Lab 2.1: Penetration Testing Techniques

Testing Types

Blackbox, whitebox, and graybox testing, plus how each one changes what the tester knows, what they target, and how closely the test mirrors a real attack.

Testing Workflow

Discovery, enumeration, vulnerability mapping, exploitation, and reporting, with an emphasis on how each phase builds on the last to create a useful assessment.

Reconnaissance

The difference between active and passive recon, including footprinting, OSINT, banner grabbing, scanning, and stealthier information gathering methods.

Testing Roles

How blue, red, white, and purple teams support realistic testing, oversight, and defense-focused validation in a professional environment.

Recon and Scanning Tools

• Nmap, Superscan, and Hping for port and service discovery
• Xprobe2, Queso, p0f, Httprint, Amap, and Winfingerprint for fingerprinting
• Nessus, BurpSuite, Acunetix, SQLMap, and Vega for vulnerability analysis

Core Techniques

• Lateral movement, privilege escalation, pivoting, and persistence
• Bug bounty fundamentals and cleanup after testing
• Rules of engagement, scope control, and responsible reporting

Recon Methods

• Active recon with ping, traceroute, and web scanning
• Passive recon with OSINT, subdomains, and external sites
• War-driving, war-flying, and drone/UAV awareness

Exercise 1: Pen Testing Basics

I learned how penetration testing differs from a vulnerability assessment and why a structured process matters for proving risk and documenting findings.

Exercise 2: Rules of Engagement

I reviewed scope, contacts, timing, sensitive data handling, and target limits so the assessment stays controlled and professional.

Exercise 3: Testing Techniques

I studied lateral movement, privilege escalation, persistence, pivoting, bug bounty concepts, and cleanup to understand the lifecycle of a test.

Exercise 4: Reconnaissance

I learned when to use active vs. passive recon and how OSINT and footprinting help identify likely attack vectors before exploitation begins.

Exercise 5: Active Recon Assessment

I connected the theory to the toolset and saw how targeted testing turns raw data into meaningful findings for defenders and decision-makers.

Professional Scope Control

I learned that a strong assessment is not just about tools; it is about boundaries, timing, authorization, and clear reporting.

Technical Breadth

The module helped me connect scanning, fingerprinting, vulnerability discovery, and recon into one repeatable methodology.

Defensive Insight

I now understand how attackers think during recon and how defenders can limit exposure, detect probing, and prioritize remediation.

Testing Types

• Blackbox, whitebox, and graybox testing
• Scope-driven and knowledge-driven planning
• Authorization-aware assessments

Methods

• Active and passive reconnaissance
• Footprinting and OSINT
• Lateral movement and privilege escalation

Tools

• Nmap, Nessus, and BurpSuite
• Fingerprinting utilities and web scanners
• SQLMap, Acunetix, and Vega