You cannot defend what you do not understand. This is the premise of ethical hacking, and it has a corollary the module takes seriously: understanding how an attack works requires actually attempting it, in a controlled environment, with clear ethical and legal boundaries. The result is a module that asks students to think like an adversary in order to build better defences.
Why it matters
The threat landscape has changed. Automated vulnerability scanners, exploit frameworks, and detailed public disclosures mean that the tools of an attacker are no longer exotic. Organisations that rely on security through obscurity or on the hope that attackers will not notice them are routinely proven wrong. The answer is systematic assessment: finding vulnerabilities before an adversary does, understanding their severity, and addressing them.
Ethical hacking, also known as penetration testing or red-teaming, is now a recognised professional discipline with its own methodologies, certifications, and legal frameworks. This module gives students the technical foundations and the conceptual grounding to participate in that discipline responsibly.
Module design
The module is structured around the penetration testing lifecycle: from scoping and reconnaissance through vulnerability discovery and exploitation to reporting. Students work with current tools on intentionally vulnerable systems, and each practical task is paired with conceptual grounding in why the vulnerability exists, not just how to exploit it.
A consistent emphasis runs through the module: the ethical dimension is not a disclaimer, it is part of the content. Understanding what authorised testing looks like, what legal exposure arises from unauthorised testing, and how to communicate findings to a non-technical audience are as central to professional practice as the technical techniques themselves.
Topics
- The case for security assessment: risk, exposure, and accountability
- Vulnerability classification: CVE, CVSS, and security scoring frameworks
- Penetration testing methodology and scoping
- Reconnaissance and information gathering
- Memory corruption vulnerabilities and exploitation
- Cross-site scripting and web application attacks
- Fundamentals of C for code analysis and reverse engineering
- Reverse engineering: tools and techniques
- Simulated attack scenarios and capture-the-flag approaches
- Privilege escalation: techniques and defences
- Security assessment reporting and remediation advice
- Legal, ethical, and professional responsibilities
What students leave with
Students can conduct structured vulnerability assessments on software, networks, and web applications, use professional-grade tools in a responsible and legally compliant way, analyse code for common vulnerability classes, and communicate findings clearly to technical and non-technical audiences. The habit of systematic adversarial thinking, asking how could this fail before it does, transfers broadly across software engineering, security operations, and product development.