Ethical Hacking Introduction

By the end of this lesson you will be able to explain what ethical hacking is, why permission is the line between a job and a crime, and how this course will take you from a blank laptop to a professional test report.

Ethical hacking sounds exciting, and it is. But it is also careful, patient and well-documented work. You will learn to think like an attacker so that you can help defenders fix problems first.

What ethical hacking means

Ethical hacking is testing the security of a system with the owner's written permission, to find weaknesses before criminals do. The formal job name is penetration testing, often shortened to pentesting. A penetration tester is the person who does it.

Think of a bank in Pune that hires a locksmith. The bank asks: "Please try to open our new vault door, and tell us how you did it." The locksmith uses the same skills a burglar would. The difference is the signed letter from the bank, the agreed date, and the report at the end. Ethical hacking is the same idea for computers.

Three things make hacking ethical:

1. Permission: the owner of the system agrees in writing before you start.
2. Scope: you test only the systems and methods the owner listed, nothing more.
3. Reporting: you tell the owner everything you found, privately, so they can fix it.

Remove any one of these and the activity is no longer ethical hacking. Without permission it is unauthorised access, which is an offence under Indian law. You will study the law closely in Ethical Hacking & Indian Law.

White, black and grey hats

You will hear people describe hackers by hat colour. The labels come from old cowboy films, where the hero wore a white hat.

Grey hat activity is still illegal. Good intentions do not create permission. If you find a problem by accident, you stop and report it through a proper channel, which you will learn in Bug Bounty & Responsible Disclosure.

What a penetration tester actually does

Films show hackers typing fast in dark rooms. Real work looks more like this:

• Reading the scope document and asking questions before touching anything.
• Running scanners and reading their output slowly and carefully.
• Testing one idea at a time, and writing down every command and result.
• Talking to the client when something looks risky or breaks.
• Writing a clear report that a developer can use to fix each problem.

Most testers say they spend as much time writing as testing. The report is the product the client pays for. A brilliant finding that nobody understands helps no one.

The tester's mindset

Developers ask, "Does my feature work?" Testers ask, "What happens if someone uses this feature in a way nobody planned?" That one question is the heart of security testing.

Here is a small example. Isha wrote a function to check a six-digit Indian PIN code for a delivery form. It works for normal input. Run it, then look at which unexpected inputs slip through.

def is_valid_pin(pin):
    return len(pin) == 6

tests = ["124001", "12400", "abcdef", "12 001", "000000", "1240011"]
for pin in tests:
    print(f"{pin!r:<11} accepted={is_valid_pin(pin)}")

'124001'    accepted=True
'12400'     accepted=False
'abcdef'    accepted=True
'12 001'    accepted=True
'000000'    accepted=True
'1240011'   accepted=False

The function only checks the length. Letters and spaces pass. A real Indian PIN code also never starts with 0. A tester's job is to think of inputs like abcdef and 000000, show that they pass, and suggest a fix. Here is the improved version:

import re

PIN_RULE = re.compile(r"[1-9][0-9]{5}")

def is_valid_pin(pin):
    return PIN_RULE.fullmatch(pin) is not None

for pin in ["124001", "abcdef", "12 001", "000000", "560001"]:
    print(f"{pin!r:<10} accepted={is_valid_pin(pin)}")

'124001'   accepted=True
'abcdef'   accepted=False
'12 001'   accepted=False
'000000'   accepted=False
'560001'   accepted=True

fullmatch makes sure the whole string follows the rule: one digit from 1 to 9, then five more digits. This habit of testing the edges, then explaining the fix, runs through the whole course.

How this course works

This is the hands-on, authorised-testing track. The Cyber Security tutorial teaches the wider defensive picture: networking, cryptography, incident response and frameworks. Here you will practise the tester's craft, step by step, only inside your own lab.

Every practical lesson uses the same small lab, which you will build in Build Your Hacking Lab:

These addresses sit on a host-only network, a private virtual network that exists only inside your computer. Nothing on it can reach the internet or your neighbours' devices. Your own addresses may differ slightly; you will learn how to check them.

The course follows the same order as a real engagement:

1. Law, permission and rules of engagement.
2. Building the lab and learning the methodology.
3. Reconnaissance and scanning with Nmap.
4. Web application testing with Burp Suite against OWASP Juice Shop.
5. Passwords, wireless, Metasploit and privilege escalation concepts.
6. Reporting, disclosure and careers, ending with a full project.

What you need before you start

• Comfort with the Linux command line. If you are new, read Linux Command Line for Security first.
• Basic networking: IP addresses, ports and HTTP. See IP Addresses, Subnets & Ports.
• Some Python. The runnable examples here use only the standard library.
• A computer with at least 8 GB of RAM (16 GB is more comfortable) and about 80 GB of free disk space.

Common mistakes

• Starting with tools instead of permission. The first step of every test is paperwork, not Nmap.
• Practising on "public" sites. A website being reachable does not mean you may test it.
• Skipping notes. If you cannot repeat a finding from your notes, you cannot report it.
• Collecting tools instead of skills. Knowing why a test works matters more than knowing fifty tools.

Key points

• Ethical hacking is security testing with written permission, a clear scope and a private report.
• Without permission, the same actions are unauthorised access and can be a crime.
• Grey hat hacking is still illegal, whatever the intention.
• A tester asks, "What happens if someone uses this in an unplanned way?", then explains the fix.
• This course uses only your own isolated lab at 192.168.56.0/24.

import re

def weak(num):
    return len(num) == 10

MOBILE = re.compile(r"[6-9][0-9]{9}")

def strong(num):
    return MOBILE.fullmatch(num) is not None

for num in ["9876543210", "0123456789", "98765 4321", "abcdefghij", "5876543210"]:
    print(f"{num!r:<14} weak={weak(num)!s:<6} strong={strong(num)}")