What Is Ethical Hacking?

This month covers cyber security and ethical hacking: understanding how attacks work so you can defend against them. Before any tools, this lesson sets the foundation, what ethical hacking is, the line between legal and illegal, and your responsibilities. You will also see, firsthand, how exposed everyday accounts are by checking your own email against known data breaches.

What ethical hacking is, and is not

Ethical hacking means testing systems for vulnerabilities, but only with permission and for the purpose of improving security. It is exactly what security researchers, bug bounty hunters, and red teams do around the world to keep people safe. Done responsibly, it protects people; done without permission, it is illegal and unethical. The entire point of this month is to learn how attacks work so you can understand, detect, and defend against them, not to cause harm.

White hat, black hat, gray hat

You will hear three terms. A white hat is an ethical hacker who protects systems, always with permission. A black hat breaks into systems illegally. A gray hat operates in a murky middle, not clearly legal or ethical. This course is firmly white hat. Everything you do this month must be on your own devices or with explicit permission, aimed at learning and protecting.

The rules you are agreeing to

This matters, so it is stated plainly. By continuing, you agree to use these tools only on devices you own or have explicit permission to access. You will not use them in public spaces, on school or work computers, or in any way that could violate laws. Crafting Table Academy is not liable for what you do with this knowledge. These are not formalities; treating them seriously is what separates a responsible security learner from someone committing a crime.

Why passwords are a vulnerability

A powerful first lesson is how exposed ordinary accounts are. Services get breached constantly, and those breach databases circulate online. Some contain passwords in plain text; others store them hashed, but weak or old hashing (like MD5) can often be reversed using databases of known hashes. The real danger is reuse: if you use the same password across sites, one breach exposes all of them. This is why a password is not just a personal choice but a security weakness when it is weak or reused.

Defending yourself

The defensive takeaway is concrete. Check your own exposure with a breach-lookup service by entering your email address (never a password) to see which breaches you appear in. Then stop reusing passwords and adopt a password manager, which generates and stores a unique strong password per site so a single breach cannot cascade. Understanding the attacker's view is exactly what tells you how to protect yourself.

Working through it

Understand the ethical frame. Accept that everything this month is white hat: your own devices or explicit permission, for learning and defense only.

Check your email for breaches. Use a breach-lookup service like haveibeenpwned.com and enter an email address (not a password) to see if it appears in known breaches.

Explore what was exposed. For any hit, note which site the breach came from, what kind of data leaked, and when, to see how exposed digital life can be.

Inventory your password reuse. Privately list the sites where you have reused a password. This is for your eyes only.

Harden your accounts. Change the password on any breached account immediately and adopt a password manager so every account has a unique strong password.

Common mistakes and troubleshooting

Entering a password into a breach-lookup site. Only enter your email address; never type a real password into any such tool.

Assuming a hashed password is safe. Weak or old hashes can be reversed with known-hash databases, so a leaked hash can still expose the password.

Reusing one password across sites. Use a password manager to give every account a unique, strong password so one breach cannot cascade.

Treating the rules as optional. Using these tools without permission is illegal; only test devices you own or are explicitly authorized to test.

Next: Next you will build your first hardware project, AI-powered smart glasses on the XIAO ESP32-S3.