Skip to content

Exercises: Module 01 — Introduction to Ethical Hacking

Instructions

Complete each exercise in order. Exercises increase in difficulty. All exercises use legal, authorized environments only — your local DVWA, CTF platforms, or conceptual/written responses. No real-world systems are involved.

Easy Exercises (1–3)

Exercise 1

Difficulty: Easy Objective: Identify whether a given scenario is authorized or unauthorized security testing

For each scenario below, state whether it is (A) authorized and legal, (B) unauthorized and illegal, or (C) a gray area requiring more information. Explain your reasoning in one sentence.

  1. You set up DVWA on your own laptop using Docker and run SQLmap against it.
  2. You find a website for a local coffee shop and notice the URL has ?id=1. You change it to ?id=2 to see what happens.
  3. You are participating in a HackTheBox challenge machine and use Metasploit to exploit it.
  4. Your friend gives you verbal permission to "test" their website. You run a port scan.
  5. You discover a login page for a government website and want to test if it is vulnerable to SQL injection because you want to report it responsibly.
  6. You are a bug bounty hunter and find a vulnerability in shop.example.com. The program scope lists *.example.com. You test shop.example.com.
  7. Same as above, but you then test hr.example.com which you found via subdomain enumeration.

Exercise 2

Difficulty: Easy Objective: Map the security domains to real-world headlines

Match each security incident below to the primary security domain it represents (web application, network, cloud, social engineering, mobile, IoT, supply chain):

  1. Attackers sent an email to a finance employee pretending to be the CEO, requesting an urgent wire transfer of $500,000.
  2. A hospital's HVAC system was found to have a default password and was accessible from the internet.
  3. An attacker found an AWS S3 bucket with public read access containing customer SSNs.
  4. A vulnerability in the login form of an e-commerce site allowed attackers to log in as any user.
  5. Attackers poisoned a software update package for a widely used IT management tool, gaining access to 18,000 organizations.
  6. A banking app for Android was found to store session tokens in plain text on the device filesystem.
  7. An attacker on the same hotel Wi-Fi network intercepted unencrypted HTTP traffic from other guests.

Exercise 3

Difficulty: Easy Objective: Set up and verify your lab environment

Set up your practice environment by completing the following checklist. For each item, write one sentence confirming you completed it or explaining what you found.

  • Install VirtualBox (free) or confirm you have a virtualization solution
  • Download and install Kali Linux as a VM (or confirm Parrot OS / WSL Kali is available)
  • Start DVWA using Docker (docker run --rm -d -p 80:80 vulnerables/web-dvwa) and confirm you can log in at http://localhost with credentials admin/password
  • Create a free account on TryHackMe (tryhackme.com) or HackTheBox (hackthebox.com)
  • Verify nmap is installed in your Kali/security environment by running nmap --version

Write your environment setup notes here:

Virtualization: [your answer]
Kali/Parrot/WSL: [your answer]
DVWA running: [yes/no, and any notes]
CTF platform: [TryHackMe / HackTheBox / both — your username or confirmation]
nmap version: [output of nmap --version]

Medium Exercises (4–6)

Exercise 4

Difficulty: Medium Objective: Apply the attacker's mindset to analyze a simple web feature

You are performing an authorized penetration test of a fictional e-commerce site. You find the following URL in the application:

https://shop.example.com/product?id=42&category=electronics

And a form on the checkout page:

<form action="/checkout" method="POST">
  <input type="hidden" name="price" value="29.99">
  <input type="hidden" name="product_id" value="42">
  <input type="text" name="quantity" placeholder="Quantity">
  <input type="submit" value="Buy Now">
</form>
  1. List at least 5 specific assumptions the developer may have made that could be wrong.
  2. For each assumption, describe what an attacker would test.
  3. For the price hidden field specifically: what is the vulnerability class, and how would a developer correctly fix it?

Exercise 5

Difficulty: Medium Objective: Write a Rules of Engagement summary

You have been hired to conduct a penetration test of a fictional company, "Acme Corp." Their scope is:

  • In scope: acme.com, shop.acme.com, api.acme.com, IP range 203.0.113.0/24
  • Out of scope: hr.acme.com, third-party payment processor, physical offices
  • Testing window: Monday–Friday, 09:00–18:00 EST
  • Prohibited: DoS testing, social engineering of employees, modifying production data

Write a one-paragraph Rules of Engagement summary in plain English that you would include in your penetration test report's introduction section.

Exercise 6

Difficulty: Medium Objective: Research and summarize a real-world security incident

Choose one of the following incidents and write a 200–300 word summary covering: (a) What happened technically, (b) which security domain it falls into, © what vulnerability was exploited, (d) how it could have been prevented:

  • The Equifax breach (2017)
  • The Morris Worm (1988)
  • Stuxnet (2010)
  • Log4Shell / CVE-2021-44228 (2021)
  • The SolarWinds supply chain attack (2020)

Hard Exercises (7–8)

Exercise 7

Difficulty: Hard Objective: Perform authorized recon on your own DVWA instance

Using your local DVWA installation (which you have full authorization to test), perform the following reconnaissance steps and document each result:

# Step 1: Identify what's running on your local machine
nmap -sV -p 80,443,3306,8080 127.0.0.1

# Step 2: Use Gobuster to find hidden directories
# Install first if needed: sudo apt install gobuster
# Use the common.txt wordlist: /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://localhost -w /usr/share/wordlists/dirb/common.txt

# Step 3: Manually explore the DVWA application and list:
# - Every URL/path you can find
# - Every form and its fields
# - Every parameter in URLs

Document your findings in this format:

Nmap Results:
[paste output here]

Gobuster Results (first 20 lines):
[paste output here]

Manual Exploration — Paths Found:
[list paths]

Manual Exploration — Forms Found:
[list forms and their fields]

Manual Exploration — URL Parameters Found:
[list parameters]

Exercise 8

Difficulty: Hard Objective: Build the attacker's mindset using a threat model

You are reviewing the design of a simple web application — a personal blog with the following features: user registration and login, post creation (markdown supported), public comments (no login required), and an admin dashboard accessible at /admin.

Draw (using ASCII art or a text description) a simple threat model diagram showing: 1. The assets (what is valuable) 2. The trust boundaries (where the system trusts input from users) 3. At least 6 potential attack entry points 4. For each entry point, name the vulnerability class it could be susceptible to

Example format: 

ASSET: [name] — VALUE: [why it's valuable]
ENTRY POINT: [what it is] — POTENTIAL VULNERABILITY: [class]

Expert Exercise (9)

Exercise 9

Difficulty: Expert Objective: Analyze a real-world CVE and write a structured finding summary

Research CVE-2021-44228 (Log4Shell) using public sources only (NVD, LunaSec blog post, CISA advisory). Write a structured vulnerability finding summary in penetration test report format:

FINDING: [Vulnerability Name]
SEVERITY: [Critical / High / Medium / Low] — CVSS Score: [X.X]
AFFECTED COMPONENT: [What is affected]
DESCRIPTION:
[2-3 paragraphs explaining what the vulnerability is, how it works technically,
and why it is significant]

PROOF OF CONCEPT SUMMARY:
[Describe (do NOT provide working exploit code) how an attacker demonstrated
the vulnerability — what input triggers it and what effect it has]

IMPACT:
[What could an attacker achieve by exploiting this?]

REMEDIATION:
[What did vendors recommend? What are the defense-in-depth mitigations?]

REFERENCES:
[List your sources with URLs]

This exercise teaches the professional skill of translating a raw CVE into a client-facing finding — one of the most important skills for a penetration test consultant.