VU23215 Test concepts and procedures for cyber security

Penetration testing is authorised, structured attack. A tester agrees a scope with the system owner, then follows the same steps a real attacker would (find the target, learn what it runs, look for weaknesses, prove they are real), and writes it all up so the organisation can close the gaps. The skill is not the individual trick; it is the discipline of doing it methodically, safely and with permission.

That permission is the whole thing. The VU23223 legislation unit is blunt about it and it holds here without exception: it is illegal to test, probe or scan any system in Australia without the express written authorisation of the owner. A port scan of a network you do not own is not a grey area. Everything on this page assumes an isolated lab of virtual machines that you own, or a target you have written authority to test. The ethical hacking procedures named in the required knowledge are, in practice, the rules that keep a tester on the right side of that line: agreed scope, written authorisation, do no damage, protect any data you encounter, and report through the right channel.

The two-scenario evidence requirement shapes how to read the rest of the unit. You are asked to test a system, show a real vulnerability, and recommend a mitigation, twice. So each technique below is worth learning at two levels: how the attack works, and what a defender does about it.

Testing is only useful if it is systematic, and the industry has settled on a small number of published methodologies that all describe the same phased shape. The value of a named process is that nothing is skipped and the work can be repeated and audited.

flowchart LR
  Scope["Scoping and<br/>authorisation"] --> Recon["Reconnaissance<br/>(footprinting)"]
  Recon --> Scan["Scanning and<br/>enumeration"]
  Scan --> Gain["Gaining access<br/>(exploitation)"]
  Gain --> Maintain["Maintaining access /<br/>post-exploitation"]
  Maintain --> Report["Analysis and<br/>reporting"]
  Report -.->|mitigations feed back| Scope

The reference frameworks worth knowing by name are the Penetration Testing Execution Standard (PTES), the older Open Source Security Testing Methodology Manual (OSSTMM), and the United States NIST Special Publication 800-115, "Technical Guide to Information Security Testing and Assessment", which is the freely available, authoritative description of this process. MITRE ATT&CK, examined in VU23226, gives a shared vocabulary for the techniques used inside these phases. For this unit the takeaway is the mental model: reconnaissance before scanning, scanning before exploitation, and reporting as the deliverable that makes the whole exercise worth anything to the organisation.

Reconnaissance is patient information-gathering before a single packet is sent in anger, and it splits in two. Passive reconnaissance collects what is already public without touching the target: domain registration records (whois), DNS records, search engines, job advertisements that reveal the technology stack, and social media. This is the open-source intelligence (OSINT) layer, and it is invisible to the target. Active reconnaissance interacts with the target directly, which is faster but leaves traces.

The layer 3 test commands named in the required knowledge belong here. Ping uses ICMP to test whether a host is reachable and how long a round trip takes; traceroute maps the sequence of routers between you and the target, which reveals the shape of the network path. Both are diagnostic tools first and reconnaissance tools second, and both illustrate a recurring theme of the unit: an ordinary administrative utility is also an attacker's utility, which is why some networks block ICMP at the border.

Where reconnaissance asks "what exists", scanning asks "what is running, and which version". Nmap is the standard tool, and the progression is worth learning as a sequence: host discovery finds live machines, a port scan finds open ports, service detection identifies the software behind each port, and version detection often pins the exact release. A service version is the pivot point of the whole exercise, because "Apache 2.4.49" or "vsftpd 2.3.4" turns directly into a search for known vulnerabilities.

Enumeration is the deeper, service-by-service questioning that follows: listing user accounts, network shares, running services and configuration details from the protocols that expose them. Thorough enumeration is what separates a real test from a superficial one; most successful intrusions turn on a detail that patient enumeration surfaced and a hurried scan missed.

Sniffing is capturing network traffic to read what is passing across the wire, and Wireshark is the tool the assessment environment names. It matters for two reasons. As a defender, packet capture is how you see what is actually happening on a network, diagnose a problem, or confirm an intrusion. As an attacker, sniffing on a network you have a foothold on can harvest credentials and data whenever traffic is unencrypted.

The concept to fix is why sniffing is easy or hard. On the old shared-hub networks every machine saw every packet, so sniffing was trivial. On a modern switched network a machine normally sees only its own traffic, so an attacker has to force traffic their way, classically by ARP spoofing (poisoning the address tables so traffic is routed through the attacker's machine), a technique that also underlies "man in the middle" attacks. The durable defence is encryption: TLS on web and mail traffic means that even a successful capture yields ciphertext rather than passwords, which is a large part of why the whole web has moved to HTTPS by default.

The unit asks for a working knowledge of the threat landscape, so the standard taxonomy is worth holding clearly.

Malware is the umbrella term. A virus attaches to a file or program and spreads when that host is run; a worm is self-propagating and spreads across a network without needing a host file or a user action, which is what lets worms move at machine speed; a trojan disguises itself as something wanted so a user runs it willingly. Modern categories layer on top: ransomware (encrypts data and demands payment), spyware, and the fileless and living-off-the-land techniques examined in VU23225 and VU23226. The defensive story is the layered endpoint stack, from signature-based antivirus through to behavioural endpoint detection and response.

Denial-of-service attacks aim not to steal but to make a service unavailable. A single-source DoS is easy to block; a distributed denial-of-service (DDoS) uses many compromised machines (a botnet) at once, which is far harder to filter. The mechanisms fall into volumetric attacks (flood the link with traffic), protocol attacks (exhaust a resource such as the TCP connection table, as in a SYN flood), and application-layer attacks (send requests that are cheap to make and expensive to answer). Mitigation is upstream: traffic scrubbing, rate limiting and content delivery networks absorb or filter the flood before it reaches the origin.

DNS attacks target the naming system the whole internet depends on. DNS spoofing or cache poisoning feeds a resolver a false answer so that a legitimate name resolves to an attacker's address; DNS tunnelling smuggles data in and out of a network inside DNS queries, abusing a protocol that firewalls usually allow. DNSSEC, which cryptographically signs DNS records, is the standards-based defence against forged answers, and monitoring DNS traffic is how tunnelling is caught.

The required knowledge includes the human layer, and it belongs in a testing unit because it is the most reliable way into most organisations. Social engineering manipulates people into breaking security: phishing (fraudulent messages at scale), spear phishing (targeted at a named individual), pretexting (inventing a scenario that justifies a request), baiting, and simple impersonation over the phone or in person. No technical control fully closes it, which is why the defences are a mix of awareness training, verification procedures for sensitive requests, and technical backstops like multi-factor authentication that blunt the value of a stolen password. In a sanctioned test, social-engineering assessment is tightly scoped and agreed in advance, precisely because it involves real people.

The required knowledge names physical and software vulnerabilities in wireless LANs, and this is the part of the unit where the standard has moved most, so it needs current teaching rather than the historical account.

The physical vulnerability of wireless is inherent: radio does not stop at the wall, so anyone within range can receive the signal, and the whole security model therefore rests on encryption. The software history is a sequence of that encryption being broken and replaced. WEP (Wired Equivalent Privacy) is thoroughly broken and can be cracked in minutes; it should never be seen in service. WPA and then WPA2 replaced it, and WPA2 was the mainstay for over a decade, though it has known weaknesses (the KRACK key-reinstallation attack, and offline cracking of weak pre-shared keys captured during a device's handshake). Wi-Fi Protected Setup (WPS), a convenience feature for joining devices with a PIN, is a common weak point and is usually best disabled.

Update, current as at August 2026. WPA3, introduced by the Wi-Fi Alliance in 2018, is the current standard and is mandatory for devices carrying recent Wi-Fi certification. It replaces the WPA2 handshake with one (Simultaneous Authentication of Equals, SAE, also called Dragonfly) that resists the offline password-guessing that made weak WPA2 keys crackable, and it adds forward secrecy so that capturing traffic today does not decrypt it later even if the password is found. WPA3 has had its own research findings (the "Dragonblood" weaknesses in early implementations), which is a useful reminder that "newest" is not the same as "flawless"; but for a current lab and a current recommendation, WPA3 with a strong passphrase, or WPA2/WPA3 mixed mode where old devices must be supported, is the right answer, and WEP or open networks are findings in their own right.

"Gaining access" in this unit is the introduction that VU23226 then develops in depth. The recurring route is credentials. Online password attacks guess against a live service and are limited by lockouts and rate limiting; Hydra is the tool commonly used to demonstrate them. Offline attacks work on password hashes already obtained, where John the Ripper and Hashcat can try enormous numbers of candidates quickly. The teaching point is defensive as much as offensive: the reason strong, unique passwords, multi-factor authentication and account lockouts matter is exactly what these tools demonstrate when those controls are absent.

The required-skill outcome pairs every vulnerability with a mitigation, and intrusion detection is where much of that mitigation lives. An intrusion detection system (IDS) watches network or host activity and raises an alert when it sees something suspicious; an intrusion prevention system (IPS) sits in line and can block it. Detection works two ways, and both belong in the answer: signature-based detection matches known-bad patterns and is precise but blind to anything new, while anomaly-based detection learns a baseline of normal and flags deviations, catching novel attacks at the cost of more false alarms. Snort and Suricata are the well-known open-source engines. For this unit, the habit to build is finishing every finding with a concrete treatment: patch this service, disable that protocol, segment this network, enforce multi-factor authentication here, and monitor for the specific technique you just demonstrated.

The required knowledge names scripting languages such as Python, and the reason is practical. Testing generates repetitive work (sweeping a range of addresses, parsing scan output, automating a check across many hosts), and a few lines of Python turn an hour of clicking into a second of running. Python is the field's default because its standard library and packages (the socket module for raw network work, requests for web testing, scapy for crafting and reading packets) cover most of what a tester needs, and because so many existing tools and proof-of-concept exploits are written in it. The aim in this unit is not to become a developer but to read a script well enough to understand and trust it before running it, and to adapt one to a new target.

Everything here needs an environment sealed off from anything real: virtual machines on an isolated, host-only virtual network, snapshotted so a broken machine is rolled back in seconds. The attacker machine is Kali Linux, which ships with Nmap, Wireshark, the Metasploit framework, Hydra, John the Ripper and the rest of the toolkit already installed. Common practice targets are Metasploitable (a deliberately vulnerable Linux box) and a vulnerable web application for the web-testing portions. For guided practice without building every target by hand, TryHackMe (tryhackme.com) and Hack The Box (hackthebox.com) run browser-based labs covering reconnaissance, scanning, sniffing and the rest of this unit's outcomes, and the freely readable NIST SP 800-115 is the reference to keep beside the work.

These notes were built for personal professional development from current, authoritative sources rather than transcribed from the training package. The unit scope, required skills, required knowledge and description follow the Victoria University published unit page for VU23215 (vu.edu.au), read August 2026 with no page-modified date shown; the core placement, nominal hours (60) and assessment conditions are confirmed against the CDU TAFE course document for 22603VIC Certificate IV in Cyber Security (V001, held in the vault). The testing-process material draws on the NIST Special Publication 800-115 Technical Guide to Information Security Testing and Assessment (nist.gov), the Penetration Testing Execution Standard (pentest-standard.org) and the OSSTMM (isecom.org). Tool references are grounded in each project's own documentation: Nmap (nmap.org), Wireshark (wireshark.org), the Metasploit framework, Hydra and John the Ripper, and Snort (snort.org) and Suricata (suricata.io) for intrusion detection. The wireless material draws on the Wi-Fi Alliance's WPA3 specification and security materials (wi-fi.org) and the historical WEP, WPA2, KRACK and Dragonblood findings, cross-checked against the TechTarget wireless-security comparison, read August 2026. The Python references point to the language and library documentation (python.org, and the scapy and requests projects). Practice references point to tryhackme.com and hackthebox.com. Web sources were read in August 2026; the WEP and WPA2 weaknesses and the 2018 introduction of WPA3 are historical and not tied to a single page.