Network Penetration Testing (Ethical Hacking) From Scratch

Explore legal considerations in penetration testing, covering company formation, mission and values, organizational type, compensation, client acquisition, insurance, customer agreements, scope, permissions, third-party terms of service, and reporting.

Obtain written permission to define the scope of pen tests—from white to black box or gray box—and bug bounty programs. Verify ownership, licenses, and terms to avoid legal risk.

Explore Windows-based tools for ethical hacking, including nmap, Wireshark, and PuTTY, and learn to build test labs with virtual machines using VirtualBox, VMware, and Hyper-V.

Set up Kali in a virtual machine, configure network options, and learn Kali rolling for in-VM updates using package managers; practice navigation, file commands, and directory traversal basics.

Master Kali setup basics by navigating the terminal, creating symbolic links, running apt update and apt upgrade, backing up virtual machines, and using workspaces and keyboard shortcuts to manage tasks.

Learn to set up ethical hacking tools on Mac OS 10 as a native pen testing platform, using a Unix terminal, Bash, built-in Netcat, SSH, Python, Perl, and Homebrew.

Install Kali Linux in macOS via Parallels using a graphical installer. Configure the hostname and root password, then install dependencies and industry-standard pen testing tools with a virtual desktop manager.

Learn to set up VulnHub VMs like Wallaby's Nightmare and Metasploitable 2 with Kali and virtualization tools, then enumerate with nmap to reveal open ports and potential entry points.

Explore cloud services for penetration testing by launching public cloud instances (Ubuntu, Windows, Red Hat) with public IPs, and configure AWS authorization, security groups, and key pairs.

Access a cloud instance via ssh with a private key, verify the fingerprint, and use nmap and nikto for basic penetration testing; manage instances and volumes to avoid charges.

Explore editing and processing information in Linux with nano or other editors, organize machine notes with KeepNote, and keep data offline to honor non-disclosure agreement while using highlighting and bolding.

Configure and use ftp and sftp services in a pentest lab, enabling anonymous access, adjusting the ftp server for standalone operation, and verifying activity on port 21 with netstat.

Set up the apache 2 web server on a kal li box to pass files between a client and attacker, and demonstrate phishing pages cloning client webmail to harvest credentials.

Engage in passive information gathering by examining a client's public web presence, employing search operators, and uncovering login pages, admin areas, and archives.

Use passive information gathering with the Google hacking database and Shodan to identify open ports, banners, ssl certificates, and metadata, plus Street View and public records for intel.

Explore how to identify organization personnel via LinkedIn and Facebook, deduce email formats for phishing or credential testing, and use meta search tools to uncover associations, groups, and contact details.

CeWL spiders a client website to collect words for building password dictionaries, revealing email addresses and metadata while warning about the traffic generated.

Learn to use nmap to scan a client network, identify open ports and services, perform OS detection with -A, and explore results in Zenmap.

Learn to leverage Nmap's scripting engine to enumerate SSL certificate details and WordPress versions and plugins, use script help and verbose outputs, and explore practical script-driven penetration testing.

Use Nikto, a command-line web vulnerability scanner, to test client websites and identify vulnerabilities. Output formats include CSV, HTML, and Nessus; configure hosts, proxies, authentication, and verbose options.

Learn to set up and use OpenVAS on Kali Linux to scan networks and websites for vulnerabilities, view and interpret scan reports, and apply defender-focused remediation guidance.

Use dirb and dirbuster in Kelley Linux to brute force and enumerate web directories with wordlists, enabling recursive scans and multi-threading.

Explore metasploit's scanning-based modules, configure the postgresql database, use the msf console with hosts and workspace commands, and run auxiliary scanners to enumerate web directories and services.

Use Metasploit auxiliary scanners to detect anonymous access and enumerate SMB on port 139, POP3 on port 110, and default users like root and MSF admin; map results to databases.

Learn to use netcat for banner grabbing to identify services, inspect http headers via get requests to reveal server and os details, and practice ftp login and listing with Wireshark.

Demonstrates banner grabbing with ncat and netcat on ports like 22 and 25, revealing login prompts and plain-text banners.

Explore dns enumeration using domain records, name servers, MX and A records to reveal target information, and automate subdomain checks with a bash script using a for loop and cut.

Explore dns enumeration techniques, including reverse ip lookups and zone transfers, using scripts and tools like host and dnsenum to map domains and name servers.

Enumerate smb shares and environments using samba and snb techniques across ports 135, 139, and 445. Explore user and share information with nbt scan, net share, smb client, and scripts.

Demonstrate locating publicly available exploits with Metasploitable 2 and Kali Linux, using Exploit Database and a Perl script to run the Unreal IRS server exploit and a netcat reverse shell.

Explore using metasploit to find, configure, and run exploits against a target, including updating modules, managing a postgresql backend, and selecting high‑rank exploits like the unreal irs backdoor.

Explains configuring a metasploit exploit with a java interpreter payload and a reverse tcp connection. Demonstrates managing sessions, interacting with the target, and retrieving system info and password hashes.

Create a Windows reverse TCP payload with msfvenom, selecting the payload, host, port, platform, and an encoder such as shikata, then catch with multi/handler to obtain an interpreter shell.

Explore how Burp Suite's web proxy intercepts and manipulates web form inputs to test security, inspect requests, and map sites with spider, scanner, intruder, and other tools.

Explore zap, a web proxy for web application testing, compare it with burp, configure local hosts, run an active scan to reveal injections, cross-site scripting, and path traversal.

Explore classic sql injection by simulating login bypass, enumerating databases and information_schema to extract user data and password hashes through crafted queries.

Explain NoSQL injection on MongoDB by crafting JSON objects to bypass login and gain admin access, using a greater-than null technique.

Explore the printer exploitation toolkit pret on GitHub, and learn how printers communicate via PostScript, PCL, and PJL. Demonstrate capture, nvram, fonts, and exploitation concepts for client security mitigation.

Explore local file inclusion and remote file inclusion vulnerabilities, showing how url parameters can pull files, reveal sensitive info, and even execute code on a vulnerable web server.

examine how penetration testers test against antivirus, compare payload encoders, and analyze VirusTotal results to understand what detections look like and how to bypass them.

Explore the Veil evasion framework to generate and encode payloads in C and Python for antivirus evasion, and test them with Virus Total using Wine on Linux.

Differentiate between shells and reverse shells and explore two-way communication between victim and attacking machine using netcat to open a shell and pass commands.

learn to establish reverse shells when netcat is unavailable by using bash one-liners, telnet, or PowerShell on Windows across attacker and victim machines.

Explore Patator password attacks, including username collection, SMB brute-force, and password spraying, with output filtering to highlight successful logins.

Patator demonstrates password attack techniques, including host logins, file-based user lists, and handling return codes, with DNS forward and reverse lookups to identify names and mail recipients.

Explore how a buffer overflow on the stack enables exploitation by overwriting the return address and bypassing canaries to execute shellcode, with fuzzing and bad characters shaping the attack.

Explore a buffer overflow demo on a Kali server accessed via netcat on port 4242, where a hidden X triggers overflow and canary protection is tested with gdb and peda.

Demonstrate a buffer overflow attack by sending junk bytes past a canary, crafting a nop sled, and hijacking execution with a calculated jump to injected code using debuggable Python script.

Demonstrates a buffer overflow exploit using MSF venom to generate shellcode and obtain a shell on Linux. Explains canaries, static addresses, and callback setup via port forwarding for remote access.

Phishing exploits the human element to obtain credentials via email, calls, and in-person social engineering, while the lecture reviews site cloning, malicious links, and tools like set, httrack, and mailx.

Explore Windows post exploitation techniques using command line and wmic to enumerate users, network interfaces, partitions, services, hotfixes, and potential pivot paths across subnets.

Explore Windows command-line techniques to enumerate network configurations, dump dhcp and system information, manipulate dns settings, and assess firewall and task statuses in ethical hacking contexts.

Learn to gather information from a Linux target connected from Windows, identify users, hosts, and processes, and explore privilege escalation paths using commands like id, whoami, sudo, and top.

Learn Linux machine reconnaissance for ethical hacking: inspect firewall rules, view ports and processes, check connections, read bash history, and explore user home directories for privilege escalation clues.

Mimikatz demonstrates extracting credentials and hashes from memory, listing SAM and credential stores, using pass-the-hash to obtain shells, and elevating privileges to access sensitive data.

Explain how to extract password hashes on Windows and Linux using FGDump, identify LM and NTLM hashes, and prepare Linux shadow data with unshadow for cracking.

Apply John the Ripper to crack hashes using single crack mode, wordless mode, and incremental mode with mangling rules; compare dictionary-based and brute-force cracking through rockyou and crack station lists.

Explore pivoting in segmented networks by using a broker to reach a blocked Windows host, and master local and remote port forwarding via SSH to access services.

Learn to perform dynamic port forwarding to create a local socks proxy, chain proxies between Debian and Windows boxes, and pivot to reachable networks via meterpreter sessions.

Learn to maintain access on a target by persisting with new administrator accounts, scheduled tasks, and registry or cron entries across Windows and Linux.

Explore Wireshark, a powerful protocol analyzer that provides a live capture window, filters, and a front end to understand and analyze packets across interfaces, including IPv4, IPv6, ARP, and ICMP.

Analyze a threeway tcap handshake and explore Wireshark's layer-by-layer packet view, including IP addresses and port 443, then apply display filters and boolean logic, and follow TCP streams.

Capture and analyze traffic with tcpdump, writing to a pcap file and reading it back for headers and payload details, using verbose options.

Explore purpose-built hardware for penetration testing, from Raspberry Pi devices and wireless sniffers to inline taps and wireless antennas, and learn to simulate attacker access and monitor traffic.

Explore hardware-based tools for physical penetration testing, including keystroke loggers, land turtle, usb rubber ducky, bash bunny, RFID cloning, proximity locks, bump keys, and mag stripe cloning.