Penetration Testing

Offensive security — thinking like an attacker, legally

1:00

How authorized, simulated cyberattacks work — the methodology pipeline, scope and ethics, attacker models, team colors, and why the report is the real deliverable.

By the end, you can

Explain why authorization is the line between ethical hacking and a crime.
List the phases of the pentest pipeline in order and describe what each phase accomplishes.
Distinguish passive from active reconnaissance, and give examples of each.
Describe how a port scan classifies ports as open, closed, or filtered.
Explain the SQL injection technique shown in the lesson and name the tool categories that automate exploitation.
Trace the post-exploitation chain from foothold to crown jewels.
Compare black-box, white-box, and gray-box test types and identify when each is appropriate.
Explain the roles of red, blue, and purple teams and how they collaborate.
Distinguish a pentest from a red-team engagement.
Contrast the Cyber Kill Chain and MITRE ATT&CK and explain how defenders use each.
Describe what belongs in a pentest report and why the report — not the shell — is the real deliverable.

Up next in Information Theory, Cryptography & Security