← Cybersecurity Professional Programme

Module 03Offensive4.5 weeks

Offensive Security

Build the mindset and foundational technical capability of an ethical hacker — understanding how attackers find and exploit weaknesses, always within a strict framework of authorization and legality, so those same weaknesses can be found and fixed before real attackers exploit them.

01

Learning outcomes

  • Understand core ethical hacking concepts and the standard penetration testing process
  • Perform basic reconnaissance using open-source information
  • Understand common web application vulnerabilities at a conceptual level
  • Understand basic network infrastructure testing concepts
  • Understand what Active Directory is and common categories of weakness within it
02

What this module covers

Ethical hacking conceptsReconnaissance techniquesWeb application securityNetwork infrastructure testingActive Directory concepts
03

Lessons

Lesson 1A Note on Ethics and Legality — Read First

Everything in this module is taught for one purpose: to test systems you have explicit, documented authorization to test — your own lab environments, dedicated legal practice platforms (like TryHackMe or Hack The Box), or a real system only under a signed engagement agreement (a “scope of work” and written permission) as part of legitimate, authorized penetration testing work.

Unambiguous and non-negotiable

Using these same techniques against any system without explicit authorization is illegal in virtually every jurisdiction, regardless of intent — “I was just curious” or “I was trying to help” is not a legal defense. This isn't a bureaucratic formality; it's the single most important professional boundary in offensive security work. Every lab in this module uses only your own environment or dedicated legal practice platforms built specifically for this purpose.

Lesson 2Ethical Hacking Concepts

“Ethical hacking” describes using the same techniques and mindset as a malicious attacker, but with authorization, for the purpose of finding and reporting weaknesses so they can be fixed. This is formally often called penetration testing (“pen testing”).

The standard penetration testing process, taught as a repeatable framework:

  • 1. Reconnaissance — gathering information about the target (covered in depth in the next lesson)
  • 2. Scanning/Enumeration — identifying live systems, open ports, and running services
  • 3. Gaining Access — attempting to exploit identified weaknesses to gain some level of access
  • 4. Maintaining Access (in real engagements) — understanding how attackers try to keep access, so defenders know what to look for (Module 4 covers detecting this directly)
  • 5. Covering Tracks (in real engagements) — understanding how attackers attempt to hide evidence, again primarily so defenders know what to look for
  • 6. Reporting — the deliverable of a real professional engagement: a clear, actionable report describing what was found, how it was found, and how to fix it

Step 6 is the step beginners most often underweight

In professional offensive security work, the report is the actual product being delivered. A brilliant technical exploit that never gets clearly documented and communicated to the client provides zero value; the client can't fix what they don't understand. This reframes the entire discipline correctly from the start: offensive security is fundamentally a communication and documentation profession built on top of technical skill, not technical skill alone.

Lesson 3Reconnaissance Techniques

Reconnaissance (“recon”) is the information-gathering phase — building a picture of a target before attempting anything technical. This connects directly back to Module 2's OPSEC lesson, viewed now from the attacker's side of that same coin.

  • Passive reconnaissance — gathering information without directly interacting with the target's systems, using publicly available sources (also called OSINT — Open Source Intelligence). This includes things like company websites, employee LinkedIn profiles, public DNS records, and search engine results.
  • Active reconnaissance — directly interacting with the target's systems to gather information (e.g., basic network scanning) — this crosses into territory that requires authorization, since it involves actual interaction with target infrastructure, unlike passive recon which uses only already-public information.

An “aha” moment worth naming directly

The personal OPSEC review you already did on yourself in Module 2 is, functionally, exactly the passive reconnaissance process being taught here, just applied to a different target. You have already practiced this skill without realizing it.

Lesson 4Web Application Security — Conceptual Overview

Web applications are one of the most common targets in real-world offensive security work, since they're often internet-facing and directly handle sensitive user data. This lesson covers major vulnerability categories at a conceptual level — understanding what they are and why they matter, which is the necessary foundation before any hands-on exploitation practice on legal training platforms.

  • Injection vulnerabilities (e.g., SQL injection) — occur when untrusted user input is processed by a system in a way that lets an attacker manipulate how that system behaves, rather than just supplying ordinary data
  • Broken authentication — weaknesses in how a system verifies user identity, potentially allowing an attacker to bypass login controls or hijack another user's session
  • Cross-Site Scripting (XSS) — occurs when an application allows untrusted input to be rendered as active code in another user's browser, potentially letting an attacker run malicious scripts in that user's session

Keep this conceptual and pattern-focused

The goal at this stage is recognizing why these vulnerability categories exist (almost always: a system trusting input it shouldn't) and what risk they represent — the foundation for the guided, hands-on labs on legal practice platforms referenced in this module's activity. Understanding why a vulnerability class exists conceptually is what allows you to later recognize novel variations of it, rather than only memorizing one specific technique.

Lesson 5Network Infrastructure Testing

Beyond web applications, offensive security also involves testing the underlying network infrastructure itself — the servers, devices, and services that make up an organization's environment.

  • Port scanning — identifying which network ports on a target system are open, and what service is running on each (e.g., a web server typically listens on port 80 or 443)
  • Service enumeration — once open ports and services are identified, determining specific versions and configurations, since known weaknesses are often tied to specific outdated software versions
  • Vulnerability scanning — using automated tools to check identified services against databases of known vulnerabilities

The “front door survey”

Before anything else, an assessor needs to know what's actually reachable and running before considering how any of it might be weak. This lesson is deliberately kept at the conceptual/process level; the actual hands-on tool use happens in this module's guided lab activity, using your own isolated lab environment.

Lesson 6Active Directory — Concepts and Common Weakness Categories

Active Directory (AD) is Microsoft's system for managing users, computers, and permissions across an organizational network — used extremely widely in real corporate environments, which makes it one of the most common and valuable targets in real-world offensive security engagements.

  • What AD actually manages: user accounts, group memberships, permissions, and trust relationships across an organization's network
  • Why AD is such a high-value target: compromising the right account or misconfiguration within AD can potentially grant broad access across an entire organization's network, not just one system
  • Common weakness categories (conceptual level): misconfigured permissions, weak or reused credentials, outdated trust relationships between systems

Appropriately introductory

AD exploitation is a genuinely deep specialization within offensive security that extends well beyond this module — the goal here is that you understand why AD matters so much and recognize the general shape of common weakness categories, building the conceptual foundation for deeper, more advanced study later if this becomes a specific area of interest.

04

Guided hands-on activity

Guided Reconnaissance and Practice Platform Lab

  1. 1.Part 1 — Choose a company that has explicitly published a public “bug bounty” or security research scope (many major companies publish these) — this ensures the target has explicitly authorized this kind of activity.
  2. 2.Using only publicly available information (company website, public job postings, public DNS lookup tools, search engines), build a short reconnaissance profile: what technologies does the company appear to use, what subdomains can be found publicly, what does their public-facing infrastructure appear to look like?
  3. 3.Document findings clearly, as if this were the first section of a professional report.
  4. 4.Part 2 — Create an account on a legal, purpose-built practice platform (such as TryHackMe or Hack The Box), which provide dedicated, intentionally vulnerable environments specifically built for hands-on learning.
  5. 5.Complete a beginner-level guided room/challenge covering basic port scanning and service enumeration.
  6. 6.Complete a beginner-level guided room/challenge covering one basic web application vulnerability category from the lesson.
  7. 7.Write a short summary report of what was found and how, practicing the reporting discipline from Lesson 1.

Teaching point

Success criteria: a clear, professionally-written passive reconnaissance profile exists using only public information about an explicitly in-scope target, and at least two guided practice-platform challenges have been completed with a written summary — demonstrating you can both gather information responsibly and apply basic technical testing skills within a fully legal, authorized environment.

05

Knowledge Check

Question 1 of 6

What is the primary difference between “ethical hacking” and malicious hacking?