Introduction and Methodology

This page covers the course introduction: what hacking is, the kinds of hackers, the core security vocabulary, two attack-modelling frameworks (Cyber Kill Chain and MITRE ATT&CK), and the methodology and phases of a penetration test.

What is hackingSearch on YouTubeBookmarkSaved

Hacking is compromising digital devices and networks through unauthorized access to an account or computer system. It is not always malicious, but it is most often linked to illegal activity and data theft. In security, hacking means misusing devices and networks to:

• damage or corrupt systems,
• gather information on users,
• steal data and documents, or
• disrupt data-related activity.

Real attackers are methodical. Before any exploit runs they study the target (technology stack, employees, public footprint), observe patterns (who logs in, what software is used, where the gaps are), probe boundaries with small low-noise checks, and wait patiently for the right moment. The mindset behind a breach is curiosity, patience, creativity and persistence.

Types of hackersSearch on YouTubeBookmarkSaved

Red team and blue teamSearch on YouTubeBookmarkSaved

• Blue team — the defenders. They run vulnerability assessments and security audits on company assets, identify weaknesses, and test the effectiveness of security controls. Their goal is to defend against attacks and prevent future ones.
• Red team — the offensive team. They simulate attacks on the organisation's assets to test the overall security posture and find exploitable weaknesses.

Core security vocabularySearch on YouTubeBookmarkSaved

Case study: Emotet malware (2014)Search on YouTubeBookmarkSaved

Emotet was a Windows malware that began in 2014 as a banking Trojan and evolved into modular malware (a malware loader). Its job was to break in, stay hidden and open the door for other malware.

Infection flow:

1. Arrives by a malicious script, macro-enabled document (Excel/Word) or link in an email attachment.
2. Obfuscated macro code launches PowerShell.
3. PowerShell downloads Emotet from compromised sites.
4. Once installed, it spreads laterally to other endpoints, steals credentials from installed applications, and spams the user's contact list.

Because the spam comes from a hijacked, trusted account, recipients feel safe and are more likely to click. After gaining control, Emotet downloaded other malware: TrickBot (steals credentials, maps the network), QakBot (lateral movement), and Ryuk / Conti (ransomware).

Cyber Kill ChainSearch on YouTubeBookmarkSaved

Every successful cyber attack follows a sequence of steps. If we understand the steps, we can detect, disrupt or stop attacks early. The Cyber Kill Chain, developed by Lockheed Martin, describes the 7 stages of an attack from planning to data exfiltration.

Mapping Emotet to the kill chainSearch on YouTubeBookmarkSaved

MITRE ATT&CK frameworkSearch on YouTubeBookmarkSaved

The kill chain is a bird's-eye view. To zoom in on exact behaviours, use the MITRE ATT&CK framework (Adversarial Tactics, Techniques, and Common Knowledge). It is a globally accessible knowledge base of adversary tactics and techniques based on real-world threats and threat actors. It is more granular than the kill chain, organised as Tactics to Techniques to Procedures (TTPs).

Threat actors and APTsSearch on YouTubeBookmarkSaved

Threat actors are individuals, groups or organisations that deliberately harm digital systems. Researchers track them over time and assign group names:

• APT1 (China) — targeted US companies for trade secrets.
• APT28 (Russia) — linked to election interference.
• APT29 (Russia) — behind the SolarWinds hack.
• APT3 (China) — known for spearphishing and privilege escalation.

APT means Advanced Persistent Threat: Advanced (sophisticated tools like zero-days and custom malware), Persistent (stays in the system for months or years, avoiding detection), Threat (intent and capability to cause serious damage).

Emulation vs simulationSearch on YouTubeBookmarkSaved

• Adversary emulation — realistically recreate a known threat actor's TTPs (e.g. APT29's TTPs from ATT&CK). It follows a step-by-step chain of what the real attacker did, is highly structured and repeatable, and tests defences against known attacks.
• Adversary simulation — test how an attacker might break in, known or unknown.

Red and blue teams share ATT&CK as a common language: the cyber-threat-intel team says "this is what the actor does", the blue team checks "can we detect that?", and the red team emulates it with the ATT&CK Navigator (export highlighted techniques as a JSON layer).

Ethical hacking vs penetration testingSearch on YouTubeBookmarkSaved

Ethical hacking is the authorized practice of testing and evaluating the security of systems, networks or applications to find vulnerabilities before malicious hackers exploit them. Ethical hackers use the same tools and techniques as attackers, but with permission. They are also called white hat hackers.

Prerequisite skills: strong networking (TCP/IP, OSI model, protocols), proficiency in Windows and Linux, programming (Python, C++, Bash), and security basics (cryptography, core principles).

What penetration testing isSearch on YouTubeBookmarkSaved

Penetration testing simulates an attack on a network or system to evaluate its security posture and find exploitable vulnerabilities. Results are documented. It requires written permission and authorization from management, including scope and time frame.

Methodologies (open-source):

1. OSSTMM — Open Source Security Testing Methodology Manual.
2. OWASP — Open Web Application Security Project.
3. NIST Framework.

Approaches and typesSearch on YouTubeBookmarkSaved

Approaches: black box (no prior knowledge), white box (full knowledge), grey box (partial knowledge).

Types of penetration test:

• Network — tests a network environment for vulnerabilities. External (internet-facing, from an outside attacker's view) and internal (attacker already inside; measures damage after initial access). May need VPN access or a physical visit.
• Web application — very common since apps hold critical data (credit cards, credentials).
• Mobile application — newest type; tests Android/iOS apps that serve customers.
• Social engineering — evaluates people, not technology; measures how susceptible staff are to manipulation.

Phases of a penetration testSearch on YouTubeBookmarkSaved

0. Pre-engagementSearch on YouTubeBookmarkSaved

Define the Rules of Engagement (RoE) and goals: identify scope, timeline and target systems; choose the testing approach (black/white/grey box); get written authorization; discuss legal and compliance boundaries.

The RoE defines how the test is laid out and must be mutually agreed. Almost every RoE includes a signed "permission to hack" and non-disclosure agreement, the scope and parts to be tested, the project duration (start and end dates), the methodology, the goals, the allowed and disallowed techniques (e.g. whether DoS testing is permitted), and the liabilities and responsibilities.

1. ReconnaissanceSearch on YouTubeBookmarkSaved

Gather intelligence about the target — the longest phase.

2. Scanning and enumerationSearch on YouTubeBookmarkSaved

Explore live hosts, open ports, services and system info; identify vulnerabilities to exploit. Port scanning discovers open ports and running services. Scanning tools: Nessus, OpenVAS, Nikto.

3. Gaining access / exploitationSearch on YouTubeBookmarkSaved

Exploit the weaknesses found:

• Password attacks — Hashcat, John the Ripper, Hydra.
• Web exploitation — SQLmap, XSSer, Burp Suite.
• Social engineering — SET Toolkit, GoPhish.
• Metasploit — msfconsole, Meterpreter.

4. Post-exploitationSearch on YouTubeBookmarkSaved

• Privilege escalation — elevate from user to root/admin.
• Persistence — maintain access across reboots (backdoors, cron jobs).
• Lateral movement — move from system to system in the network.
• Data exfiltration — simulate stealing sensitive data (limited to scope).
• Pivoting — use a compromised host to attack internal segments.
• Covering tracks — clear logs, hide artifacts, test detection capabilities.

5. ReportingSearch on YouTubeBookmarkSaved

Document the process, findings and vulnerabilities; create a comprehensive report for the client; offer actionable remediation suggestions. The report is the deliverable the client pays for.

Quick self-testSearch on YouTubeBookmarkSaved

Who developed the Cyber Kill Chain and how many stages does it have?

Lockheed Martin. It has 7 stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives.

Define vulnerability, threat and risk, and relate them.

A vulnerability is a weakness that can be exploited. A threat is a potential danger that could exploit that weakness. Risk is the potential loss or damage when a vulnerability is exploited.

What does TTP stand for in MITRE ATT&CK, and what does each level describe?

Tactics, Techniques, Procedures. Tactic = the goal (the why), Technique = how the goal is achieved (the how), Procedure = the specific implementation a threat actor uses.

How does MITRE ATT&CK let defenders zoom in beyond the Cyber Kill Chain?

The kill chain gives a high-level 7-stage view. ATT&CK is a granular knowledge base of real adversary behaviours, so defenders move from "an attack is happening" to "this exact technique is used, here is how to detect and mitigate it".

Difference between adversary emulation and adversary simulation?

Emulation recreates a known threat actor's documented TTPs step by step (structured, repeatable). Simulation tests how an attacker in general might break in, known or unknown.

What does APT stand for and what makes a threat "advanced" and "persistent"?

Advanced Persistent Threat. Advanced = sophisticated tools (zero-days, custom malware). Persistent = stays hidden in the system for months or years. Threat = intent and capability to cause serious damage.

List the three open-source penetration testing methodologies.

OSSTMM (Open Source Security Testing Methodology Manual), OWASP (Open Web Application Security Project), and the NIST framework.

What is the difference between an external and an internal network penetration test?

External tests the internet-facing infrastructure from an outside attacker's view. Internal assumes the attacker is already inside the network and measures how much damage they can do after initial access.

Why must a penetration test always have written authorization, and what document defines it?

Because unauthorized access is illegal and the tester may break things or reach sensitive data; liabilities must be agreed beforehand. The Rules of Engagement (RoE) define scope, timeline, methodology, allowed/disallowed techniques and liabilities, with a signed "permission to hack" and NDA.

Name the five main phases of a penetration test in order.

Reconnaissance, Scanning & Enumeration, Gaining Access (Exploitation), Post-Exploitation, Reporting (preceded by a pre-engagement/scoping step).