5 Phases of Ethical Hacking

Master the structured methodology used in penetration testing. From reconnaissance to covering tracks, understand each phase of an ethical hacking engagement and the tools used in each step.

Phase 1

Reconnaissance

Gather information about target systems without direct interaction

Key Concepts

Passive OSINT: Social media, DNS records, WHOIS, archives, public databases

Active OSINT: Network mapping, DNS enumeration, website analysis, footprinting

Tools: Google Dorking, Shodan, theHarvester, Recon-ng, whois, nslookup

Practical Tasks

1

Map network topology and identify IP ranges

2

Identify personnel and email addresses

3

Discover web applications and servers

4

Gather DNS information and subdomains

5

Identify technologies and software versions

Kali Linux Tools

theHarvesterRecon-ngMaltegowhoisnslookupdigsublist3rGoogle

Penetration Testing Methodologies

PTES

Penetration Testing Execution Standard

Open-source, freely available framework with 7 phases aligned with industry practices

Visit ptes.org →

OWASP

Open Web Application Security Project

Focus on web application security testing with top vulnerabilities and testing guide

Visit owasp.org →

CEH

Certified Ethical Hacker Framework

Industry-recognized certification framework covering all phases of ethical hacking

Visit ec-council.org →

Testing Types (Black/White/Grey Box)

🔒

Black Box Testing

Tester has no prior knowledge of system. Most realistic, simulates external attacker

✓ Pros:

  • • Most realistic
  • • Tests actual defenses
  • • Simulates real threats

✗ Cons:

  • • Takes longer time
  • • May miss issues
  • • Limited scope
🔓

White Box Testing

Tester has full access and knowledge of system architecture and code

✓ Pros:

  • • Comprehensive testing
  • • Faster execution
  • • Deep vulnerability discovery

✗ Cons:

  • • Less realistic
  • • Biased by knowledge
  • • May over-test
⚙️

Grey Box Testing

Tester has partial knowledge (like internal employee with limited access)

✓ Pros:

  • • Balanced approach
  • • Realistic scenario
  • • Cost effective

✗ Cons:

  • • Assumptions made
  • • Variable scope
  • • Mid-level thoroughness

HackTheBox Practicals - Tier 0 Starting Points

Complete these beginner-friendly machines to practice the 5 phases of ethical hacking. Each focuses on specific skills and phases.

Meow

Very Easy

Learn basic reconnaissance and service enumeration using Telnet on a legacy system

Phases:

ReconnaissanceScanningGaining Access

Skills: Telnet, basic enumeration, credential discovery

Start Challenge →

Dancing

Very Easy

Explore SMB file sharing to discover sensitive documents and information

Phases:

ReconnaissanceScanning

Skills: SMB shares, file discovery, network enumeration

Start Challenge →

Fawn

Very Easy

Practice FTP enumeration and exploit anonymous access to retrieve files

Phases:

ScanningGaining Access

Skills: FTP, anonymous login, file download, access control

Start Challenge →

Explosion

Very Easy

Use RDP to gain remote access and understand Windows service vulnerabilities

Phases:

ReconnaissanceScanningGaining Access

Skills: RDP, Windows services, protocol exploitation

Start Challenge →

Preignition

Very Easy

Discover web application vulnerabilities and default admin credentials

Phases:

ReconnaissanceWeb Scanning

Skills: Web enumeration, default credentials, HTTP methods

Start Challenge →

Appointment

Very Easy

Practice SQL injection techniques on a vulnerable web application

Phases:

ScanningGaining Access

Skills: SQL injection, web application testing, basic exploitation

Start Challenge →

Key Takeaways

  • •Penetration testing follows a structured 5-phase methodology that guides the entire engagement
  • •Each phase has specific objectives, tools, and techniques that must be mastered independently
  • •Proper reconnaissance is critical—well-gathered intelligence makes later phases more effective
  • •Always follow established methodologies (PTES, OWASP, CEH) to ensure comprehensive testing
  • •Black box testing is most realistic but time-consuming; choose testing type based on engagement goals
  • •HackTheBox starting point machines provide hands-on practice for each phase methodology