Ethical

Hacking

—

Technical

Skills

SKILL

DO MAINS

Networking

Protocol

Analysis

Operating

Systems

Internals

Programming

Scripting

Web

Application

Security

Exploitation

Post

Exploitation

Reconnaissance

OSINT

Wireless

Physical

Cryptography

Cloud

Container

DevOps

Reverse

Engineering

Malware

Mobile

Embedded

Systems

Red

Team

Operations

Governance

Reporting

Practice

Toolchain

Reference

1 / 15

Ethical Hacking Technical Skills — page 2

Networking

Protocol

Analysis

The

foundation

every

offensive

engagement

—

packets

first

exploits

second

TCP

stack

fundamentals

Subnetting

CIDR

notation

routing

tables

NAT

and

the

OSI

model

applied

real

captured

traffic

Packet

capture

and

analysis

Wireshark

and

tcpdump

BPF

filter

syntax

TCP

stream

reassembly

and

TLS

decryption

using

session

key

logs

Protocol

dissection

Working

knowledge

DNS

DHCP

HTTP

/1.1

and

HTTP

/2,

TLS

SMB

Kerberos

LDAP

RDP

and

SNMP

the

byte

level

Network

scanning

and

enumeration

Nmap

host

discovery

SYN

UDP

ACK

scans

service

and

version

detection

operating

system

fingerprinting

NSE

scripting

Man

the

middle

techniques

ARP

cache

poisoning

LLMNR

NBT

mDNS

poisoning

with

Responder

and

traffic

interception

and

rewriting

with

Bettercap

Segmentation

and

firewall

testing

VLAN

hopping

, 802.1

trunk

abuse

ACL

bypass

and

validating

internal

east

west

filtering

rules

IPv

attack

surface

Router

flooding

SLAAC

spoofing

DHCPv

takeover

and

dual

stack

gaps

where

IPv

filtered

but

IPv

not

IDS

IPS

and

firewall

evasion

Packet

fragmentation

source

port

manipulation

decoy

scans

timing

templates

and

encryption

command

channels

DNS

security

Zone

transfer

abuse

cache

poisoning

concepts

DNS

tunnelling

for

covert

exfiltration

and

resolver

misconfiguration

Tunnelling

and

pivoting

SSH

and

SOCKS

proxies

chisel

dnscat

ICMP

tunnels

and

routing

traffic

through

compromised

internal

hosts

2 / 15

Ethical Hacking Technical Skills — page 3

Operating

Systems

Internals

Comfort

the

command

line

assumed

;

understanding

why

the

command

works

the

skill

Linux

internals

File

permissions

SUID

SGID

binaries

capabilities

systemd

units

cron

and

timers

PAM

configuration

and

package

integrity

Windows

internals

Registry

hives

service

control

manager

WMI

token

privileges

access

tokens

and

process

and

thread

architecture

Active

Directory

architecture

Domains

forests

trusts

Group

Policy

Kerberos

ticketing

LDAP

queries

and

delegation

models

Linux

privilege

escalation

Enumeration

with

LinPEAS

GTFOBins

abuse

writable

service

files

misconfigured

sudo

rules

and

kernel

exploitation

Windows

privilege

escalation

Unquoted

service

paths

SeImpersonate

and

SeBackup

abuse

UAC

bypass

DLL

hijacking

and

token

impersonation

Shell

proficiency

Bash

and

PowerShell

fluency

including

piping

job

control

remote

execution

and

living

off

the

land

binaries

Persistence

mechanisms

Scheduled

tasks

registry

run

keys

service

creation

SSH

authorised

keys

and

how

defenders

detect

each

Hardening

knowledge

CIS

benchmark

configuration

patch

management

least

privilege

design

and

application

allow

listing

3 / 15

Ethical Hacking Technical Skills — page 4

Programming

Scripting

You

cannot

automate

modify

weaponise

what

you

cannot

read

Python

Tooling

and

automation

with

requests

Scapy

Impacket

and

raw

socket

programming

;

parsing

output

from

third

party

tools

Bash

and

PowerShell

scripting

Task

automation

log

parsing

bulk

operations

and

remote

execution

across

large

host

sets

and

Memory

layout

pointer

arithmetic

stack

frames

and

writing

proof

concept

exploit

code

86/

and

ARM

assembly

Reading

disassembly

understanding

calling

conventions

and

locating

controllable

buffers

during

exploit

development

JavaScript

DOM

behaviour

prototype

pollution

event

handling

and

browser

based

payload

construction

SQL

Query

construction

joins

subqueries

and

the

syntax

required

for

injection

and

database

enumeration

and

Ruby

Building

custom

tooling

cross

platform

implants

and

Metasploit

modules

Regex

and

data

parsing

Extracting

credentials

tokens

secrets

and

indicators

compromise

from

large

unstructured

data

sets

4 / 15

Ethical Hacking Technical Skills — page 5

Web

Application

Security

The

largest

real

engagement

findings

lives

the

application

layer

OWASP

Top

fluency

Practical

exploitation

and

mitigation

awareness

across

every

Directory

attacks

Kerberoasting

REP

roasting

DCSync

Golden

and

Silver

tickets

unconstrained

and

constrained

delegation

abuse

Credential

relay

and

reuse

NTLM

relay

with

ntlmrelayx

Pass

the

Hash

Pass

the

Ticket

and

over

pass

the

hash

techniques

Lateral

movement

PsExec

WMI

WinRM

SMB

admin

RDP

session

hijacking

and

internal

pivoting

Command

and

control

Cobalt

Strike

Sliver

and

Mythic

;

beacon

sleep

and

jitter

configuration

malleable

profiles

and

redirector

chains

Payload

evasion

Obfuscation

memory

execution

AMSI

and

ETW

bypass

fundamentals

and

EDR

behavioural

testing

Data

exfiltration

Covert

channels

staged

and

throttled

transfer

and

awareness

DLP

controls

during

objective

execution

Exploit

research

workflow

CVE

analysis

vendor

patch

diffing

and

safe

weaponisation

public

advisories

lab

conditions

6 / 15

Ethical Hacking Technical Skills — page 7

Reconnaissance

OSINT

The

best

operators

spend

time

here

than

the

exploit

console

Passive

reconnaissance

Shodan

Censys

certificate

transparency

via

crt

WHOIS

records

and

historical

DNS

data

engine

intelligence

Advanced

Google

dorking

Bing

and

GitHub

code

for

leaked

credentials

and

exposed

configuration

Subdomain

and

asset

enumeration

Amass

Subfinder

Assetfinder

HTTPX

and

permutation

scanning

surface

forgotten

staging

hosts

Breach

and

credential

intelligence

Have

Been

Pwned

DeHashed

and

combolist

analysis

inform

password

spraying

within

scope

Metadata

harvesting

Document

metadata

EXIF

extraction

from

published

images

and

header

analysis

for

infrastructure

clues

Social

engineering

reconnaissance

Organisational

charting

employee

and

role

enumeration

and

building

credible

pretext

material

Attack

surface

management

Continuous

asset

discovery

shadow

identification

and

exposure

prioritisation

across

subsidiaries

Infrastructure

fingerprinting

WAF

detection

CDN

identification

framework

and

version

profiling

and

origin

server

discovery

7 / 15

Ethical Hacking Technical Skills — page 8

Wireless

Physical

Where

the

perimeter

radio

waves

and

door

handles

802.11

fundamentals

Monitor

mode

channel

hopping

frame

types

beacon

and

probe

analysis

and

signal

survey

technique

Handshake

capture

and

cracking

WPA

four

way

handshakes

PMKID

attacks

GPU

accelerated

cracking

and

WPA

transition

mode

weaknesses

Rogue

access

points

Evil

twin

attacks

captive

portal

phishing

Karma

attacks

and

credential

harvesting

Enterprise

wireless

802.1

and

EAP

analysis

RADIUS

testing

certificate

validation

gaps

and

rogue

device

detection

RFID

and

NFC

Proxmark

and

Flipper

Zero

operation

badge

cloning

MIFARE

analysis

and

access

control

relay

Bluetooth

and

BLE

Device

enumeration

GATT

characteristic

abuse

pairing

weaknesses

and

relay

attacks

Software

defined

radio

RTL

SDR

and

GNU

Radio

basics

signal

capture

and

replay

attacks

against

fixed

code

key

fobs

Physical

security

testing

Lock

bypass

tailgating

badge

and

key

copying

camera

and

sensor

evasion

and

dumpster

reconnaissance

8 / 15

Ethical Hacking Technical Skills — page 9

Cryptography

Enough

theory

identify

broken

implementations

not

design

new

primitives

Symmetric

and

asymmetric

primitives

AES

modes

operation

RSA

elliptic

curve

cryptography

and

Diffie

Hellman

key

exchange

Hash

functions

and

cracking

SHA

-1/

SHA

-2,

bcrypt

and

scrypt

plus

GPU

accelerated

attack

workflows

and

salt

handling

Public

key

infrastructure

Certificate

chains

CSR

handling

revocation

checking

and

internal

abuse

TLS

testing

and

hardening

testssl

and

sslyze

protocol

and

cipher

misconfiguration

downgrade

attacks

and

HSTS

gaps

Cryptographic

implementation

flaws

Padding

oracles

reuse

weak

randomness

sources

and

nonce

reuse

stream

ciphers

Applied

crypto

attacks

Hash

length

extension

ECB

cut

and

paste

signing

oracle

abuse

and

JWT

signature

confusion

Secure

protocol

design

awareness

Forward

secrecy

key

rotation

authenticated

encryption

and

the

consequences

rolling

custom

crypto

9 / 15

Ethical Hacking Technical Skills — page 10

Cloud

Container

DevOps

Identity

the

new

network

perimeter

Cloud

identity

and

access

management

AWS

IAM

policy

analysis

role

chaining

trust

relationship

abuse

and

privilege

escalation

path

mapping

Cloud

storage

exposure

Misconfigured

Azure

Blob

and

GCS

buckets

;

enumeration

access

validation

and

impact

assessment

Metadata

service

abuse

SSRF

instance

metadata

credential

theft

instance

profile

abuse

and

workload

identity

confusion

Microsoft

365

and

Entra

Tenant

enumeration

conditional

access

gaps

token

theft

and

illicit

consent

grant

abuse

Kubernetes

security

RBAC

abuse

exposed

kubelets

etcd

exposure

service

account

token

usage

and

admission

controller

gaps

Container

escapes

Privileged

containers

mounted

Docker

sockets

namespace

breakout

and

container

image

supply

chain

review

pipeline

attacks

Secret

exposure

build

logs

poisoning

pipeline

configuration

and

third

party

action

risk

Cloud

tooling

ScoutSuite

Prowler

Pacu

CloudFox

Trivy

and

kube

hunter

for

posture

review

and

attack

path

discovery

10 / 15

Ethical Hacking Technical Skills — page 11

Reverse

Engineering

Malware

Analysis

Understanding

malicious

code

understanding

how

build

and

stop

Mobile

Embedded

Systems

High

value

targets

with

weak

tooling

and

slow

patch

cycles

Static

analysis

and

ELF

header

structure

import

and

export

tables

section

entropy

and

string

extraction

Disassemblers

and

decompilers

IDA

Pro

and

Free

Ghidra

Binary

Ninja

and

interpreting

decompiler

output

accurately

Dynamic

analysis

dbg

GDB

with

pwndbg

API

monitoring

behaviour

tracing

and

memory

inspection

Sandbox

analysis

Cuckoo

CAPE

and

Any

Run

and

critical

evaluation

automated

reports

rather

than

blind

acceptance

Unpacking

and

anti

analysis

Packer

identification

and

sandbox

detection

anti

debugging

bypass

and

unpacking

workflows

Malware

triage

IOC

extraction

YARA

rule

authoring

family

classification

and

communicating

findings

defenders

Firmware

analysis

Binwalk

extraction

filesystem

reconstruction

embedded

service

discovery

and

hardcoded

credential

location

Android

testing

APK

decompilation

with

jadx

and

apktool

manifest

review

insecure

data

storage

and

exported

component

abuse

Dynamic

mobile

instrumentation

Frida

hooking

root

detection

bypass

SSL

pinning

bypass

and

runtime

method

tracing

iOS

testing

IPA

analysis

keychain

inspection

binary

hardening

review

and

jailbreak

based

instrumentation

Embedded

and

IoT

protocols

MQTT

CoAP

and

Modbus

analysis

protocol

fuzzing

and

default

credential

testing

Hardware

interfaces

UART

JTAG

SPI

and

identification

console

access

and

flash

chip

reading

11 / 15

Ethical Hacking Technical Skills — page 12

Red

Team

Operations

Goal

oriented

adversary

emulating

work

rather

than

scan

and

report

Engagement

planning

Scoping

rules

engagement

deconfliction

procedures

and

defining

measurable

objectives

with

the

client

Threat

modelling

and

adversary

emulation

MITRE

ATT

mapping

threat

actor

selection

and

realistic

scenario

design

Infrastructure

build

Redirectors

domain

categorisation

phishing

infrastructure

TLS

configuration

and

long

haul

operational

resilience

Operator

OPSEC

Infrastructure

separation

logging

discipline

artefact

hygiene

and

attribution

reduction

Social

engineering

campaigns

Phishing

pretexting

vishing

and

payload

delivery

design

with

measured

ethical

boundaries

Assumed

breach

testing

Starting

from

defined

foothold

and

pursuing

named

objectives

across

the

internal

estate

Purple

team

collaboration

Detection

engineering

feedback

loops

control

validation

and

joint

tuning

with

the

blue

team

12 / 15

Ethical Hacking Technical Skills — page 13

Governance

Reporting

Professional

Practice

unreported

finding

unfixed

finding

Vulnerability

scoring

CVSS

3.1

and

4.0

vectors

contextual

risk

rating

and

business

impact

framing

Technical

report

writing

Clear

findings

reproducible

steps

sanitised

evidence

and

specific

remediation

guidance

Executive

communication

Translating

technical

risk

into

business

language

for

non

technical

stakeholders

and

boards

Framework

familiarity

PTES

the

OWASP

Testing

Guide

NIST

800-115,

and

MITRE

ATT

Compliance

context

PCI

DSS

ISO

27001,

SOC

and

data

protection

obligations

when

handling

client

systems

and

evidence

Legal

and

ethical

boundaries

Written

authorisation

strict

scope

adherence

safe

data

handling

and

responsible

disclosure

Retesting

and

remediation

validation

Verifying

fixes

without

regressing

production

systems

and

documenting

residual

risk

13 / 15

Ethical Hacking Technical Skills — page 14

Toolchain

Reference

Tools

change

;

the

underlying

technique

does

not

This

maps

the

standard

working

set

Directory

BloodHound

SharpHound

Mimikatz

Rubeus

Certipy

Post

exploitation

Cobalt

Strike

Sliver

Mythic

Empire

Chisel

Wireless

Aircrack

Kismet

Wifite

Proxmark

GNU

Radio

Cloud

containers

ScoutSuite

Prowler

Pacu

Trivy

kube

hunter

Reverse

engineering

Ghidra

IDA

Pro

dbg

Frida

dnSpy

Network

analysis

Wireshark

tcpdump

Bettercap

Zeek

tshark

Proficiency

Tiers

The

same

skill

list

maps

onto

four

levels

Hiring

and

certification

decisions

usually

hinge

which

tier

candidate

can

evidence

EXPECT ED

DEPT H

LEVEL

T IER

WHAT

LOOKS

REPRESENTAT IVE

SKILLS

Foundational

Comfort

the

command

line

understands

how

protocols

behave

can

documented

methodology

TCP

Linux

and

Windows

CLI

Nmap

Wireshark

basics

OWASP

Top

theory

Intermediate

Runs

web

application

tests

unaided

reproduces

common

findings

scripts

repetitive

work

Burp

Suite

common

privilege

escalation

Metasploit

Python

and

Bash

tooling

basic

enumeration

Advanced

Chains

multiple

weaknesses

into

business

impacting

outcome

and

evades

modern

controls

attack

chains

custom

exploit

development

EDR

evasion

cloud

attack

paths

infrastructure

Expert

Produces

original

research

tooling

leads

engagements

and

improves

defensive

capability

Novel

exploit

research

tool

authoring

red

team

leadership

detection

engineering

collaboration

14 / 15

Ethical Hacking Technical Skills — page 15

Certification

Alignment

Where

the

skills

above

are

formally

assessed

OSCP

Offensive

Security

Certified

Professional

—

practical

exam

covering

exploitation

Active

Directory

and

reporting

PNPT

Practical

Network

Penetration

Tester

—

focused

with

live

client

debrief

component

CPTS

Certified

Penetration

Testing

Specialist

—

broad

network

web

and

cloud

curriculum

with

exam

CRTO

Certified

Red

Team

Operations

—

Cobalt

Strike

tradecraft

and

red

team

infrastructure

OSWE

Offensive

Security

Web

Expert

—

white

box

source

code

review

and

web

exploitation

OSEP

Experienced

Penetration

Tester

—

evasion

Active

Directory

and

client

side

attack

chains

GPEN

GIAC

Penetration

Tester

—

vendor

certification

aligned

the

SANS

SEC

560

curriculum

CEH

Certified

Ethical

Hacker

—

foundational

theory

and

tooling

overview

for

newcomers

15 / 15

Ethical Hacking Technical Skills

Prompt to Clone This Ethical Hacking Technical Skills

Apply this example's core structure, strategic pacing, and structural hierarchy directly to your own topic.

What are you generating today?