Ethical Hacking
Ethical hacking is defensive work done with permission
Ethical hackers use the same technical understanding as attackers, but operate under written authorization, defined scope and a duty to report findings to the system owner.
Authorization is not optional
What is ethical hacking?
Ethical hacking is the authorised assessment of systems to find weaknesses before a malicious actor does. The work is structured: scope is agreed, activity is logged, impact is controlled, and every finding is handed to the owner with guidance on how to fix it. The goal is never access — it is evidence that leads to a stronger system.
Ethical vs malicious
- Permission: ethical hackers have written authorization; attackers do not.
- Intent: reduce risk for the owner versus extract value from the victim.
- Impact: controlled and agreed versus unrestricted and damaging.
- Outcome: a remediation report versus data theft, extortion or disruption.
Disciplines
The fields ethical hackers work across
Each area below is taught defensively: what goes wrong, why, and the controls that prevent it.
Penetration testing
A time-boxed, authorised simulation of realistic attack techniques against a defined scope, ending in a prioritised remediation report.
Vulnerability assessment
Systematic identification and ranking of weaknesses across systems you own, usually with broad coverage and automated tooling.
Web application security
Access control, injection, session handling, business logic and configuration flaws in browser-facing applications.
Network security
Segmentation, exposed services, firewall and VPN configuration, and monitoring of traffic on networks you administer.
Mobile security
Insecure local storage, transport security, platform permission misuse and backend API exposure in mobile apps.
API security
Object-level authorisation, excessive data exposure, rate limiting and token handling in machine-facing interfaces.
Cloud security
Identity and access management, storage exposure, misconfiguration, secrets handling and workload isolation.
Social engineering awareness
Understanding pretexting, phishing and manipulation so people and processes can resist them — defensive framing only.
Password security
Hashing, credential stuffing resistance, breach corpora checks, and authorised internal password strength auditing.
Authentication security
MFA design, session lifecycle, recovery flows and phishing-resistant credentials such as passkeys.
Security monitoring
Logging, detection engineering, alert triage and the telemetry needed to notice an incident early.
Responsible disclosure
Reporting findings privately, agreeing timelines, and publishing only after a fix or an agreed window.
Bug bounty programs
Formalised research with published scope, rules and safe harbour for good-faith testing.
Where to practise legally
- • Intentionally vulnerable apps you host yourself, such as OWASP Juice Shop.
- • Public CTF platforms built for learning, such as picoCTF.
- • Lab environments and virtual machines on your own hardware.
- • Bug bounty programmes, strictly within their published scope and rules.