Basics of Ethical Hacking You Must Know

Ethical Hacking — Core Concepts:
1. Authorization first — never test without written permission.
2. Scope — know exactly which systems and domains are allowed.
3. Confidentiality — protect everything you discover.
4. Non-destructive testing — avoid damaging data or services.
5. Documentation — record every action and finding.
6. Responsible disclosure — report vulnerabilities privately.
7. Continuous learning — tools change, fundamentals stay.

Key terms:
- Vulnerability: a weakness in a system.
- Exploit: code or technique that abuses a vulnerability.
- Threat: a potential cause of harm.
- Risk: likelihood × impact of a threat.
- Payload: the action performed after exploitation.
- CVE: public identifier for a known vulnerability.

Legal & Ethical Checklist Before Testing:
☐ Do I have written authorization from the system owner?
☐ Is the exact scope (IPs, domains, apps) documented?
☐ Are testing dates and times agreed?
☐ Have I identified prohibited actions (DoS, data deletion)?
☐ Is there an emergency contact if something breaks?
☐ Am I using an isolated lab for practice?
☐ Will I report findings privately and responsibly?
☐ Have I read the relevant cyber laws?
☐ Am I avoiding public disclosure without consent?
☐ Is all data stored securely and deleted after the engagement?

Ethical Hacking — Phase Workflow:
Phase 1 — Reconnaissance:
  Passive: search engines, LinkedIn, WHOIS, DNS records
  Active: direct interaction (only with authorization)

Phase 2 — Scanning & Enumeration:
  Nmap for ports and services
  Vulnerability scanners for known issues
  Enumerate users, shares, and versions

Phase 3 — Gaining Access:
  Validate vulnerabilities in a controlled way
  Use the least invasive exploit possible
  Capture evidence (screenshots, logs)

Phase 4 — Maintaining Access:
  Test persistence only within the agreed scope
  Document how access could be retained

Phase 5 — Reporting:
  Summarize findings by risk
  Include reproduction steps and fixes
  Deliver a private report to the owner

Phase Checklist:
Reconnaissance:
☐ Is the target scope confirmed in writing?
☐ Have I collected public information only?
☐ Is the target profile documented?

Scanning:
☐ Have I scanned only authorized IPs?
☐ Are open ports and services documented?
☐ Have I identified known vulnerabilities?

Exploitation:
☐ Is the exploit non-destructive?
☐ Do I have evidence of the finding?
☐ Have I stopped after proving impact?

Reporting:
☐ Are findings rated by risk?
☐ Are fixes clearly explained?
☐ Was the report delivered privately?

Beginner Ethical Hacking Lab:
1. Use a virtual machine (VirtualBox / VMware).
2. Install Kali Linux as the attacker VM.
3. Install a deliberately vulnerable target:
   - Metasploitable 2
   - DVWA (Damn Vulnerable Web Application)
   - OWASP Juice Shop
4. Keep the lab on a host-only network — never expose it.
5. Take snapshots before testing.
6. Practice only inside this isolated lab.

Golden rule:
Never scan or test systems you do not own or have
written permission to test.

Beginner Practice Checklist:
☐ Can I navigate Linux from the terminal?
☐ Do I understand IP addresses, ports, and DNS?
☐ Can I run an Nmap scan on my lab machine?
☐ Can I identify open services and versions?
☐ Can I intercept a request with Burp Suite?
☐ Can I read a packet capture in Wireshark?
☐ Have I documented one finding with evidence?
☐ Have I written a short remediation note?

Daily Tracker:
Date: _________
☐ Morning routine completed
☐ Linux / networking study (1 hour)
☐ Hands-on lab practice (2 hours)
☐ Tool practice (Nmap / Burp / Wireshark)
☐ Read one security write-up
☐ Documented what I learned
☐ Reviewed progress
☐ Planned tomorrow

Today's Accomplishments:
1. 
2. 
3. 

Tomorrow's Priorities:
1. 
2. 
3. 

Weekly Tracker:
Week: _____ (Fundamentals / Scanning / Web / Reporting)

Goals for this week:
1. 
2. 
3. 

Daily Progress:
Mon: ☐☐☐
Tue: ☐☐☐
Wed: ☐☐☐
Thu: ☐☐☐
Fri: ☐☐☐
Sat: ☐☐☐
Sun: ☐☐☐

Weekly Wins:
1. 
2. 
3. 

Challenges & Solutions:
1. 
2. 

Next Week's Goals:
1. 
2. 
3. 

Monthly Tracker:
Month: _____ (1 / 2 / 3)

Monthly Goal:
_______________________________________________

Week 1 Progress: ☐☐☐
Week 2 Progress: ☐☐☐
Week 3 Progress: ☐☐☐
Week 4 Progress: ☐☐☐

Monthly Wins:
1. 
2. 
3. 

Skills Gained:
1. 
2. 
3. 

Lab Reports Written:
1. 
2. 
3. 

Tools Practised: _____
Write-ups Read: _____
Labs Completed: _____

Next Month's Goal:
_______________________________________________