# Lab 2.1: Penetration Testing Techniques

> CompTIA Security+ Module 02 case study by Johnathan Belcher.

## Overview

This module gave me a practical foundation in penetration testing by connecting reconnaissance, testing scope, testing types, and reporting into one workflow. I learned how ethical testers assess targets, identify attack paths, and document findings in a way that supports business decisions and defensive improvement.

## What I Learned

- **Testing Types**: Blackbox, whitebox, and graybox testing, plus how each one changes what the tester knows, what they target, and how closely the test mirrors a real attack.
- **Testing Workflow**: Discovery, enumeration, vulnerability mapping, exploitation, and reporting, with each phase building on the last to create a useful assessment.
- **Reconnaissance**: The difference between active and passive recon, including footprinting, OSINT, banner grabbing, scanning, and stealthier information gathering methods.
- **Testing Roles**: How blue, red, white, and purple teams support realistic testing, oversight, and defense-focused validation in a professional environment.

## Tools, Methods, and Testing Types

- **Recon and Scanning Tools**: Nmap, Superscan, and Hping for port and service discovery; Xprobe2, Queso, p0f, Httprint, Amap, and Winfingerprint for fingerprinting; Nessus, BurpSuite, Acunetix, SQLMap, and Vega for vulnerability analysis.
- **Core Techniques**: Lateral movement, privilege escalation, pivoting, and persistence; bug bounty fundamentals and cleanup after testing; rules of engagement, scope control, and responsible reporting.
- **Recon Methods**: Active recon with ping, traceroute, and web scanning; passive recon with OSINT, subdomains, and external sites; war-driving, war-flying, and drone/UAV awareness.

## Exercise Summary

- **Pen Testing Basics**: How penetration testing differs from a vulnerability assessment and why a structured process matters for proving risk and documenting findings.
- **Rules of Engagement**: Scope, contacts, timing, sensitive data handling, and target limits so the assessment stays controlled and professional.
- **Testing Techniques**: Lateral movement, privilege escalation, persistence, pivoting, bug bounty concepts, and cleanup.
- **Reconnaissance**: When to use active vs. passive recon and how OSINT and footprinting help identify likely attack vectors before exploitation begins.
- **Active Recon Assessment**: Connecting theory to the toolset and seeing how targeted testing turns raw data into meaningful findings for defenders and decision-makers.

## Professional Value

- Recruiter-ready structure explaining scope, process, tooling, and findings clearly.
- Hands-on assessment mindset combining active and passive methods into a complete test plan.
- Tool awareness across scanners, fingerprinting tools, and web vulnerability tools used in real assessments.
- Ethical testing habits: authorization, cleanup, and reporting as part of the job.

## Security+ Alignment

Supports Security+ Objective 1.8 by reinforcing testing types (blackbox/whitebox/graybox), methods (active/passive recon, footprinting, OSINT, lateral movement, privilege escalation), and tools (Nmap, Nessus, BurpSuite, SQLMap, Acunetix, Vega).