
Learn what to expect: footprinting and reconnaissance, networking fundamentals, cryptography and SSL/TLS, scanning with Nmap and Metasploit, malware basics, web app hacking, wireless security, and programming attack defenses—hands-on.
Define hacking as a deep understanding of computer systems and networks, driven by exploration, the joy of learning, and creative problem solving, with historical examples like Morris Worm and RFCs.
Explore ethical hacking (white hat) alongside black hat, gray hat, and hacktivism, using Kevin Mitnick, Lulz Security, and Anonymous as examples to show motives and methods.
Practice ethical hacking by obtaining explicit permission, defining the scope of authority, and communicating risks and potential outages to build trust with clients.
Apply a framework for ethical hacking engagements using OSSTMM and OISSG to guide steps, testing types, risk assessment, and reporting.
Explore common attack types such as defacing, buffer overflows, and format string attacks, and examine denial of service and DDoS origins like Stacheldraht, TFN, and Trinoo.
Develop foundational hacking and penetration testing skills by mastering basic computing, operating systems, command line use, networking concepts, and reading packets with security-focused problem solving.
Learn what penetration testing is, its scope, and how scope exclusions and sign-off affect engagements. Compare penetration tests with security assessments and emphasize actionable remediation.
Map the target's footprint by collecting domain names, ip blocks, and scope details, then document findings in a spreadsheet or database to guide footprinting and testing.
Explore how to use the Wayback machine and Netcraft to research a company’s historical website data and infrastructure, revealing past pages, server types, and potential vulnerabilities for targeted ethical hacking.
Use online resources like Monster, LinkedIn, and social networks to research target systems and infrastructure, discovering Windows, Cisco, Citrix, UNIX, Apache, and Tomcat details for later exploitation.
Use the whois utility to query regional internet registries and uncover domain ownership. Identify IP owners, administrative and technical contacts, DNS data, and leverage the -h flag or web interfaces.
Learn how to extract information from dns using nslookup, host, and dig, including A, MX, SOA, and PTR records.
Identify network ranges by using whois, dns, and registries to map a domain to ip addresses and hosting blocks, exploring related hostnames while respecting scope and exclusions.
Explore Google hacking techniques to narrow search results, uncover error pages, version numbers, bash_history, and vulnerable web applications like Joomla, enabling targeted information gathering for penetration testers.
Explore Google hacking by using quotes and operators like index of, filetype, site, intitle, ext, and inurl to locate web.config files, password files, and sensitive documents.
Explore the Google hacking database to learn how Google dorks surface sensitive information for penetration testing, including usernames, vulnerable servers, and login portals.
Trace the TCP/IP history from ARPANET's 1969 origins, through NCP to TCP/IP, the first IMP router, and IPv6, highlighting 32 bit versus 128 bit addresses and NSFNET's role.
Explore how Wireshark captures packets on a network interface, revealing addresses, protocols, layer details, and hex dumps; filter http traffic and follow tcp streams to analyze related packets.
Explore the OSI seven-layer model and the four-layer TCP/IP stack, with a focus on physical, data link, network, transport, and the session, presentation, and application layers.
Explain how an IP address uses four octets of eight bits, with 192.168.1.24 as an example, and how 255.255.255.0 separates network and host portions to yield 254 host addresses.
Learn how UDP, a fast, connectionless transport protocol in the TCP/IP suite, uses source and destination ports and checksums to support quick DNS queries (type A record) and Skype communications.
Understand tcp, the transport protocol in the tcp/ip suite, and how a three-way handshake establishes reliable, connection-oriented communication using ports, sequence numbers, and syn, syn-ack, and ack.
Learn how background services operate on Windows and Linux, including startup scripts, and how compromising a service can grant elevated privileges, such as local system access.
Wireshark enables deep network analysis of VoIP and other traffic, showing VoIP call statistics, endpoints and IP address details, flow and ladder diagrams, decode as and follow TCP streams.
Learn how dhcp automates ip address, subnet mask, router, and dns assignment via a dhcp server, with lease times, per-host mac address configurations, and tftp boot server settings.
Explore how ARP maps IP addresses to MAC addresses via arp table on a local area network and how ARP poisoning and gratuitous ARPs enable a man-in-the-middle attack with Ettercap.
Explore the history of cryptography from Caesar cipher and rot13 to Enigma and AES, tracing DES and Triple-DES 56- and 168-bit keys toward Rijndael with 128–256-bit options.
Explore the fundamentals of cryptography, including symmetric and asymmetric types, their key lengths, speed, and use cases, plus hybrid encryption and practical RSA key generation with OpenSSL.
Explore how certificates establish identity, enable encryption, and provide non-repudiation through RSA keys, certificate authorities, and digital signatures, with hands-on OpenSSL demonstrations.
Cryptographic hashing is a one-way function, not encryption, producing fixed-length hashes and revealing no original data. The lecture discusses collisions, software hashes for downloads, and password storage.
Discover how SSL and TLS encrypt web traffic between servers and browsers, covering handshakes, cipher suites, and key exchange, plus how to audit with SSL scan and manage certificates.
Explore secure shell basics with ssh, including public key authentication, authorized_keys and known_hosts management, and using scp for encrypted file transfer and config aliases—while noting historical version 1 vulnerabilities.
Discover disk encryption across Windows, Mac, and Linux, including BitLocker with TPM and AES, FileVault, and GDecrypt, and why protecting client data matters when devices are lost.
Explore cryptographic analysis through frequency analysis, mapping common English letters like e, t, a, o, i, n to plaintext and guiding substitutions, while noting its limits with modern ciphers.
Explore different scan types used in ethical hacking, including ping, port, and vulnerability scans, and learn how open ports, banners, and version information guide security assessments.
Explore idle, Xmas, and fin scans in nmap to verify port status behind firewalls, using a zombie host and IP identification header behavior, with Wireshark captures.
Explore war dialing, identifying modems as out-of-band access to critical infrastructure, and review tools like ToneLoc, THC-Scan, and PhoneTag that enable this practice.
Explore banner grabbing by reading banners from network services on common ports, revealing service type, version, and encryption details for SSH, Telnet, HTTP, SMTP, and mail servers.
Understand vulnerability scanning and how scanners probe open ports, banners, and versions to identify risks, including Nessus, Nexpose Community, and Qualys guard with limitations like false positives.
Learn to perform vulnerability scanning with Nessus, create and configure scan policies, adjust plugins and credentials, run scans, and review reports for issues like self-signed SSL certificates and open ports.
Explore enumeration techniques to reveal system information, including banner grabbing, DNS queries, zone transfers, and Windows network discovery using net commands, LDAP, and null sessions.
Explore how SNMP enables managing network devices by extracting information and sometimes setting configuration parameters, and compare versions 1, 2, and 3 with security improvements.
Discover how the lightweight directory access protocol (LDAP) organizes data about users and resources in a hierarchical directory, including Active Directory, and compare graphical tools like JXplorer and LdapMiner.
Learn how proxies forward web requests, cache content for bandwidth savings, block sites, and insert antivirus checks; configure Firefox to use a proxy and analyze requests and responses for debugging.
Explore Tor and anonymizers for privacy and security in information gathering. Conceal your IP via onion relays, and beware rogue anonymizers that spread malware.
Explore how tunneling hides data inside other streams to enable private transmission and bypass firewalls, with practical SSH port forwarding and HTTP tunnel methods.
Set penetration goals aligned with target needs, from compliance checks to red team objectives. Define access, persistence, and control outcomes, and outline information gathering as credentials and credit card numbers.
Explore password cracking with word lists, cryptographic hashes, and rainbow tables, using tools like John the Ripper, ophcrack, and Cain and Abel, and how complexity deters brute-force.
Explore password attack methods from brute-force and word-list attacks to rainbow tables. Examine non-technical tactics like written passwords and mnemonic substitutions.
Discover how passwords are stored as one-way hashes across Windows SAM, shadow files, Mac OS Apple Open Directory, and how attackers crack them with Cain and Abel and PwDump 7.
Explore privilege escalation across Linux, Windows, and Mac OS, using sudo, su, and administrator prompts, and understand set you id bit and root access.
Explore spyware, rootkits, and key loggers, how they infect systems, how they differ from adware, and ethical hacking considerations in penetration testing.
Explore metasploit, a penetration testing framework that bundles payloads and exploits, enables quick exploit writing, scans for services, and integrates with Nexpose for vulnerability assessment.
Explore auditing and logging across Linux, macOS, and Windows, learn where logs live (Linux /var/log, macOS console, Windows Event Viewer), inspect syslog, auth.log, kernel messages, and login and access auditing.
Explore Metasploit from the command line with msfconsole, run nmap scans, import Nessus reports, and exploit ms08-067 to obtain a meterpreter session, view system info, passwords, and screen captures.
Explore malware definitions and history, tracing self-replicating viruses, worms, trojan horses, and rootkits from 1947 through the 1980s, including Creeper, Rabbit, Elk Cloner, Brain, and Vienna.
Learn malware detection methods, including anomaly-based and signature-based approaches, antivirus tools such as Windows Defender and ClamAV, and intrusion detection across host and network.
Explore antivirus evasion tactics by showing how malware can morph its hash, use encryption, packing, and encoding to bypass signature-based and anomaly-based detectors, highlighting challenges and false positives.
Explore how malware is deployed and disguised, featuring botnet builders like Zeus and wrappers such as Elitewrap that turn executables into trojan horses.
Explore virus types such as boot sector, shell, multipartite, macros, and polymorphic and metamorphic varieties, and learn how they infect systems, mutate, and how signatures change.
Explore malware analysis basics using VirusTotal to identify a Zeus variant, review strings and DLL imports, and use PEID to detect UPX packing and unpacking for debugging memory layout.
Explore Windows alternate data streams, attaching a streams.exe payload to a text file, hiding data in hidden streams, and inspecting ADS with Sysinternals tools, noting Windows 7 restrictions on execution.
Learn the fundamentals of debugging with Windows debuggers like OllyDbg and Immunity Debugger, exploring assembly language, registers, and step-by-step execution to analyze programs and malware.
Explore how packers and tools like free UPX compress and wrap Windows portable executables, decompress at runtime, and examine malware automation with Zeus Builder and bot creation.
Examine malware analysis using Linux tools strace and ltrace to trace system and library calls, and Windows Process Explorer and Process Monitor to inspect processes, memory, IO, and registry.
Explore the differences between a denial of service attack and a distributed denial of service attack, including master–slave botnets, command and control networks, and blowfish encryption.
Explore classic denial-of-service attacks, from Nestea to Smurf and Teardrop, and show how modern defenses focus on application-level attacks and simple flooding.
Study cybercrime to understand attacker tactics, recognize costs and types of attacks, and mitigate risks to protect systems with ethical hacking insights.
Explore botnets, networks of bots controlled by a master via a command and control server network, and learn how they enable spam, viruses, and attacks.
Learn attack countermeasures for network flooding with Linux iptables, including firewall rules, input/output/forward chains, rate limiting, state tracking, logging, and dropping spoofed or RFC 1918 traffic.
Demonstrates web application testing with Burp Suite, mapping pages with a spider and scanning for issues like cross site scripting, CSRF, and SQL injection, then validating results.
Explore web application architecture by mapping presentation, services, application, and data layers across browser clients, web servers, application servers, and databases.
Explore cross-site scripting, where scripts in form fields run in the browser to access cookies and other data. Distinguish persistent from non-persistent XSS and their implications.
Learn how SQL injection targets web app databases, bypasses login, and retrieves data, using Burp Suite and payloads to explore vulnerable queries.
Examine cross site request forgery, or get for post, a technique that tricks a user into triggering a server action via a forged get request. The lecture emphasizes using post for data submission to prevent forgery and shows how image tags can initiate hidden requests.
Learn how HTTP's stateless design leads web apps to use sessions and cookies, enabling session IDs that can be hijacked, compromising shopping carts and accounts.
Explore how password attacks work, including brute force with Burp Suite, payload strategies, and the importance of input validation and encryption between client and server across layered architectures.
Master encoding and decoding in web applications using Burp Suite, Base64, HTML, and URL encodings, with smart decoding, ASCII hex, and MD5/SHA hashing.
Explore wireless networking basics, including 802.11 WiFi standards (b, g, a, ac, ad), SSID naming, channels, and signal strength, plus encryption options and open networks.
Compare wireless encryption from WEP to WPA and WPA2, including open and shared keys, pre-shared keys and enterprise EAP-TLS with username, radius server, and auditability.
discover methods to find hotspots and wireless networks for penetration testing, using built-in OS tools and apps like KisMAC, Kismet, NetStumbler, and Wi-Fi Explorer.
Discover how to crack WEP encryption using aircrack-ng tools, setting up monitor mode with airmon, capturing data with airodump-ng, and using capture files and word lists to brute-force the key.
Examine rogue access points and attacks, including cloning a WPA2 personal network, gathering authentication data, and sniffing data from open or unsecured wifi in enterprise and public settings.
Learn wireless sniffing techniques using Wireshark and Airodump to capture packets on wireless networks, including layer one and two details and WPA encryption considerations.
Protect wireless networks by configuring the access point, adjusting SSID, channels, and encryption. Enforce MAC authentication and access policies to limit who can connect.
In this Ethical Hacking - Whitehat Hacking and Penetration testing tutorial, expert ethical hacker Ric Messier covers the essentials you will need to know to harden and protect your hardware and software to avoid downtime and loss of data. Protecting your networks and customer data are more important that ever, and understanding HOW you are vulnerable is the best way to learn how you can prevent attacks.
Some of the topics covered in this course are; researching and background information retrieval, networking fundamentals, a deeper look at TCP/IP and packets, as well as understanding cryptography. You will learn about scanning networks, penetration testing and the use of Metasploit, malware and viruses, DoS and DDoS attacks, web application hacking and securing wireless networks. Finally, you will learn about detection evasion and preventing programming attacks, and much more throughout this video based tutorial.
By the time you have completed this video tutorial for Whitehat Hacking and Penetration testing, you will have a deeper understanding of the areas you may be potentially be vulnerable to attack in, as well as the methods that hackers use to exploit your systems, allowing you to better understand how to secure your hardware and data from unethical hackers.