MCCoE — Pillar 4: Ethical Hacking Lab

Phase	HTB Machine	Skills Practiced	Difficulty
Phase 1 — Recon	Meow + Fawn	Nmap scanning, service ID, Telnet, FTP anonymous login	Very Easy
Phase 2 — Scanning	Dancing + Redeemer	SMB enumeration, smbclient, Redis enumeration	Very Easy
Phase 3 — Exploitation	Preignition + Appointment	Gobuster, default credentials, SQL injection login bypass	Easy
Phase 4 — Post-Exploitation	Sequel + Mongod	MySQL, database enumeration, MongoDB data exfiltration	Easy
Phase 5 — Reporting	Any completed machine	Professional pentest report covering all findings	Written

⚠ Legal & Ethical Boundaries — Read Before You Start

You may NEVER scan, probe, or exploit any system without explicit written permission

You may NEVER use these tools on school, workplace, or public networks without authorization

ALWAYS use TryHackMe or HackTheBox authorized machines — or your own isolated VirtualBox VM

ALWAYS document your authorization before beginning any real-world penetration test

Report every vulnerability you find — withholding findings is unethical and potentially illegal

Responsible disclosure: if you find a real vulnerability, report it to the organization privately — not on social media

Passive vs. Active Recon

Type	Description	Detection Risk
PASSIVE	Gather from public sources only. Zero contact with target systems.	Very Low
ACTIVE	Directly interact with the target — DNS queries, ping sweeps, banner grabbing.	Medium — may appear in logs

Key Recon Tools

Tool	Purpose	Free?
Google Dorking	Advanced search operators to surface exposed files, login pages, and configs	YES
WHOIS Lookup	Domain registration records — owner, registrar, nameservers, creation date	YES
theHarvester	Collects emails, subdomains, and IPs from public sources (Google, LinkedIn, Shodan)	YES — in Kali
Shodan	Search engine for internet-connected devices and open services worldwide	YES — free tier
Maltego Community	Visual OSINT mapping — link people, domains, IPs, and organizations	YES — free tier
LinkedIn / Social Media	Employee names, roles, tech stack — social engineering preparation	YES

Real-World Connection

⚡ TARGET BREACH 2013 — RECON PHASE

Attackers identified Fazio Mechanical Services — a small HVAC vendor with remote network access to Target's systems — through public procurement records and LinkedIn profiles of Target facilities staff. No packets were sent to Target's network during this phase. The entire attack plan was assembled from publicly available information. Zero technical skills required. Zero detection risk.

Exercise 1 — OSINT Challenge

🎯 Objective: Build an intelligence profile using public sources only

Option A — TryHackMe (Beginner Recommended)

01Create a free account at tryhackme.com

02Complete the "Passive Recon" room or the "OhSINT" room (both free)

03Practice Google Dorking: use the site: and filetype: operators to surface exposed files or login pages

04Use who.is to look up a domain and examine registration records

05Search Shodan (free tier) for a publicly known vulnerable device type

Option B — HackTheBox Starting Point

06Create a free account at hackthebox.com

07Navigate to Starting Point → Tier 0 and complete the "Meow" machine — guided walkthrough included

08Read the walkthrough questions carefully — they teach you what information to gather during recon

📋 DELIVERABLE — OSINT REPORT

Target Summary — name, domain, industry, estimated company size

Employee Intelligence — names, roles, departments found from public sources

Technology Stack — software or platforms identified from job postings or page metadata

Exposed Assets — files, login pages, or devices found via Dorking or Shodan

Attack Surface Summary — one paragraph: which findings pose the highest risk and why

📝 SAMPLE SUBMISSION — OSINT REPORT

Target: TryHackMe OhSINT target — "OWoodflint" persona

Employee Intel: Found Twitter handle @OWoodflint via Google search. LinkedIn showed job title "Software Developer" at a UK firm. GitHub profile revealed real name Oliver Woodflint.

Technology Stack: WordPress blog identified via page source meta tag. BSSID found in Wigle.net — geolocated to New York City area.

Exposed Asset: Personal email address found in a public GitHub commit (owoodflint@gmail.com). Password hint found in WordPress blog HTML source.

Attack Surface Summary: The target's OSINT footprint is extremely high. A real attacker could launch a targeted phishing campaign using the email, craft a convincing spear-phishing message referencing the target's employer, and attempt credential stuffing using the GitHub password hint. Highest risk: exposed email combined with reused password patterns.

📎 SUBMIT YOUR DELIVERABLE LINK — REQUIRED BEFORE MARKING COMPLETE

Types of Scanning

Scan Type	Purpose	Tool
Host Discovery	Find which IP addresses are live on the network	Nmap ping sweep
Port Scanning	Identify which TCP and UDP ports are open on a host	Nmap SYN scan
Service / Version	Determine what software runs on each open port	Nmap version detection
OS Fingerprinting	Guess the operating system from network response patterns	Nmap OS detection
Vulnerability Scanning	Match discovered services to known CVEs in the NVD database	Nessus, Nikto, OpenVAS
Web App Scanning	Find SQL injection, XSS, and misconfigurations on web targets	Nikto, Burp Suite

Common Nmap Scan Modes

Mode	What It Does
Basic port scan	Scans the 1,000 most common TCP ports on the target host
Version detection (-sV)	Identifies software name and version on each open port
OS detection (-O)	Attempts to fingerprint the operating system
Full pentest scan (-sV -O -sC)	Version, OS, and default NSE scripts — standard starting point
All ports (-p-)	Scans all 65,535 TCP ports — slower but thorough
Ping sweep (-sn)	Finds all live hosts on a subnet without port scanning

Real-World Connection

⚡ COLONIAL PIPELINE 2021 — SCANNING PHASE

DarkSide affiliates scanned the internet for exposed VPN endpoints belonging to Colonial Pipeline. They found a legacy VPN account — no MFA, password likely reused from a prior breach — that was still active and reachable. That single open port and single weak credential was the entire entry point for a $4.4 million ransom attack that shut down fuel supplies to 17 states for six days.

Exercise 2 — Nmap Scanning Lab

⚠ LEGAL REQUIREMENT

Only scan systems you own or have explicit written permission to scan. All practice must use TryHackMe, HackTheBox, or your own isolated VirtualBox VM. Unauthorized scanning violates federal law.

🎯 Objective: Scan an authorized target and produce a vulnerability findings report

Option A — TryHackMe

01Complete the "Further Nmap" room — free, fully guided, authorized targets

02Also try the "Nmap Live Host Discovery" room for deeper scanning techniques

Option B — HackTheBox Starting Point

03Study the HTB Academy — Network Enumeration with Nmap ↗ — learn scan types, flags, and output before touching a live target

04Complete "Fawn" (Tier 0) — Nmap scan reveals an open FTP port; guided questions teach you to interpret scan output

05Complete "Dancing" (Tier 0) — Nmap scan of SMB ports (445/TCP); identify the service and enumerate shares

📋 DELIVERABLE — SCANNING REPORT TABLE

Port and Protocol (example: 22 TCP, 80 TCP, 445 TCP)

Service and Version (example: OpenSSH 7.2, Apache 2.4.18)

CVE found — number from NVD if a known vulnerability exists

CVSS Score — severity score from 0 to 10

Risk Rating — Critical, High, Medium, or Low

Recommended Fix — patch, disable, or reconfigure

📝 SAMPLE SUBMISSION — SCANNING REPORT

21/TCP — vsftpd 2.3.4 — CVE-2011-2523 — CVSS 10.0 — CRITICAL — Patch immediately: upgrade to vsftpd 3.0+

22/TCP — OpenSSH 4.7p1 — CVE-2008-0166 — CVSS 7.8 — HIGH — Replace with OpenSSH 8.9+; disable weak key algorithms

80/TCP — Apache 2.2.8 — CVE-2017-7679 — CVSS 9.8 — CRITICAL — Upgrade to Apache 2.4.54+; disable mod_mime

445/TCP — Samba 3.0.20 — CVE-2007-2447 — CVSS 10.0 — CRITICAL — Upgrade Samba immediately; restrict SMB access by firewall

3306/TCP — MySQL 5.0.51a — CVE-2008-0226 — CVSS 7.5 — HIGH — Patch to MySQL 8.0+; disable remote root login

Exercise 2b — Web Enumeration

🎯 Objective: Discover hidden directories, files, and entry points on a web target

Option A — TryHackMe

01Complete the "Content Discovery" room — covers manual, automated, and OSINT-based discovery of hidden web content

02Complete the "Web Fundamentals" room to understand HTTP requests, response codes, and how web applications are structured

Option B — HackTheBox Starting Point

03Complete "Ignition" (Tier 1) — find a hidden admin login page and gain access using a default credential

04Complete "Bike" (Tier 1) — Server-Side Template Injection on a Node.js app; introduces web vulnerability concepts beyond basic scanning

📋 DELIVERABLE — WEB ENUMERATION FINDINGS

List of hidden directories or files discovered — path and HTTP status code for each

Admin or login pages found — URL and what technology is running it

Any default credentials that worked — username, password, and what access they granted

Risk Assessment — one sentence on why exposed admin panels are dangerous in production

📎 SUBMIT YOUR DELIVERABLE LINK — REQUIRED BEFORE MARKING COMPLETE

Common Exploitation Techniques

Technique	Description	Example
CVE Exploitation	Exploit a known, unpatched software vulnerability	Equifax Apache Struts — no authentication required
Password Attacks	Brute force, credential stuffing, or dictionary attacks	Automated login attempts against SSH or web forms
Social Engineering	Manipulate people into revealing credentials or clicking malicious links	Phishing emails, vishing phone calls
SQL Injection	Insert malicious database code into input fields to access data	DVWA SQL injection practice lab
Cross-Site Scripting	Inject JavaScript into web pages to steal sessions or redirect users	PortSwigger Web Security Academy XSS labs
Metasploit Modules	Pre-built exploit framework with hundreds of attack modules	vsftpd 2.3.4 backdoor on Metasploitable2

Key Exploitation Tools

Tool	Purpose	Free?
Metasploit Framework	Industry-standard exploit and post-exploitation platform	YES — Community
Burp Suite Community	Web application proxy — intercept and modify HTTP traffic	YES — Community
Hydra	Fast multi-protocol password brute-force tool	YES — in Kali
SQLmap	Automated SQL injection detection and database extraction	YES — in Kali
DVWA	Damn Vulnerable Web Application — safe local practice target	YES — free download

Real-World Connection

⚡ EQUIFAX 2017 — EXPLOITATION PHASE

Attackers exploited CVE-2017-5638 — a critical remote code execution flaw in Apache Struts. The CVE was published March 7, 2017 with a patch available the same day. Equifax was breached on May 13, 2017 — 69 days after the patch was released. The exploit required zero authentication and could be triggered with a single crafted HTTP request. Result: 147 million Americans had their Social Security numbers, birthdates, and financial data stolen.

Exercise 3 — Exploitation Lab

🎯 Objective: Exploit a known vulnerability on an authorized target

Option A — TryHackMe (Beginner Recommended)

01Complete the "Basic Pentesting" room — free, fully guided, authorized

02Complete the "OWASP Top 10" room for hands-on web application exploitation

03Document every step — what you tried, what succeeded, and what failed, with screenshots

Option B — HackTheBox Starting Point

04Study the HTB Academy — Service Enumeration ↗ — understand how to identify services and versions before exploiting them

05Complete "Appointment" (Tier 1) — SQL injection exploitation against a login form; no Metasploit needed

06Complete "Sequel" (Tier 1) — MySQL exploitation with unauthenticated access; practice extracting database content

📋 DELIVERABLE

Screenshot proof of successful access — a command shell or Meterpreter session

Exploit used: name, CVE number, and plain-English explanation of the vulnerability

Access level gained: standard user, root, or administrator

One paragraph: what could a real attacker accomplish with this level of access?

📝 SAMPLE SUBMISSION — EXPLOITATION

Platform: TryHackMe — "Basic Pentesting" room

Exploit Used: SSH brute-force via Hydra against port 22. Username discovered from SMB enumeration (enum4linux). CVE: N/A — weak credential, not a software vulnerability.

Access Gained: Standard user shell as "jan". Ran "whoami" — output: jan. Ran "id" — output: uid=1000(jan) gid=1000(jan) groups=1000(jan).

Impact Analysis: A real attacker with this access level could read all files owned by the jan account, attempt privilege escalation to root, enumerate running services, and establish persistence via a cron job or SSH key. The weak password (123456) on an internet-facing SSH port would be discovered by an automated scanner within minutes of deployment.

Exercise 3b — Web Application Attacks

⚠ AUTHORIZED PLATFORMS ONLY

PortSwigger Web Academy and TryHackMe provide fully isolated, legal targets. Never attempt these techniques on any real website — SQL injection and XSS against unauthorized targets is a federal crime.

🎯 Objective: Exploit SQL injection and XSS vulnerabilities on authorized practice targets

Option A — PortSwigger Web Security Academy (Free)

01Create a free account at portswigger.net/web-security

02Complete SQL Injection — Lab 1: retrieve hidden data by injecting into a search query — no tools needed, just your browser

03Complete Reflected XSS — Lab 1: inject a script tag into a search parameter and confirm it executes in the browser

Option B — TryHackMe

04Complete the "SQL Injection" room — covers in-band, blind, and time-based injection with hands-on live targets

05Complete the "Cross-site Scripting" room — reflected, stored, and DOM-based XSS in a live browser environment

📋 DELIVERABLE — WEB ATTACK REPORT

SQL Injection: the exact payload you used, what data came back, and why the query broke

XSS: the script you injected, where it executed, and what a real attacker could steal with it

Business Impact: one paragraph — what real data or accounts could be compromised using these two techniques?

Remediation: how a developer fixes each — parameterized queries for SQLi, output encoding for XSS

📝 SAMPLE — SQL INJECTION FINDING

Target: PortSwigger Lab — "SQL injection vulnerability in WHERE clause allowing retrieval of hidden data"

Payload: ' OR 1=1-- injected into the category parameter. The query became: SELECT * FROM products WHERE category='Gifts' OR 1=1--' AND released=1

Result: All products returned including unreleased items. 1=1 is always true, and -- commented out the released=1 filter entirely.

Remediation: Use parameterized queries. Replace string concatenation with: SELECT * FROM products WHERE category=? AND released=1 — user input is passed as a bound parameter and can never alter the query structure.

📎 SUBMIT YOUR DELIVERABLE LINK — REQUIRED BEFORE MARKING COMPLETE

Key Post-Exploitation Concepts

Concept	Definition	Example
Persistence	Mechanisms that survive system reboots and session timeouts	Registry startup keys, scheduled tasks, backdoor user accounts
Lateral Movement	Moving from the initial host to other systems on the network	Pass-the-hash, Remote Desktop pivoting, SMB share access
Privilege Escalation	Gaining higher permissions than initially obtained	Escalating from standard user to root or SYSTEM
Command and Control (C2)	Maintaining a communication channel for attacker instructions	Reverse shell, Metasploit multi-handler, Cobalt Strike
Pivoting	Using a compromised host to reach otherwise inaccessible systems	Port forwarding through an active Meterpreter session
Living Off the Land	Using built-in OS tools instead of custom malware to avoid detection	PowerShell, WMI, certutil — all built into Windows

Real-World Connection

⚡ SOLARWINDS 2020 — PERSISTENCE PHASE

After gaining initial access via the poisoned Orion software update, attackers maintained presence for 9 months across approximately 100 high-value targets including US Treasury, Commerce, and Homeland Security departments. They used SAML token forgery for persistent cloud access, scheduled tasks for local system persistence, and lived off the land — using PowerShell, WMI, and other built-in Windows tools to avoid triggering antivirus. Some organizations did not discover the compromise for over a year.

Exercise 4 — Post-Exploitation Lab

🎯 Objective: Demonstrate 2+ post-exploitation techniques from Exercise 3 access

Option A — TryHackMe

01Complete the "Post-Exploitation Basics" room — covers hashdump, Mimikatz, persistence techniques

02Complete the "Linux Privilege Escalation" room for escalation techniques on Linux targets

Option B — HackTheBox

03Complete "Blue" — EternalBlue (MS17-010) exploitation; post-exploit to dump hashes and escalate to SYSTEM

04Complete "Unified" (Starting Point Tier 2) — demonstrates persistence via a planted SSH key after initial access

📋 DELIVERABLE

Initial Access Level — what user account and permissions did you start with?

Privilege Escalation — method used, and what level did you reach?

Network Discovery — what other hosts or services were visible from inside the system?

Credentials Found — any usernames or hashes discovered (document only — do not crack)

Persistence Plan — what method would a real attacker use to guarantee return access? Describe it.

📝 SAMPLE SUBMISSION — POST-EXPLOITATION

Initial Access: Standard user "jan" via SSH brute-force. uid=1000, no sudo permissions initially.

Privilege Escalation: Ran "sudo -l" — discovered jan can run /bin/cat as root with no password. Used this to read /etc/shadow and retrieve root password hash. Escalated to root using the cracked hash. Final level: root (uid=0).

Network Discovery: Ran "arp -a" from root shell — found 3 additional hosts on 192.168.1.0/24. Identified a Windows host at 192.168.1.50 running SMB on port 445.

Credentials Found: /etc/shadow retrieved — 4 password hashes documented. Not cracked. Hashes saved to notes for reporting only.

Persistence Plan: A real attacker would add an SSH public key to /root/.ssh/authorized_keys for keyless re-entry. This method survives password changes and persists across reboots with no new open ports or services that would trigger alerts.

📎 SUBMIT YOUR DELIVERABLE LINK — REQUIRED BEFORE MARKING COMPLETE

Professional Pentest Report Structure

Section	What to Include
Executive Summary	Non-technical overview: what was tested, overall risk rating, top 3 findings. Written for leadership — no jargon.
Scope and Rules of Engagement	Systems in scope, what was off-limits, test dates, authorization reference document
Methodology	Which of the 5 phases were performed, tools used, and general approach
Findings Summary Table	All vulnerabilities ranked: Critical, High, Medium, Low, Informational
Detailed Findings	Per vulnerability: description, screenshot evidence, CVSS score, business impact, step-by-step remediation
Recommendations	Prioritized fix list — Critical and High first, specific and actionable
Appendix	Full tool output, raw scan results, and complete evidence logs

Risk Rating Reference

Rating	CVSS Score	Meaning	Real Example
Critical	9.0 – 10.0	Remote code execution, full compromise, no auth required	EternalBlue MS17-010, Log4Shell
High	7.0 – 8.9	Significant data exposure, may require some conditions	SQL injection with full database dump
Medium	4.0 – 6.9	Limited impact or requires user interaction	Stored XSS, weak password policy
Low	0.1 – 3.9	Minimal direct impact, informational value	Verbose error messages, version banners
Info	N/A	No direct risk but a best-practice concern	HTTP where HTTPS is recommended

Exercise 5 — Write Your Pentest Report

🎯 Objective: Turn Exercises 1–4 into a professional client-ready report

01Use the MCCoE Executive Summary Template as your starting document (download below)

02Write an Executive Summary — one page maximum, readable by a non-technical executive in two minutes

03Create a Findings Summary Table ranking all vulnerabilities you discovered with severity ratings

04Write a Detailed Finding for your highest-severity vulnerability: description, screenshot, CVSS score, business impact, and step-by-step remediation

05Close with a prioritized Recommendations section — most critical fixes first

06Reference TryHackMe "Wreath" or "Report Writing for Pentesters" for professional report structure guidance

CRITERIAFULL CREDITPARTIALPOINTS

Executive SummaryClear, non-technical, covers scope and top riskToo technical or missing elements20

All 5 Phases DocumentedEach phase documented with specific actions3–4 phases covered30

Findings TableAll findings rated with CVSS scoresSome ratings missing15

Detailed FindingDescription, proof, impact, remediationMissing one element20

RecommendationsPrioritized and actionableGeneric or unordered15

TOTAL100 pts

📝 SAMPLE — EXECUTIVE SUMMARY PARAGRAPH

Overall Risk Rating: HIGH

On August 14, 2026, an authorized penetration test was conducted against the Metasploitable2 training environment. Testing covered all five phases of a standard penetration test. Five vulnerabilities were discovered: two rated Critical, two High, and one Medium. The most severe finding was CVE-2011-2523 (vsftpd 2.3.4 backdoor) — a remotely exploitable vulnerability requiring no authentication that resulted in full root-level system access. An attacker exploiting this flaw would have complete control of the server and all data stored on it. Immediate patching of all Critical and High findings is strongly recommended before this system is connected to any production or campus network.

📝 SAMPLE — DETAILED FINDING ENTRY

Finding: vsftpd 2.3.4 Backdoor Command Execution

CVE: CVE-2011-2523 | CVSS Score: 10.0 | Severity: CRITICAL

Description: vsftpd version 2.3.4 contains a deliberately planted backdoor. When a username containing a smiley face string ":)" is sent, the server opens a command shell on port 6200. No password is required.

Evidence: [Screenshot of Metasploit session output showing root shell — see Appendix A]

Business Impact: Full root access to the server. An attacker could exfiltrate all data, install ransomware, pivot to other systems, or destroy the host entirely.

Remediation: Immediately upgrade vsftpd to version 3.0.5 or later. Verify package integrity before deployment. Block port 6200 at the firewall as a secondary control.

📎 SUBMIT YOUR PENTEST REPORT LINK — REQUIRED BEFORE MARKING COMPLETE

🏁

CAPSTONE CHALLENGE

All 5 phases. One target. One report. Pick a TryHackMe room, work through it end-to-end while documenting every action across all 5 phases, then deliver a professional pentest report as your final submission.

▶ Launch HTB Starting Point ▶ Launch TryHackMe ⬇ Download Lab Guide

Recommended Rooms by Difficulty

Basic Pentesting

BEGINNER

Phases: 1, 2, 3, 5

Best first full pentest experience. Start here if you've never done this before.

RootMe

BEGINNER

Phases: 2, 3, 4

File upload exploitation and Linux privilege escalation. Clean and well-guided.

Mr. Robot CTF

INTERMEDIATE

Phases: 1, 2, 3, 4, 5

All 5 phases. Excellent recon phase. Themed after the TV show — iconic room.

Vulnversity

BEGINNER–INT

Phases: 2, 3, 4

Web exploitation and Linux privilege escalation. Great Metasploit practice.

Blue (EternalBlue)

BEGINNER

Phases: 2, 3, 4

Experience the exact MS17-010 exploit used in the WannaCry ransomware attack.

Pickle Rick

BEGINNER

Phases: 1, 2, 3

Web enumeration + command injection. Short, fun, and teaches directory busting. Great for practicing Exercise 2b skills.

OWASP Juice Shop

INTERMEDIATE

Phases: 2, 3, 5

Real Node.js web app with 100+ vulnerabilities. SQL injection, XSS, broken auth — closest thing to attacking a real web application.

Anthem

BEGINNER

Phases: 1, 2, 3

Windows-based. OSINT recon reveals credentials, then RDP access. Great for practicing the full Phase 1 → Phase 3 flow on a Windows target.

HackTheBox — Recommended Machines

Create a free account at hackthebox.com · Starting Point machines are fully guided and free

Meow / Fawn / Dancing ↗

STARTING POINT

Phases: 1, 2

Tier 0 guided machines. Teaches Telnet, FTP, and SMB scanning from scratch — perfect first HTB experience.

Appointment / Sequel ↗

STARTING POINT

Phases: 2, 3

Tier 1 machines covering SQL injection exploitation — no Metasploit needed. Great web app intro.

Blue (MS17-010) ↗

BEGINNER

Phases: 2, 3, 4, 5

EternalBlue exploit. Nmap scan → Metasploit exploit → hashdump → full report. All 5 phases in one machine.

Legacy ↗

BEGINNER

Phases: 1, 2, 3, 5

Classic Windows SMB vulnerabilities (MS08-067). Excellent for capstone — clear attack path and report structure.

Lame ↗

BEGINNER

Phases: 2, 3, 4, 5

Samba 3.0.20 exploit (CVE-2007-2447). Instant root via Metasploit. Great for practicing post-exploitation documentation.

Three ↗

STARTING POINT

Phases: 1, 2, 3

Tier 1 — AWS S3 bucket misconfiguration leads to a web shell upload. Real-world cloud attack vector used in actual breaches.

Crocodile ↗

STARTING POINT

Phases: 2, 3

Tier 1 — FTP anonymous login leaks credentials; those same credentials unlock a web admin panel. Teaches credential reuse attacks.

Capstone Deliverables

📋 WHAT TO SUBMIT

Phase-by-Phase Log — running document of every action taken, tool used, and output observed

Professional Pentest Report — full report following Exercise 5 structure, minimum 3 pages

Risk Summary — overall risk rating for the target machine with written justification

Remediation Roadmap — numbered list of recommended fixes in priority order

COMPONENTDESCRIPTIONREQUIREMENTPOINTS

Phase DocumentationAll 5 phases documented with specific actionsAll 5 required30

Executive SummaryClear, non-technical, 1 page maxLeadership-readable15

Findings TableAll vulnerabilities rated with CVSS scoresComplete table15

Detailed FindingWith proof, impact, and remediationHighest severity25

RecommendationsPrioritized and actionableOrdered by urgency15

TOTAL100 pts

Free Practice Platforms

TryHackMe

Guided beginner to intermediate rooms. Best place to start — fully authorized targets.

Hack The Box ↗

Starting Point machines are free and fully guided. Click to open HTB directly.

PicoCTF

Beginner CTF challenges covering cryptography, forensics, and web exploitation.

PortSwigger Web Academy

The best free web application security lab available — SQL injection, XSS, and more.

DVWA

Damn Vulnerable Web App — install locally for safe SQL injection and XSS practice.

Metasploitable2

Intentionally vulnerable Linux VM. Run in VirtualBox on host-only network only.

Legal and Ethical Boundaries

You may NEVER scan, probe, or exploit any system without explicit written permission

You may NEVER use these tools on school, workplace, or public networks without authorization

ALWAYS use TryHackMe authorized machines or your own isolated VirtualBox VM for all practice

ALWAYS document your authorization before beginning any real-world penetration test

Report every vulnerability you find — withholding findings is unethical and potentially illegal

Responsible disclosure: if you find a real vulnerability, report it to the organization privately — not on social media

📎 SUBMIT YOUR CAPSTONE REPORT LINK — REQUIRED BEFORE MARKING COMPLETE

🏠 Back to Hub

Ethical Hacking Hands-On Lab

Ethical Hacking
Hands-On Lab