Penetration Testing — Ethical Hacking

What you'll learn

• What a penetration test is (and how it's legal)
• The 5 phases every pentest follows
• The mindset: think like an attacker to defend better
• How this becomes a well-paid career

⚠️ The line that matters: a pentester has written permission to attack a system. Without it, the exact same actions are a serious crime. Ethics and authorization are the whole profession.

Hiring a burglar to test your locks 🔓

Companies pay ethical hackers (penetration testers) to break into their own systems on purpose, then report every hole so it can be fixed before a real criminal finds it. It's like hiring a professional burglar to test your locks — with a signed contract.

Every engagement follows 5 phases:

1. Reconnaissance — gather intel on the target. Public info, employee names, exposed servers. (Passive: looking without touching.)
2. Scanning — actively probe: which ports are open? what software and versions run? Tools like Nmap map the attack surface.
3. Gaining Access — exploit a weakness found in scanning to get in (a vulnerable app, a weak password, a known bug).
4. Maintaining Access — can an attacker stay hidden and keep the foothold? This shows the real-world impact.
5. Reporting — the most important phase. Document every finding, its risk, and exactly how to fix it. The report is the product the client pays for.

The key insight: offense teaches defense. Once you've seen how easily a weak password or an unpatched server gets exploited, you defend far more effectively. That's why many blue-team (defensive) pros learn red-team (offensive) skills.

Getting started legally and free: platforms like TryHackMe, Hack The Box, and PortSwigger Web Security Academy give you deliberately vulnerable machines to practice on — no risk, huge learning. Certifications like CompTIA PenTest+ and OSCP open doors to paid roles.

Scoring how bad a vulnerability really is: CVSS 📊

A pentest report can list dozens of findings. Which one gets fixed first? The industry standard answer is CVSS (Common Vulnerability Scoring System) — a score from 0 to 10 that turns "this looks bad" into a number a manager can prioritize against a deadline.

Rough bands used across the industry:

• 0.0 – 3.9 → Low
• 4.0 – 6.9 → Medium
• 7.0 – 8.9 → High
• 9.0 – 10.0 → Critical

A Critical finding (like a remote attacker gaining full server control with zero authentication) gets patched within hours. A Low finding (like a missing security header) might sit in the backlog for months. This is exactly why Reporting is the deliverable — a list of holes without severity scoring just overwhelms the client; a scored, prioritized list gets acted on.

Real-world case study: Equifax (2017) 🔍

Equifax, one of the three major US credit bureaus, was running Apache Struts with a known vulnerability (CVE-2017-5638) that let attackers remotely execute code on the server. A patch for it had already been released — two months before the breach.

The vulnerability was never fixed on that server. Attackers found and exploited it, exfiltrating personal data — names, SSNs, birth dates, addresses — on ~147 million people. It remains one of the costliest breaches in history (over $1.4 billion in cleanup and settlement costs).

This is precisely the gap penetration testing and vulnerability scanning exist to close: a scored, prioritized finding ("Critical: unpatched Struts CVE, remote code execution") sitting in a report is only useful if someone acts on it before an attacker does.

Track complete! 🎓

You've built a full security foundation:

• Computers, networking, and Linux — the terrain
• Python — your automation weapon
• Security basics, web attacks, SOC defense, and ethical pentesting
• You built classifiers for brute-force severity, CVSS scoring, and CSRF-token validation — the real logic behind triage tools
• Case studies from Dyn, WannaCry, TalkTalk, Target, and Equifax show exactly what these skills prevent

Your path to paid work: pick a side — defense (SOC Analyst) or offense (Pentester) — and go deep on TryHackMe/Hack The Box. Get a cert (Security+ to start, then PenTest+ or a SOC cert), build a GitHub of your scripts and writeups, and you're job-ready. Stay ethical, stay curious.