Start at whoami.
End at root.

Standard, extended, and named ACLs for network traffic filtering.

AD enumeration with net commands, PowerShell, and LDAP queries.

ldapsearch, windapsearch, and manual LDAP queries to map AD structure.

SID history injection, foreign principal abuse, and cross-forest attacks.

ESC1–ESC8 ADCS misconfigurations for certificate-based domain compromise.

SharpHound collection, BloodHound graph analysis, and finding attack paths.

CME for SMB enumeration, credential testing, and lateral movement.

PowerView functions for enumerating users, groups, ACLs, and SPNs.

Second-order SQLi, stored procedures, and WAF bypass techniques.

XSS chaining, CSP bypass, CSRF token theft, and SameSite attribute bypass.

Evade a phishing classifier you can train in seconds, but only through the API and only within a query budget — the way a real attacker has to.

Plant a backdoor in training data, keep clean accuracy at 95%, flip every triggered input, and prove the model passes its tests anyway.

AI as the tester's tool: four genuine accelerants, the boundaries you never cross, and a graded checker that catches fabricated findings.

Frida hooking, SSL unpinning, and runtime method tracing on Android.

Analyse an Android malware sample: C2 extraction, permissions, and indicators.

APK decompilation, manifest review, jadx, and secret extraction.

REST API enumeration, BOLA, mass assignment, and API-specific fuzzing.

AppLocker rule bypass via trusted paths, DLL side-loading, and COM objects.

2FA bypass, brute force protection bypass, and credential stuffing.

Full attack chain from external foothold to domain admin in a lab network.

Introspection abuse, batching attacks, and GraphQL injection.

Dragonblood side-channel attacks and WPA3 transition mode weaknesses.

Boolean-based and time-based blind SQLi with sqlmap and manual methods.

Session fixation, prediction, and authentication logic flaws.

Classic stack overflow: control EIP/RIP, find bad chars, and deliver shellcode.

Intercept, modify, and replay HTTP requests using Burp Suite Community Edition.

MAC spoofing, DNS tunnelling, and other captive portal evasion techniques.

Enumerate AWS with compromised keys: IAM, S3, EC2, Lambda, and Secrets Manager.

Deploy and operate the Sliver C2 framework for red team engagements.

OS command injection via semicolons, pipes, and backticks with filter bypass.

Capture 4-way handshake and crack with hashcat GPU-accelerated wordlists.

Reflected, stored, and DOM-based XSS with cookie theft and keylogger payloads.

GenericAll, WriteDACL, GenericWrite, and AddMember for privesc.

Cisco IOS DHCP server and relay agent configuration.

Build a DNS reconnaissance tool from scratch in Python.

Socket abuse, privileged mode, CAP_SYS_ADMIN cgroup escape, and runc CVE.

Dynamic binary analysis with WinDBG, setting breakpoints, and inspecting memory.

Egghunter technique for small buffer spaces and custom shellcode writing.

Configure and verify EIGRP routing including neighbour adjacency and metrics.

Move files between machines using HTTP, FTP, SCP, SMB, and base64 encoding.

Bypass extension filters, MIME type checks, and upload webshells.

Read stack memory, leak canaries, and perform arbitrary writes with %n.

Memory scanning, value freezing, pointers, and basic code patching against a running game.

Byte-array signatures, script persistence, logic reversing, and packaging a simple mod.

BLE scanning, GATT attribute enumeration, and Bluetooth relay attacks.

Build real webpages from scratch. 15 exercises that take you from basic tags to a complete styled portfolio page — all you need is a text editor and a browser.

CORS, caching, host header injection, and HTTP/2 downgrade attacks.

CL.TE and TE.CL desync attacks to bypass front-end security controls.

Online password attacks against SSH, FTP, HTTP forms, and RDP with Hydra.

Snort/Suricata rule writing, tuning, and evasion-aware detection.

Exploit XML XPath and LDAP directory injection vulnerabilities.

Java, PHP, and Python deserialization gadget chains for RCE.

IDOR via predictable IDs, GUIDs, and horizontal vs vertical privilege escalation.

AFL++, libFuzzer, and coverage-guided fuzzing to discover binary vulnerabilities.

IP addressing, CIDR notation, and subnet calculation practice.

IPv6 addressing, EUI-64, SLAAC, and dual-stack configuration.

Unpack obfuscated JS, extract hidden endpoints, and reverse client-side logic.

Interactive JavaScript exercises — variables, DOM manipulation, events, arrays, APIs, and 5 browser mini-projects you build from scratch.

Set up your Kali VM, configure tools, and prepare your hacking lab environment.

Kerberoasting, ASREPRoasting, Pass-the-Ticket, and Golden/Silver tickets.

Disk acquisition, filesystem timeline, log analysis, and bash history forensics.

Linux and Windows privesc fundamentals using linpeas, winpeas, and manual methods.

ptrace-based injection, LD_PRELOAD abuse, and /proc/mem manipulation.

Insecure output handling: turn model output into XSS and command injection, then prove the fix blocks it. A two-stage grader script you run locally.

Path traversal, null byte injection, PHP wrappers, and remote file inclusion.

Analyse malicious Office documents, PDFs, and macros with olevba and remnux.

Analyse infected memory dumps: find malware, C2 IPs, injected code, and creds.

msfconsole, searching modules, setting options, running exploits, and Meterpreter.

Prototype pollution, web cache poisoning, and client-side path traversal.

Linked server abuse, MSSQL xp_cmdshell, Exchange privilege escalation.

Configure static NAT, dynamic NAT, and PAT overload.

Netcat as a network Swiss army knife — listeners, file transfer, reverse shells.

Host discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.

MongoDB operator injection, authentication bypass, and data extraction.

Responder, NTLMrelayx, and relay chains for credential capture and relay.

alg:none bypass, RS256→HS256 confusion, JWT cracking, and OAuth code theft.

End-to-end passive recon on a target: DNS, WHOIS, Shodan, theHarvester.

OSPF areas, DR/BDR election, and route summarisation.

Pass-the-Hash, credential dumping with Mimikatz, and password spray techniques.

Crack NTLM, SHA1, and bcrypt hashes offline using hashcat and John the Ripper.

Proxychains, SSH tunneling, Chisel, and Ligolo for network pivoting.

Configure port security, sticky MAC addresses, and violation modes.

Detect DLL injection, process hollowing, and reflective injection in EDR logs.

Direct and indirect prompt injection against a RAG chatbot you build yourself, graded on a canary flag string.

Socket programming, subprocess, file I/O, and building basic automation tools.

Bypass NX/DEP with ROP gadget chains, ret2libc, and ASLR defeat via info leaks.

Bash, Python, PHP, PowerShell, and Meterpreter reverse shells with netcat handlers.

Structured Exception Handler overflow exploitation with POP/POP/RET chains.

Advanced SSRF chains, XXE, and server-side prototype pollution.

Detect and exploit Jinja2, Twig, and Freemarker SSTI for RCE.

Banner grabbing and service enumeration across FTP, SSH, SMTP, SMB, and HTTP.

Enumerate SMB shares, null sessions, and users with enum4linux and smbclient.

Work a realistic alert queue: classify, investigate, and escalate findings.

STP operation, root bridge election, and port states.

Hands-on SQL exercises from basic queries to complex JOINs and aggregations. Work through 20 challenges on a real database schema — no install required.

Error-based, union-based, and basic SQLi with manual exploitation.

Internal service access, cloud metadata exploitation, and SSRF filter bypasses.

Static route configuration, floating routes, and troubleshooting.

Enumerate dangling DNS, claim GitHub Pages and S3 buckets, exploit cookie scope.

Build process compromise, dependency confusion, and package hijacking.

Write SPL queries, build dashboards, and create detection rules in Splunk.

Hypothesis-driven hunting in Elastic/Kibana using KQL and EQL.

UEBA concepts, detecting insider threats, and anomalous account activity.

Configure VLANs, trunk ports, and inter-VLAN routing on Cisco switches.

Directory busting, technology fingerprinting, and web attack surface mapping.

XXE external entity injection, blind XXE via OOB, and mass IDOR testing.

Fast directory, parameter, and vhost fuzzing with ffuf and SecLists.

IV collection and statistical WEP key recovery with aircrack-ng.

Code review-driven RCE finding in PHP, Python, and Java web applications.

hostapd-wpe captive portal, SSL strip, and credential capture via rogue AP.

Monitor mode, packet capture, deauth attacks, and WPA2 handshake cracking.

Recon a same-network target with Wireshark and Nmap, crack SSH with Hydra, then flip to the defender's view. 7 steps, every command explained.

Attack and detect common Windows attack patterns in a paired lab environment.

AMSI bypass, PowerShell logging bypass, and process injection methods.

Key event IDs for logon, process creation, lateral movement, and privilege use.

Heap spray, use-after-free, and Windows heap internals for exploitation.

PSExec, WMI, WinRM, DCOM, and token impersonation for lateral movement.

Services, tokens, registry, DLL hijacking, and AlwaysInstallElevated.

Full 32-bit Windows stack overflow with mona.py and custom shellcode.

Capture, filter, and dissect network traffic to understand protocols.

WMI for persistence, lateral movement, and stealthy code execution.

WPScan, plugin CVEs, theme RCE, XML-RPC abuse, and brute force.

Reaver and Bully WPS PIN brute force against vulnerable routers.

Write YARA malware signatures and Sigma detection rules for SIEM platforms.

Set up your Kali VM, configure tools, and prepare your hacking lab environment.

Host discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.