Business and technology qualifications, Levels 3-6, in Brussels. Explore qualifications
Portal login

Ethical Hacking

CYB504

Course CodeCYB504
ECTS

Course Description

This unit aims to provide learners with the knowledge and skills required to identify and exploit vulnerabilities in cyber systems through ethical hacking techniques, otherwise known as penetration testing. Students will explore various offensive security methods used in penetration testing, including passive and active attacks, while gaining an understanding of the legal and ethical considerations involved. Learners will develop an appreciation of how ethical hacking helps to strengthen security by identifying weaknesses in systems before they can be exploited.

Course Objectives

This unit aims to provide learners with the knowledge and skills required to identify and exploit vulnerabilities in cyber systems through ethical hacking techniques, otherwise known as penetration testing. Students will explore various offensive security methods used in penetration testing, including passive and active attacks, while gaining an understanding of the legal and ethical considerations involved. Learners will develop an appreciation of how ethical hacking helps to strengthen security by identifying weaknesses in systems before they can be exploited.

Key Topics

  1. LO1: Understand the role of penetration testing in enhancing Cyber Security.
  2. LO2: Be able to identify and assess security vulnerabilities through reconnaissance, scanning and vulnerability assessment.
  3. LO3: Be able to exploit security vulnerabilities and report findings to help mitigate and prevent security attacks.
  4. LO4: Understand the legal and ethical considerations for penetration testing.

Course Outline

WeekTopics
1Penetration testing as offensive security and as a deep form of security testing
2Phases of penetration testing (reconnaissance, scanning, vulnerability assessment with CVE, exploitation, reporting) and its benefits: compliance, attack prevention and research
3Legal frameworks and standards: Computer Misuse Act, CFAA, GDPR and PTES
4Reconnaissance: collecting top-level information such as IP address ranges
5Enumeration lab: active vs. passive enumeration, packet sniffing
6Scanning lab: port scanning techniques (TCP Connect, SYN, UDP, FIN, Null, Xmas), ping sweeps, Nmap, Wireshark, Nessus and OpenVAS
7Exploitation lab: injection, buffer overflows, XSS, privilege escalation and insecure authentication using Metasploit and Burp Suite within agreed scope
MidtermMidterm evaluation
9Post-exploitation: privilege escalation, maintaining access, backdoors, data exfiltration, pivoting and lateral movement
10Documenting and reporting: action logs, evidence capture, reproducibility and the exploit report
11Ethical issues: responsible disclosure, responsibilities of the ethical hacker, grey areas balancing client requirements with legal and ethical boundaries
12Applying Ethical Hacking in practice: case studies
13Assignment workshop: research, planning and referencing
14Assignment workshop: drafting, feedback and improvement
15Review and coursework completion
FinalFinal assessment and submission

Learning Outcomes

  1. LO1 Understand the role of penetration testing in enhancing Cyber Security.
  2. 1.1 Describe what is meant by penetration testing/ethical hacking.
  3. 1.2 Explain how penetration testing is connected to the broader notion of security testing.
  4. 1.3 Explain the differences between white box, grey box, and black box penetration testing.
  5. 1.4 Analyse the key stages of penetration testing, including reconnaissance, scanning, vulnerability assessment, exploitation, and reporting.
  6. 1.5 Critically evaluate the benefits of penetration testing from a variety of perspectives.
  7. LO2 Be able to identify and assess security vulnerabilities through reconnaissance, scanning and vulnerability assessment.
  8. 2.1 Outline the key information that is collected as part of the reconnaissance stage.
  9. 2.2 Explain the purposes of reconnaissance, enumeration, and scanning for penetration testing.
  10. 2.3 Use industry-standard software tools to perform active and passive enumeration.
  11. 2.4 Use industry-standard software tools and databases to perform scanning.
  12. LO3 Be able to exploit security vulnerabilities and report findings to help mitigate and prevent security attacks.
  13. 3.1 Use tools to exploit identified security vulnerabilities to agreed extents.
  14. 3.2 Use existing exploitations to capitalise and extract information or extend the degree of exploitation to test system vulnerabilities.
  15. 3.3 Analyse results to document actions, evidence, and vulnerabilities, and to provide security recommendations through an exploit report.
  16. 3.4 Evaluate results to enact steps to mitigate vulnerabilities.
  17. LO4 Understand the legal and ethical considerations for penetration testing.
  18. 4.1 Explain the legal frameworks governing ethical hacking and penetration testing.
  19. 4.2 Analyse the responsibilities of an ethical hacker, including responsible disclosure of vulnerabilities.
  20. 4.3 Evaluate the potential ethical dilemmas faced by penetration testers.
Back to programme
Scroll