Ethical Hacking dan Penetration Testing

Ethical Hacking adalah authorized attempt untuk exploit sistem dengan tujuan improve security. Penetration Testing (pentest) adalah structured approach. Pentester vs malicious hacker: explicit permission, follow rules of engagement, report findings, suggest remediations. Phases: Reconnaissance (information gathering passive/active), Scanning (port scanning, vulnerability scanning), Gaining Access (exploit vulnerabilities), Maintaining Access (backdoors, persistence), Covering Tracks (clear logs, hide evidence), Reporting. Reconnaissance tools: Google dorking, WHOIS lookup, Shodan (IoT search engine), theHarvester (email harvesting), Maltego (relationship mapping). Scanning: Nmap (network mapping, port scanning), Nessus/OpenVAS (vulnerability scanners), Nikto (web server scanning). Exploitation: Metasploit Framework (exploitation toolkit), SQLMap (SQL injection), Burp Suite (web application testing), Social Engineering Toolkit. Post-exploitation: privilege escalation (vertical/horizontal), lateral movement, data exfiltration. Common vulnerabilities (OWASP Top 10): Injection flaws, Broken Authentication, Sensitive Data Exposure, XML External Entities, Broken Access Control, Security Misconfiguration, Cross-Site Scripting (XSS), Insecure Deserialization, Using Components with Known Vulnerabilities, Insufficient Logging. Operating systems untuk pentesting: Kali Linux (Debian-based, pre-installed tools), Parrot OS, BlackArch. Certifications: CEH (Certified Ethical Hacker), OSCP (Offensive Security Certified Professional), GPEN, GWAPT. Legal framework: Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), always get written permission. Types of pentests: Black box (no prior knowledge), White box (full knowledge), Gray box (partial knowledge). Specializations: network penetration testing, web application testing, mobile app testing, wireless testing, physical security, social engineering. Bug bounty programs: HackerOne, Bugcrowd, companies pay untuk vulnerability discoveries. Ethical hacking career lucrative dengan high demand, average salary $90K-150K. Mindset: think like attacker, stay updated dengan latest vulnerabilities, continuous learning.