⏱️ 45 Mins Foundational

Lab 01: Security Concepts & Web Prerequisites

Establish foundational security concepts, threat actor models, and target visibility methodologies. Master the 5 testing phases, network transport primitives, HTTP request/response headers, and browser DevTools interception workflows.

1. Fundamental Security Concepts

Ethical Hacking is the authorized simulation of cyberattacks to discover and remediate security vulnerabilities before malicious threat actors can exploit them.

📋 Vulnerability Assessment

BREADTH-FIRST
  • 🎯 Objective: Comprehensive catalog of all potential flaws.
  • ⚙️ Method: Automated, non-intrusive scanning (Nessus, OpenVAS).
  • 🛡️ Exploitation: None. You flag the weaknesses, you don't fire them.
  • 📊 Output: Prioritized risk matrix and CVE score list.
  • ⚡ System Risk: Zero downtime, safe for live production.

🎯 Penetration Test

DEPTH-FIRST
  • 🎯 Objective: Prove real-world business impact and compromise depth.
  • ⚙️ Method: Active simulation of adversarial tactics & custom payloads.
  • 💥 Exploitation: Active. You actually use the flaws to get a foothold.
  • 📊 Output: Proof-of-concept shells, compromised data & remediation roadmap.
  • ⚡ System Risk: Controlled risk; requires formal Rules of Engagement.

Threat Actor Taxonomy

Hacking intent and legal authorization separate threat actors across a spectrum of risk:

🛡️

White Hat

Ethical Hacker
Auth: Explicit Written Contract
Goal: Defense, Hardening, Compliance
Methods: Responsible Disclosure
Malice Index 0% (BENIGN)
⚖️

Gray Hat

Ambiguous Hacker
Auth: None / Unsolicited
Goal: Recognition, Bounties, Curiosity
Methods: Tests without consent, then reports
Malice Index 50% (PERILOUS)
☠️

Black Hat

Hostile Threat Actor
Auth: Zero (Illegal Breach)
Goal: Financial extortion, Espionage, Destruction
Methods: Zero-days, Ransomware, Exfiltration
Malice Index 100% (CRITICAL)
👶

Script Kiddie

Amateur Attacker
Auth: None
Goal: Thrills, Vandalism, Ego, Griefing
Methods: Point-and-click GUI automated tools
Malice Index 75% (CHAOTIC)

Target Visibility: The 3 Box Models

Assessments differ fundamentally by how much internal architecture is disclosed upfront:

⬛ Black Box Zero Knowledge
Target Transparency 0%
  • Perspective: External internet attacker
  • Tester Given: Target domain or IP range only
  • Simulation: Maximum real-world adversary accuracy
🔲 Gray Box Industry Standard
Target Transparency 50%
  • Perspective: Malicious insider or compromised account
  • Tester Given: Low-privilege user credentials & network diagram
  • Simulation: Best balance of depth, time & budget efficiency
⬜ White Box Full Disclosure
Target Transparency 100%
  • Perspective: Security architect & lead auditor
  • Tester Given: Full source code, API docs, root configs
  • Simulation: Deepest audit with 100% code path coverage

The 5 Penetration Testing Domains

🌐
Network Subnets, Routers, Firewalls, SMB/SSH
💻
Web Applications OWASP Top 10, SQLi, XSS, REST APIs
📶
Wireless WPA2/3 Handshakes, Rogue APs, Evil Twins
👥
Social Engineering Spear Phishing, Vishing, Pretexting
🏢
Physical Security RFID Badges, Tailgating, Lock Bypasses

2. The 5 Core Phases of Penetration Testing

Standardized methodologies (NIST SP 800-115, PTES, OWASP) structure engagements into five sequential stages:

PIPELINE: Penetration Testing Lifecycle NIST SP 800-115 / PTES
PHASE 01 🔍 Recon OSINT & Intelligence PHASE 02 📡 Scanning Ports & Services (Nmap) PHASE 03 ⚠️ Vuln Analysis Identify CVE Flaws PHASE 04 💥 Exploitation Initial Foothold & PoC PHASE 05 📝 Reporting Remediation Roadmap
PHASE 1–2: DISCOVERY

Map attack surface via OSINT, passive queries, and Nmap port scanning to identify open doors (ports 80, 443, 22).

PHASE 3–4: ATTACK

Correlate running software versions with known CVEs, craft weaponized payloads in Metasploit, and secure shell access.

PHASE 5: REMEDIATION

Erase artifacts and deliver clear CVSS risk ratings with actionable mitigation code to prevent black-hat breach.

3. Networking, Ports & Handshake Dynamics

In offensive operations, the internet is not theory: you locate a target (IP), knock on a service (Port), and open a session (TCP/UDP). Master this flow in 4 visual blocks:

3.1 The Hacker's 4-Layer Stack & Triage

Textbooks teach 7 OSI layers; the real world runs on TCP/IP. When a scan or exploit fails, diagnose down the stack in seconds:

Layer Role (Mental Model) Attacker Weapon Triage ("Which Layer Broke?")
L7 Application The Payload (HTTP, SSH, DNS) SQLi, XSS, RCE, Auth Bypass curl -I <url> (403 WAF or bad headers)
L4 Transport The Door (TCP, UDP) Port scans, Reverse shells nc -zv <ip> 80 (Port closed / RST)
L3 Network The Address (IP, ICMP) Ping sweeps (-sn), Spoofing ping <ip> / ip route (Host unreachable)
L2 Data Link Local Hops (MAC, ARP) ARP Poisoning, LAN sniffing ip neigh (No MAC / switch isolation)

3.2 Ports Demystified: The Apartment Analogy

🏢 IP ADDRESS = BUILDING STREET ADDRESS
192.168.56.101 gets packets to the machine. There is only 1 IP per server.
🚪 PORT (0–65,535) = SPECIFIC ROOM DOOR
65,536 doors. The OS kernel routes packets to whichever program is listening inside!
Port 80/443
Web (HTTP/S)
Port 22
SSH (Remote Shell)
Port 445
SMB (File Sharing)
Port 3306
MySQL (Database)
Port 53
DNS (Lookup)
Ranges: 0–1023 System (Root only) 1024–49151 User Apps 49152–65535 Dynamic Return

3.3 TCP vs. UDP & The 3-Way Handshake

📞 TCP (Stateful)

100% RELIABLE

Like a certified phone call. Packets are acknowledged; lost bytes are resent. Mandatory for interactive reverse shells. Cannot spoof IP.

📢 UDP (Stateless)

FIRE-AND-FORGET

Like a megaphone in a stadium. Zero receipts, zero state. Trivial IP spoofing (DDoS amplification). Agonizingly slow to port-scan.

SEQUENCE: TCP Three-Way Handshake (RFC 793) State Synchronization
💻 KALI SCANNER 🎯 TARGET SERVER 1. [SYN] "Can you hear me? Seq=100" 2. [SYN-ACK] "Yes! Seq=300, Send byte 101" 3. [ACK] "Got it! Send byte 301. Connected!"
🚪 DOOR OPENS PORT OPEN
SYN ➔ [SYN-ACK]

Service daemon is actively listening. Primary attack target!

🚪 DOOR SLAMS PORT CLOSED
SYN ➔ [RST]

Host is alive, but no program is bound to this port. Move on.

🚪 SILENCE FILTERED
SYN ➔ Timeout

Firewall (iptables/ACL) dropped the packet silently.

💡
The SYN Stealth Scan ("Ding-Dong Ditch")

When target returns SYN-ACK, Kali instantly sends RST instead of completing the handshake. The port is confirmed OPEN without writing a connection entry into web server logs!

3.4 Web Protocols: GET vs. POST & Header Leaks

HTTP GET Postcard

Parameters in URL bar (?user=admin). Logged in browser history and proxy access logs. Never put credentials in a GET!

HTTP POST Sealed Envelope

Payload tucked inside request body. Hidden from URL and default access logs. Used for logins and state modifications.

KALI SENDS (Request Headers):
Host: Target virtual host domain.
Cookie: Session passport (target for hijacking).
Authorization: Base64 credentials for HTTP auth.
SERVER LEAKS (Response Headers):
Server: Banner leak! (e.g. Apache/2.2.8 ➔ CVE lookup).
Set-Cookie: Audit for missing HttpOnly / Secure flags.
X-Powered-By: Leaks backend framework (PHP, Express).
200 OKSuccess
302 FoundRedirect
401 AuthNeeds Login
403 DeniedForbidden / WAF
404 MissingNot Found
500 ErrorBackend Crash

3.5 The Web Request Lifecycle: From Click to Response

What actually happens when a user clicks a link or submits a form? Here's the full trip, and where an attacker can sit on each hop:

PIPELINE: Complete Web Request Lifecycle Client ➔ DNS ➔ TCP ➔ Server ➔ DOM
1. User Click Event / URL input 2. Hosts & DNS Resolve target IP 3. TCP Handshake Port 80/443 Syn-Ack 4. HTTP Request Headers, Cookies, Burp 5. Server & DB Apache/PHP/MySQL 6. HTTP Response (200 OK) ➔ Browser Parses DOM, Executes JS & Stores Cookies Target for Stored/Reflected XSS execution and cookie theft
1. USER CLICK & /etc/hosts

System: Checks browser cache, then OS /etc/hosts file.
Attacker: Local DNS override / phishing redirection.

2. DNS QUERY (PORT 53)

System: Resolves target.lab to IP (192.168.56.101).
Attacker: DNS Spoofing & Cache Poisoning.

3. TCP HANDSHAKE

System: SYN ➔ SYN-ACK ➔ ACK opens port 80/443 socket.
Attacker: Port scanning (-sS), SYN floods, ARP MITM.

4. HTTP REQUEST & PROXY

System: Sends HTTP verb, headers, cookies, payload.
Attacker: Burp Suite tampering & payload injection.

5. BACKEND APP & DATABASE

System: Web server executes code and queries database.
Attacker: SQL Injection (SQLi), SSRF, Remote Code Execution.

6. RESPONSE & DOM RENDER

System: Returns HTTP 200 OK + HTML/JS body to browser.
Attacker: Reflected/Stored XSS execution & cookie theft.

4. Interactive Hands-on: Browser DevTools Guide

Before deploying heavy interception proxies like Burp Suite, pentesters utilize browser Developer Tools (F12) to intercept traffic, cookies, and tokens.

Elements Console Network Application
☑ Disable Cache ☑ Preserve Log
STEP 1: NETWORK INSPECTION
  1. Press F12 ➔ open Network tab.
  2. Navigate to https://httpbin.org/headers.
  3. Click the headers request ➔ inspect Headers.
  4. Locate the Server: gunicorn banner disclosure!
STEP 2: POST PAYLOAD INTERCEPTION
  1. Navigate to https://httpbin.org/forms/post.
  2. Submit sample credentials in the form.
  3. Select the logged /post request ➔ open Payload tab.
  4. Notice data is sent in the HTTP body, invisible in the URL bar.
🛡️
DevTools Console Security Check: The HttpOnly Flag

Open the Console tab and execute: document.cookie.

If a session cookie has the HttpOnly attribute set by the server, JavaScript returns an empty string, neutralizing Cross-Site Scripting (XSS) cookie theft!

Request Replay: Browser to Terminal (cURL)

Right-click any request in the DevTools Network log ➔ Copy ➔ Copy as cURL to replay and fuzz parameters directly from Kali:

bash · Replay POST Request 
curl -X POST 'https://httpbin.org/post' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'username=admin_tester&action=auth'

5. Classroom Hands-On Exercises

Exercise 5.1: Base64 Sniffed Credential Decoding SNIFFED AUTH HEADER

You captured an HTTP Basic Auth header: Authorization: Basic dGVhY2hpbmc6aGFja2luZzEyMw==. Decode it:

bash · Decode Base64 Token 
echo "dGVhY2hpbmc6aGFja2luZzEyMw==" | base64 -d
Core Principle: Is Base64 an encryption algorithm?

No! Base64 is an encoding scheme, not encryption. It provides zero confidentiality. Any attacker intercepting cleartext HTTP can decode credentials in a fraction of a second (teaching:hacking123).

Exercise 5.2: Banner Grabbing via cURL RECONNAISSANCE

Extract HTTP response banners without downloading web page bodies:

bash · Banner Grab 
curl -I http://example.com
Why is Server Banner leakage dangerous?

Disclosing web server versions (e.g. Apache/2.2.14) allows adversaries to query the CVE vulnerability database and execute targeted, off-the-shelf exploits in minutes.

Lab 01 Self-Assessment Quiz

Q1: What distinguishes an active Penetration Test from a Vulnerability Assessment?
Q2: In which penetration testing methodology does the tester receive zero prior knowledge of internal infrastructure, accurately simulating an external internet attacker?
Q3 [Terminal Challenge]: Type the Linux bash command to decode the Base64 authorization string dGVhY2hpbmc6aGFja2luZzEyMw==:
Q4 [Terminal Challenge]: Type the curl command to perform an HTTP header-only request (banner grab) against http://example.com:
Q5: A ping to 192.168.56.101 returns 0% packet loss, but a connection to port 80 replies with an immediate [RST] (Connection Refused). What does this tell you about the network layers?