attack types like sniper and battering ram.

Explore how sql injection inserts malicious code into sql statements to bypass login validation and access backend data, using boolean operators and comments, with anomalies in responses revealing the attack.

Identify sql injection vulnerabilities with union-based techniques, test data entry points using Burp Suite, analyze http 500/302, determine column counts, data types, and craft payloads with order by and comments.

Practice discovering and exploiting sql injection on a linux validation machine using Burp Suite, union attacks, and php shell upload to gain remote access, then attempt privilege escalation.

Explore common file upload restrictions—content type, extension, and content verification—and bypass techniques using Burp Suite to understand how attackers deploy reverse shells.

Identify sql injection vulnerabilities by using burp suite to locate data entry points. Explore union based sql injection, determine columns and data types, and apply comments to bypass.

Explores using exiftool to manipulate image metadata and embed a php reverse shell via double extensions to bypass upload restrictions, and covers sql injection testing with burp suite on kali.