EXPLORE THE CURRICULUM
Your learning map
See how it fits together. Find the lesson you want to learn next.
351 lessons
Reset filtersL0PowerShell & WindowsStep 1–1515 lessons
- 001 First Steps in PowerShell — Driving Your Computer with TextOpen PowerShell and read your current location from the prompt
- 002 Working with Files — Create, Copy, Move, DeleteCreate files and folders with New-Item
- 003 The Pipe (|) — A Way of Thinking That Assembles CommandsPass a command's output into the next command's input with the pipe (|)
- 004 Text Processing — Finding a Needle in the LogsRead files with Get-Content, and peek at just the beginning of long files
- 005 Collecting System Information — A Health Checkup for My ComputerCollect OS and hardware info with Get-ComputerInfo and pick out only the items you need
- 006 Checking the Network — Inspecting My Computer's Outside LinesFind and explain your PC's IP address, default gateway, and DNS server
- 007 Variables and Data Types — Putting Values into Labeled BoxesStore values in variables and pull them back out
- 008 Conditionals and Loops — Making the Computer Judge and ToilTurn "if ~ then" judgments into code with if/else
- 009 Execution Policy and Your First Script — Meeting Windows' Safety Lock Head-OnSave a bundle of commands as a .ps1 script file and run it
- 010 ★ Project: Automatic File Classification — A Robot That Cleans Your Downloads FolderDesign the algorithm (processing order) in plain language before writing code
- 011 Exploring the Registry — Opening Windows' VaultExplain the registry as "a tree structure of keys and values"
- 012 Event Logs — Reading Windows' Black BoxOpen an administrator PowerShell and explain why this privilege is used "only when needed"
- 013 Inside Processes and Services — Trace the Lineage of ExecutionExplain what a PID is and why processes are identified by number rather than name
- 014 Remote Management — Commanding a Computer Across the NetworkExplain what a remote session is, and the role and port numbers of WinRM/PSRemoting
- 015 ★ Project: What Happens After Boot? — A Full Survey of Auto-Start LocationsExplain what persistence is and why attackers use "doors that already exist"
L0Linux & your labStep 16–3015 lessons
- 016 Understanding Virtualization — Building a Computer Inside a ComputerExplain what a virtual machine (VM) and a hypervisor are
- 017 Installing Ubuntu and Snapshots — Moving Into the Lab and Setting Save PointsExplain what an ISO file and LTS are
- 018 Linux Basic Commands 1 — Finding Your Way in the Black WindowExplain that the Linux filesystem is a single tree rooted at /
- 019 Linux Basic Commands 2 — Three Pipes for Steering OutputExplain the three standard streams (stdin/stdout/stderr) along with their numbers
- 020 Searching (grep/find) — Finding Two Needles in a HaystackExplain the difference in roles between grep (content search) and find (name/condition search)
- 021 Package Management — apt, Linux's App StoreExplain the three concepts of package, repository, and dependency
- 022 Editors — Surviving the Terminal with nano and vimExplain why terminal editors are needed, and why cat or > isn't enough
- 023 Permissions 1 — rwx, Rules Carved Into FilesInterpret a string like -rwxr-xr-- at the front of ls -l output, class by class
- 024 Permissions 2 — Ownership and sudo: How to Wield PowerExplain what root (UID 0) is and why it bypasses permission checks
- 025 User Management Lab — Crossing the Boundary Between Authentication and AuthorizationExplain the difference between authentication and authorization with examples
- 026 Process Management — List Them, Find Them, Signal ThemView the list of running processes and find each one's PID (number) and PPID (parent's number)
- 027 Exploring the Directory Structure — Putting the Linux Map in Your HandsExplain the roles of Linux's top-level folders (/etc, /var, /bin, etc.)
- 028 bash Scripts and cron — Hand Your Typed Commands Over to an Alarm ClockCreate a shell script that gathers several commands in a file and runs them at once
- 029 SSH Remote Access — Opening the Encrypted Front GateExplain what SSH is and which problem of plaintext communication it solves
- 030 ★ Project: Monitoring Automation — Building a Watcher That Works AloneExplain what monitoring is and why "records" become the baseline of normal
L0Network foundationsStep 31–4010 lessons
- 031 Understanding IP Addresses Completely — Neighborhood Name and House NumberExplain that an IPv4 address is actually a 32-bit number
- 032 MAC Addresses and ARP — The Real Address on the WireExplain the difference between IP and MAC addresses from three perspectives (who assigns it, does it change, w…
- 033 DNS — The Internet's Phone BookExplain that DNS is a hierarchical system that converts "name → IP"
- 034 Ports and Services — Room Numbers Inside the BuildingExplain what a port is and how it differs from an IP (building and room number)
- 035 TCP Deep Dive — The Art of the HandshakeExplain what it means that TCP is "connection-oriented"
- 036 UDP and ICMP — The Courier Who Throws and the Status HotlineExplain the difference between TCP and UDP by the criterion "is it meaningful to receive the missing piece aga…
- 037 Routing and Gateways — Follow the Letter's JourneyExplain what a router and a hop are
- 038 NAT and Home Routers — The Secret of the Disguise-Managing DoorstepRecite the three private IP ranges and tell whether a given address is private or public
- 039 The OSI 7 Layers — A Map for Placing Nine PiecesRecite the OSI 7 layers in order and describe each layer's role in one line
- 040 Level 0 Comprehensive Test — Examining YourselfPinpoint what you know and what you don't across all of Level 0
L1Python programmingStep 41–5515 lessons
- 041 Setting Up Python and Your First Code — The Day You Build Your WorkbenchInstall Python and verify the PATH registration with python --version
- 042 Data Types in Depth — Four Baskets for Holding ValuesCreate lists, retrieve by index, and add with append
- 043 Conditionals and Loops — Code That Decides and RepeatsWrite programs that act differently based on conditions with if/elif/else
- 044 Functions and Modules — Building and Assembling PartsDefine and call functions with def and return
- 045 File Input/Output — Making Programs That RememberCreate, write, and read files with with open()
- 046 Exception Handling and Debugging — Programs That Get Back Up When They FallRead an error message (traceback) from the bottom up to find the cause and the scene
- 047 ★ Project: Rock-Paper-Scissors — Your First Game Completed Without a ManualWrite a five-line design (task, input, output, rules, accidents) on paper before coding
- 048 Regular Expressions — A Magnet That Finds by ShapeExplain the meaning of d, w, ., +, *, {n,m} and assemble patterns
- 049 ★ Project: Password Tool — Building Your First Security ToolExplain with numbers that password strength is determined by the combination count (multiplication)
- 050 Exploring Encoding — The Bridge Between Letters and NumbersVerify with ord/chr experiments the principle that characters are stored as numbers inside a computer
- 051 The Standard Library — The Toolbox Already Inside PythonExplain what the standard library is, and find and import the module you need
- 052 Classes and Object Orientation — Data and Behavior in One BoxExplain the relationship between a class (the blueprint) and an instance (the thing)
- 053 pip and Virtual Environments — How to Bring the World's Tools into Your RoomExplain what pip and PyPI are, and what a dependency is
- 054 Algorithm Training 1 — The Muscle That Translates Problems into CodeRun the whole cycle of signing up for Baekjoon, reading a problem, submitting code, and getting judged
- 055 ★ Project: Log Analyzer — Pick the Footprints Out of the Pile of RecordsExplain what a log is and why it's the basic material of security analysis
L1C & computer internalsStep 56–7015 lessons
- 056 Starting C — In the Language the Machine Knows DirectlyExplain the difference between an interpreted language (Python) and a compiled language (C)
- 057 C Control Flow and Functions — Same Thinking, Different NotationWrite C's if, for, and while by matching them to their Python counterparts
- 058 Pointers 1 — The Day You Hold Addresses in Your HandConfirm with %p output that every variable lives at an address in memory
- 059 Pointers 2: Arrays — The Law of Adjacent SlotsConfirm with address output that an array is "slots stuck together in memory"
- 060 Memory Layout — The Map of a Running ProgramExplain that a running program's memory is divided into four regions (code/data/heap/stack)
- 061 malloc and free — Borrow from the Heap and Return ItBorrow as much memory as you need mid-run with malloc, used together with sizeof
- 062 Experiment: Buffer Overflow — Where the Overflowing Input GoesExplain what a buffer is and why it overflows
- 063 The Compilation Process — Four Workers Passing the BatonRecite in order the four stages behind gcc hello.c -o hello (preprocessing, compilation, assembly, linking)
- 064 First Encounter with Assembly — The Final Form of My CodeExplain what assembly language is (the human-readable edition of machine code)
- 065 CPU and Registers — Seeing the Heartbeat of ExecutionExplain why the CPU computes in registers instead of memory
- 066 The Structure of an Executable — The Blueprint Inside the IconExplain that an executable consists of "a manual (header) + purpose-specific regions (sections)"
- 067 The Role of the Operating System — Every Request Goes to the KernelExplain what the kernel is and why programs can't touch hardware directly
- 068 The True Nature of a Process — The fork ExperimentExplain processes, PIDs, and PPIDs, and observe them with ps and pstree
- 069 Virtual Memory — Every Process's Sweet IllusionExplain the difference between virtual and physical addresses, and the role of the page table connecting them
- 070 Project — Building a Memory Observation Tool in CComplete the C program memmap, which draws a map of its own memory addresses
L1How the web worksStep 71–766 lessons
- 071 HTML/CSS Basics — A Web Page's Skeleton and ClothesStarting from an empty file, build by hand a web page with a title, paragraphs, links, images, lists, and inpu…
- 072 JavaScript Basics — The Language That Brings Web Pages to LifeWrite basic JS syntax compared with Python (let/const, function, console.log)
- 073 Understanding HTTP Completely — The Web's Rules of ConversationLaunch a practice web server on your computer with python -m http.server
- 074 The requests Library — Talking to the Web with PythonBuild your own practice server (lab.py) in Python that understands POST and cookies
- 075 Crawling with BeautifulSoup — Pulling Only What You Want from HTMLTurn an HTML string into a navigable structure with BeautifulSoup(string, "html.parser")
- 076 Crawlers and Automation — A Collector That Works by Itself Every DayLaunch a local practice site with python -m http.server
L1Network toolsStep 77–859 lessons
- 077 Socket Communication 1 — A TCP echo Server and ClientExplain in code that a socket is "a communication endpoint between program and program"
- 078 Socket Communication 2 — A Multi-Client Chat ServerExplain that a thread is "a flow of execution sharing memory inside the same process"
- 079 The Port Scanner — A Scout That Finds Open DoorsExplain, with a tool you built yourself, that the principle of port scanning is "attempting a connection (conn…
- 080 Introduction to Scapy — The Handmade Packet WorkshopRead from show() output that a packet is a multi-layer structure stacked as Ethernet/IP/TCP/data
- 081 Mastering nmap — The Standard Tool of ReconnaissanceChoose the right nmap option (-sT/-sS/-sV/-O/--script) for the situation
- 082 Project — Network Map and Risk AssessmentDefine the three terms — asset, attack surface, and risk — and apply them in practice
- 083 Wireshark 1 — Capture and Filters, the Microscope of NetworksPick a network interface and start and stop a capture
- 084 Wireshark 2 — Dissecting Protocols and Detecting AnomaliesFind the TCP 3-way handshake as three packets in a real capture
- 085 Project — HTTP vs HTTPS Comparison ReportOpen a plaintext web server locally and prove with a capture that requests/responses ride in packets letter fo…
L1Developer tools & projectsStep 86–9510 lessons
- 086 Git Basics — A Time Machine for CodeExplain Git's operating structure with the three concepts: repository, commit, staging
- 087 GitHub Remote Repositories and Your Portfolio — Both Backup and ShowcaseExplain the relationship between local and remote repositories, and the directions of push and pull
- 088 Branches and merge — Parallel Universes and MergingExplain that the true nature of a branch and HEAD is "an arrow pointing to a commit"
- 089 Markdown Documentation — Your Own Personal WikiWrite technical documents with the seven core pieces of markdown syntax
- 090 Project — XOR File Encryption/Decryption ToolDemonstrate XOR's restoration property (A ⊕ K ⊕ K = A) with Python's ^ operator
- 091 Linux Review — OverTheWire Bandit 0–10Connect to and exit a remote server over SSH (ssh user@address -p port)
- 092 SQL Basics 1 — Talking to a Database (CRUD)Enter sqlite3, create a table, and exit
- 093 SQL Basics 2 — JOIN and Python IntegrationJOIN two tables with an ON condition and query them
- 094 A Taste of Flask — Building Your Own Web ServerLaunch a server with two or more routes using Flask
- 095 Level 1 Comprehensive Project — Completing a Network Watchdog ToolBuild a finished product from a requirements specification alone
L2First wargamesStep 96–10510 lessons
- 096 Bandit 0–5 — The Wargame Solving CycleConnect to a remote server over SSH and specify a port
- 097 Bandit 6~10 — Mastering Conditional Searches with findCombine find conditions (-user, -group, -size, -perm, -mtime, -writable) with AND to extract exactly the files…
- 098 Bandit 11~15 — Encoding and Network ConnectionsPerform character substitutions like ROT13 with tr and explain the principle
- 099 Bandit 16~20 — First Encounter with setuidFind open services with a port-range scan and check whether they use TLS
- 100 Bandit 21~25 — The cron Exploitation MindsetRead /etc/cron.d/ and interpret "who runs what, with whose privileges, when"
- 101 Bandit 26~30 — Digging Secrets from git History, and the Finish LineExplain the concept of bypassing a restricted shell by reading files via more/vim
- 102 Natas 0~5 — Opening the Door to Web WargamesPerform the reconnaissance routine — view source → search comments → robots.txt → guess paths — when you meet…
- 103 Natas 6~10 — Reading Server Code and Command InjectionFind and read include paths and comparison logic in PHP source
- 104 Natas 11~15 — XOR Analysis and Your First SQL InjectionRecover the key from a repeating-key XOR cipher with a known-plaintext attack
- 105 ★ Review — Cataloging Wargame TechniquesList every technique you used in Bandit 0–30 and Natas 0–15 without omissions
L2Linux securityStep 106–1105 lessons
- 106 Linux Permissions Deep Dive — setuid, setgid, sticky bitExplain how setuid, setgid, and the sticky bit each work in one sentence
- 107 Exploring Linux Logs — /var/logState the roles of the main files in /var/log (auth.log, syslog, kern.log, wtmp, etc.)
- 108 Environment Variables and PATH InjectionExplain what environment variables are, and read and write them with export and $VARIABLE
- 109 Symbolic Links and Hard Links — Another Name for a FileExplain the structure in which a file's substance (inode) and its name are separated
- 110 Project: "The Gaps in Linux's Permission Model" Reference Document — Reviewing Through an Attacker's EyesOrganize 4 types of Linux privilege-bypass points into the 4-part structure "conditions / discovery / exploita…
L2Labs & penetration testingStep 111–13020 lessons
- 111 Installing Kali Linux — Setting Up the Attacker's WorkbenchExplain what Kali Linux is and why it's the security industry's standard working environment
- 112 Installing Metasploitable2 and Building the Isolated Lab — Completing a Safe Firing RangeExplain what an intentionally vulnerable VM is and why it exists
- 113 Reconnaissance 1: A Complete Survey of the Target's Services — Attacks Begin with Building a ListExplain what the attack surface is and enumerate it with a full scan
- 114 Reconnaissance 2: Vulnerability Scanners and Reading Their Results — A Scanner Is a Candidate GeneratorAutomatically collect vulnerability candidates with nmap's vuln script category
- 115 How to Read a CVE: NVD and Exploit-DB — The Story Packed into a Single NumberExplain the structure of a CVE number (year + serial number) and state the difference in roles among CVE, NVD,…
- 116 Getting Started with Metasploit — The Standard Assembly Plant of AttacksLaunch msfconsole and recognize the change in the prompt (ordinary shell → msf shell)
- 117 ★ Your First Shell: Taking Over MS2 with the vsftpd Backdoor — Your Life's First Remote Command ExecutionRun exploit in Metasploit and obtain your first remote shell
- 118 Bind Shells vs. Reverse Shells — The Connection's Direction Is EverythingBuild a bind shell and a reverse shell with nc and execute commands through each
- 119 Mastering netcat — The Swiss Army Knife of NetworkingChoose between nc's two modes (listener/client) appropriately for the situation
- 120 Manual Exploitation 1: Attacking Without a Framework — Reproducing the Button's Inner Workings by HandManually trigger the vsftpd backdoor with nc alone, without Metasploit
- 121 Manual Exploitation 2: Expanding Your Repertoire — Every Service Opens a Different DoorProve the principle of hidden-path discovery (directory busting) with a server you build yourself
- 122 Password Attack 1: hydra Online Brute Force — An Attack That Knocks on a Living DoorExplain the principle of online brute force (wordlist submission) with a tool you built yourself
- 123 Password Attack 2: John the Ripper Offline Cracking — Stolen Hashes Break in SilenceRead the format of one /etc/shadow line (account, algorithm, salt, hash)
- 124 Password Attack 3 — hashcat and Attack ModesExplain why GPU cracking is faster than CPU, in terms of core structure
- 125 Introduction to Privilege Escalation — From Shell to rootRun reconnaissance commands that enumerate system info, accounts, and privileges from a restricted shell
- 126 Enumeration Automation — linPEASRun a bundle of manual enumeration commands and know what information comes out
- 127 The Post-Exploitation Checklist — The Beginning After the ShellClassify and state the items of information to collect right after acquiring a shell
- 128 ★ Project — The MS2 Full-Compromise ReportExplain the standard structure of a penetration test report (summary through remediation)
- 129 Attacking Another VulnHub Vulnerable VM — Apply the Whole Routine to a Target You've Never SeenPick a beginner-friendly machine on VulnHub and add it to your Host-only lab
- 130 ★ Checkpoint: Time-Attack Mock Penetration — Run the Entire Process in 6 HoursMake and keep a time-allocation table for a 6-hour penetration exercise
L2Web security foundationsStep 131–15525 lessons
- 131 Build Your Own Web Server — Login and SessionsCreate accounts in a sqlite3 DB and implement login verification
- 132 Burp Suite 1: Intercepting with a Proxy — Slipping Between Browser and ServerExplain what a proxy does between a browser and a server
- 133 Burp Suite 2: Repeater and Intruder — The Repeat Experiment Bench and the Automatic Machine GunSend a caught request to Repeater and run repeated experiments
- 134 Cookie and Session Attacks — Shaking the ID Card the Server TrustsExplain the structure by which cookies and sessions maintain login state, at the request/response header level
- 135 DVWA Setup and SQLi Basics — Crossing Low and MediumLaunch DVWA with Docker and adjust its security difficulty
- 136 SQLi Advanced — Dumping the Entire Database with UNIONExplain UNION SELECT's rule for combining two results (matching column counts)
- 137 Blind SQLi & sqlmap — Extracting Even When Nothing ShowsExplain the oracle (true/false answering device) principle of Boolean-based Blind SQLi
- 138 XSS Basics — Reflected & Stored, the Traitor Inside the BrowserExplain how XSS differs from SQL injection (the attack target is the browser)
- 139 XSS Advanced: Cookie Theft & Filter Bypass — Beyond alert, Stealing SessionsWrite a real-world XSS payload that sends document.cookie to the attacker's server
- 140 CSRF: Request Forgery — The Victim's Browser Clicks for YouExplain how the browser's automatic cookie-sending trait enables CSRF
- 141 File Upload Attack: Web Shell — From a Board Post to Server TakeoverExplain what a web shell is and the chain by which "one upload" leads to "server takeover"
- 142 Web Shell Advanced: Writing Your Own & the Principles — Building the One-Line Door YourselfExplain a web shell's core structure (input → execute → output) line by line
- 143 Command Injection — The Moment a Search Box Becomes the Server's TerminalFind command injection's two conditions (input concatenation + shell execution) in code
- 144 File Inclusion: LFI/RFI — I Choose the File the Server "Reads for Me"Explain the difference between LFI and RFI in terms of how include works
- 145 Directory Busting & Information Exposure — The "If They Don't Know the Address, It's Safe" FallacyExplain the principle of forced browsing and the basic usage of gobuster
- 146 Authentication Attacks, Combined — Four Ways to Knock on the Front DoorExplain why a default-credential check is the "first five minutes" of a real penetration test
- 147 ★ DVWA All Difficulty Levels + the Three-Tier Summary Table — What It Means to "Completely" Know One VulnerabilityExplain at the code level how defense code evolves as DVWA's difficulty rises
- 148 OWASP Juice Shop 1: Introduction to the Modern Web App — The Attack Stage Has ChangedExplain the structural difference between an SPA (single-page application) and a traditional web app
- 149 Juice Shop 2 — Access Control and IDORExplain the condition under which IDOR arises ("authenticates but doesn't authorize")
- 150 Juice Shop 3 — JWT and Business LogicBreak a JWT into its three chunks (header.payload.signature) and read its contents
- 151 Dreamhack Web Introduction — Your First Real ProblemsKnow the components of a Dreamhack wargame problem (title, description, URL, flag submission)
- 152 Dreamhack Web (Cumulative 16) — Recognizing Techniques in DisguiseExplain how the same vulnerability hides in different features (search box, download, basket)
- 153 DreamHack Web (Running Total: 24) — Breaking Through with ResearchIdentify the tech stack (Flask, PHP, etc.) in a challenge and use it as search-keyword material
- 154 DreamHack Web (Running Total: 32) — Your Weakness List and Problem-Picking StrategyMaintain solve records in CSV format (date, problem name, type, minutes spent, result)
- 155 ★ Project — Independent Assault on a Vulnerable Web Target, with a ReportCarry out the recon → feature mapping → hypothesis → verification sequence on an unknown web target, on your o…
L2Networks & authenticationStep 156–16611 lessons
- 156 MITM Primer — ARP Spoofing 1: A Protocol with No ID CardExplain the structure and fields of ARP requests (who-has) and replies (is-at)
- 157 ARP Spoofing 2 — Bidirectional Interception and the End of PlaintextExplain the difference between one-way and bidirectional spoofing in terms of "what becomes visible"
- 158 Packet Sniffing Advanced — The Two Faces of Filters and Reassembling ConversationsExplain the difference between capture filters (BPF syntax) and display filters (Wireshark syntax), and use ea…
- 159 DNS Spoofing and bettercap — Swapping Out the Phone BookExplain the structure of DNS query/response packets (question record and answer record)
- 160 SSL/TLS and HSTS — The ID-Card System That Stops the Man in the MiddleExplain the TLS handshake's stages (Client Hello → certificate → key agreement → encrypted communication)
- 161 Firewalls and iptables — Designing the Gatekeeper's RulesExplain the meaning of chains (INPUT/OUTPUT/FORWARD) and targets (ACCEPT/DROP/REJECT)
- 162 Proxies and Anonymity — The Art of Hiding Behind a Stand-In, and Its LimitsExplain the difference between a forward proxy and a reverse proxy by "whom it represents"
- 163 SSH Tunneling and Port Forwarding — Loading Other Roads onto an Encrypted PassageExplain the directional differences of local (-L), remote (-R), and dynamic (-D) forwarding with diagrams
- 164 Enumeration Tools, Complete Review — A System for Flipping Every StonePick the right tool for each enumeration situation (external network / web / host internals) without hesitatio…
- 165 Password Spraying and Credential Stuffing — Attacks That Walk Sideways Past the LockClassify online password attacks into vertical (brute force) / horizontal (spraying) / reuse (stuffing)
- 166 Wireless Security: WPA2 and the Handshake — Key Material Floating in the AirExplain the four messages of the WPA2 4-way handshake in order
L2Security perspectives & practiceStep 167–1759 lessons
- 167 Social Engineering: Hacking Humans — One Email That Bypasses the FirewallExplain with examples that social engineering is a technique "attacking psychology, not technology"
- 168 Malware Structure: Trojans and Ransomware — Dissecting Without BuildingDistinguish viruses/worms/Trojans/ransomware by the criterion of reproduction method
- 169 Encryption and Detection Evasion Concepts — The Arms Race Between the Hiders and the SeekersExplain the difference between obfuscation and encryption from the perspective of "the key that reverses it"
- 170 Introduction to OSINT — Social Media Collection and Digital FootprintsExplain the definition of OSINT and the boundary of legality (public information, purpose, consent)
- 171 OSINT Advanced — Subdomain and Asset EnumerationExplain the difference between passive and active enumeration
- 172 ★ Capstone Scenario 1 — From Recon to ShellPerform the kill chain — recon → scan → enumerate → hypothesize → verify → shell — independently
- 173 Scenario 1 Review and Penetration Report — The Skill of Weaving Records into a DocumentReconstruct the attack path from timeline records
- 174 Capstone Scenario 2: Web Intrusion → Internal Expansion — One Entrance Opens EverythingExplain what a chain attack is and list the five stages from web intrusion to root
- 175 Level 2 Comprehensive Assessment: The Attack/Defense Response Table — Completing Two-Sided ThinkingExplain Level 2's major attack techniques as pairs with their matching defenses
L3Explore CTF disciplinesStep 176–1816 lessons
- 176 CTF First Taste 1: Five Web Challenges — Entering the Real ArenaExplain CTF's format (flags, categories, submission)
- 177 CTF Taste Test 2: Pwn Challenge (pwnable.kr) — First Encounter with a BinaryExplain the structure of a Pwn challenge (analysis file + target server)
- 178 CTF Taste Test 3: Reversing — Two crackmes + Ghidra — How to Read Without SourceExplain the difference between static analysis (reading without executing) and dynamic analysis (observing whi…
- 179 CTF Taste Test 4: Three Crypto Intros — Cryptography as Math PuzzlesExplain the difference between encoding and encryption
- 180 CTF Taste Test 5: Forensics & Misc 3 — Dissecting Suspicious FilesDetermine a file's real type from its magic bytes (file signature)
- 181 ★ Choosing Your Main Field + Deciding a Secondary — What Kind of Player Am I?Compare the five fields' characters (learning curve, competition weight, career links) in a table
L3Assembly & system foundationsStep 182–1909 lessons
- 182 Assembly 1: Registers, mov/push/pop/call/ret, Stack Frames — The Alphabet of the Common LanguageKnow the names and roles of the x86-64 general-purpose registers (rax, rdi, rsp, rbp, etc.)
- 183 Assembly 2: gdb Basics — A Microscope for Running ProgramsExplain what gcc -g -O0 means (-g: debug info, -O0: optimization off) and build a debugging binary
- 184 Assembly 3: Following a C Program Line by Line in gdb — Live Coverage of the Calling ConventionRead assembly source made with gcc -S side by side with gdb's disas output
- 185 The Stack, Fully Understood — A Complete Map of What Piles Up on a Function CallDraw the order of what piles up on the stack on a function call (local variables → saved rbp → RET)
- 186 ★ Reproducing a Buffer Overflow: RET Overwrite Success — Your First Memory AttackCompile a target binary with lab-only options and explain what each option means
- 187 Protections: NX, ASLR, Canary, PIE — A Map of the Four-Layer DefenseExplain the working principle of each of the four protections — NX, Canary, ASLR, PIE — in one sentence
- 188 pwntools 101: Connections, p64, Payload Automation — From Hand Attacks to ScriptsInstall pwntools in a venv and verify the installation
- 189 ★ Mini Project: Completing an Overflow Exploit Script — Turning a Hand Attack into EngineeringExplain the principle of the cyclic() pattern (a sequence of non-repeating chunks)
- 190 Finding/Forming a Team + the CTFtime Calendar — Turning a Solo Game into a Team SportRead CTFtime's competition calendar, team pages, and ranking structure
L3Advanced web securityStep 191–20212 lessons
- 191 PortSwigger Academy: Advanced SQLi — Blind, time-based, OOBDistinguish Blind SQLi's three oracles (true/false, time, OOB) by situation
- 192 Advanced XSS: CSP Bypass, DOM Deep Dive — Attacking Where Defenses ExistRead a CSP header's directives (script-src, 'self', etc.) and interpret their meaning
- 193 SSTI: Template Injection → RCE — When Your Input Becomes the Server's CodeExplain that SSTI shares the same root as SQL injection and XSS (input becomes code)
- 194 SSRF — Making the Server Your Proxy to Read the Internal NetworkExplain why SSRF arises from "features that send requests on your behalf"
- 195 XXE — The File-Reading Command Hidden in the XML ParserRead XML DOCTYPE and entity declaration syntax, and explain why external entities are dangerous
- 196 Deserialization Vulnerabilities — The Moment Data Becomes CodeExplain what serialization and deserialization are, and why deserialization leads to code execution
- 197 Advanced JWT Attacks — Becoming Admin via alg Confusion and Weak SecretsExplain the key-structure difference between HS256 (symmetric) and RS256 (asymmetric)
- 198 GraphQL/API Security — Enter Through One Door, Read the Whole SchemaRead the structure of a GraphQL query and explain how it differs from REST
- 199 Webhacking.kr 1–15 — The Korean Wargame Sampler PackRead Webhacking.kr's challenge list structure (points, solve counts) and gauge difficulty
- 200 Webhacking.kr 16–30 — Creative Combinations of TechniquesList a problem's "visible defenses," build a table of bypass candidates, and eliminate them
- 201 Race Conditions & HTTP Request Smuggling — Attacks of the Instant and the MisalignmentExplain the structure of TOCTOU (time-of-check to time-of-use) with a diagram
- 202 ★ Midterm Check: Solve Three Intermediate Web Challenges Independently in a Row — The No-Write-up ZoneApply challenge-selection criteria that keep the check fair (randomness, pre-blocking by type)
L3Pwn & memoryStep 203–21412 lessons
- 203 Writing Shellcode: Hand-Crafting an execve Shellcode — The 29 Bytes That Spawn a ShellExplain the execve system call convention (rax=59, rdi, rsi, rdx)
- 204 ret2win: Calling the Function You Want — RET Overwrite That Even Hands Over the ArgumentExplain that in the System V calling convention, the first argument is passed via rdi
- 205 ROP 1: The Gadget Concept, ROPgadget/ropper — The Assembly Art of Code FragmentsKnow the definition of a gadget ("an instruction fragment ending in ret") and the kinds of useful gadgets
- 206 ROP 2: Calling system("/bin/sh") with a Chain — Past NX, Into a ShellExplain why ROP is the only road on an NX-enabled binary
- 207 ret2libc: Leaking the libc Address to Bypass ASLR — Tracing an Address That Changes Every RunProve with an ldd measurement how ASLR changes libc's address
- 208 Format String: Writing Memory with %n — An Attack That Writes Through a Print FunctionExplain why printf(buf) is vulnerable, in comparison with the correct code
- 209 Finishing pwnable.kr Toddler's Bottle — Graduation Day for the Beginner WargameSummarize the full Toddler's Bottle challenge list and the trap each one teaches
- 210 Understanding GOT/PLT and the GOT Overwrite — Hijacking Function CallsExplain the roles of the PLT (jump pads) and the GOT (address table), and the sequence of lazy binding
- 211 Heap Fundamentals: Allocator Behavior and the Use-After-Free Concept — Reusing Returned LandDraw the structure of a heap chunk (header + user data) and compute its size
- 212 A Taste of Heap Exploitation: tcache Poisoning — Overwriting the Queue's LedgerExplain that the tcache is a singly linked list, and where the next pointer lives
- 213 Three Easy pwnable.tw Challenges — Into a World Without SourceExplain the difficulty and structure differences between pwnable.kr and pwnable.tw
- 214 ★ Midterm Check: Independent Exploitation of a Canary+NX Binary — Leak It, Keep It Alive, Overwrite ItDesign the entire exploit process yourself, from protection identification (recon) to strategy
L3Reverse engineeringStep 215–22612 lessons
- 215 Ghidra In Depth: Function Analysis and Struct Recovery — Turning Machine-Made Names into Human LanguageRename functions (L) and edit signatures (Edit Function Signature) in Ghidra
- 216 x64dbg In Depth: Memory Breakpoints and Patching — Surgery on a Running ProgramPerform the routine of reverse-tracing comparison code via string search in x64dbg
- 217 10 crackmes (Easy Difficulty) — Building the Speed to Recognize PatternsDistinguish the three types of easy crackmes (direct comparison / transformed comparison / per-character branc…
- 218 10 crackmes (Medium Difficulty) — Reading Relations, Opening Gates One by OneDistinguish the three hallmarks of medium difficulty (relational verification, multi-stage checks, runtime-dep…
- 219 Anti-Debugging Techniques and Bypasses — Programs That Dodge Debuggers, and How to Break ThroughExplain what anti-debugging is and why it's used
- 220 Packing and Unpacking — UPX and Finding the OEPExplain the structure of a packer — a compressed payload plus an unpacking stub
- 221 Keygen — Serial Algorithm Analysis and Writing a GeneratorExplain the standard structure of a serial verification program (input → transform → compare)
- 222 Reversing .NET and Python Binaries — Binaries That Aren't Machine CodeExplain and identify the differences between native / .NET / Python binaries
- 223 A First Taste of Android APK Analysis — jadxExplain an APK's internal structure (AndroidManifest.xml, classes.dex, resources)
- 224 Strategies for Analyzing Obfuscated Code — Read It Head-On and You LoseDistinguish the three types of obfuscation (name destruction, string encryption, control-flow flattening)
- 225 Static Malware Analysis (Isolated Lab Required) — Reading the Insides Without Running ItExplain the three rules of an isolated lab (network isolation, snapshots, dedicated environment) together with…
- 226 ★ Mid-Check: Independently Dissecting a Medium-Difficulty crackme — No Solutions, All the WaySelect a crackme that makes for a fair test (difficulty, architecture, solution-count criteria)
L3Cryptography & CryptoStep 227–23812 lessons
- 227 Math Foundations: Modular Arithmetic, the Euclidean Algorithm, Euler's Theorem — Crypto's Minimum ArmamentUnderstand modular arithmetic as "clock arithmetic" and compute with Python's % and pow(a, b, n)
- 228 Full RSA Implementation: From Key Generation to Encryption/Decryption — The Textbook, by My Own HandsGenerate 512-bit primes yourself with Miller-Rabin primality testing
- 229 RSA Attacks 1: Small e, Common Modulus — The Moment Implementation Mistakes Become Mathematical WeaknessesRecover plaintext via the integer cube root when e=3 and m^3 < n
- 230 RSA Attacks 2: Fermat Factorization, Wiener's Attack — When Key Generation Is Botched, the Math CollapsesImplement Fermat factorization and explain the relationship between the p–q distance and the iteration count
- 231 Completing Cryptopals Set 1 — The Textbook of XOR Attacks, in My CodeConvert freely among hex ↔ bytes ↔ base64 and explain each format's role
- 232 Cryptopals Set 2: ECB/CBC, the Padding Oracle — Piercing the Block Cipher's CracksImplement PKCS#7 padding and explain why the true/false of validity checking leaks information
- 233 AES Structure and Mode-Specific Vulnerabilities — Anatomy of the World Standard and a Map of FailuresState AES's block and key sizes and the round counts (10/12/14) they correspond to
- 234 Hash Attacks: Length Extension and Collision Concepts — What Happens When You Use a Hash as a "Signature"Explain that Merkle-Damgård hashes "carry forward internal state"
- 235 DH Key Exchange and an MITM Simulation — Making a Secret on an Eavesdropped Channel, and Its LimitsImplement the DH key-exchange procedure (exchange g^a mod p → share g^ab mod p) in code
- 236 A Taste of ECC: Addition on an Elliptic Curve — Adding Points to Build a CipherEnumerate every point of an elliptic curve y² = x³ + ax + b (mod p) over a finite field
- 237 10 Real CTF Crypto Problems — The Day You Deploy Your Arsenal in the FieldNarrow a Crypto problem's type candidates down to two by looking at the given numbers (parameter sizes and sha…
- 238 ★ Midterm Check: Independently Solving 5 Medium Crypto Problems — The Write-up Forbidden ZoneApply problem-selection criteria (random, pre-exposure blocked) for a fair check
L3Digital forensicsStep 239–25012 lessons
- 239 Hex and File Signatures: file, binwalk, Manual Carving — An Identity Check on Six BytesName the file type from the magic bytes of 10 major formats
- 240 Steganography: LSB, zsteg, Audio Spectrograms — The Letter Behind the Visible PictureExplain the principle of LSB embedding and hide and extract data yourself in Python
- 241 Advanced pcap Analysis: Wireshark Advanced Filters, tshark — Reconstructing an Incident from Ten Thousand PacketsDecide "where to dig first" with -z io,phs (protocol hierarchy) and -z conv,tcp (conversation list)
- 242 Memory Forensics: Volatility 3 — How to Catch Evidence That Vanishes When the Power Goes OffEnumerate the kinds of evidence that exist only in memory (processes, connections, command lines, cleartext da…
- 243 Disk Forensics: Autopsy, Deleted-File Recovery — What's Deleted Isn't GoneExplain structurally that filesystem deletion is "deallocation," not "data erasure"
- 244 Windows Forensics: Registry, Event Logs, Prefetch — Digging Through the Archive of Execution TracesExplain three kinds of Windows execution traces (Prefetch, UserAssist, event logs) using the term artifact
- 245 Log Analysis Scenario: Reconstructing an Intrusion Timeline — Scattered Puzzle Pieces into a Single Line of StoryRead one line of a web access log (Apache format) and an authentication log (auth.log format)
- 246 EXIF/Metadata and Document Forensics — Reading the Fingerprints Engraved Inside FilesExplain what EXIF and document metadata are and why they become evidence
- 247 Encrypted-Artifact Recovery Techniques — Three Keys That Open Locked EvidenceRecover a single-byte XOR-encrypted file with brute force (256 tries)
- 248 Five Comprehensive Forensics Challenges — Linking the Chain of Techniques on Your OwnPhysically perform the investigative order that starts with a signature check when handed an unknown file
- 249 Network Breach Analysis Simulation — Reconstructing the Incident Inside PacketsState the five phases of the IR process (preparation → detection → containment → recovery → lessons learned)
- 250 ★ Mid-Track Check: Solving a Comprehensive Forensics Challenge Independently + Report — Becoming Someone Who ProvesSelect and start a comprehensive forensics challenge without help
L3Practice machines & pentestingStep 251–27828 lessons
- 251 TryHackMe Intro Path + 3 Easy Rooms — Opening the Door to Real MachinesExplain the structure of a TryHackMe room (tasks, questions, hints, machines)
- 252 THM Easy ×5 (8 Cumulative) — Engraving the Routine into Your FingersApply the same routine to machines of different types (web-centric, SMB-centric, etc.)
- 253 THM Linux Privesc Rooms (13 Cumulative) — After the Shell, All the Way to rootRun the first command set right after getting a shell (sudo -l → SUID → cron → passwd permissions) in order
- 254 THM Windows/AD Intro Rooms (18 Cumulative) — Meeting the Protagonist of Corporate EnvironmentsBuild an approach strategy upon seeing a Windows machine's signature service ports (SMB 445, RDP 3389, WinRM 5…
- 255 Hack The Box Starting Point Complete Run — Up to a Stage One Level HigherExplain the structural differences between HTB and THM (hints, machine operation, flag style)
- 256 HTB Easy ×2 — Alone to root: The First Complete Run Without GuidanceExplain the boundary between allowed and forbidden resources under "solving alone"
- 257 HTB Easy x2 (Cumulative 4) — Widening Your Repertoire of Entry PointsClassify initial access vectors (entry points) by type and diagnose the skew in your own experience
- 258 HTB Easy x2 (Cumulative 6) — Time-Limit Training: Solving with the Clock OnSet per-phase time allocations (recon/exploitation/escalation) and enforce them with alarms
- 259 Linux Privilege Escalation, Fully Conquered — From Patterns to a ChecklistList the eight patterns of Linux privilege escalation and the discovery command for each
- 260 Windows Privilege Escalation, Fully Conquered — Doors of Services, Tokens, and SettingsRead whoami /priv output and understand what SeImpersonatePrivilege means
- 261 Active Directory 1 — Understanding Domain StructureDraw the relationship between domain, tree, forest, and domain controller (DC) as a diagram
- 262 Active Directory 2 — Kerberoasting and AS-REP RoastingExplain, on top of the Kerberos flow, why Kerberoasting is "abuse of a normal feature"
- 263 Active Directory 3 — Pass-the-Hash and BloodHoundExplain why the NTLM challenge-response structure creates "hash = password"
- 264 Pivoting, Deepened — Through the Compromised Machine into the Internal NetworkExplain with a diagram why pivoting is needed in a dual-network structure (an internal network inside the DMZ)
- 265 One HTB Medium Machine — Solve It Independently, Even If It Takes DaysExplain the structural differences between Easy and Medium (chains, misdirection, enumeration demands)
- 266 Medium Review + Re-Attack — How to Learn After SolvingReconstruct a timeline from your progress log and quantify "where the time went"
- 267 One HTB Medium Machine (Cumulative 2) — Read the Starring Service, Turn Stuck Points into StatisticsIdentify the machine's type (web-focused / service-focused / AD, etc.) and its "starring service" from the fir…
- 268 One HTB Medium Machine (Cumulative 3) — The Depth of EnumerationDistinguish enumeration's "wide" from "deep," and choose the side that fits the kind of stuck
- 269 One HTB Medium Machine (Cumulative 4) — Vulnerability ChainingExplain the concept of vulnerability chaining and the representative pattern (information disclosure → authent…
- 270 One HTB Medium Machine (Cumulative 5) + Medium Graduation ReviewIndependently attack a fifth Medium machine
- 271 One HTB AD-Track Machine — The Standard Route to Domain TakeoverRead an AD machine's scan results (SMB, LDAP, Kerberos ports) and judge that it's a domain environment
- 272 Completing Your Own Pentest Playbook — Taking a Photo of Your Current SkillIntegrate scattered routine documents into a playbook with an 8-section structure
- 273 HTB Hard Challenge 1 — Enumerate Deeper, Test HypothesesExplain the three traits that make Hard different from Medium (unknown techniques, hidden entrances, multi-sta…
- 274 HTB Hard Challenge 2 — Repaying Technical Debt: Turn What You Don't Know into a List and Pay It OffExtract "what I couldn't do because I didn't know" from an attack log using [UNKNOWN] tags
- 275 HTB Hard Debrief — Analyzing Top Players' Write-ups: Read the Reasoning, Not the ResultsApply a dissection method that reads a write-up not as an "answer key" but as "a record of a thought process"
- 276 Speed Training: Easy in Under 4 Hours — Push Your Routine to AutopilotBuild and keep a stage-by-stage budget table for a 4-hour Easy time attack
- 277 Speed Training: Medium in Under 8 Hours — Stamina and Pace Allocation for the Long GameBuild a stage-by-stage budget table for a Medium 8-hour run (enum 2h / foothold 3.5h / privesc 2h / slack 0.5h…
- 278 ★ Real-World Check: Medium Time Attack + Presentation Practice — Solving and Explaining Are Different MusclesAssault a Medium machine in an 8-hour time attack while simultaneously collecting presentation evidence (captu…
L3CTF competitions & reflectionStep 279–30325 lessons
- 279 ★ CTF Competition #1: Full Weekend Participation — The Goal of Your First Competition Is Finishing, Not RankingRun a checklist that inspects environment, tools, and playbook before the first competition
- 280 CTF Debrief Block A: Digging Three Unsolved Problems to the Bottom — Skill Grows in the Debrief, Not the CompetitionApply the criteria for selecting the 3 highest-debrief-value problems from a competition log
- 281 ★ CTF #2: This Time as a Team — The Day You Learn the Efficiency of Division and the Cost of Communication at OnceAgree on field assignments and clue-sharing rules in a 30-minute kickoff meeting
- 282 CTF Debrief Blocks A + B: Writing Three Write-ups — A Reproducible Write-up Is Proof of SkillApply the 6-part structure of a write-up a reader can reproduce (problem info / observation / attempts / failu…
- 283 ★ CTF #3: Team Debut + Goal Setting — Only Measurable Goals Grow a TeamDistinguish ranking goals from behavior goals, and design competition goals out of behavior goals only
- 284 CTF Debrief Block A + Team Meeting: Weakness Analysis — Drawing the Team's Map with Data, Not GutOrganize three competitions' results into a per-field table of attempts / successes / time taken
- 285 ★ CTF #4: The Weakness-Field Assault Competition — The Courage to Set Your Strengths Down for a WhileExplain the principle of deliberate discomfort training and apply it to a competition
- 286 CTF Debrief Block B: Reaching 30 Accumulated Write-ups — Records Grow by Compound InterestCount the current total with an accumulation tally and plan how to fill the shortfall
- 287 ★ CTF #5: The Main-Field Depth Confirmation Match — A Competition That Measures Where Our Ceiling IsQuantify "current weight class" by measuring success rates per difficulty within one field
- 288 CTF Debrief Block A + Focused Weakness Work: A 10-Problem Boot Camp on the Type You Keep Missing — Chronic Ills Are Cut by Concentrated RepetitionSelect the TOP failure-frequency types from debrief records using data
- 289 ★ CTF #6: The Midterm Evaluation Competition — Aiming for the Top 50%, the Team That Reads the Scoring Structure Harvests the PointsExplain the difference between static scoring and dynamic scoring, and what each means for solving strategy
- 290 CTF Debrief Blocks A + C: Tidying Exploit Code — Turning Improvisation into AssetsApply the debrief block A routine (digging unsolved problems to the bottom) to the midterm competition
- 291 ★ CTF #7: Live-Fire Library Validation — An Asset's Value Is Proven Only at a CompetitionOpen the library index as the competition starts and reach a type-match verdict within 10 seconds
- 292 CTF Debrief Blocks A + B: 40 Write-ups Accumulated — Writing That Gets Read Is Proof of SkillDig three unsolved problems from competitions #6–#7 to the bottom with the block A routine and close them as w…
- 293 ★ CTF #8: The Team Tactics Experiment — Role Rotation, Trading Points for a Map of the TeamFix the prior agreements of a role-rotation experiment (purpose, assignments, rules) in a document
- 294 CTF Debrief Block A + 50 Write-ups + Blog Tidy-Up — The Moment Records Become a CareerDig competition #8's unsolved problems to the bottom with the debrief block A routine and reach 50 write-ups
- 295 ★ CTF #9: The Top-30% Goal Competition — A Testing Ground for Measuring Your Weight ClassBuild a per-field expected-scoring table from recent competition data, grasping your strength in numbers
- 296 CTF Debrief Block A + Team Strategy Checkup: Operations Improvement — Reducing Friction, Not Just Tech, Is Also PointsExtract operational metrics from chat logs — clue response times, buried clues, status-board update intervals
- 297 ★ CTF #10: 10th Competition Special — The Full Retrospective — Growth Is Not Linear, It Is a Cycle of Plateaus and LeapsEnter the 10th competition with your usual routine intact, securing comparable data
- 298 Preparing for Domestic Qualifiers: Solving CODEGATE/CCE Past Exams — Past Exams Are the Best TextbookCollect problems from CODEGATE/CCE public past-exam archives and structure the list
- 299 Qualifier Speed Training: 10-Problem Time Attack — The Technique of a Pace That Sweeps Easy Problems FirstDesign a mixed-field 10-problem set matching the qualifier format
- 300 ★ CTF #11: Qualifier Dress Rehearsal — A Rehearsal Validated at 80% PowerOperate a competition as "a simulation of the qualifier" — matching even the time slots and rest plan
- 301 CTF Debrief Blocks A + B: The Final Reinforcement — Sealing the Leaks and Building the Battle PackDebrief competition #11 with the block A (dig unsolved problems to the bottom) and block B (Write-up) routines
- 302 ★ CTF #12: The Goal-Attainment Competition — Top 30%, Season FinaleExecute the fixed strategy as-is, without experiments — blocking the temptation to modify strategy mid-competi…
- 303 ★ Level 3 Comprehensive Evaluation: Score Analysis of the Last 3 Competitions + Level 4 Plan — Close with Data, Open with DesignVerify the Level 3 completion eligibility conditions (12 competition logs, 12 retrospectives, 3 Hard-tier Writ…
L4Advanced penetration testingStep 304–31310 lessons
- 304 Understanding the OSCP Exam and a Preparation Roadmap — The Rules of the 24-Hour Practical BattlefieldExplain the OSCP exam's structure (time, machine composition, report regulations)
- 305 Taking Down Practice Machines Begins — One Report per MachineSelect machines matching difficulty and type from an OSCP-like machine list
- 306 The Thoroughness of Enumeration — The Reality of "Try Harder"Define the true meaning of "Try Harder" as "regression to enumeration"
- 307 ★ Project — Finalizing the Exam-Format Report TemplateTranslate OSCP report requirements (reproducible description, evidence screenshot rules) into a template struc…
- 308 AD Set Takedown Training — From the Client to the Domain ControllerExplain the composition (client → server → DC) and scoring structure of the OSCP AD set
- 309 ★ The First 24-Hour Mock Exam — A Day of Learning to Fight the ClockCompose a 24-hour mock exam set under the real rules (prohibited tools, evidence collection, no external solut…
- 310 Mock Exam Failure-Pattern Analysis & Remediation — Unsolved Machines Come in Three KindsClassify unsolved machines by failure type (missing technique / missed enumeration / time management / stamina…
- 311 ★ The Second 24-Hour Mock Exam — Verification Day, Measuring Whether the Remediation WorkedOrganize Step 310's remedy deliverables into an "improvement list" and fix the items to apply on the second ex…
- 312 ★ Sitting the OSCP Practical Exam — 24 Hours of Doing Only What You PracticedExecute the day-before preparation checklist (equipment, rules, condition)
- 313 OSCP Retrospective & Next Plan — What to Do Before the Results Come OutReconstruct the exam's hour-by-hour timeline (what you solved when, and where you got stuck)
L4Vulnerability research & contributionStep 314–32310 lessons
- 314 Starting Bug Bounty — Understanding the System and Picking Your First TargetExplain the structure of the bug bounty system (platforms, programs, triage)
- 315 Real-Service Recon — Attack Surface MappingExecute the 4 stages of the recon chain — collect → liveness check → classify → map — in order
- 316 Vulnerability Discovery — A Systematic Feature-by-Feature ApproachExplain why "scanner dependence" is a beginner's trap
- 317 Verifying Candidates and Confirming ImpactApply the "is it a bug or not" judgment criteria (reproducibility + security impact)
- 318 Writing a Report That Gets AcceptedExplain the standard report structure (summary · reproduction steps · impact · fix suggestion · evidence)
- 319 Submitting Your First Report & Handling Triage — The Real Work Starts After the ButtonExplain the triage flow a submitted report goes through (intake → review → verdict)
- 320 1-day Vulnerability Analysis — Reverse-Engineering the Flaw from a Patch diffExplain what a 1-day vulnerability and patch-diff analysis are, and why they're powerful
- 321 CVE Reproduction and Publishing the Analysis Report — The Proof of an Analysis Is ReproductionExplain the structure of reproduction proof: "success on the vulnerable version + blocked on the patched versi…
- 322 Second CVE: Independent Analysis — Standing Alone Through the Analysis CyclePerform the full 1-day analysis cycle alone, guided only by a checklist
- 323 Publishing an Open-Source Tool and Contributing to the Community — Code as a WorkChoose a tool to publish and clean its code into "a state others can use"
L4Broaden competition experienceStep 324–3296 lessons
- 324 Competing in a Domestic Qualifier — Chasing the Finals: The Total Score Beats the HeroExplain and execute the four mechanisms of qualifier-day operations (team channel, problem assignment, time ma…
- 325 Intensive Training for the Finals — Two Weeks of Making What You Know CertainResearch the finals format (long-duration Jeopardy / Attack & Defense / presentation included) and explain how…
- 326 Competing in the Finals — The Highest-Level Experience: Executing Our Plan Under PressureExplain the environmental differences of an offline finals (venue atmosphere, network, operating rules) and pr…
- 327 Gap Analysis Against the Winning Team — Dissecting "Why," Not "What"Define the four gap types (technique, tooling, perspective, operations) and apply them to real cases
- 328 Competing in an International CTF — The Global Competition Experience: Seeing the World's CeilingExplain the differences between international and domestic competitions (scale, difficulty, timezone, language…
- 329 Analyzing World-Class New Techniques — The Write-up Is Your TextbookExplain a systematic procedure for collecting top-team Write-ups after a competition
L4Sharing knowledge & careersStep 330–3356 lessons
- 330 Building a Routine for Absorbing Cutting-Edge Knowledge — Whoever Subscribes to Good Channels WinsClassify security information channels into three tiers (conferences, blogs, newsletters) and explain the clas…
- 331 Starting to Mentor — Learning by Teaching: If You Can't Explain It, You Don't Know ItExplain the Feynman technique's principle and argue why mentoring is "the best review"
- 332 Building Seminar Talk Materials — Designing What the Audience Takes HomeSelect a talk topic by the criterion of "among what I'm good at, what's useful to the audience"
- 333 Giving a Public Talk and Sharing Materials — Carving Your Name into the CommunityExplain the three routes to a speaking opportunity (club, online meetup, self-organized) and execute one
- 334 Consolidating Your Portfolio — The Proof-of-Skill Package: Scattered Evidence into One StoryInventory scattered assets (posts, reports, repos, competitions, certifications, talks) with a script
- 335 Fixing Your Career Direction — Choosing Your Path Among Security's BranchesDistinguish and explain four or more major security career branches by their daily routines and required compe…
L4Competition & reflectionStep 336–3405 lessons
- 336 Challenging for the Domestic Championship — Mustering Total Strength: 24 Hours of Discipline Makes a ChampionDo a final field-by-field audit of team strength and judge whether to reinforce weak fields
- 337 Win/Loss Analysis and Designing the Next Challenge — Win or Lose, It's All DataStructure competition results into a per-problem analysis table (solve status, time spent, winning-team compar…
- 338 Intensive Weakness Training — Completing the Top Tier: Escaping the Trap of Doing More of What You're Good AtSort a weak field's past problems by difficulty and build a training plan
- 339 The Highest-Level Contest — A Domestic Rematch or an International Final: Skill Gaps Are Small; Operations Decide the MatchExplain the structure in which "non-skill variables" decide the match at highest-level competitions
- 340 A Memoir of the Entire Competition Journey — Assetization: Turning Experience into StoryCollect scattered competition records in one place while keeping the "no record" rule
L4New fields & integrated practiceStep 341–3444 lessons
- 341 Exploring the Next Growth Axis — Cloud/Mobile/IoT Security: A New Layer to Lay on the Fundamentals You've BuiltExplain the attack surfaces and representative resources of the four areas: cloud, mobile, IoT, and AI securit…
- 342 Launching into a New Field — With the Posture of Level 0 and a Proven MethodologyFind the selected area's standard entry path (official docs, beginner labs, community curricula) and fix its t…
- 343 The Integrated Intrusion Scenario — Operating Your Full Capability: From a List of Techniques to an OperationDefine an intrusion scenario with the three elements of goal, starting point, and rules
- 344 Penetration Playbook v2.0 — The Cycle Where Experience Becomes a ManualExhaustively collect the assets accumulated since v1.0 (checklists, timelines, lessons) and build a revision-c…
L4Community & the next journeyStep 345–3484 lessons
- 345 Establishing a System for Giving Back — Building a Structure That Returns What You ReceivedSettle your contribution activities so far (writing, code, mentoring, presentations) into numbers
- 346 Leading a CTF Team — Becoming the Center of Gravity of a Winning TeamDiagnose each member's strengths, weaknesses, growth desires, and available time to build a team status table
- 347 Competing in the Target Competition — The Curriculum's ReckoningConfirm the season's target competition and design a training cycle to match it
- 348 A Completion Retrospective and the Next Journey — The End Is the Starting PointOrganize the journey's growth metrics into numbers and tables