CMU6XX

Ethical Hacking

Session 1: Methodologies & Frameworks

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Differentiate between Ethical Hacking, Penetration Testing, and Vulnerability Assessments.
  • Deconstruct the Penetration Testing Execution Standard (PTES).
  • Define Rules of Engagement (RoE) and operational scope.
  • Understand the legal boundaries established by the Computer Misuse Act 1990.
  • Evaluate vulnerabilities using the Common Vulnerability Scoring System (CVSS).

Seminar Structure (3 Hours)

Part 1: The Anatomy of a Pentest (1.5 hrs)
  • Ethical vs Malicious Hacking
  • The PTES Methodology
  • Task 1: Scoping a Penetration Test
Part 2: Governance & Reporting (1.5 hrs)
  • Legal Frameworks & Ethics
  • Bug Bounties & CVSS Scoring
  • Task 2: Bug Bounty Triage Simulation

Part 1: The Anatomy of a Pentest

Duration: 1.5 Hours

Clarifying Terminology

Not all security assessments are created equal.

  • Vulnerability Assessment: Automated scanning (e.g., Nessus) to find known flaws. Broad coverage, low depth. Yields a massive list of unverified issues.
  • Penetration Testing: Exploiting vulnerabilities to prove business impact. "Can you actually access the database?" High depth, verified flaws.
  • Red Teaming: A full-scope, stealthy simulation of an APT to test the organization's Detection and Response capabilities (Blue Team). Highly targeted.
Practical Resource: Penetration Testing Execution Standard (PTES)

The PTES Methodology

Professional hacking is highly structured. The PTES phases are:

  1. Pre-engagement Interactions (Scoping, RoE)
  2. Intelligence Gathering (Reconnaissance)
  3. Threat Modeling
  4. Vulnerability Analysis
  5. Exploitation
  6. Post Exploitation (Pivoting, Persistence)
  7. Reporting (The most critical phase)
Practical Resource: Penetration Testing Execution Standard (PTES)

Rules of Engagement (RoE)

The contract that keeps you out of prison.

  • Scope Limits: Exactly which IPs, domains, and applications are permitted to be tested. Out-of-scope means strictly off-limits.
  • Permitted Techniques: Are Denial of Service (DoS) attacks allowed? Is Social Engineering allowed?
  • Timeframes: Testing may only be permitted between 12:00 AM and 4:00 AM to avoid business disruption.

Introduction to Task 1

A disastrous penetration test occurs when a hacker brings down a production server because they misunderstood the scope.

We will analyze a client's Request for Proposal (RFP) to extract the operational boundaries of the engagement.

Task 1: Scoping a Penetration Test

Timing: 45 minutes

A regional bank has requested a penetration test against their main web application: app.bank.local.

  1. Draft a formal Rules of Engagement (RoE) document based on the provided RFP scenario.
  2. Identify the primary "Out of Scope" targets implicitly mentioned in the RFP (e.g., third-party payment gateways).
  3. Define an emergency "Stop-Test" procedure. What exact technical parameters dictate an immediate halt to exploitation?
Practical Resource: Penetration Testing Execution Standard (PTES)

15 Minute Break

Please return promptly for Part 2.

Part 2: Governance & Reporting

Duration: 1.5 Hours

The Law: Computer Misuse Act 1990

In the UK, hacking is governed by the CMA. The primary offenses are:

  • Section 1: Unauthorized access to computer material. (Even a port scan can theoretically violate this if deemed "unauthorized").
  • Section 2: Unauthorized access with intent to commit a further offense.
  • Section 3: Unauthorized acts with intent to impair, or with recklessness as to impairing, the operation of a computer.
"Ethical" hacking requires explicit, written authorization. Verbal permission is insufficient.

Bug Bounties & Responsible Disclosure

Crowdsourced security testing platforms (HackerOne, Bugcrowd).

  • Safe Harbor: Companies publicly state they will not pursue legal action against researchers who find flaws, provided they stay within the defined scope.
  • Bounty Economics: Rewards range from $50 (XSS on a minor domain) to $1,000,000+ (Zero-click RCE on iOS).
  • The Challenge: Duplicate reports and triage fatigue. Analysts must filter out automated scanner spam from genuine vulnerabilities.

CVSS Scoring

The Common Vulnerability Scoring System (CVSS) is the industry standard for assessing the severity of a security vulnerability.

  • Base Metrics: Attack Vector (Network vs Local), Complexity, Privileges Required.
  • Impact Metrics: Confidentiality, Integrity, Availability (CIA).
  • Scores: Range from 0.0 to 10.0. A score of 9.0+ is considered Critical and often triggers an immediate SLA response.

Introduction to Task 2

Security teams are inundated with vulnerability reports. The ability to rapidly triage and accurately score a vulnerability is a critical skill.

We will act as the internal security team triaging incoming Bug Bounty submissions.

Task 2: Bug Bounty Triage Simulation

Timing: 50 minutes

You have received two vulnerability reports from external researchers.

  1. Report A: A Reflected XSS vulnerability on a marketing landing page requiring user interaction.
  2. Report B: An unauthenticated Remote Code Execution (RCE) flaw in an internal, non-internet-facing HR database.
  3. Use the online CVSS v3.1 calculator to generate a severity score vector for both reports.
  4. Draft a professional response to "Researcher A" explaining why their payout is significantly lower than "Researcher B", despite XSS being more common.
Practical Resource: FIRST CVSS v3.1 Calculator

Summary & Next Steps

  • Ethical hacking is defined entirely by authorization and scope. Technical prowess without legal permission is a crime.
  • The CVSS framework provides a standardized language for discussing risk severity.
Next Week: Reconnaissance & Footprinting (OSINT & Active Discovery)