Ethical Hacking Skills That Recruiters Look For in 2026

# Count failed SSH login attempts by source IP in your own server's log
import re
from collections import Counter

pattern = re.compile(r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)")
counts = Counter()

with open("/var/log/auth.log") as f:    # Debian/Ubuntu path
    for line in f:
        m = pattern.search(line)
        if m:
            counts[m.group(1)] += 1

for ip, n in counts.most_common(10):
    print(f"{ip:15s} {n}")

# Which ports are listening on YOUR machine?
sudo ss -tulpn

# Which users can log in with a shell?
grep -E "/bin/(bash|sh|zsh)$" /etc/passwd

# Find files with the SUID bit set (review for hardening)
sudo find / -perm -4000 -type f 2>/dev/null

# Recent authentication events
sudo tail -n 50 /var/log/auth.log

# ONLY scan machines you own or are explicitly authorised to test.

# Discover live hosts on your private lab network
nmap -sn 192.168.56.0/24

# Check common ports and service versions on a lab VM
nmap -sV -p 1-1000 192.168.56.101

# Save results for your report
nmap -sV 192.168.56.101 -oN lab-vm-scan.txt

# Vulnerable: user input concatenated into SQL (injection risk)
# cursor.execute("SELECT * FROM users WHERE email = '" + email + "'")

# Fixed: parameterised query - the driver handles escaping
import sqlite3

conn = sqlite3.connect("app.db")
cursor = conn.cursor()
email = input("Email: ")
cursor.execute("SELECT id, name FROM users WHERE email = ?", (email,))
print(cursor.fetchone())

Finding ID: LAB-03
Title: SQL injection in login form (practice app)
Risk: High
Affected: /login (lab environment only)

Description:
User input is placed directly into a database query.

Impact:
An attacker could read or change data they should not access.

Evidence:
Screenshots and request/response from the lab.

Recommendation:
Use parameterised queries, validate input,
and apply least-privilege database accounts.

References: OWASP guidance on injection

Rules of engagement (lab or authorised test)

In scope:     192.168.56.101, practice web app on port 8080
Out of scope: everything else, including my home router
Allowed:      scanning, manual web testing
Not allowed:  denial of service, social engineering
Time window:  ________
Authorised by: ________ (written permission on file)
Contact if something breaks: ________

Skill                | Proof                                   | Link
---------------------|-----------------------------------------|------
Networking           | Annotated Wireshark capture of own traffic |
Linux                | Hardening checklist applied to a VM      |
Scripting            | Log analysis script on GitHub            |
Web security         | 3 lab write-ups (practice apps)          |
Reporting            | Sample pentest-style report (lab)        |
Certification        | Name + status                            |

Lab: ____________________ (platform / practice app)
Date: ________
Goal: __________________

Approach:
1. Reconnaissance
2. Finding
3. Verification

What I learned:
________________
How to fix it:
________________
Note: published only where the platform allows write-ups.

Example resume lines (use your real work):

- Built a home security lab with Linux and Windows VMs
  to practise network and web security testing
- Wrote lab write-ups covering OWASP Top 10 risks with
  remediation advice
- Automated failed-login analysis with a Python script