Search
Every step, command and objective across 135 labs and 79 workbooks.
Section
Track
Difficulty
Showing all 214 pages. Start typing to search their full text.
🧪 Labs 135
Access Control Lists (ACLs)Standard, extended, and named ACLs for network traffic filtering.Active Directory BasicsAD enumeration with net commands, PowerShell, and LDAP queries.Active Directory LDAP Enumerationldapsearch, windapsearch, and manual LDAP queries to map AD structure.Active Directory Trust AttacksSID history injection, foreign principal abuse, and cross-forest attacks.AD Certificate Services (ADCS) AttacksESC1–ESC8 ADCS misconfigurations for certificate-based domain compromise.AD Enumeration with BloodHoundSharpHound collection, BloodHound graph analysis, and finding attack paths.AD Enumeration with CrackMapExecCME for SMB enumeration, credential testing, and lateral movement.AD Enumeration with PowerViewPowerView functions for enumerating users, groups, ACLs, and SPNs.Advanced SQL InjectionSecond-order SQLi, stored procedures, and WAF bypass techniques.Advanced XSS & CSRFXSS chaining, CSP bypass, CSRF token theft, and SameSite attribute bypass.Adversarial AI Evasion Under a Query BudgetEvade a phishing classifier you can train in seconds, but only through the API and only within a query budget — the way a real attacker has to.AI Data & Model Attacks: The Backdoor That Passes Every TestPlant a backdoor in training data, keep clean accuracy at 95%, flip every triggered input, and prove the model passes its tests anyway.AI Lab: EU AI Act Article 50 Transparency in CodeSign an asset with c2patool, verify it, tamper with it and watch verification fail — then implement the Article 50(1) chatbot disclosure. Graded on the verification exit code.AI Lab: LLM-Assisted Log and Alert TriageRun an LLM over a labelled alert corpus and find out where it helps, where it lies, and what it costs.AI Lab: Model Supply Chain — When torch.load Is Remote Code ExecutionA downloaded model file can own your machine on load. Prove it safely, then build the scan-and-refuse controls that stop it — and load only what you trust.AI Lab: Satisfy a NIST RMF MEASURE Subcategory with garakScan llama3.2:1b with garak under Docker Compose, then turn the report into a NIST AI RMF MEASURE 2.7 evidence record. Graded on the artefact and the metric being in range.AI Lab: Securing a RAG PipelineBuild a RAG stack on CPU, break it four ways, then drive the hidden attack tests from fail to pass.AI Lab: Unbounded ConsumptionTurn a summarisation pipeline into a cost bomb, then defuse it with four controls and re-plot the curve.AI-Augmented Penetration TestingAI as the tester's tool: four genuine accelerants, the boundaries you never cross, and a graded checker that catches fabricated findings.Android Dynamic AnalysisFrida hooking, SSL unpinning, and runtime method tracing on Android.Android Malware AnalysisAnalyse an Android malware sample: C2 extraction, permissions, and indicators.Android Static AnalysisAPK decompilation, manifest review, jadx, and secret extraction.API & Web Service AttacksREST API enumeration, BOLA, mass assignment, and API-specific fuzzing.Application Whitelisting BypassAppLocker rule bypass via trusted paths, DLL side-loading, and COM objects.Attacking Authentication Mechanisms2FA bypass, brute force protection bypass, and credential stuffing.Attacking Enterprise NetworksFull attack chain from external foothold to domain admin in a lab network.Attacking GraphQLIntrospection abuse, batching attacks, and GraphQL injection.Attacking WPA3 NetworksDragonblood side-channel attacks and WPA3 transition mode weaknesses.Blind SQL InjectionBoolean-based and time-based blind SQLi with sqlmap and manual methods.Broken Authentication & SessionsSession fixation, prediction, and authentication logic flaws.Buffer Overflow BasicsClassic stack overflow: control EIP/RIP, find bad chars, and deliver shellcode.Burp Suite BasicsIntercept, modify, and replay HTTP requests using Burp Suite Community Edition.Bypassing Wi-Fi Captive PortalsMAC spoofing, DNS tunnelling, and other captive portal evasion techniques.Cloud AWS EnumerationEnumerate AWS with compromised keys: IAM, S3, EC2, Lambda, and Secrets Manager.Command & Control with SliverDeploy and operate the Sliver C2 framework for red team engagements.Command InjectionOS command injection via semicolons, pipes, and backticks with filter bypass.Cracking WPA/WPA2 NetworksCapture 4-way handshake and crack with hashcat GPU-accelerated wordlists.Cross-Site Scripting (XSS)Reflected, stored, and DOM-based XSS with cookie theft and keylogger payloads.DACL Attacks in Active DirectoryGenericAll, WriteDACL, GenericWrite, and AddMember for privesc.DHCP Configuration LabCisco IOS DHCP server and relay agent configuration.DNS Enumeration with PythonBuild a DNS reconnaissance tool from scratch in Python.Docker Container EscapeSocket abuse, privileged mode, CAP_SYS_ADMIN cgroup escape, and runc CVE.Dynamic Malware Analysis with WinDbgDynamic binary analysis with WinDBG, setting breakpoints, and inspecting memory.Egghunters & Custom ShellcodingEgghunter technique for small buffer spaces and custom shellcode writing.EIGRP Routing LabConfigure and verify EIGRP routing including neighbour adjacency and metrics.Excessive AgencyExploit an agent with an unrestricted shell tool, then add an allowlist and approval gate and prove the same attack now fails. Before/after transcript grading.File TransfersMove files between machines using HTTP, FTP, SCP, SMB, and base64 encoding.File Upload VulnerabilitiesBypass extension filters, MIME type checks, and upload webshells.Format String VulnerabilitiesRead stack memory, leak canaries, and perform arbitrary writes with %n.Game Hacking FundamentalsMemory scanning, value freezing, pointers, and basic code patching against a running game.Game Reversing & ModdingByte-array signatures, script persistence, logic reversing, and packaging a simple mod.Hardware & Bluetooth AttacksBLE scanning, GATT attribute enumeration, and Bluetooth relay attacks.Hidden Context ExposureExtract a decoy API key from a system prompt, then re-architect so the secret is never in context. Flag capture plus a hidden pytest on every context payload.HTML & CSS LabBuild real webpages from scratch. 15 exercises that take you from basic tags to a complete styled portfolio page — all you need is a text editor and a browser.HTTP Misconfiguration AbuseCORS, caching, host header injection, and HTTP/2 downgrade attacks.HTTP Request SmugglingCL.TE and TE.CL desync attacks to bypass front-end security controls.Hydra Brute ForceOnline password attacks against SSH, FTP, HTTP forms, and RDP with Hydra.IDS/IPS Detection EngineeringSnort/Suricata rule writing, tuning, and evasion-aware detection.Injection Attacks: XPath, LDAP & HTML-to-PDFExploit XML XPath and LDAP directory injection vulnerabilities.Insecure DeserializationJava, PHP, and Python deserialization gadget chains for RCE.Insecure Direct Object References (IDOR)IDOR via predictable IDs, GUIDs, and horizontal vs vertical privilege escalation.Introduction to Binary FuzzingAFL++, libFuzzer, and coverage-guided fuzzing to discover binary vulnerabilities.IP Subnetting MasteryIP addressing, CIDR notation, and subnet calculation practice.IPv6 Configuration LabIPv6 addressing, EUI-64, SLAAC, and dual-stack configuration.JavaScript DeobfuscationUnpack obfuscated JS, extract hidden endpoints, and reverse client-side logic.JavaScript LabInteractive JavaScript exercises — variables, DOM manipulation, events, arrays, APIs, and 5 browser mini-projects you build from scratch.Kali Linux Environment SetupSet up your Kali VM, configure tools, and prepare your hacking lab environment.Kerberos AttacksKerberoasting, ASREPRoasting, Pass-the-Ticket, and Golden/Silver tickets.Linux ForensicsDisk acquisition, filesystem timeline, log analysis, and bash history forensics.Linux Privilege EscalationLinux and Windows privesc fundamentals using linpeas, winpeas, and manual methods.Linux Process Injection & Detectionptrace-based injection, LD_PRELOAD abuse, and /proc/mem manipulation.LLM Output & Application AttacksInsecure output handling: turn model output into XSS and command injection, then prove the fix blocks it. A two-stage grader script you run locally.Local & Remote File InclusionPath traversal, null byte injection, PHP wrappers, and remote file inclusion.Malicious Document AnalysisAnalyse malicious Office documents, PDFs, and macros with olevba and remnux.Mapping an Incident to MITRE ATLASMap a public AI incident to ATLAS techniques, emit a Navigator layer, render a heat map, and grade it against MITRE's own data.Memory Forensics with VolatilityAnalyse infected memory dumps: find malware, C2 IPs, injected code, and creds.Metasploit Framework Basicsmsfconsole, searching modules, setting options, running exploits, and Meterpreter.Modern Web ExploitationPrototype pollution, web cache poisoning, and client-side path traversal.MSSQL, Exchange & SCCM AttacksLinked server abuse, MSSQL xp_cmdshell, Exchange privilege escalation.NAT & PAT LabConfigure static NAT, dynamic NAT, and PAT overload.Netcat FundamentalsNetcat as a network Swiss army knife — listeners, file transfer, reverse shells.Network Scanning with NmapHost discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.NoSQL InjectionMongoDB operator injection, authentication bypass, and data extraction.NTLM Relay AttacksResponder, NTLMrelayx, and relay chains for credential capture and relay.OAuth & JWT Attacksalg:none bypass, RS256→HS256 confusion, JWT cracking, and OAuth code theft.OSINT & Passive ReconnaissanceEnd-to-end passive recon on a target: DNS, WHOIS, Shodan, theHarvester.OSPF Routing LabOSPF areas, DR/BDR election, and route summarisation.Password Attacks & Credential HuntingPass-the-Hash, credential dumping with Mimikatz, and password spray techniques.Password Cracking LabCrack NTLM, SHA1, and bcrypt hashes offline using hashcat and John the Ripper.Pivoting, Tunneling & Port ForwardingProxychains, SSH tunneling, Chisel, and Ligolo for network pivoting.Port Security LabConfigure port security, sticky MAC addresses, and violation modes.Process Injection & DetectionDetect DLL injection, process hollowing, and reflective injection in EDR logs.Prompt Injection AttacksDirect and indirect prompt injection against a RAG chatbot you build yourself, graded on a canary flag string.Python Coding LabSocket programming, subprocess, file I/O, and building basic automation tools.Return Oriented Programming (ROP)Bypass NX/DEP with ROP gadget chains, ret2libc, and ASLR defeat via info leaks.Reverse ShellsBash, Python, PHP, PowerShell, and Meterpreter reverse shells with netcat handlers.SEH-Based Buffer OverflowsStructured Exception Handler overflow exploitation with POP/POP/RET chains.Server-Side Request Forgery & AttacksAdvanced SSRF chains, XXE, and server-side prototype pollution.Server-Side Template Injection (SSTI)Detect and exploit Jinja2, Twig, and Freemarker SSTI for RCE.Service FootprintingBanner grabbing and service enumeration across FTP, SSH, SMTP, SMB, and HTTP.SMB EnumerationEnumerate SMB shares, null sessions, and users with enum4linux and smbclient.SOC Alert Triage with a SIEMWork a realistic alert queue: classify, investigate, and escalate findings.Spanning Tree Protocol (STP)STP operation, root bridge election, and port states.SQL Coding LabHands-on SQL exercises from basic queries to complex JOINs and aggregations. Work through 20 challenges on a real database schema — no install required.SQL Injection Deep DiveError-based, union-based, and basic SQLi with manual exploitation.SSRF AttacksInternal service access, cloud metadata exploitation, and SSRF filter bypasses.Static Routing LabStatic route configuration, floating routes, and troubleshooting.Subdomain TakeoverEnumerate dangling DNS, claim GitHub Pages and S3 buckets, exploit cookie scope.Supply Chain AttacksBuild process compromise, dependency confusion, and package hijacking.Threat Detection with SplunkWrite SPL queries, build dashboards, and create detection rules in Splunk.Threat Hunting with ElasticHypothesis-driven hunting in Elastic/Kibana using KQL and EQL.User Behavior ForensicsUEBA concepts, detecting insider threats, and anomalous account activity.VLANs & Trunking LabConfigure VLANs, trunk ports, and inter-VLAN routing on Cisco switches.Web Application ReconDirectory busting, technology fingerprinting, and web attack surface mapping.Web Attacks: IDOR, XXE & Verb TamperingXXE external entity injection, blind XXE via OOB, and mass IDOR testing.Web Fuzzing & Directory Brute ForcingFast directory, parameter, and vhost fuzzing with ffuf and SecLists.WEP Wireless AttacksIV collection and statistical WEP key recovery with aircrack-ng.White-Box Web Exploitation: Auth Bypass to RCECode review-driven RCE finding in PHP, Python, and Java web applications.Wi-Fi Evil Twin Attackshostapd-wpe captive portal, SSL strip, and credential capture via rogue AP.WiFi Hacking with Aircrack-ngMonitor mode, packet capture, deauth attacks, and WPA2 handshake cracking.WiFi Recon → SSH TakeoverRecon a same-network target with Wireshark and Nmap, crack SSH with Hydra, then flip to the defender's view. 7 steps, every command explained.Windows Attacks & DefenseAttack and detect common Windows attack patterns in a paired lab environment.Windows Evasion TechniquesAMSI bypass, PowerShell logging bypass, and process injection methods.Windows Event Log AnalysisKey event IDs for logon, process creation, lateral movement, and privilege use.Windows Heap ExploitationHeap spray, use-after-free, and Windows heap internals for exploitation.Windows Lateral MovementPSExec, WMI, WinRM, DCOM, and token impersonation for lateral movement.Windows Privilege EscalationServices, tokens, registry, DLL hijacking, and AlwaysInstallElevated.Windows Stack Buffer Overflows (x86)Full 32-bit Windows stack overflow with mona.py and custom shellcode.Wireshark Packet AnalysisCapture, filter, and dissect network traffic to understand protocols.WMI Tradecraft & AnalysisWMI for persistence, lateral movement, and stealthy code execution.WordPress ExploitationWPScan, plugin CVEs, theme RCE, XML-RPC abuse, and brute force.WPS AttacksReaver and Bully WPS PIN brute force against vulnerable routers.YARA & Sigma for DefendersWrite YARA malware signatures and Sigma detection rules for SIEM platforms.إعداد بيئة كالي لينكسSet up your Kali VM, configure tools, and prepare your hacking lab environment.فحص الشبكات باستخدام NmapHost discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.
📘 Workbooks 79
Active Directory Enumeration & AttacksBloodHound, PowerView, Kerberoasting, ASREPRoasting, and DACL abuse.Active Directory FundamentalsAD architecture, objects, Kerberos, NTLM, GPOs, and trusts before attacking AD.Advanced AI Red TeamingAdvanced adversarial attacks on AI systems, data poisoning, and model extraction.Advanced Web Attacks & ExploitationAdvanced techniques: request smuggling, deserialization, prototype pollution, and more.Advanced Windows ExploitationHeap exploitation, kernel basics, ROP chains, and 64-bit exploits.AI Governance with the NIST AI Risk Management FrameworkThe four AI RMF functions, the Generative AI Profile (AI 600-1), and the governance artefacts that turn framework prose into exit codes.AI Literacy: Embeddings and RetrievalHow text becomes numbers, how similarity is computed, and what a RAG pipeline really does to a prompt. Worked by hand in three dimensions, then run for real on a CPU.AI Literacy: LLM MechanicsWhat happens between your prompt and the model's reply: tokenisation, the context window, the decoding loop, and the mechanism behind hallucination and non-determinism.AI Literacy: The Confusion Matrix and Base RatesTP/FP/TN/FN, precision and recall, and the base-rate arithmetic that decides whether a detector is useful or useless. Worked on the page, with a napkin method you can use in a meeting.AI Literacy: Thresholds and ConfidenceThreshold sweeps worked by hand, ROC and AUC explained without calculus, and the misconception that causes more misplaced trust in AI output than any other: confidence is not correctness.AI Red Teaming: A MethodologyScope, threat-model, attack, evidence and report an AI system — the discipline, not a list of jailbreak prompts.AI Security Essentials: Detection, Segmentation and Model OperationsML detection and the base-rate problem, AI dev-environment segmentation, SIEM correlation, safe LLM use at work, model backups and drift — for beginners, with three CPU-only labs.AI Security Essentials: Non-Human Identity and Behavioural AuthenticationNon-human identities, the owner/expiry/review rule, agent authority and behavioural authentication, for beginners — with a CPU-only lab that builds a broker refusing to issue a bad credential.AI Security Essentials: Poisoning, Bias and GovernancePoisoning, bias and AI under GRC, taught from first principles for beginners — with a CPU-only lab in which you backdoor a spam classifier you trained yourself.AI Security Essentials: Start HereOrientation for a four-page AI security series for beginners: the four framings that make every later topic recognisable, and a CPU-only Docker lab box you build once and reuse.Android FundamentalsAndroid architecture, ADB, APK analysis, and mobile application security.Applications of AI in InfoSecSix real uses of AI in security work, the specific way each one fails, and the control that bounds it.Bash ScriptingShell scripting, conditionals, loops, and automation on Linux.Binary Exploitation FoundationsMemory layout, protections (ASLR, NX, canaries), and exploitation primitives.Bug Bounty HuntingHackerOne/Bugcrowd methodology, triaging, report writing, and maximising payouts.C++ FundamentalsMemory management, pointers, and C++ for understanding binary vulnerabilities.CCNA Foundation GuideCCNA syllabus: switching, routing, VLANs, ACLs, and network fundamentals.Cloud Security & AWSAWS IAM, S3 misconfigs, IMDS exploitation, IAM privesc, and cloud hardening.Computer Architecture & Assemblyx86/x64 assembly, registers, calling conventions, and reading disassembly.Containers for AI Labs: Docker and Compose from ZeroDocker and Compose from zero — images vs containers, volumes, ports, logs, cleanup, and a worked compose.yaml that runs a local model.Cryptography FundamentalsSymmetric, asymmetric, hashing, PKI, TLS, and common crypto weaknesses.CTF Beginner's GuideHow CTFs work, common categories, tools, and tips for first-timers.Cybersecurity EssentialsThe CIA triad, threat actors, vulnerability lifecycle, and security frameworks.Detection EngineeringWriting detection rules, YARA, Sigma, and tuning for low false positive rates.Digital Forensics & Incident ResponseEvidence acquisition, chain of custody, disk and memory forensics fundamentals.Docker & Container SecurityContainer escapes, Docker socket abuse, image scanning, and Kubernetes security.Documentation & ReportingExecutive summaries, technical findings, remediation tables, and templates.Evasion Techniques & Breaching DefensesAV evasion, EDR bypass, AppLocker, AMSI bypass, and living-off-the-land.Foundational Incident ResponseComplete incident response from detection to lessons learned.Foundational Threat HuntingHypothesis-driven hunting, data sources, TTP mapping, and Elastic/Splunk.Fundamentals of AIAI vs ML vs DL vs GenAI, supervised vs unsupervised, what a model is as a file on disk, training vs inference, and an honest statement of what this track will not teach you.HTML & CSS BasicsHTML structure, CSS, forms, and JavaScript basics for web security context.HTTP & Web RequestsHow HTTP works: methods, headers, cookies, proxies, and Burp basics.Incident HandlingIncident lifecycle, communication, containment, eradication, and post-mortems.Introduction to C#.NET, C# basics, and Windows development context for security work.Introduction to Penetration TestingWhat pentesting is, legal context, scope, phases, and methodology.Introduction to Web ApplicationsClient-server model, web technologies, cookies, sessions, and same-origin policy.ISO/IEC 42001: The AI Management System, and How It Meets ISO 27001AIMS clauses 4–10, the Annex A control themes, the Statement of Applicability as a checked file, and where ISO 27001 stops and 42001 starts.Java FundamentalsJava OOP, JVM, serialisation, and security-relevant Java concepts.JavaScript BasicsES6+, DOM, async/await, and security implications of JavaScript.Kali Linux FundamentalsKali toolset, configuration, and staying organised during engagements.Linux for BeginnersStart from zero — navigation, files, permissions, processes, bash basics.macOS FundamentalsmacOS architecture, filesystem, security model (SIP, Gatekeeper), and the command line.Malware AnalysisStatic and dynamic analysis, sandboxes, deobfuscation, and IOC extraction.Memory ForensicsVolatility 3, process analysis, code injection detection, and rootkit hunting.Network Traffic AnalysisWireshark, tcpdump, protocol analysis, and detecting anomalies in traffic.Networking Deep DiveTCP/IP, subnetting, DNS, routing, OSI model, and packet analysis.OSINT & ReconnaissanceGoogle dorking, Shodan, WHOIS, theHarvester, Maltego, and recon reports.Penetration Testing with KaliFull enterprise pentest from external recon to domain dominance.Pre-Engagement & Setting UpScope documents, rules of engagement, and lab environment configuration.Privilege Escalation — Linux & WindowsSUID, sudo, services, tokens, DLL hijacking — complete privesc reference.Python for AI Work: Environments, Data, and Testsvenv/uv and committed lockfiles, HTTP and JSON, CSV and pandas, scikit-learn as an API only, the chat-completions message shape, and pytest as the grading mechanism.Python for HackersSockets, subprocess, ctypes, pwntools, and offensive Python scripting.Python FundamentalsVariables, functions, loops, file I/O, and scripting for automation.Reading AI-Written Code: Review from Week OneA repeatable six-question review pass, then six flawed AI-generated snippets with the flaw, the cause, the fix, and a failing test.Red Team OperationsC2 frameworks, tradecraft, OPSEC, persistence, and advanced lateral movement.Secure CodingInput validation, output encoding, and secure SDLC practices.Secure Java DevelopmentSecure Java coding patterns, OWASP Java guidance, and code review.Security Operations & Defensive AnalysisComplete SOC analyst track: detection, response, and documentation.Shell and Data Wrangling for AI WorkTerminal, filesystem, permissions, processes and ssh, plus the text-processing verbs used to inspect model output and datasets.SOC Operations & SIEMSOC workflow, alert triage, SIEM platforms, and escalation procedures.Social EngineeringPhishing, vishing, pretexting, physical intrusion, and building awareness defences.SQL FundamentalsSELECT, INSERT, JOIN, subqueries, and understanding SQL for injection attacks.SQL Injection FundamentalsIn-band, blind, and out-of-band SQLi with manual and automated exploitation.The EU AI Act After the Omnibus: Who Owes What, and WhenRisk tiers, the provider/deployer split, GPAI duties, and the Article 50 transparency rules that are live right now.The Penetration Testing ProcessFull pentest lifecycle: recon → scan → exploit → post-exploit → report.Vulnerability AssessmentNessus, OpenVAS, prioritisation frameworks, and CVSS scoring.Web Application PentestingOWASP Top 10, Burp Suite advanced usage, and web pentest methodology.Web Attacks with KaliComplete web attack track: injection, authentication, client-side, and serialisation.Windows Active Directory for PentestersDeep dive into AD administration, enumeration, and attack paths.Windows Command Line & PowerShellCMD and PowerShell commands, scripts, and automation for enterprise environments.Windows FundamentalsWindows OS, registry, services, file system, and PowerShell basics.Windows User-Mode Exploit DevelopmentStack overflows, SEH, egghunters, shellcoding on 32-bit Windows.Wireless Penetration TestingWPA2/WPA3, evil twin, deauth attacks, captive portal bypass, and WPS attacks.