Ethical Hacking Methodology
Mission Brief
ShadowX Labs hands you your first solo pentest: a 5-day external + internal engagement for Glasshouse Bank's new mobile-banking API. You must walk the team through your methodology in tomorrow's kick-off — and prove you won't go out of scope.
Story · Five days, six phases, one signed scope
Last quarter another vendor lost their PCI accreditation because a junior consultant ran a full nmap -sS against the entire /16 — including a /24 that belonged to the bank's payment processor, not the bank. The processor's IDS lit up, lawyers got involved, and the engagement was terminated.
Methodology isn't bureaucracy. It's how ethical hackers stay ethical when adrenaline kicks in. The CEH phases give you a checklist you can defend in a deposition: 'I was in Scanning. The target was in scope. The technique was authorised. Here's the timestamp.'
Today you learn the spine: Reconnaissance → Scanning → Gaining Access → Maintaining Access → Covering Tracks → Reporting. Six words. Memorise them. Every CEH module from here forward lives inside one of these phases.
Trainer · Core Concepts
Information gathering. Passive (WHOIS, Google, LinkedIn, Shodan, certificate transparency, leaked credentials — no packets to target) vs Active (DNS zone transfers, banner grabbing, light probing — packets touch target infra). Passive recon is almost always in scope by default; active recon requires explicit RoE approval.
Identify live hosts, open ports, services, versions, and vulnerabilities. Tools: nmap, masscan, nessus, nuclei. This phase produces noisy traffic — schedule windows, notify SOC, stay inside agreed IP ranges. Output: target-service inventory + ranked vulnerability list.
Exploit vulnerabilities to obtain a foothold: password attacks, public exploits, web app flaws (OWASP Top 10), social engineering if authorised. Document every command. Stop at the agreed depth (e.g. 'prove RCE, don't pivot').
Persistence: backdoors, scheduled tasks, additional users, C2 beacons. In a pentest this is usually time-boxed and reversed at the end of the engagement. In Red Team ops it's stealthy and longer-lived. Every artefact must be inventoried for cleanup.
Clearing logs, disabling auditing, timestomping. In ethical hacking we DEMONSTRATE the technique to prove the gap, but we PRESERVE logs (the client needs them for forensics) and document everything we touched. Real attackers destroy evidence; ethical hackers create it.
The phase that pays the invoice. Executive summary, methodology, findings (with CVSS + business impact), reproduction steps, evidence, remediation guidance, and a cleanup checklist. Without a report, the engagement never happened — and the client can't fix anything.
Knowledge Map · drag to explore
Micro Labs
Lab 16 · Place the Activity in the Right Phase
Twelve activities from your Glasshouse pentest. Drop each into the CEH phase where it belongs.
Lab 17 · Passive vs Active Reconnaissance
Same engagement, finer call. Which recon activities are passive (no packets to target) vs active (probes touch target)?
Lab 18 · Will You Run It? (Authorisation Decision)
Three live calls during the engagement. Pick the answer that keeps you ethical AND useful.
Day 2: your scan finds an open RDP on 203.0.113.42. Reverse DNS resolves to 'shared-host.payment-co.net'. RoE lists 203.0.113.0/26 in scope.
Day 3: you have RCE on an in-scope app server. RoE says 'prove impact, do not pivot to internal networks'. You can see a path to the domain controller.
Day 5: time to clean up. You created a scheduled task, a local user, and dropped a beacon binary. The client's SOC kept full logs.
Knowledge Check
Challenge · The 60-second Kickoff Walk
You have 60 seconds in tomorrow's kickoff. Walk the client from Phase 1 to Phase 6 naming, for each phase, ONE activity, ONE tool, and ONE deliverable. Bonus: name the phase where scope creep most often happens (it's Gaining Access).
CEH v13 Exam Focus
- ·Five hacking phases (six with Reporting)
- ·Passive vs active recon — sources and tools
- ·When written authorisation is required
- ·What 'Covering Tracks' means in an ETHICAL context
- ·Deliverables per phase
- ·RSGMCR — Recon · Scan · Gain · Maintain · Cover · Report
- ·'Real Spies Generally Move Carefully, Reporting' — the 6 phases
- ·Passive = 'no packets to target'. Active = 'packets land on target'.
- ⚠Forgetting Reporting as a phase (CEH counts it)
- ⚠Calling nmap passive recon — it's ACTIVE
- ⚠Thinking 'Covering Tracks' means deleting client logs in a pentest
- ⚠Conflating Pentest (time-boxed, noisy, reversed) with Red Team (stealth, longer, simulates real adversary)
- ▸WHOIS / crt.sh / Shodan = passive
- ▸nmap / nessus / nuclei = active
- ▸Burp = scanning + gaining access (web)
- ▸Mimikatz = gaining-access / credential phase
- ▸Cleanup checklist = reporting phase artefact