Ethical Hacking

1. Ethical hacking, authorization and the law

The difference between a penetration tester and a criminal is a document. This lesson covers what ethical hacking is and is not, the authorization and scope that must exist in writing before any test, the phases of a penetration test, the professional codes and reporting standards, and the legal position in Ghana under the Cybersecurity Act and the Data Protection Act — because a tester who cannot state their authority is a liability to their client.

2. Reconnaissance and mapping the attack surface

Before a single packet is sent, most of a system's weaknesses are already visible in public data: DNS records, certificate logs, cloud pointers, exposed metadata and job adverts that name every technology in the stack. This lesson covers passive reconnaissance, mapping an attack surface from the outside, service and directory enumeration on an authorised target, and how to organise findings so that the exploitation phase — and the report — has something to stand on.

1. Exploitation: how weaknesses become access

This lesson covers the vulnerability classes that dominate real-world breaches — injection, broken authentication and session handling, broken access control, misconfiguration and outdated components — how each is tested methodically with the OWASP Web Security Testing Guide as the checklist, how exploitation is documented as evidence rather than loot, and where a test stops at proof of impact instead of going further.

2. Reporting, defence and the security career

A penetration test that produces a folder of screenshots has failed. This lesson covers the report that clients actually act on — findings, risk ratings in business terms, reproduction steps, remediation, prioritisation — plus the defensive habits that follow from everything you have learned (patching, least privilege, logging, backups), responsible disclosure of a bug you find outside an engagement, and the routes into security work from where you are now.