Another topic that is very important to understand is, you know, ethical hacking versus penetration
testing, so essentially it's important to know that ethical hacking and penetration testing are actually
the same thing.
They typically refer to the same exact thing and can be used interchangeably.
Ethical hackers conduct penetration tests for their clients or employers.
All right.
So throughout the course, you're probably going to hear me use both.
I like to lean towards saying we're conducting penetration tests versus saying, you know, while ethical
hacking because it just sounds a little bit better.
It's a little bit more direct, you know, on, you know, what we're doing.
And that's what you'll be doing if you ever become an ethical hacker.
OK, so let's talk about some types of ethical hacking, right?
There's three different types.
The first one is white box hacking.
This is before this is when you do ethical hacking and you have full knowledge of the systems, applications
or networks that you'll be attempting to penetrate.
So, for example, you know, exact IP addresses, you'll know specifics about the application or the
network.
You know, you know where you need to look, where some vulnerabilities might be just so that you can
test them.
That's white box.
So full disclosure is what white box hacking is.
Now that we have gray box, we you know, people say, you know, there's like the gray area.
This is gray box.
So it's you kind of know some stuff and then you kind of don't.
So they're going to give you some information about the network or a system or an application, but
you're not giving full details.
So this is usually the case when a company like a client might not want you to have full access or full
knowledge of maybe their application or their network.
So they're not going to give you too much information and you kind of just how to go about it yourself.
So now the last one will be black box hacking, which is proof we have no information at all.
And they just give you, like, you know, a public IP address or they just drop you on a network or
just in application and say, hey, hack this and we know what you can find.
And this is the one where you really get to flex your hacker muscle a lot because, you know, you really
have to go through the different processes that we're going to go over to make sure that you cover all
of your bases, gather all the possible information and, you know, activate any potential exposures
that you might find.
So now let's go over the different types of penetration testing that you may be conducting if you were
to become a penetration testing professional.
So there's various types of penetration testing that you might run into when you become a professional.
And these include internal penetration testing, external penetration testing and web application penetration
testing.
So during this course, you're going to learn various techniques in attacks and you can use for each
one of these types of testing.
So first is broadband penetration testing.
So this started penetration testing done to simulate what an attacker that has made their way into your
network and get access to.
Now, it's also a way that companies like to figure out, you know, what's just vulnerable in their
network.
You know, how you typically would be on site and connected to the network physically or through Wi-Fi
or you'll be remotely connected, you know, like a VPN and, you know, given the right to break into
as many machines as possible and find valuable, sensitive information like, you know, company financial
information, employee personal information, different stuff like that.
That's the goal.
Kind of like Internet penetration says you want to see what can happen if someone is inside your network
to see where you know you need to improve your security.
So now, next up, we're going to talk about the extent of penetration testing.
Now, this is inside.
Penetration testing is typically done from the outside of the network, and it has the ability for hackers
to break in from the outside.
So you typically going to connect this kind of test with a public IP address for the network and try
to break in.
So you're going to be given a public IP address and we all have public IP address and Internet.
No matter where you are, if you connect the Internet, you have a public IP address.
So technically, anyone on the Internet and find you if you have some type of service running that might
be vulnerable and you can see that from the outside, hackers can potentially take advantage of that.
So that's why external penetration testing is very important, because, you know, hackers usually
come in from the outside and we have something sitting out there on a wall that can literally within
an instant launch off an exploit and get into your network and then you're screwed at that point.
So now let's talk about a Web application or Web site penetration testing.
So this type of penetration testing focuses on attempting to exploit vulnerabilities.
In a Web application or Web site and see where is vulnerable, so you want to test this from the outside
and from the inside, typically you want to see someone break in to the application from the outside
and bypass authentication or in someone with, like, basic rights that logged into the application
access, something that they shouldn't be able to be, you know, trying to exploit the application.
That's something that's very important.
And companies care a lot about this because, you know, they might be collecting private information
and storing it.
They want to make sure that their application is safe because breaches like this, if your application
would have a breach of cost companies thousands or even millions of dollars, depending on what, you
know, what happened, how big the breach was, different things.
So that's why a web application for penetration testing is very important.