Build a Beginner Ethical Hacking Environment

Begin your Ethical Hacking journey. This documentation shares tricks and free software available to start the journey. There are several tutorials, AI can also assist, to help setup and learn the craft. This is an exciting, frustrating and overall challenge but is rewarding.

Students and individuals have inquired "How do I get started?"

• Check out the Cybersecurity mentoring notes

Checklist for setting up your own environment.

• Setup your environment : get started here Computer Resources
• Update your local VM docker instance to use network address vs. localhost for JuiceShop : start here
• Getting started **hacking ** your JuiceShop and learn more about how to solve flags: start here
• https://vagrantcloud.com/api/v2/vagrant/bento/ubuntu-22.04

Automated server building using Vagrant by Hashicorp, embedded vulnerable container apps

• YouTube covering building a machine

• Ubuntu 22.04 Vagrant Environment for M-Series MacBooks

  • JuiceShop
  • DVWA
  • OWASP WebGoat
  • VAmPI
  • musashi-js
  • vuln-bank

My YouTube Channel

• YouTube channel building environments videos and other things I have became obsessed with.

YouTube videos to get started in order

• #1 - Build Beginner Ethical Hacking Envionment with OWASP JuiceShop
• #2 - Build Ubuntu server with Vagrant on MacBook with sample vulnerable applications
• #3 - Getting Started hacking your local JuiceShop instance

Misc Pentesting steps

Part of a penetration test is checking for malware vulnerabilities. When performing a penetration test, the penetration tester follows a set of steps:

1. Scan for open ports.
2. Scan for running processes.
3. Check for suspicious or unknown registry entries.
4. Verify all running Windows services.
5. Check startup programs.
6. Look through event log for suspicious events.
7. Verify all installed programs.
8. Scan files and folders for manipulation.
9. Verify that device drivers are legitimate.
10. Check all network and DNS settings and activity.
11. Scan for suspicious API calls.
12. Run anti-malware scans.
13. Document results and findings.
14. Run a full TCP port sweep with masscan to quickly identify exposed services at scale.
15. Validate masscan findings with nmap -sV -sC to confirm versions and default script results.
16. Use nmap -O and service fingerprinting to identify unexpected operating systems and hosts.
17. Run targeted nmap NSE vulnerability checks (for SMB, RDP, HTTP, SSL/TLS, and DNS).
18. Use nmap UDP scans (-sU) for high-risk services like DNS, SNMP, and NTP.
19. Identify weak TLS ciphers and certificate issues on exposed HTTPS services.
20. Check SMB shares, signing settings, and anonymous access exposures.
21. Audit RDP and SSH hardening (MFA, lockout policy, weak auth settings, legacy protocol support).
22. Enumerate local admins and privileged groups for unauthorized or stale accounts.
23. Verify scheduled tasks and cron jobs for persistence mechanisms and suspicious commands.
24. Inspect PowerShell logs and command history for encoded or obfuscated execution patterns.
25. Baseline outbound connections and detect beaconing to unknown IPs/domains.
26. Inspect DNS query logs for tunneling patterns, DGA-like domains, and unusual record types.
27. Check endpoint security controls (EDR/AV/firewall) for tampering, disabled agents, or policy drift.
28. Re-test remediated findings and record evidence (commands, output, timestamps, and risk ratings).