Why Delhi NCR Is Becoming a Hub for Ethical Hacking Training

Key terms
VA   = Vulnerability Assessment: find and list weaknesses
PT   = Penetration Testing: prove impact by safely exploiting them
VAPT = both together, usually with a written report
Black box = tester has no inside information
Grey box  = tester has some access, e.g. a user login
White box = tester has full information, e.g. source code

Common engagement types
1. Web application penetration test
2. API security test
3. External network test (internet-facing hosts)
4. Internal network test (inside the office network)
5. Cloud configuration review
6. Retest after fixes

# Lab only: discover and fingerprint services on an authorised target
nmap -sn 192.168.56.0/24               # live hosts
nmap -sV -p- 192.168.56.110            # all ports, service versions
nmap --script http-title -p 80,443 192.168.56.110

Web application test checklist (lab app)
[ ] Authentication: weak passwords, lockout, session handling
[ ] Access control: can user A see user B's data?
[ ] Input handling: injection, cross-site scripting
[ ] Sensitive data: exposed in responses or URLs?
[ ] Configuration: default pages, verbose errors
[ ] Logging: are attacks visible to defenders?

# Run OWASP Juice Shop locally with Docker (safe practice target)
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Then open http://localhost:3000 in your browser

Finding: Insecure direct object reference on /api/orders/{id}
Severity: High
Affected: GET /api/orders/1043
Steps to reproduce:
  1. Log in as user A
  2. Request /api/orders/1043 (belongs to user B)
  3. Response returns user B's order details
Impact: Any user can read other users' orders
Fix: Check that the order belongs to the logged-in user on the server

Rules of engagement (lab practice)
Target: OWASP Juice Shop at localhost:3000
Testing window: Saturday 10:00-14:00
Allowed: manual testing, Burp Suite, scanners on the target
Not allowed: anything outside localhost
Data: no real personal data
Contact if something breaks: myself (lab)

Severity guide (simple)
Critical: full compromise or mass data exposure
High:     access to other users' data or admin functions
Medium:   limited data exposure or harder-to-exploit issues
Low:      information leaks with little direct impact
Info:     best-practice improvements

Report outline
1. Executive summary (non-technical, half a page)
2. Scope and approach
3. Findings summary table (title, severity, status)
4. Detailed findings (steps, impact, evidence, fix)
5. Retest results
6. Appendix: tools and timeline