Cybersecurity III: Ethical Hacking and Penetration Testing Explained
INTRODUCTION
Every day in Nigeria, thousands of people send money through apps like Opay, Palmpay, and GTBank Mobile. Students log into school portals. Businesses store customer data online. But here is the question nobody asks out loud — who makes sure all of that is safe?
The answer is cybersecurity professionals. And among the most skilled of them are ethical hackers.
Now, when most people hear the word "hacker," they immediately think of a criminal hiding behind a screen, stealing money or crashing websites. But that is only one side of the story. There is another kind of hacker — one who uses the same skills, the same tools, and the same knowledge, but for a completely different purpose: to protect people.
This is what Cybersecurity III is about. In this lesson, you will learn what ethical hacking means, how penetration testing works, and why these skills are becoming some of the most valuable in the world — including right here in Nigeria.
LEARNING OBJECTIVES
By the end of this lesson, students should be able to:
- Define ethical hacking and explain how it differs from criminal hacking
- Describe the concept of penetration testing and its stages
- Identify the types of ethical hackers and their roles
- Explain common tools and techniques used in ethical hacking
- Demonstrate understanding of real-life applications of penetration testing in Nigeria
- Discuss the ethical and legal responsibilities of a cybersecurity professional
MAIN CONTENT
What Is Ethical Hacking?
Ethical hacking is the practice of intentionally trying to break into a computer system, network, or application — but with full permission from the owner — in order to find weaknesses before a criminal does.
Think of it this way. Imagine a bank in Lagos hires a security expert to dress like a thief, walk around the bank, and try every possible way to break in. The expert finds a broken window at the back. The bank fixes it. Now, when a real thief comes, there is nothing to exploit. That is exactly what ethical hacking does — but for digital systems.
Ethical hackers are also called White Hat Hackers. They are professionals who use their technical knowledge to improve security, not destroy it.
The Difference Between Ethical Hackers and Criminal Hackers
There are three types of hackers in cybersecurity, commonly described using the colours of hats:
White Hat Hackers — These are the ethical hackers. They have permission to test systems and they report what they find. Their goal is to protect.
Black Hat Hackers — These are the criminals. They break into systems without permission, steal data, damage networks, or demand ransom. In Nigeria, activities like this fall under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015.
Grey Hat Hackers — These fall in between. They may hack without permission but do not always cause damage. They sometimes report what they found — but still, hacking without authorisation is illegal.
The most important difference between a white hat and a black hat is not the skill. It is the permission and the intent.
What Is Penetration Testing?
Penetration testing — often shortened to "pen testing" — is a structured method of testing a computer system's security by simulating a real attack. It is one of the core jobs of an ethical hacker.
The word "penetration" here means to find a way in. Just like testing whether a fence is strong enough by pushing against it from all sides, penetration testing checks whether a digital system can hold up against different types of attacks.
Companies, government agencies, banks, and hospitals in Nigeria hire penetration testers regularly to check their systems.
Stages of Penetration Testing
A proper penetration test follows a clear process. Here are the five main stages:
Stage 1 — Reconnaissance (Information Gathering) This is the first step. The ethical hacker gathers as much information as possible about the target system without touching it yet. This can include things like the company's IP address, the software they use, the names of employees, or even publicly available social media information. In Nigeria, this might mean looking at a company's website, checking their LinkedIn profiles, or scanning public domain records.
Stage 2 — Scanning After collecting information, the hacker uses tools to scan the system for open doors — called open ports — and identify running services or software versions that might have known weaknesses.
Stage 3 — Gaining Access (Exploitation) This is the stage most people think of when they hear "hacking." The ethical hacker now attempts to use the vulnerabilities found to actually enter the system. This could involve cracking a weak password, exploiting a software bug, or tricking a user into clicking a harmful link (this is called social engineering).
Stage 4 — Maintaining Access Here, the tester checks whether they can stay inside the system without being detected. This tests whether the organisation has proper monitoring in place. A real attacker would use this stage to steal data quietly over a long period.
Stage 5 — Reporting This is the most important stage for an ethical hacker. After all the testing is done, a detailed report is written explaining what was found, how serious each issue is, and how to fix it. Without this report, the whole exercise is useless.
Common Tools Used in Ethical Hacking
You do not need to memorise all the tools at this stage, but as an SSS 2 student, you should be familiar with the names and what they do.
Nmap — A tool used to scan networks and discover devices and open ports. It helps the hacker understand the layout of the target system.
Wireshark — A tool that captures and analyses data packets travelling across a network. It helps identify unencrypted or suspicious traffic.
Metasploit — A popular framework used to test known vulnerabilities in systems. It is widely used in professional penetration testing.
Burp Suite — Used specifically for testing web applications and websites. It can detect issues in login pages, forms, and APIs.
Kali Linux — This is not just a tool but an entire operating system specifically designed for ethical hacking. Most professional penetration testers use it.
Note to students: These tools are for learning and professional use only. Using them on any system without written permission is a criminal offence under Nigerian law.
Real-Life Nigerian Examples of Ethical Hacking and Penetration Testing
Understanding how this works in real life makes it much easier to grasp. Here are some examples that are very close to home:
Example 1 — Nigerian Banks and Fintech Companies Nigerian financial institutions like Zenith Bank, Access Bank, and fintech companies like Flutterwave and Paystack handle billions of naira in transactions every day. They regularly hire cybersecurity firms to carry out penetration tests on their mobile apps, ATM networks, and online platforms. When a tester discovers that a login page can be bypassed, the company fixes it before a criminal finds it.
Example 2 — The Nigerian Communications Commission (NCC) In 2021, the NCC warned Nigerians about a dangerous vulnerability that could allow hackers to intercept calls and data through a software flaw. Ethical hackers and security researchers identified this issue and reported it responsibly so that users could protect themselves.
Example 3 — University and School Portals Many Nigerian universities have had their student result portals hacked in the past. Institutions that invest in penetration testing are better protected against students or outsiders who try to manipulate results or access private records.
Example 4 — Government Digital Services As Nigeria moves more government services online — from NIN registration to tax filing on the FIRS portal — the need for ethical hackers to test these platforms before launch has become critical.
Practical Applications of Ethical Hacking
Ethical hacking is not just a theory topic. Here is how it is practically applied in different sectors:
In Banking and Finance — Pen testers regularly audit mobile banking apps and payment gateways to ensure customer funds and data are protected.
In Healthcare — Hospitals that store patient records digitally use ethical hackers to ensure that sensitive medical data is not exposed.
In Education — Online examination platforms and school management systems are tested to prevent result manipulation or unauthorised access.
In E-Commerce — Online stores use penetration testers to secure payment pages and prevent customer data from being stolen.
In Government — Federal and state government agencies test their websites and internal networks to protect critical national infrastructure.
Advantages of Ethical Hacking
It helps organisations find and fix security gaps before criminals exploit them.
It builds trust with customers, who feel safer knowing their data is protected.
It reduces financial loss that would result from a successful cyberattack.
It helps companies stay compliant with data protection laws, including Nigeria's NDPR (Nigeria Data Protection Regulation).
It creates well-paying career opportunities for Nigerian youths in a growing global industry.
H2: Disadvantages and Risks of Ethical Hacking
If not done carefully, penetration testing can accidentally crash a live system or cause data loss.
A trusted ethical hacker who turns dishonest can misuse sensitive information discovered during testing.
Without clear legal agreements, ethical hacking can cross into illegal territory.
It requires significant investment in tools, training, and time.
Ethical and Legal Considerations
This is perhaps the most important section of this lesson.
No matter how skilled you are, hacking into any system without written permission is illegal. In Nigeria, the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 clearly states that unauthorised access to computer systems is a criminal offence punishable by imprisonment and heavy fines.
An ethical hacker must always:
- Obtain written authorisation from the system owner before testing
- Define the scope of the test clearly — meaning exactly which systems will be tested
- Protect any sensitive data discovered during the test
- Report all findings honestly and completely
- Never share or sell information obtained during a test
The goal of ethical hacking is to protect people, not to gain personal advantage. Any cybersecurity professional who forgets this is no longer ethical — and no longer a professional.
Classroom and Home Activities
Activity 1 — Spot the Vulnerability Ask your teacher to show you the login page of your school portal (or any public website). As a class, discuss: What would a hacker look for on this page? What makes a login page strong or weak? Write down your observations.
Activity 2 — Password Strength Test Without sharing your real passwords, create five sample passwords of your own (fictional ones). Then, discuss with your classmates: Which of these passwords is strongest and why? What makes a password difficult to crack?
Activity 3 — The Hacker's Report Imagine you are an ethical hacker hired to test a small Nigerian online shop. Write a one-page report explaining what three things you would check, what you might find, and how the shop should fix each issue.
Activity 4 — Research Assignment Find out more about the NCC's cybersecurity advisory from 2021. Write a short paragraph explaining what the vulnerability was, who it affected, and what advice was given to Nigerian users.
Assessment Questions
Objective Questions:
-
An ethical hacker is also known as a: a) Black hat hacker b) White hat hacker c) Grey hat hacker d) Blue hat hacker Answer: b) White hat hacker
-
Which of the following is the FIRST stage of penetration testing? a) Exploitation b) Reporting c) Reconnaissance d) Scanning Answer: c) Reconnaissance
-
Which tool is used to capture and analyse network traffic? a) Metasploit b) Nmap c) Wireshark d) Burp Suite Answer: c) Wireshark
-
What does "pen testing" stand for? a) Personal testing b) Penetration testing c) Performance testing d) Permission testing Answer: b) Penetration testing
-
Under Nigerian law, hacking into a computer without permission is a crime under which act? a) Criminal Code Act b) NDPR 2019 c) Cybercrimes (Prohibition, Prevention, etc.) Act 2015 d) Freedom of Information Act Answer: c) Cybercrimes (Prohibition, Prevention, etc.) Act 2015
Theory Questions:
-
Explain the difference between a white hat hacker and a black hat hacker. In your answer, mention at least two things that separate them.
-
Describe the five stages of penetration testing. Use a Nigerian banking company as your example to explain what would happen at each stage.
-
Why is it important for ethical hackers to have written permission before testing a system? What could go wrong if they proceed without it?
Summary
In this lesson, you learned that:
Ethical hacking is the practice of legally and professionally testing systems to find weaknesses before criminals do.
Penetration testing is a structured method with five stages: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Reporting.
White hat hackers work with permission and for protection. Black hat hackers operate illegally.
Popular tools used in ethical hacking include Nmap, Wireshark, Metasploit, Burp Suite, and Kali Linux.
In Nigeria, ethical hacking is used by banks, fintech companies, government agencies, and educational institutions to protect digital systems.
Legal and ethical conduct is non-negotiable for any cybersecurity professional.
CONCLUSION
Cybersecurity is no longer just a topic for technology experts in faraway countries. It is a reality that affects every Nigerian who uses a smartphone, visits a website, or sends money through a mobile app. As the country continues to grow its digital economy, the need for skilled, ethical, and responsible cybersecurity professionals will only increase.
As an SSS 2 student, understanding ethical hacking and penetration testing is not just about passing an exam. It is about equipping yourself with knowledge that could one day protect individuals, businesses, and even national institutions from cyber threats.
The future of Nigeria's digital world may very well depend on how well today's students understand and apply these principles.
FAQ SECTION
Q1: Is ethical hacking legal in Nigeria? Yes, ethical hacking is legal in Nigeria when it is done with proper written permission from the system owner. Hacking without permission is a criminal offence under the Cybercrimes Act 2015.
Q2: Can a Nigerian student pursue a career in ethical hacking? Absolutely. There are globally recognised certifications like CEH (Certified Ethical Hacker) and CompTIA Security+ that Nigerian students can pursue after secondary school. Several Nigerian universities and private tech institutions also offer cybersecurity programmes.
Q3: What is the difference between penetration testing and vulnerability scanning? Vulnerability scanning is an automated check that lists possible weaknesses in a system. Penetration testing goes further — a human tester actively tries to exploit those weaknesses to see how serious they really are.
Q4: What age can someone start learning ethical hacking? There is no fixed age. Many cybersecurity professionals started learning in secondary school. What matters most is curiosity, discipline, and a strong understanding of computer fundamentals.
Q5: How does penetration testing help Nigerian banks? Nigerian banks use penetration testing to check that their mobile apps, ATM systems, and online platforms cannot be easily compromised. This protects millions of customers from fraud and data theft.
Q6: What is social engineering in cybersecurity? Social engineering is a technique where hackers manipulate people — rather than machines — into giving up sensitive information. For example, sending a fake email pretending to be from your bank and asking you to enter your password. This is one of the most common attack methods in Nigeria today.
.jpg)
0 Comments