Practical Ethical Hacking: Core Concepts & Quick Revision

📅 Published 2026-05-18 ·offensive-securitypentestingnetwork-securityattack-techniqueslinuxeducationreference

Written by Aryan Giri

Introduction

A lot of beginners think ethical hacking starts with exploits, payloads, or fancy tools.

In reality, hacking starts much earlier.

Before an attacker exploits anything, they first:

This is why foundational skills matter more than flashy tools.

A person who understands networking, note-taking, protocols, and hacker methodology will usually outperform someone who only memorizes commands.

This article explains the core foundations behind practical ethical hacking in simple English with practical examples.

What Is Ethical Hacking?

Ethical hacking means legally testing systems to discover security weaknesses before malicious attackers do.

Instead of attacking random targets illegally, ethical hackers work with permission.

Their job is to:

Ethical hackers are also called:

Why Ethical Hacking Is Different From Normal IT

Normal IT work usually focuses on:

Ethical hacking focuses on:

Example

A system administrator may see:

An ethical hacker immediately thinks:

That attacker mindset is the difference.

The Hacker Methodology

Most ethical hacking follows a general workflow.

1. Reconnaissance

This stage is about collecting information.

Examples:

Practical Example

A target company may expose:

Even small details can help attackers later.

2. Scanning and Enumeration

After collecting information, attackers begin interacting with the target.

This usually includes:

Enumeration is one of the most important hacking skills.

Important mindset

Good hackers do not randomly exploit.

They first understand:

3. Exploitation

Once weaknesses are identified, exploitation begins.

Examples:

Example attack chain

An attacker may:

  1. discover SMB open,
  2. identify SMB signing disabled,
  3. perform NTLM relay,
  4. gain credentials,
  5. move laterally through the network.

This is called attack chaining.

Small weaknesses become dangerous when combined.

4. Post Exploitation

After gaining access, attackers attempt to:

Real-world idea

Initial access is often not the final objective.

The real objective may be:

5. Reporting

Reporting is one of the most underrated security skills.

A great hacker with terrible reporting is still a weak consultant.

Reports should explain:

Why Note-Taking Is Extremely Important

Many beginners ignore note-taking.

That is a mistake.

Professional penetration testers document everything.

Good notes should include

Example of Bad vs Good Notes

Bad notes

Port 80 open

That tells almost nothing.

Good notes

Now the finding is useful.

Useful Note-Taking Tools

Common tools include:

The tool itself matters less than organization.

Screenshot Tools Matter Too

Screenshots are critical in penetration testing.

Good screenshots:

Tools like Greenshot are useful because they allow:

Networking Foundations Every Hacker Needs

Networking is one of the most important skills in offensive security.

A hacker who does not understand networking will struggle during:

Understanding IP Addresses

An IP address identifies a device on a network.

IPv4

Most common format:

192.168.1.10

IPv4 uses:

Each octet ranges from:

IPv6

IPv6 is much larger and uses hexadecimal notation.

Example:

2001:0db8:85a3::8a2e:0370:7334

IPv6 exists because IPv4 address space became limited.

Private vs Public IP Addresses

Private IP ranges

Common private ranges:

These are used internally.

Public IP addresses

Public IPs communicate on the internet.

Your router usually shares one public IP across many private devices using NAT.

NAT Explained Simply

NAT means:

Network Address Translation

It allows multiple private devices to communicate externally through one public IP.

Practical Example

Your:

may all use private addresses internally.

But externally, websites only see your router's public IP.

MAC Addresses

A MAC address is a hardware-level network identifier.

Example:

00:0C:29:AB:CD:EF

MAC addresses operate at Layer 2.

Why MAC Addresses Matter in Security

Attackers sometimes analyze MAC prefixes to identify vendors.

Example

A MAC prefix may reveal:

This helps identify target infrastructure.

TCP vs UDP

These are transport layer protocols.

Understanding them is extremely important.

TCP

TCP is:

Used by:

TCP Three-Way Handshake

TCP communication usually follows:

  1. SYN
  2. SYN-ACK
  3. ACK

Simple analogy

Person A:
"Hello"

Person B:
"Hello, I heard you"

Person A:
"Great, connection established"

UDP

UDP is:

Used by:

UDP does not verify every packet like TCP does.

Why Attackers Care About TCP and UDP

Scanning techniques differ.

TCP scans are usually easier.
UDP scans can be slower and less reliable.

Understanding protocol behavior helps identify:

Common Ports Every Beginner Should Memorize

Port Protocol Usage
21 FTP File transfer
22 SSH Secure remote access
23 Telnet Insecure remote access
25 SMTP Mail transfer
53 DNS Name resolution
80 HTTP Web traffic
443 HTTPS Secure web traffic
139 SMB File sharing
445 SMB Windows sharing

Why SMB Is Important

SMB appears constantly in penetration testing.

Historically, SMB has been involved in:

Example

The WannaCry outbreak abused SMB vulnerabilities to spread rapidly across networks.

This is why SMB exposure matters so much.

DNS Explained Simply

DNS converts names into IP addresses.

Humans remember:

Computers use:

DNS acts like the internet's phonebook.

The OSI Model

The OSI model explains networking in layers.

Mnemonic

Please Do Not Throw Sausage Pizza Away

Layer Name
1 Physical
2 Data Link
3 Network
4 Transport
5 Session
6 Presentation
7 Application

Important Security Mapping

Layer Security Relevance
Layer 2 MAC attacks, VLAN issues
Layer 3 Routing, IP filtering
Layer 4 TCP/UDP scanning
Layer 7 Web attacks, authentication

Subnetting Explained Simply

Subnetting divides networks into smaller sections.

This helps organizations:

CIDR Notation

Examples:

These indicate subnet size.

Easy Way to Remember

Example

/24

Common in homes/small offices.

Usually around:

/16

Much larger.

Can support thousands of devices.

Often seen in enterprises.

Why Subnetting Matters for Attackers

Subnet size affects:

Example

Scanning a /24 network is much faster than scanning a /16 network.

A /16 may contain thousands of hosts.

Beginner Enumeration Workflow

A strong beginner workflow looks like this:

  1. Discover hosts
  2. Scan ports
  3. Identify services
  4. Identify versions
  5. Research attack surface
  6. Document findings
  7. Attempt exploitation carefully

Practical Enumeration Example

Suppose a scan reveals:

An attacker's thinking may become:

SSH

HTTP

SMB

Enumeration creates direction.

Soft Skills Matter Too

Technical skills alone are not enough.

Strong penetration testers also need:

The Most Important Mindset: Never Stop Learning

Cybersecurity changes constantly.

New:

appear all the time.

A hacker who stops learning eventually becomes outdated.

Final Thoughts

Ethical hacking is not magic.

It is the combination of:

Before learning advanced exploitation, beginners should become comfortable with:

These fundamentals are what everything else builds upon.

A strong foundation creates stronger hackers.