Penetration Testing
Election 1 VM
A simulated penetration test against the Election 1 vulnerable VM from VulnHub — applying reconnaissance, vulnerability analysis, exploitation, and post-exploitation techniques to achieve root access, with a formal pentest report as the deliverable.
🎯 Project Overview
This project simulates a real-world penetration testing engagement by targeting Election 1 — an intentionally vulnerable Linux VM available on VulnHub. The test was conducted from a Kali Linux attack machine, both hosted on Oracle VirtualBox, in an isolated lab environment.
The objective was to systematically apply penetration testing techniques — from initial reconnaissance through to privilege escalation — ultimately gaining root/administrative access and producing a formal pentest report documenting all findings and mitigations.
🔍 Penetration Testing Phases
1. Information Gathering
- Performed network and port scanning using Nmap to enumerate open services and OS fingerprint the target.
- Identified running services, application versions, and potential entry points from scan output.
# Nmap: Service and version detection
nmap -sV -sC -p- <target_ip>
# Nmap: OS detection
nmap -O <target_ip>2. Vulnerability Analysis
- Identified vulnerabilities in exposed services and web applications running on the target VM.
- Used OpenVAS and Nessus for automated vulnerability scanning alongside manual analysis.
3. Exploitation
- Executed targeted exploits against identified vulnerabilities in accessible services.
- Leveraged open service ports to gain initial access to the target system.
4. Reporting
Findings were compiled into a comprehensive penetration test report — documenting each vulnerability, the exploitation method used, the business impact, and recommended mitigations. The report follows professional pentest reporting conventions.