Ethical Hacking

Syllabus

1. Introduction to Ethical Hacking – Definitions, Legal Framework, Ethical Boundaries • Introduction to the course, importance of ethical hacking. • Legal frameworks (e.g., GDPR, national cybersecurity law), ethical standards. • Hacker ethics and responsible disclosure. • Discussion: the line between ethical and unethical hacking. 2. Fundamentals of Network and System Security • Network architecture, OSI model, communication protocols. • Principles of authentication, authorization, and auditing. • Common vulnerabilities in systems and services. • Practical: configuring a firewall and system security policies. 3. Setting Up the Testing Environment • Virtualization tools (VirtualBox, VMware, Proxmox). • Installing Kali Linux, Metasploitable, DVWA. • Network configuration and environment isolation. • Creating snapshots, documenting configurations. 4. Information Gathering and Network Scanning • Passive vs. active reconnaissance. • Whois, nslookup, dig, Shodan usage. • Tools: Nmap, Netcat, Wireshark – demonstrations and hands-on labs. • Identifying open ports and running services. 5. Web Application Testing • Common vulnerabilities: XSS, SQL injection, CSRF, RFI/LFI. • Tools: OWASP ZAP, Burp Suite. • Working with DVWA and bWAPP test platforms. • Interpreting results and suggesting mitigations. 6. Exploitation and Privilege Escalation • Exploiting vulnerabilities (Metasploit, exploit-db). • Obtaining shell access, maintaining persistence. • Local vs. remote privilege escalation. • Bypassing antivirus detection mechanisms. 7. Social Engineering and Phishing • Techniques: pretexting, baiting, impersonation. • Crafting phishing emails and fake login pages (SET toolkit). • Protection against human-centric attacks. • Ethics of simulated social engineering. 8. Securing Systems and Mitigating Attacks • Hardening systems, patching, encryption best practices. • Using IDS/IPS, honeypots, antivirus and monitoring tools. • Log analysis and incident detection. • Exercise: designing a multi-layered security strategy. 9. Penetration Testing • Pentest phases: planning, execution, reporting. • Black box, grey box, and white box testing types. • Writing a penetration testing report. • Group exercise: simulated pentest of a target. 10. Security of IoT and Mobile Devices • Specific risks in IoT (limited resources, weak updates). • Mobile OS vulnerabilities (Android, iOS). • Hands-on: IoT sniffing, rooting, and jailbreaking. • Implications for corporate environments. 11. Cyber Incident Response and Forensic Analysis • Incident response lifecycle and documentation. • Digital forensics: evidence acquisition, chain of custody. • Tools: Autopsy, Volatility, FTK Imager. • Case study: analyzing a compromised machine. 12. Simulation of Real-World Attack and Defense • Red team vs. Blue team exercises. • Planning attacks, implementing defense strategies. • Activity logging, defense efficiency evaluation. • Reflection: lessons learned and gaps identified. 13. Final Assessment and Emerging Trends in Cybersecurity • Final presentations and practical demonstrations. • Discussion: trends such as AI in cybersecurity, Zero Trust, and quantum cryptography. • Analysis of ethical dilemmas in real-world cybersecurity. • Self-evaluation and further learning paths.