Ethical Hacking and Penetration Testing (legal labs)

Before any tool, learn the one rule that keeps hacking legal: get clear written permission, and stay inside the agreed scope. After this module you can explain the law in India, write a simple rules-of-engagement note, and tell a legal test from a crime.

1. What ethical hacking is (and is not)Ethical hacking means testing a system for weaknesses WITH the owner's permission, to help them fix the holes before a criminal finds them. The same action without permission is a crime. The skill is the same; the permission is what makes it legal.18 min
2. The law in India: IT Act 2000, sections 43 and 66In India, unauthorised access to a computer is against the law under the Information Technology Act, 2000. Section 43 makes you pay for the damage (civil); section 66 can mean jail (criminal). Written permission is your defence. Know the law before you touch any system.20 min
3. Scope and rules of engagementRules of engagement (RoE) are the written agreement that says exactly what you may test, when, how hard, and what is off-limits. Scope is the list of systems you are allowed to touch. A good test never goes outside the scope, even when something tempting is just one step away.20 min
4. The CIA triad and the tester's mindsetSecurity protects three things: Confidentiality (only the right people see data), Integrity (data is not changed secretly), and Availability (the system is up when needed). A tester thinks about how each one could be broken — and then how the defender would stop and spot it.16 min

Build a safe place to practise where nothing you do can reach a real, outside system. After this module you can set up VirtualBox with Kali, add vulnerable targets like Metasploitable, DVWA and Juice Shop, use a host-only network, and know the legal online platforms for practice.

1. Why you need an isolated labA lab is a set of computers that exist only to be practised on, kept separate from the real internet and from your home network. You attack machines you own, on a private network, so nothing can leak out. This is how you learn attacks legally and safely.16 min
2. Kali Linux: the attacker machineKali Linux is a free Linux distribution made for security testing. It comes with hundreds of tools already installed, such as nmap, Burp Suite and Metasploit. You run it as a VM and drive it from the terminal. Learning a few basic commands is enough to start.18 min
3. Vulnerable targets: Metasploitable, DVWA and Juice ShopYou need safe things to attack. Metasploitable is a Linux machine deliberately full of old, weak services. DVWA and OWASP Juice Shop are web apps built to be broken, with lessons for each flaw. All are free, legal to attack in your own lab, and must stay offline.18 min
4. Legal online platforms: TryHackMe, Hack The Box and moreBesides your own lab, there are websites built for legal practice: TryHackMe, Hack The Box, the PortSwigger Web Security Academy and OverTheWire. They give you targets you are allowed to attack, with guided lessons. They are the right place to stretch your skills beyond your home VMs.15 min

A test follows a repeatable method, not random poking. After this module you can describe the PTES phases and OWASP WSTG, and carry out passive and active reconnaissance (gathering information) on an authorised target, and explain how a defender would notice it.

1. A repeatable method: PTES and OWASP WSTGProfessionals follow a standard set of phases so nothing is missed and reports are consistent. PTES describes the phases of a penetration test; the OWASP Web Security Testing Guide (WSTG) is a detailed checklist for web apps. Following a method is what separates a professional from a script-kiddie.16 min
2. Passive reconnaissance (OSINT)Passive reconnaissance means learning about a target without touching its systems — only from public sources. This is also called OSINT (open-source intelligence). Because you never contact the target directly, it is quiet, but you must still stay within the engagement's rules and the law.18 min
3. Active reconnaissanceActive reconnaissance means touching the target directly to learn about it: pinging it, looking at its web pages, checking which services answer. Because you contact the target, it can be logged, so you only do it on authorised, in-scope systems. It bridges recon and scanning.18 min

Scanning finds which hosts are up, which ports are open, and what services and versions run behind them. After this module you can use nmap's common scan types, service and OS detection and the basics of its scripts — on authorised targets — and explain how a defender spots and limits scanning.

1. Ports, services and what scanning doesA port is a numbered door on a machine where a service listens, such as 80 for web or 22 for SSH. Scanning asks each door whether it is open. Knowing which services are open and which versions they run tells a tester what to examine next.16 min
2. nmap scan typesnmap is the standard tool for scanning. It can discover hosts, scan ports in different ways, and work quickly or quietly. The common scan types are the TCP connect scan and the SYN ("half-open") scan. You pick ports, speed and output format with simple flags.20 min
3. Service, version and OS detection, and NSEnmap can go beyond open/closed: -sV finds the service and version on each port, -O guesses the operating system, and the Nmap Scripting Engine (NSE) runs small scripts for extra checks. These turn a port list into a detailed picture — and into a to-do list for the defender too.20 min

Enumeration digs deeper into the services you found; vulnerability assessment decides which weaknesses are real and how serious they are. After this module you can enumerate common services, read CVE and CVSS information, and explain how scanners like OpenVAS and Nessus fit in — and their limits.

1. Enumeration: digging into servicesEnumeration is the careful, deeper look at a service after scanning: listing users, shares, directories, software details and configuration. It turns "port 80 is open" into "this web app has an admin login and a /backup folder". It is still information gathering, done only on authorised targets.18 min
2. CVE and CVSS: naming and scoring weaknessesA CVE is a public, unique ID for a specific known vulnerability, like CVE-2021-44228. CVSS is a score from 0 to 10 that rates how severe a vulnerability is. Together they let the whole industry talk about the same flaw and agree how urgent it is.18 min
3. Vulnerability scanners: OpenVAS and Nessus (concepts)A vulnerability scanner automatically checks a target against a huge list of known issues and reports what it finds, with CVSS scores. OpenVAS (open-source) and Nessus (commercial) are common examples. They save time, but they produce false positives, so a human must verify every finding.16 min

Web apps are where most testing happens. After this module you understand how HTTP requests and responses work, how a proxy like Burp Suite lets you see and change them, and the overall OWASP approach — ready for the detailed web attacks and fixes in the next module.

1. How web requests work (and why that matters)Every web action is a request from the browser and a response from the server. A request has a method (GET, POST), a path, headers and sometimes a body. Understanding this exchange is the foundation of all web testing: attacks work by changing the request.18 min
2. Burp Suite basics: the intercepting proxyBurp Suite sits between your browser and the web app as a proxy, so you can see and change every request before it reaches the server. Its Proxy, Repeater and Intruder tools are the core of web testing. The free Community edition is enough to learn.20 min
3. The OWASP approach to web testingOWASP gives free, trusted guidance for web security: the Top 10 (the most common risks) and the Web Security Testing Guide (how to test each area). Using them makes your testing thorough and your findings credible, because they map to a standard everyone recognises.16 min

The common web vulnerabilities, each explained with how it works, how a defender detects it, and exactly how to fix it. After this module you can recognise SQL injection, XSS, CSRF, IDOR, SSRF and authentication flaws in a lab, and write the remediation a developer would apply.

1. SQL injection (SQLi)SQL injection happens when user input is put straight into a database query, so the input can change the query's meaning. The fix is always the same idea: never mix user input into query text; use parameterised queries so input is treated as data, not code.22 min
2. Cross-site scripting (XSS)XSS happens when a web page shows user input without making it safe, so an attacker's script runs in another user's browser. The fix is to treat all output as text: escape or encode it for the place it appears, and set a Content Security Policy.22 min
3. CSRF and IDORCSRF tricks a logged-in user's browser into making a request they did not intend; the fix is anti-CSRF tokens and SameSite cookies. IDOR lets a user reach another user's data by changing an ID; the fix is to check ownership on the server for every request.20 min
4. SSRF and authentication flawsSSRF tricks the server into fetching a URL the attacker chooses, sometimes reaching internal systems; the fix is to allow only known destinations. Authentication flaws are weak logins — no rate limit, weak passwords, poor sessions; the fixes are rate limiting, strong hashing, and solid session handling.20 min

Concepts and lab-only skills for the later stages of a test, each paired with its defence. After this module you understand password hashing and cracking (on your own hashes), privilege-escalation ideas, what Metasploit does in a lab, and wireless security basics — and how defenders stop each one.

1. Password hashing and cracking (your own hashes only)Systems should store passwords as hashes, not plain text. "Cracking" means guessing the original password that produced a hash, by hashing many guesses and comparing. You practise only on hashes you created yourself, to understand why slow hashing and strong passwords matter.20 min
2. Privilege escalation concepts (labs only)Privilege escalation is turning limited access into higher access — for example, a normal user becoming administrator. You study the common causes (misconfigurations, excessive permissions, old software) and, crucially, how defenders prevent and detect them. All practice is on your own lab machines.18 min
3. Metasploit basics (in the lab)Metasploit is a framework that organises known exploits and payloads so testers can safely verify a vulnerability. You learn what it is and its main parts — modules, options, payloads — and use it only against your own lab targets like Metasploitable, with the defence in mind.18 min
4. Wireless security conceptsWi-Fi security has improved from the broken WEP to WPA2 and WPA3. You learn why old encryption is unsafe, what makes a network strong, and the common attacks in concept — and you only ever test your own network. The defences are strong encryption, strong passphrases and up-to-date equipment.16 min

The most valuable part of a test is the write-up. After this module you understand the ethics of what to do once you are "in", and how to write a professional report: an executive summary, clear findings with CVSS and evidence, and practical remediation the client can act on.

1. Post-exploitation ethics: what to do once you are inGetting access is not the goal; proving and reporting the risk is. Once in, you do the minimum needed to demonstrate impact, touch no more data than necessary, change nothing, and keep careful notes. The rules of engagement and the law still apply at every step.16 min
2. The structure of a penetration test reportA report has two audiences: managers who need the big picture, and technical staff who need the detail. So it has an executive summary, then detailed findings with evidence, CVSS and remediation. A clear report is what the client actually pays for.20 min
3. Writing findings that get fixedA finding only helps if it is understood and acted on. Good findings are specific, reproducible, honest about severity, and lead with the fix. You write for the person who has to repair the issue, not to show off. This skill, more than any tool, defines a professional.16 min

How to use these skills to earn and build a career, legally. After this module you understand bug-bounty programmes and their rules, responsible disclosure and India's CERT-In, the main certification paths (eJPT, CEH, PNPT, OSCP), and how to build a portfolio and get hired.

1. Bug bounties and responsible disclosureA bug-bounty programme is a company's public invitation to find and report flaws, within strict rules, sometimes for a reward. Platforms like HackerOne and Bugcrowd host them. Responsible disclosure means reporting a flaw privately and giving the owner time to fix it before any public mention.18 min
2. India: CERT-In and the legal landscapeCERT-In is India's national computer emergency response team. It handles incident reporting and coordinates responses, and has rules organisations must follow. As a tester in India, you report flaws responsibly, know the IT Act, and handle personal data under the DPDP Act, 2023.16 min
3. Certification paths: eJPT, CEH, PNPT, OSCPCertifications prove your skills to employers. For penetration testing, a common ladder is eJPT (entry, hands-on), CEH (broad, well known to HR), PNPT (practical with a report), and OSCP (hard, hands-on, highly respected). Always check the current exam details on the official site.18 min
4. Building a portfolio and getting hiredEmployers hire proof, not promises. Build a portfolio from legal labs and bug bounties: clear write-ups of flaws you found and fixed, a blog or GitHub, and a tidy CV. Pair it with the ethics and reporting habits from this course, and you are ready to apply for junior roles.16 min