Ethical Hacking Guide: Types & Common Attacks

Ethical hacking might sound like an oxymoron - like a cop pretending to be a criminal - but it’s one of the most important jobs in cybersecurity today. Ethical hackers are trained pros hired to think like attackers so they can find weaknesses in systems, report them, and help fix them. In short: they help protect people, companies, and users from real criminals.

Below is a friendly, SEO-friendly guide that explains the types of hackers, common attacks you should know, defensive practices, safe code examples, and how to start as a bug bounty hunter. I kept the language simple and clear, added emojis to improve readability, and included practical code snippets that focus on defense (not exploits).

What is an Ethical Hacker? ​

An Ethical Hacker uses hacking skills for good. Companies hire them to test systems, find security holes, and propose fixes before bad actors exploit those holes. Ethical hackers follow rules - they have permission, report findings responsibly, and help fix problems.

Why it’s rewarding:

• You solve real-world problems.
• You work with new tech and travel sometimes.
• You stop fraud and protect people’s data.

---

Types of Hackers (Simple & Clear) ​

People often split hackers into three groups:

• White Hat - the good guys. These are ethical hackers hired to protect systems.
• Black Hat - the bad guys. They hack for profit, fame, or harm.
• Grey Hat - somewhere in between. They might break rules but don’t always have bad intent.

---

Common Attacks Every Defender Should Know ​

Understanding attacks helps defenders prevent them. Here are common attacks explained in plain words.

Man-in-the-Middle (MITM)​

In a MITM, an attacker sits between you and a service (like your bank). Instead of a direct connection between you and the bank, the hacker relays traffic and can read or change data. Always use secure connections (HTTPS, certificate pinning, HSTS) to reduce this risk.

Man-in-the-Browser (MitB)​

A Man-in-the-Browser attack is when malicious code (often from a phishing link or infected software) runs inside your browser and captures or alters data you submit - like passwords or payment info. Browser security updates and avoiding unknown downloads help prevent this.

Social Engineering​

Attackers trick people into revealing secrets (passwords, codes). Examples: fake emails asking you to “update details,” phone calls pretending to be support, or malicious links. Always verify the sender and never give passwords over email or chat.

Brute Force Attacks​

Trying many passwords until one works. Defenses: rate-limiting, lockouts, and strong password policies.

---

Realistic Defensive Code Examples (Safe & Helpful) ​

Below are short, defensive code snippets you can study and adapt. These examples help protect apps and users - they don’t enable attacks.

1) Verify HTTPS requests in Python (don’t skip verification)​

import requests

# Always verify SSL/TLS certificates (default True)
resp = requests.get("https://example.com/api", timeout=5)
print(resp.status_code, resp.headers.get('content-type'))

Tip: Don’t set verify=False in production - that disables certificate checks and opens you to MITM.

2) Hash passwords safely with bcrypt (Python)​

import bcrypt

password = b"myS3cretP@ss"
salt = bcrypt.gensalt()
hashed = bcrypt.hashpw(password, salt)

# To check:
if bcrypt.checkpw(password, hashed):
    print("Password OK")

Use strong hashing (bcrypt/Argon2) rather than plain text or weak algorithms.

3) Simple 2FA using TOTP (pyotp) - defensive example​

import pyotp

# Create a TOTP secret (store securely per user)
secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)

# Generate current code (show to user to pair with authenticator)
print("Setup code:", secret)

# Verify a code from the user's app
user_code = input("Enter the 6-digit code: ")
if totp.verify(user_code):
    print("2FA verified")
else:
    print("Invalid code")

Two-factor authentication (2FA) greatly reduces account takeover risk.

---

How Attacks Often Start - and How to Block Them ​

• Phishing emails → Train users, use email filtering, and enforce strong login steps.
• Outdated software → Keep apps, libraries, and systems updated.
• Weak passwords → Enforce password strength and require 2FA.
• Open ports and misconfigured servers → Harden servers and limit network exposure.

---

Tools & Mindset: What Makes a Good Ethical Hacker ​

You don’t need to be a “black hat” to think like one - you need curiosity and discipline.
Good traits:

• Loves solving problems and learning.
• Keeps skills current with courses and labs.
• Follows rules and ethical guidelines.
• Understands networking, web apps, and OS internals.

Important certifications (optional, but widely recognized):

• Certified Ethical Hacker (CEH) - a common starter cert.
• Practical experience and hands-on labs often matter more than paper.

---

How to Practice Safely (Labs & Resources) ​

Practice on intentionally vulnerable apps and platforms - never attack real systems without permission.

Practice platforms:

• bugcrowd.com
• hackerone.com

These two platforms also run bug bounty programs where companies invite hackers to find bugs legally.

Other safe places:

• Vulnerable VM images (e.g., OWASP Juice Shop)
• CTF (capture-the-flag) challenges
• Local lab environments using VMs or containers

---

From Learner to Bug Bounty Hunter: Practical Path ​

1. Learn basics: networking, HTTP, SQL, XSS, CSRF, authentication flows.
2. Practice on labs: get hands-on with vulnerable apps.
3. Read reports: study write-ups from real bug bounty reports.
4. Start small: try low-risk targets on bug bounty platforms.
5. Write clear reports: explain steps, impact, and fixes - good reports get paid.

---

Final Tips - Stay Responsible & Professional ​

• Never test systems without written permission.
• Report findings responsibly and include steps to reproduce.
• Focus on fixes, not bragging. Help teams patch problems.
• Keep a learning log - saving writeups and lessons helps long-term growth.

Conclusion
Ethical hacking is a career where you use hacker thinking for good. By learning attack types, practicing safe defensive coding, using 2FA, and testing in legal labs, you can protect systems and possibly earn money from responsible disclosures or bug bounties. Want a starter learning path or a tailored study plan? I can make one for you based on your current skills - just say what you already know.