The ultimate guide to ethical hacking

Penetration testing and ethical hacking are often used interchangeably when people talk about networking and cybersecurity. Currently, the demand for cybersecurity professionals such as ethical hackers and penetration testers far outweighs the supply.

This is great news for anyone looking to learn about various hacking techniques and work towards being a cybersecurity professional. Understanding why ethical hacking is important and how it differs from the maliciously or criminally motivated hacker is an important first step for anyone that wants to pursue a career in cybersecurity.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

This ultimate guide to ethical hacking will help you get started and provide you with recommendations on what you should look at when learning and practicing. Ethical hacking takes a lot of discipline, both in terms of technique and learning, so it is vital that anyone considering this career path takes it very seriously and dedicates the relevant time and resources to it that it deserves. It can lead to a fulfilling and rewarding profession.

Who was this guide made for?

Anybody that has an interest in ethical hacking and cybersecurity! If you have an interest in learning techniques about ethical hacking, the educational opportunities around ethical hacking, or just want some tips and tricks related to ethical hacking, then you will want to keep reading.

We will answer some of the burning questions you might have about the profession as well as what educational track you should consider as a penetration tester or ethical hacker. Here are some frequently asked questions about ethical hacking and pentesting.

What are the different kinds of hackers?

There are a few general terms that people use to differentiate between groups of hackers, including:

1. Script kiddies: You can think of this group of hackers as a class of ‘wannabes.” They generally will not have much of their own practical hacking knowledge. They will not understand how to write their own code, how different architectures interact with one another or how specific networks work. Instead, they rely on readymade applications and copies of software.
2. Green hat hackers: These are aspiring hackers with limited knowledge of the subject. You can often find evidence of their activities on forums and social media, where they ask basic questions that could be easily researched. They also use premade tools and applications, but unlike Script Kiddies, they will try to understand what they are doing and learn from their activities. For example, a green hat hacker may try to learn how to crack passwords.
3. White hat hackers: These are the good guys of the internet. If you take a hacking course or a penetration testing course, it is what you may become. They hold down high-paying jobs as security analysts, penetration testers and security specialists. They are able to thwart the advances of cybercriminals because they understand the methodologies used when breaking into a computer system or network. They act decisively and within the legal frameworks and company policies that have been laid out for them to follow.
4. Black hat hackers: These are cybercriminals, and they are often responsible for data breaches and security hacks, malware creation, and worm and virus distribution. They use their extensive knowledge of computer systems to gain unauthorized access, where they maliciously attack networks, steal information and extort money through blackmail and ransomware. They also perpetrate payment card and banking fraud.
5. Gray hat hackers: These are not generally criminals, but they understand the methods used by black hat hackers, and they are not afraid of hacking a system or two if they feel the ends justify the means.

It is important to understand the different classes of hackers, but it is the white hat hackers who are the penetration testers and ethical hackers of the cybersecurity world. If this is a path that you would like to pursue, then there are many different courses and studies that you will need to study and get certified.

What must you learn to become a proficient ethical hacker?

Basic networking concepts should be at the top of your list. You will need to understand how different protocols enable different possibilities for you to connect to systems remotely. This knowledge will help you to understand how you can close down these ports and keep attackers at bay. A good starting certification that will teach you about these concepts is CompTIA’s Network+, which will teach you the basic networking concepts you need. After completing this certification, CompTIA’s CASP (Certified Advanced Security Practitioner), ISC2’s CISSP (Certified Information Systems Security Professional), and EC Council’s CEH (Certified Ethical Hacker) are good choices to learn penetration testing and ethical hacking, although the CISSP and CEH are more advanced certification.

Aside from the academic requirements of learning how to apply your knowledge as a security professional, you will need to learn logic and reasoning as well. The best way to learn how to hack is to actually spend time in a test lab environment and practice. This should become a regularly practiced exercise, and you must constantly seek to improve, learn and implement all of the new skills that you pick up along the way. You will eventually learn to commit to memory all of the different port numbers, applications and techniques required to hack your way into systems and keep out any unwanted intruders.

How will this information help with your ethical hacking career progression?

Learning these basic concepts and by applying the methods and techniques will help with your ethical hacking career progression. You will be able to practice many of the theoretical concepts you learn with a practical lab test. This makes the learning process much more effective and will improve the rate at which you progress.

Do you need special degrees and certifications to become an ethical hacker?

The short answer is no; there are many resources online that will assist you with learning how to become an ethical hacker and penetration tester. However, there are some limiting factors to this approach. One issue is that there is a lot of material, and trying to figure out what is important and what is not can be somewhat daunting. Another issue is that finding employment will almost always be easier if you have a certification behind your name.

What degrees and/or certifications will help your career as an ethical hacker?

There are several options you can pursue when trying to attain a relevant hacking degree, including:

• Computer science
• Computer programming
• Information security
• Computer information systems

Having a degree will help you when finding a job, but you will still need specialized certifications to show your competency in the field of ethical hacking and penetration testing. These include:

• EC-Council: Certified Ethical Hacker (CEH)
• EC-Council: Certified Network Defender (CND)
• EC-Council: Certified Security Analyst (CSA)
• EC-Council: Computer Hacking Forensic Investigator (CHFI)
• Offensive Security: Offensive Security Certified Professional (OSCP)
• GIAC: GIAC Penetration Tester (GPEN)

There are many other certifications, so you will be able to find the right one for you, depending on your existing knowledge and skills.

What are some of the most common security issues that companies have with their networks?

There are many issues that could occur on a corporate network, but some of the most common ones include:

• Improperly set firewalls
• Untrained staff
• Using default credentials
• Unprotected passwords
• Lack of encryption
• Lack of logical server grouping
• Logging improperly setup
• Bad DMZ setup
• Delegating IT functions to employees such as AV updates

Can ethical hacking help improve other technical skills?

Definitely. Ethical hacking and penetration testing will teach you how to think laterally and apply multiple solutions to achieve one specific goal. This is because one particular goal might require using a few different types of hacking techniques. In situations where you have never done a particular task before, you will almost always walk away from the exercise with new insights, knowledge and skills that you didn’t possess when you started.

What other technical skills can help improve your ethical hacking skills?

Deeply technical subjects like programming, scripting, networking and hardware engineering can all help with your fundamental understanding of underlying technologies that all come together to form the systems that you are working on. Other technical skills that can help to widen your technical horizons include system administration, network engineering and software development.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Conclusion

As companies become more interconnected, there is more opportunity for security vulnerabilities to be exploited. This may be bad news for organizations, but it is good news for those considering careers as ethical hackers and pentesters.

InfoSec Institute has a wide range of courses, boot camps and training to give you the best possible start as an ethical hacker. You can find the best way to get started with your certification goals, as well as progression paths for certification that you might want to follow. EC-Council has just released v10 revision of their Certified Ethical Hacking certification, and InfoSec Institute offers updated boot camp to help get you ready for certification. For certified Ethical Hackers that want to take their skills to the next level, InfoSec Institute also offers Advanced Ethical Hacking Training Boot Camp.