In our previous article, we covered the theoretical foundations and methodology of penetration testing. Now it is time to move on to the engineering layer. As a network administrator or aspiring pentester, you need to know how to evaluate vulnerabilities in a controlled manner, use basic reconnaissance tools, and verify system resilience against password cracking.
In this part, we will focus on three pillars of a practical audit: service mapping with Nmap, exploring exploit databases, and credential testing (password cracking).
Important Ethical Notice: All penetration tests, scans, and password-cracking attempts must be conducted exclusively within strictly controlled environments (e.g., your own virtual labs, test machines, or platforms like TryHackMe / HackTheBox). Scanning external systems without explicit written permission is illegal.
1. Network Mapping and Service Discovery (Nmap)
Before testing anything, you must understand the attack surface. The primary and irreplaceable tool for network scanning is Nmap (Network Mapper).
To scan a selected test host for open ports, identify running services, and detect their versions, use the version detection flag -sV alongside default scripts -sC:
nmap -sV -sC 192.168.1.100This reveals not only which ports are open (e.g., SSH on port 22, HTTP on 80), but also the exact software versions running on the server. Older, unpatched network daemons are a prime source of critical flaws.
2. Vulnerability Research and Exploit-DB
Once you obtain service versions from your scan, the next step is checking whether public vulnerabilities exist for them. The searchsploit command-line utility is used for this purpose, querying a local copy of the Exploit-DB directly from your terminal:
searchsploit apache struts 2.3In a pentesting engagement, this allows you to quickly assess business risk—proving to management that running outdated software with a known Remote Code Execution (RCE) exploit provides the strongest possible argument for immediate patching.
3. Password Resilience Testing (Password Cracking)
Weak user passwords and default administrative credentials represent one of the most common vectors for successful breaches. During pentests, we test these using two main approaches:
Dictionary Attacks on Network Services (Hydra)
If reconnaissance reveals an active login panel or service (such as SSH or FTP) and you want to test susceptibility to dictionary attacks, THC Hydra is indispensable:
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100The tool tests combinations of a specified user against top dictionary passwords (such as the legendary rockyou.txt list). This serves as an excellent demonstration of why password complexity policies and account lockout mechanisms after multiple failed attempts are critical.
Cracking Password Hashes (Hashcat)
If an audit yields a database dump containing hashed passwords (e.g., MD5, SHA-256), tests are performed offline, leveraging CPU or Graphics Processing Unit (GPU) power via the powerful Hashcat utility:
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txtConclusion
Practical penetration testing combines precise network reconnaissance, vulnerability analysis, and authentication auditing. Understanding these mechanisms from an offensive perspective enables you to build more robust, multi-layered defensive barriers within your own infrastructure.