(Session Recap) On 24th September 2026, the Department of Cybersecurity at DUET’s Faculty of Information & Computing Sciences, in collaboration with the IEEE Education Society DUET Student Branch, hosted a hands-on session titled “ETHICAL HACKING & PENETRATION TESTING ” Running from 9:00 AM to 11:00 AM, the event brought together students eager to understand how ethical hacking and penetration testing work outside the classroom, not through theory, but through real, authorized security assessments.
The session was led by Laiba Khalid, Senior Penetration Tester at Apprise Cyber Pvt. Ltd., as guest speaker, alongside Huzakil Waseem , Associate Penetration Tester at Apprise Cyber, as co-host. Both speakers made clear from the outset that everything shared in the technical portion came from genuine, authorized client engagements, with all identifying data redacted for confidentiality.
Cybersecurity is bigger than hacking. The field spans penetration testing, red teaming, SOC operations, digital forensics, application and cloud security, malware analysis, and governance and compliance. Ethical hacking is one branch, not the whole tree.
Foundations come before tools. Networking, Linux and Windows internals, web technologies, scripting, SQL, and authentication and cryptography basics come first. Tools like Burp Suite, Nmap, Wireshark, and SQLMap automate testing, but understanding the technology is what tells a tester what to test and why a result matters.
A tester thinks differently. Can this input be manipulated? Does the server trust client supplied values? Can one user access another user’s data?
The session walked through six real vulnerabilities from authorized assessments:
- Unauthenticated data exposure, an orders API returning names, phone numbers, GPS coordinates, and pricing to anyone, with no login required.
- Broken access control, any authenticated user pulling every user’s name, email, and password hash. Authentication is not authorization.
- Blind XSS, a stored payload that executed inside an admin panel, confirmed via an out of band callback.
- SQL injection (auth bypass), a Base64 encoded payload that logged in without valid credentials.
- SQL injection (blind, WAF bypass), a hex based Boolean oracle that exfiltrated a 151,000 row user table past Cloudflare.
- Unauthorized fund transfer, a modified recipient IBAN accepted by the server, resulting in a real, successful payment.
Every bug traced back to one root cause: misplaced trust, whether in an endpoint, a token, stored content, a query, or a client sent value.
Final takeaway: learn systems before attacks, treat tools as support rather than substitutes for knowledge, validate findings instead of trusting scanners, and test only what you’re authorized to test.
About Apprise Cyber Pakistan
Apprise Cyber Pvt. Ltd. is a cybersecurity firm specializing in penetration testing, vulnerability assessments, and security consulting for organizations. The session was represented by Laiba Khalid and Huzakil Waseem from the Apprise Cyber team.
Beyond client engagements, Apprise Cyber conducts corporate seminars and training sessions, equipping businesses and academic institutions with practical, hands-on cybersecurity skills.
