Posts

Week 6 - Forum Week, Vulnerability Exploitation using Metasploit

  As always, any tools, techniques, and concepts shared on this blog are strictly for educational purposes. I am not responsible for any misuse of the information or tools discussed here. All practical exercises were conducted on authorized target domains. We've spent the last few weeks footprinting, scanning, and enumerating targets. This week, we finally moved into the actual exploitation phase. For our assignment, we had to review some practical demonstrations of exploitation, specifically watching The Ultimate Metasploit Tutorial! by Hacker Joe and a Metasploit Hacking Demo featuring David Bombal. After going through the demos, I had to write up my understanding of the core concepts. Here are my submitted notes for the week: 1. What is Metasploit?   Metasploit is a core tool used in cybersecurity to test how secure a system or network actually is. It helps security professionals find weaknesses by simulating real cyberattacks in a safe and controlled way. Basically, it’s...

Week 5 - Target Enumeration and Uncovering Real IPs

As always, any tools, techniques, and concepts shared on this blog are strictly for educational purposes. I am not responsible for any misuse of the information or tools discussed here. All practical exercises were conducted on authorized target domains. Week 5 of Ethical Hacking and Penetration Testing moved us from discovering targets into actively enumerating them. Led by S. Pradono Suryodiningrat, the lecture focused on extracting highly specific information from our targets—things like network shares, active usernames, passwords, and the exact operating systems running on the machines. Here are my notes from the session, followed by the results of our practical lab assignment. The Theory: Enumerating Environments   Enumeration is an intrusive process. We looked heavily into enumerating Microsoft operating systems, specifically utilizing NetBIOS over TCP/IP (NBT). We practiced installing and using nbtscan on our Kali Linux setups to scan ranges of IP addresses. We also reviewe...

Week 4 - Target Discovery, OS Fingerprinting, and Port Scanning

 As always, a quick reminder that any tools, techniques, and concepts shared on this blog are strictly for educational purposes. I am not responsible for any misuse of the information or tools discussed here. We are officially in Week 4 of Ethical Hacking and Penetration Testing. This session was led by S. Pradono Suryodiningrat, and it was incredibly network-heavy. We shifted our focus from passive footprinting to active target discovery and enumeration. This is where you actually start interacting with the target machines. Here is a breakdown of my notes from the lecture and lab. 1. Target Discovery   Before you can scan a target, you have to find out if it is actually alive on the network. We looked at a bunch of tools used to ping and identify machines. The usual suspects: ping , arping , fping , hping , and nping . We also touched on alive6 for IPv6 environments and nbtscan for dealing with NetBIOS over TCP/IP. 2. OS Fingerprinting (Active vs. Passive)   Once you ...

Week 3 - Deep Dive into Footprinting and Burp Suite

As required by the course guidelines, any tools, techniques, and tutorials shared on this blog are strictly for educational purposes. I am not responsible for any misuse of the information or tools demonstrated here. Week 3 of Ethical Hacking and Penetration Testing got significantly more technical. We moved past the high-level theory of Target Scoping and Information Gathering and started getting our hands dirty with actual footprinting tools in our Kali Linux VMs. Here is a rundown of the practical techniques we covered. Target Scoping Realities Before launching into the tools, we discussed the logistics of scoping. It is not just about picking a target; it involves defining business objectives, establishing strict test boundaries, and setting up project management schedules. You need to know exactly what is allowed (e.g., black-box vs. white-box testing) and what is strictly off-limits before you start. Intercepting Traffic with Burp Suite One of the core practical skills this week ...

Week 2 - Target Scoping and Information Gathering

Here is a draft for your Week 2 blog post, keeping that same grounded, realistic student perspective. Just a reminder as required by the course: any tools, techniques, and concepts shared on this blog are strictly for educational purposes. I am not responsible for any misuse of the information or tools discussed here. Week 2 of Ethical Hacking is here, and my Kali Linux VM is finally set up and running smoothly. This week, we moved past the legal definitions and jumped right into the first two steps of the Kali Linux Testing Methodology: Target Scoping and Information Gathering. To prepare, our reading assignment was chapters 3 and 4 from Kali Linux: Assuring Security By Penetration Testing (KLASPT). Here are my notes on the early phases of a penetration test. Step 1: Target Scoping Before you even think about touching a network or firing up a terminal, you have to define the scope of the test. This is arguably the most important part from a legal and professional standpoint. Scoping ...

Week 1 - Intro to Ethical Hacking and Building the Lab

As required by the course guidelines, any tools, techniques, and tutorials shared on this blog are strictly for educational purposes . I am not responsible for any misuse of the information or tools demonstrated here. We just had our first session for the Ethical Hacking & Pen Test course at BINUS University International . Our lecturer, Pak Kalpin Erlangga Silaen , laid out the syllabus, the ground rules, and what we will be covering this semester. The main objective of the course is straightforward: get hands-on experience with hacking tools and penetration testing techniques . We will be walking through the complete ethical hacking cycle, which includes information gathering, enumeration, system hacking, privilege escalation, and covering tracks . Our main textbook for the semester is Mastering Kali Linux by Noah Hardy . Course Policies and Ethics One thing made very clear today is that professional ethics are non-negotiable in this field. We are actually expected to sign an a...