Master Ethical Hacking Methodology

This skill covers the complete penetration testing lifecycle from reconnaissance through reporting for authorized security assessments, covering the stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting. Prerequisites: Kali Linux (persistent or live), network access to authorized targets, and written authorization from the system owner, plus baseline networking, Linux CLI, web technology, and security knowledge.

Its core workflow runs ten phases. Phase 1 classifies security professionals (white hat/ethical hackers working with authorization to fix vulnerabilities; black hat/malicious actors conducting unauthorized intrusions; grey hat hybrids who may cross ethical boundaries without malicious intent; plus script kiddies, hacktivists, nation-state operatives, and coders). Phase 2 (Reconnaissance) gathers information without direct system interaction via passive techniques (WHOIS lookups, DNS enumeration, subdomain discovery via dnsrecon, email harvesting via theHarvester), Google hacking/OSINT (finding exposed files, login pages, directory listings, and config files via targeted search operators), and social media reconnaissance (LinkedIn org charts, job postings revealing tech stack). Phase 3 (Scanning) covers host discovery (ping sweep, ARP scan), Nmap port scanning (SYN scan, full connect, UDP, top-1000-with-service-detection, aggressive OS/version/script scanning), and vulnerability scanning. Phase 4 (Vulnerability Analysis) uses Nikto, OpenVAS, and Nessus alongside directory brute forcing, subdomain enumeration, and web technology fingerprinting.

Phase 5 (Exploitation) covers Metasploit workflow (search, select exploit, set target/payload, execute), Hydra brute forcing, John the Ripper password cracking, SQLMap for SQL injection, manual XSS testing, and command injection testing. Phase 6 (Maintaining Access) covers Meterpreter persistence, SSH key persistence, cron job persistence, and post-exploitation enumeration (Linux/Windows enumeration, SUID binary checks, sudo permission checks). Phase 7 covers professional reporting. Phase 8 catalogs common attack types. Phase 9 covers Kali Linux USB setup with a persistence partition. Phase 10 (Ethical Guidelines) states the legal requirements explicitly: obtain written authorization, define scope clearly, document all testing activities, report all findings to the client, and maintain confidentiality - plus professional conduct standards (work with integrity, respect data privacy, avoid unnecessary system damage, execute only planned tests, never use findings for personal gain).

Its quick reference summarizes the penetration testing lifecycle (Reconnaissance -> Scanning -> Exploitation -> Maintaining Access -> Reporting) with key tools per stage (theHarvester/WHOIS/Google; Nmap/Nikto/Gobuster; Metasploit/SQLMap/Hydra; Meterpreter/SSH keys; report templates) and essential commands. Its constraints and limitations section is explicit: never test without written permission, stay within the defined scope, and report unauthorized access attempts if discovered; follow rules of engagement, maintain client confidentiality, document methodology, and provide actionable recommendations. Its troubleshooting section covers scans being blocked (slower rates, alternative techniques, proxy/VPN, packet fragmentation) and failing exploits (verify the vulnerability exists, check payload compatibility, adjust parameters, try alternatives).

# WHOIS lookup
whois target.com

# DNS enumeration
nslookup target.com
dig target.com ANY

# Subdomain discovery
dnsrecon -d target.com

# Email harvesting
theHarvester -d target.com -b all

Use this skill only for authorized penetration testing engagements with written authorization from the system owner - working through reconnaissance, scanning, exploitation, persistence testing, and professional reporting within a defined scope.

Never use this skill to test systems without written permission, exceed the defined scope, or retain findings for personal gain. All testing activity must be documented and confidentiality maintained.

Inputs: an authorized target scope with written permission and defined rules of engagement.

Outputs: a reconnaissance report, a vulnerability assessment, exploitation proof-of-concept evidence, and a final executive/technical report with actionable remediation recommendations.

Kali Linux, WHOIS, dnsrecon, theHarvester, Nmap, Nikto, OpenVAS, Nessus, Gobuster, Metasploit, Hydra, John the Ripper, SQLMap, Meterpreter.

Security professionals conducting authorized penetration tests who need the complete methodology from reconnaissance through professional reporting, with explicit legal and ethical guardrails.