SOFTENANT TECHNOLOGIES · ETHICAL HACKING LEARNING GUIDE

6 Ethical Hacking Projects for Freshers with Deliverables

Ethical hacking projects for freshers should demonstrate a clear question, an authorised environment, evidence and a defensible conclusion. These six original project briefs use lab machines or synthetic records. Choose one, complete the report and ask for feedback before adding more tools.

1. Service inventory with Nmap

Use a permitted isolated VM and list the services you expect it to expose. Record the observed host, port, service and scan time.

Check: Compare expected exposure with observations; explain open, closed and filtered results without calling every open port a vulnerability.

Deliverable: Inventory table, assumptions and two follow-up questions.

2. Linux permissions review

Create a fictional employee and administrator access matrix for sample files in your own lab. Inspect account groups and permissions.

Check: Check that intended access works and unrelated access is denied. Explain any proposed change before applying it in the lab.

Deliverable: Access matrix, before/after permissions and test results.

3. HTTP request notebook with Burp Suite

Use a designated training application and its supplied accounts to observe a login flow and a permitted page request.

Check: Identify method, path, status, session mechanism and the server-side control that should decide access. Redact cookies and tokens.

Deliverable: Annotated request/response pair and a plain-language flow explanation.

4. Web access-control report

In a purpose-built lab, compare what two authorised test roles are meant to see. Record expected behaviour before observing the result.

Check: Use the minimum evidence required and explain a corrective control and retest. Do not publish personal data or session tokens.

Deliverable: Scope, one finding, impact, remediation and retest plan.

5. Vulnerability triage exercise

Use five fictional alerts: outdated-looking banner, public login page, unintended data exposure, missing optional header and duplicate alert.

Check: Separate observations, confirmed findings, duplicates and unverified claims. Explain why severity needs context.

Deliverable: Triage table with status, evidence needed and owner action.

6. Remediation and retest portfolio

Take one of your lab findings, document a proposed fix and write both positive and negative test cases.

Check: Check that authorised behaviour still works and the reported undesired behaviour is prevented. State if the fix could not be tested.

Deliverable: Before/after evidence, test outcomes, limitations and short executive summary.

A folder structure that makes your work reviewable

project-name/
  README: objective, environment, authorisation and limits
  scope: permitted assets, accounts and exclusions
  evidence: redacted observations with dates
  findings: impact, remediation and uncertainty
  retest: expected behaviour, result and remaining work

Use fictional data and label the work as a learning exercise. A reviewer should understand what you did, why you chose it and what you could not conclude. In an interview, describe one decision and one limitation rather than reading a tool list.

For technical interpretation, read Nmap’s port-state definitions and PortSwigger’s Burp Suite introduction. The Web Security Academy provides dedicated web training labs.

Continue learning

• Sample VAPT finding report
• Interview preparation
• Internship portfolio checklist