Ethical hacking for beginners: what it is, what a pentester does and where to start

This ethical hacking for beginners guide answers the three questions almost everyone asks when starting out: what exactly ethical hacking is, what a pentester's job involves and where to start without getting lost. You do not need any prior knowledge to follow it.

What ethical hacking is

Ethical hacking means using the same techniques as an attacker to find security flaws, but with the explicit authorisation of the system owner and with the goal of fixing them. The difference from a real attack is not in the tools, which are usually the same, but in three things:

• Permission: there is a signed agreement that defines what can be attacked, when and how.
• Scope: it is limited to the agreed systems. Going out of scope, even out of curiosity, stops being ethical and may be a crime.
• Purpose: the outcome is a report so the organisation can fix the problems, not a gain for whoever finds them.

That is why, while learning, you should only practise in your own lab or on platforms that authorise you to attack their machines, such as TryHackMe or Hack The Box.

What a pentester does day to day

A pentester (penetration tester) carries out penetration tests: technical audits in which they try to compromise a client's systems, applications or networks to measure their real security. A typical project follows these phases:

1. Agreement and scope. Goals, dates, systems in scope and rules of engagement are defined.
2. Reconnaissance. Gathering information: domains, subdomains, technologies, employees. Tools such as Subfinder or theHarvester help here.
3. Enumeration and analysis. Discovering services, versions and possible vulnerabilities, for example with Nmap.
4. Exploitation. Proving that a vulnerability is real and what impact it has.
5. Post-exploitation. Seeing how far it goes: escalating privileges, moving to other hosts, accessing sensitive data.
6. Report. Documenting findings, risk and recommendations. It is the part the client actually pays for, and many beginners underestimate it.

Besides pentesters there are other offensive profiles: red team (simulates real adversaries over weeks, focused on staying undetected), bug bounty (researchers who report flaws to public programmes in exchange for rewards) or specialists in web, mobile or cloud applications. And on the defensive side, SOC analysts, incident response or forensics, who also benefit from knowing how an attacker thinks.

Types of ethical hacking tests

Not all audits are the same. Depending on the information the auditor receives, we talk about:

• Black box: the auditor starts with no internal information, as an external attacker would.
• Grey box: they receive some information, for example an unprivileged user account for the application.
• White box: they have access to documentation, architecture and even source code. They find more flaws in less time.

And depending on the target: web application audits, internal infrastructure (often focused on Active Directory), external infrastructure, wifi networks, mobile applications or cloud environments. When starting out you do not have to choose, but it is worth knowing these specialisations exist because each one requires somewhat different knowledge.

Where to start in ethical hacking as a beginner

1. Fundamentals: Linux, networking and web

This is the base of everything. You need to handle the Linux terminal, understand TCP/IP and DNS, and know how an HTTP request works. The OverTheWire wargames and PortSwigger's Web Security Academy are two excellent free starting points.

2. Your own lab

Install a virtual machine with Kali Linux and, next to it, deliberately vulnerable applications such as DVWA or OWASP Juice Shop. That way you can break things with no legal risk. If you have never used Kali, follow our guide to Kali Linux for beginners.

3. Guided practice

TryHackMe's introductory paths explain each step while you do it. When you finish them, move on to machines without guidance.

4. Few tools, learned well

You do not need to know two hundred. A port scanner, a web proxy and a couple of enumeration utilities will keep you busy for a long time. We cover which ones in ethical hacking tools for beginners.

If you want a detailed week-by-week plan, it is in how to learn ethical hacking from scratch.

What skills an ethical hacker needs

• Curiosity and patience. Most of the time goes into enumerating and testing hypotheses that do not work.
• Technical base. Operating systems, networking, web and some programming (Bash and Python cover a lot).
• Methodology. Following an orderly process and taking notes on everything.
• Written communication. A poorly explained finding in the report is a finding that does not get fixed.
• Ethics. Knowing where the limits are and always respecting them.

Common myths about ethical hacking

• "You have to be a computer genius". It takes consistency more than special talent. Many people come from non-technical backgrounds.
• "Installing Kali is enough". Kali is a toolbox; without fundamentals you will not know which tool to use or why.
• "It is like in the movies". Real work is methodical, with lots of reading, documentation and reports.

Frequently asked questions

Is it legal to learn ethical hacking?

Yes, learning and practising in your own or authorised environments is completely legal. What is not legal is attacking third-party systems without permission, regardless of your intention.

Do I need to know how to code?

Not to start, but it is worth learning early to read and write simple Bash and Python scripts.

Which certification is best to start with?

For a first hands-on step, the eJPT is a common choice. There is a full comparison in ethical hacking certifications.

Where can I find more resources?

In the Learn section and in our list of free ethical hacking courses.

And if you want to start with a guided route in Spanish, we are preparing Ethical hacking from scratch ("Hacking ético desde cero"), a beginner course in 8 modules. It will have a launch price of 29 € (49 € afterwards) and the waitlist is already open.