Ethical Hacking – Module 1 Study Guide
Scope and Limitations of Ethical Hacking
Ethical hacking is the authorized practice of bypassing system security to identify potential
threats and vulnerabilities.
It’s like hiring a friendly burglar to find weaknesses in your house security so you can fix
them before a real burglar strikes.
Scope
1. Identifying Security Weaknesses – Detect flaws in configuration, code, or policies.
2. Risk Assessment – Evaluate the severity of discovered vulnerabilities.
3. Compliance – Meet laws and standards (ISO 27001, HIPAA, PCI-DSS).
4. Security Posture Improvement – Suggest defenses.
5. Employee Awareness – Train on threats.
6. Continuous Monitoring – Regular testing for evolving threats.
Limitations
1. Legal Boundaries – Must stay within agreed scope.
2. Resource Constraints – Limited time/budget.
3. Scope Restrictions – Some systems excluded.
4. False Positives/Negatives – Errors in detection.
5. Dynamic Threat Landscape – New risks appear quickly.
6. Ethical Boundaries – No harm, no data theft.
Types of Penetration Testing
Penetration testing is like crash testing a car—it’s deliberate stress testing to see what
breaks.
Types include:
1. Black Box – No prior system knowledge; realistic but slower.
2. White Box – Full system knowledge; thorough but less realistic.
3. Grey Box – Partial knowledge; balance of coverage & realism.
4. Internal – Simulates insider threats.
5. External – Focuses on internet-facing assets.
6. Targeted – With IT team’s awareness; used for training.
Phases of Penetration Testing
1. Planning – Define scope, get legal permission.
2. Reconnaissance – Gather info (passive & active).
3. Threat Modeling – Identify weaknesses.
4. Exploitation – Attempt to exploit vulnerabilities.
5. Post-Exploitation – Assess depth of access.
6. Reporting – Document findings.
7. Remediation & Retesting – Verify fixes.
Flowchart of Penetration Testing Phases:
Security Testing Methodology
Frameworks:
1. OSSTMM – Covers human, physical, wireless, telecom, and network security.
2. OWASP – Web app focus: authentication, input validation, session management.
3. NIST SP 800-115 – Gov’t standard with planning, discovery, attack, reporting.
4. PTES – Pre-engagement, intelligence, threat modeling, exploitation, reporting.
Principles: Be systematic, repeatable, documented, and legal.
Security Audit vs Vulnerability Assessment vs Penetration Testing
Feature Security Vulnerabilit Penetration
Audit y Testing
Assessment
Goal Compliance Find Exploit to
check vulnerabiliti assess risk
es
Depth Broad Moderate Deep
Approach Checklists, Automated/ Manual +
interviews manual scans
scans
Output Compliance Vulnerabilit Exploit
report y list proof +
impact
Realistic No No Yes
Attack
Case Studies
1. Hospital – Grey box test found SQL injection; fixed with parameterized queries.
2. E-Commerce – Black box test found weak sessions; fixed with strong tokens.
3. Banking – Internal test found plain-text admin passwords; fixed with encryption.
