What is Penetration Testing?

After this lesson, you will be able to: Understand ethical hacking, the engagement types, and the legal frame.

Pen testing is authorized attack, emulating a real adversary to find weaknesses *before* one does. Authorization is what separates this from a crime. This lesson covers the engagement types, the legal contracts, and the mindset shift.

Black, white, gray box

Black box, tester knows nothing (most realistic, slow). White box, tester has source code, creds, architecture (efficient, less realistic). Gray box, somewhere between (most common in practice).

Pen test phases

1
1. Reconnaissance, passive + active info gathering.
2
2. Scanning & Enumeration, find services, versions.
3
3. Exploitation, gain initial access.
4
4. Post-Exploitation, privilege escalation, lateral movement.
5
5. Reporting, what you found, how to fix it.

Pentester vs Red Teamer

Pen tester: scoped technical assessment of one app/network. Red Teamer: full-spectrum simulation including social engineering, physical, prolonged. Different jobs.

←Ethics and the Law (Mandatory First)

Back to Penetration Testing

Reconnaissance and Information Gathering→