Ethical Hacking 101: Part 3 brings together three essential pillars of cybersecurity for beginners:
This part sets the foundation for the hands-on phases that will come next.
People often imagine “a hacker” as a single stereotype. In reality, hackers differ in skills, intentions, and motivations. Understanding these differences helps newcomers see that ethical hacking is a legitimate, structured, and responsible domain.
These are cybersecurity professionals who legally test systems to identify vulnerabilities.
They work with permission and help organisations strengthen security.
These are attackers who exploit systems illegally for personal gain—stealing data, money, or causing harm.
A mix of both:
They may test systems without permission but typically report issues rather than exploiting them.
Beginners who use pre-made hacking tools without understanding how they work.
They lack deep skills but can still cause damage.
Hackers driven by ideology or activism.
They attack systems to support political or social causes.
Highly skilled cyber professionals working for governments.
Their targets often include critical infrastructure, defense, or global corporations.
Understanding these categories helps you distinguish intent, capability, and ethical boundaries — crucial in cybersecurity.
Ethical hacking requires knowing what attackers typically do.
Here are the major attack categories explained in clear, simple language.
Tricking users into sharing sensitive information (passwords, bank details) through fake emails or websites.
Malicious software like viruses, ransomware, spyware, or worms that damage or steal data.
An attacker secretly intercepts communication between two parties — like reading messages on public Wi-Fi.
Flooding a server with traffic until it crashes or becomes unavailable.
Injecting malicious commands into a website’s input fields to access or manipulate databases.
Exploiting software vulnerabilities before the vendor discovers or fixes them.
These examples show the range of threats ethical hackers must understand before they can defend or test systems.
Every ethical hacking project begins with reconnaissance — gathering information legally and quietly about a target.
This step is crucial because the more you know about a system, the better you can test it.
Footprinting means collecting details about:
the organisation
its network
its systems
publicly available information
Ethical hackers map out the “digital footprint” of the organisation to understand potential vulnerabilities.
Passive Reconnaissance
Gathering information without interacting with the target.
Examples:
Reading the company website
Checking public documents
Social media profiling
Finding subdomains
Searching past data breaches
This method is quiet and difficult to detect.
Directly interacting with the target system.
Examples:
Ping sweeps
Port scanning
DNS interrogation
Traceroute
This method gives more accurate results but carries a higher risk of detection.
OSINT is the practice of gathering intelligence from publicly accessible sources.
Ethical hackers use it to build a strong initial profile.
Common OSINT sources include:
Google & advanced search operators (“Google Dorking”)
Social media
WHOIS databases
Shodan (search engine for internet-connected devices)
GitHub repositories
Company reports
OSINT helps ethical hackers understand:
what technologies the company uses
what systems are exposed to the internet
where potential vulnerabilities may lie
Here are tools ethical hackers use during reconnaissance:
Shows domain ownership details, admin emails, IP ranges.
Retrieves DNS records of a website.
Using advanced search queries to find hidden or exposed information.
Finds exposed devices like webcams, servers, IoT systems, with their vulnerabilities.
Shows the path data takes to reach a server, revealing network infrastructure.
These tools provide the initial data an ethical hacker needs before performing deeper assessments.
Reconnaissance helps ethical hackers:
understand the system
identify weak points
plan structured testing
avoid unnecessary risk
work within ethical and legal boundaries
It is the first and one of the most important phases of ethical hacking.