Beginner · Rules first: ethics, law and permission · topic 1 of 35 · 18 min
What ethical hacking is (and is not)
Explanation
Two people, same keyboard
Imagine two people run the exact same scan against the same website. One has a signed contract from the website's owner that says "please test us". The other does not. The first person is a penetration tester doing a job. The second is committing a crime. The commands are identical. The only difference is permission.
A penetration test (pentest) is an authorised, planned attempt to break into a system so the owner learns where it is weak. "Authorised" means the owner said yes, in writing. "Planned" means both sides agreed what will be tested and how. The goal is to help the defender, not to steal or damage anything.
The words people use
| Term | Plain meaning |
|---|---|
| Vulnerability | A weakness in a system that could be misused |
| Exploit | A way (often code) to use a vulnerability |
| Threat | Someone or something that could cause harm |
| Risk | How likely harm is, and how bad it would be |
| White hat | A hacker who works with permission to defend |
| Black hat | A criminal who attacks without permission |
| Grey hat | Someone in between, often acting without permission even if not for money — still illegal |
| Red team | The attacking side in a test |
| Blue team | The defending side: SOC, admins, responders |
Why companies pay for this
Criminals attack banks, hospitals, UPI apps and government portals every day. A company would rather pay a trusted tester to find the holes first, quietly, and fix them, than read about a breach in the newspaper. So ethical hacking is a real, well-paid job: the tester is on the same side as the defenders.
The line you must never cross
A common beginner mistake: pointing a scanner at a famous website "just to see". Even a scan can be logged, reported, and treated as an offence. Another mistake: thinking that finding a bug gives you the right to keep poking. It does not. If you ever find something by accident, stop, and report it through the right channel (you will learn responsible disclosure later).
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
What ethical hacking is (and is not) · 1/7
Ethical hacking is testing a system for weaknesses with the owner's written permission.
Prefer a video by a teacher? Find free videos on “what is ethical hacking and penetration testing explained for beginners” on YouTube ↗
In real life: A bank hires a tester
A Mumbai bank is about to launch a new UPI feature. Before the launch they hire a CERT-In empanelled testing firm. The firm signs a contract, agrees exactly which test servers may be touched and during which nights, tries to break in, and hands over a report: "a login screen can be bypassed, fix it this way". The bank fixes it before customers ever see it. Nobody's money moved; the test servers were copies, not the real one.
Practice (0/3 done)
What makes a penetration test legal?
You run a port scan against a company you do not work for, "just to learn". This is…
In your own words, explain to a friend the difference between a white-hat tester and a black-hat attacker.
Quick quiz
Read more (free)
Related help
Related topics
- The law in India: IT Act 2000, sections 43 and 66Rules first: ethics, law and permission · same module
- Scope and rules of engagementRules first: ethics, law and permission · same module
- The CIA triad and the tester's mindsetRules first: ethics, law and permission · same module
- Ethics and the law: permission firstCyber Security: from zero to SOC analyst · Security basics
- Legal online platforms: TryHackMe, Hack The Box and moreYour legal practice lab
- Bug bounties and responsible disclosureBug bounties, disclosure and careers
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
A "grey hat" who finds a bug on a stranger's site without permission is…
Answer: Still acting illegally
No permission means it is illegal, whatever the intention.
The blue team in a security exercise is the…
Answer: Defenders
The blue team defends: SOC analysts, admins and incident responders.
Which is the safest place to practise your skills?
Answer: Your own deliberately vulnerable practice VM
Your own lab VMs and legal practice platforms are made for this. The others are off-limits.
What should you do if you stumble on a vulnerability by accident?
Answer: Stop and report it through the right channel
Stop, do no more, and report it responsibly. Continuing to poke is itself an offence.
You find a bug by accident on a company website. What should you do?Related
Answer: Stop, and report it privately to the owner or CERT-In
Responsible disclosure: stop, keep only what you saw, and report privately.
A tester downloads customer records "to prove the bug" during an engagement whose scope said not to touch customer data. This is…Related
Answer: Outside scope and a legal and ethical problem
Staying inside the agreed scope is mandatory; pulling data the scope forbids is both an ethical and a legal problem.
Do you need to pay to start learning on these platforms?Related
Answer: No, free tiers are enough to begin
Free tiers are plenty to get started; pay only if you want more later.
From Legal online platforms: TryHackMe, Hack The Box and more
"I was doing a bug bounty" protects you only if…Related
Answer: A programme exists and you stayed within its scope and rules
Authorisation is limited to the programme's scope and rules.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “Rules first: ethics, law and permission” before its exam: The law in India: IT Act 2000, sections 43 and 66, Scope and rules of engagement, The CIA triad and the tester's mindset.
- Module 1 exam: ethics, law and permission · 13 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Your legal practice lab. 35 topics left in the course before the final exam.