Ethical Hacking Basics: Offense in Service of Defense

Grade 11 · Technology · Study Guide

An introduction to how authorized security professionals think and operate — covering penetration testing methodology, common attack types, and responsible disclosure.

Ethical hacking, also called penetration testing or 'white-hat' hacking, is the practice of deliberately probing a system for vulnerabilities with the explicit permission of the owner. The goal is to find weaknesses before malicious actors do, allowing them to be patched. Without permission, the exact same techniques become illegal under laws like the Computer Fraud and Abuse Act (CFAA) in the United States — consent is the defining line.

Penetration testing follows a structured methodology. The reconnaissance phase collects publicly available information about a target (IP ranges, employee names, technologies in use) using tools like WHOIS lookups, Shodan, and Google dorking. The scanning phase uses tools like Nmap to discover open ports and running services. Exploitation attempts to leverage discovered vulnerabilities to gain unauthorized access, using frameworks like Metasploit. Post-exploitation explores what an attacker could do after gaining a foothold — escalating privileges, moving laterally, exfiltrating data. The final phase is reporting: documenting every finding with severity ratings, evidence, and remediation recommendations.

Common attack categories include SQL injection (inserting malicious SQL into input fields to manipulate databases), cross-site scripting (XSS, injecting scripts into web pages viewed by other users), phishing (social engineering via fraudulent communications), buffer overflow (writing past a buffer's boundary to corrupt adjacent memory), and man-in-the-middle (intercepting communications between two parties). Understanding how these attacks work is essential both for executing and for defending against them.

Responsible disclosure is the ethical framework for reporting vulnerabilities. A researcher who discovers a flaw typically notifies the affected organization privately and gives them a reasonable window (often 90 days) to patch before publicly disclosing. Bug bounty programs formalize this relationship, offering monetary rewards for valid, responsibly reported vulnerabilities.

Key terms

Penetration Testing: An authorized simulated cyberattack on a system to identify exploitable vulnerabilities.
Reconnaissance: The information-gathering phase of a pentest, collecting data about the target from open sources.
SQL Injection: An attack that inserts malicious SQL code into an input field to manipulate or extract database data.
Cross-Site Scripting (XSS): An attack that injects malicious scripts into web pages viewed by other users.
Buffer Overflow: Writing data beyond a buffer's allocated size to corrupt adjacent memory, potentially hijacking program control.
Exploit: Code or a technique that takes advantage of a vulnerability to gain unauthorized access or cause unintended behavior.
Social Engineering: Manipulating people into divulging confidential information or performing actions that compromise security.
Responsible Disclosure: The practice of privately notifying a vendor about a vulnerability before making it public, giving time to patch.
Bug Bounty: A program offering rewards to security researchers for responsibly reporting valid vulnerabilities.
Man-in-the-Middle (MitM): An attack where a third party secretly intercepts and potentially alters communications between two parties.

Flashcards

Ethical hacking: Authorized penetration testing to find vulnerabilities before malicious actors do.
White-hat hacker: A security professional who uses offensive techniques legally and ethically with owner permission.
Black-hat hacker: A malicious actor who exploits systems without permission for personal gain.
Reconnaissance: Open-source intelligence gathering about a target before active testing begins.
Scanning: Using tools (Nmap, etc.) to discover open ports, services, and potential entry points.
Exploitation: Leveraging a vulnerability to gain unauthorized access or control.
SQL Injection: Inserting malicious SQL into input fields to manipulate a backend database.
XSS (Cross-Site Scripting): Injecting malicious scripts into pages served to other users' browsers.
Buffer overflow: Writing beyond allocated memory to corrupt adjacent data or inject shellcode.
Phishing: Deceptive communications designed to trick users into revealing credentials or clicking malicious links.
Responsible disclosure: Privately notifying a vendor of a vulnerability with a remediation deadline before public release.
Bug bounty: A formal program rewarding researchers for valid, responsibly reported security findings.

Questions

What is the key legal distinction that separates ethical hacking from criminal hacking?
1. The tools used
2. Written authorization from the system owner
3. The skill level of the hacker
4. Whether any data is accessed
Show answer
Answer: Written authorization from the system owner
Written authorization (scope agreement / rules of engagement) from the system owner is what makes the same techniques legal; without it, the activity is criminal under laws like the CFAA.
Which phase of penetration testing involves using Nmap to discover open ports and running services?
1. Reconnaissance
2. Scanning
3. Exploitation
4. Reporting
Show answer
Answer: Scanning
The scanning phase uses tools like Nmap to probe discovered hosts for open ports and service versions, building a detailed attack surface map.
Injecting malicious SQL into a web form to extract or manipulate database records is called ________.
Show answer
Answer: SQL injection
SQL injection exploits insufficient input validation — by inserting SQL syntax into a form field, an attacker can query, modify, or delete database records.
Responsible disclosure means a security researcher may publish a vulnerability immediately without notifying the vendor.
Show answer
Answer: False
Responsible disclosure requires privately notifying the vendor first and allowing a reasonable window (commonly 90 days) to release a patch before any public disclosure.
Which attack type manipulates a user psychologically rather than exploiting software code directly?
1. Buffer overflow
2. SQL injection
3. Social engineering
4. Cross-site scripting
Show answer
Answer: Social engineering
Social engineering targets the human element — tricking people through deception, impersonation, or urgency — rather than exploiting technical flaws in software.

Get a personalized course on Ethical Hacking Basics built around your child.