Becoming an ethical hacker: skills, certifications and legal practice

Ethical hacking and penetration testing

The two terms overlap. Ethical hacking is the broad idea of using attacker techniques with permission to improve security. Penetration testing is one formal, time-boxed service within it, with a scope, a methodology and a report. Ethical hacking also includes bug bounty work, red teaming, security research and social engineering assessments. Most paid roles carry titles such as penetration tester, security consultant or red team operator. See types of penetration test.

The skills you need

• Networking: IP addressing, TCP and UDP, DNS, HTTP and common ports. A CCNA-level understanding is a strong base.
• Systems: comfortable use of the Linux and Windows command lines, file permissions, services and Active Directory.
• Scripting: enough Python, Bash or PowerShell to automate repetitive tasks and read other people's code.
• Web technologies: how sessions, cookies, APIs and databases work, and the OWASP Top 10.
• Professional skills: ethics, careful note-taking, report writing and explaining risk to non-technical people. Many testers say writing is half the job.

A defensive background is an advantage, not a detour. People who have run networks or worked in a SOC know how systems are really built and monitored, so their findings are more realistic and their fixes more practical.

Certifications

Exam names and formats change, so always check the provider's current syllabus. Employers often ask for one recognised certificate plus evidence of hands-on skill.

Tools by category

Testers use tools for each phase of work: network scanners to find hosts and services, web proxies to inspect and change browser traffic, vulnerability scanners, password auditing tools, packet analysers such as Wireshark and frameworks that bundle known exploits. Many come pre-installed on testing distributions such as Kali Linux. Learn what each category does and why before learning buttons; tools change, but the concepts behind them last. Read the five phases to see where each kind of tool fits.

Practising legally

Never practise on systems you do not own or have written permission to test. Safe options include a home lab of virtual machines on an isolated network, deliberately vulnerable training applications, online lab platforms and capture the flag (CTF) competitions. See building a security virtual lab. Keep notes as if you were writing a client report; they become a portfolio.

Real-world example: from network support to testing

A network technician at a fictional logistics company wants to move into security. He builds a small lab on an old PC with a few virtual machines, works through web security labs in the evenings and writes short blog posts about what he learns, without naming any real company. He passes PenTest+, then volunteers to help the company's external testers during their annual test by preparing access and explaining the network. Eighteen months later the testing firm offers him a junior role, citing his networking knowledge and clear write-ups rather than the certificate alone.