01. Pentest fundamentals and terminology 📚¶

Before getting hands-on, let's nail down the basic concepts that come up a lot. What you call a test changes depending on "from what position," "with how much information," and "with what goal" you run it.

1. Three categories by amount of information (black / gray / white box)¶

How a test is classified depends on how much internal information the tester has up front.

flowchart LR
    B["Black box<br>zero information"] --> G["Gray box<br>some information"] --> W["White box<br>everything disclosed"]
    style B fill:#2d333b,stroke:#8b949e,stroke-width:2px,color:#e6edf3
    style G fill:#2d333b,stroke:#8b949e,stroke-width:2px,color:#e6edf3
    style W fill:#2d333b,stroke:#8b949e,stroke-width:2px,color:#e6edf3

Type	Prior information	Position it mirrors	Pros / Cons
Black box	Almost none (just a URL or IP)	Same viewpoint as an external attacker	Reproduces a realistic attack / takes time, and things get missed
Gray box	Some (e.g. a regular user account)	An attacker with a small foothold inside	Well balanced (common in practice)
White box	Fully disclosed (source code, architecture, admin privileges)	An audit with deep inside knowledge	Thorough and deep / differs from a real attacker's viewpoint

💡 When to use which: Want to see "how far someone can get in from the outside"? → Black box. Want to "exhaustively hunt for holes in limited time"? → White box (reading the source too). In practice, gray box (handing over a regular user account to test) is the most common.

2. Classification by position (red / blue / purple team)¶

The attacking side (red) versus the defending side (blue)

A security operation splits into "the side that attacks" and "the side that defends."

flowchart TB
    R["🔴 Red team<br>the attacking side"] <-->|learn from each other| P["🟣 Purple team<br>bridges the two"]
    P <--> BL["🔵 Blue team<br>the defending side"]
    style R fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style P fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3
    style BL fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3

Team	Role	What they do
🔴 Red team	Attacker	Attempt intrusion like a real attacker and expose the organization's weaknesses. Steps ① through ⑤ in this guide are red team techniques
🔵 Blue team	Defender	Detect, defend against, and respond to attacks. Log monitoring, intrusion detection, trace investigation (→ 10. Defenders' tools)
🟣 Purple team	Bridge	Red and blue collaborate, cross-referencing "attack techniques" against "defensive improvements" to strengthen the whole organization

💡 Penetration test vs. red team exercise (often confused): - Penetration test = within a defined scope, "find vulnerabilities and report them" (the focus of this guide) - Red team exercise = a more full-blown test of "can you actually break in and achieve the goal without being noticed" (stealthy, long game)

This guide teaches the fundamental techniques of penetration testing, but the techniques you use carry over to red teaming too.

3. Offense and defense are one continuum (where this guide stands)¶

flowchart LR
    A["Learn attack techniques<br>(red)<br>nmap→exploit→meterpreter"] --> B["Understand what to defend<br>(blue)<br>trace detection, patching holes"]
    style A fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style B fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3

The main thread of this guide (① Recon through ⑤ Lateral movement) is red (offensive) technique. But understanding attacks directly builds your blue (defensive) skill — knowing "where and what to watch to notice an intrusion." That's why 10. Defenders' tools covers tools for the defending side as well.

4. Other common terms (mini glossary)¶

Term	Meaning
Scope	The range of targets you're allowed to test. Never step outside it (doing so is illegal)
Rules of Engagement (RoE)	The agreed terms of the test (targets, timeframe, methods, contacts, etc.). Agreed in writing
Vulnerability	A weakness that can be exploited
Exploit	Attack code or a technique that targets a vulnerability → 07. Exploitation (Metasploit)
Payload	The code that runs after you break in → 07. Exploitation (Metasploit)
CVE	A globally shared ID assigned to a vulnerability (e.g. `CVE-2017-5638`)
CVSS	A severity score for a vulnerability (0–10, where 10 is the worst)
OSINT	Recon from publicly available information → 06. Recon (nmap)
Pivot / lateral movement	Using a foothold to spread deeper inside → 09. Lateral movement

⚠️ Whatever the type or position, do it only within authorized targets and scope. That's the ground rule.