EXPLORE THE CURRICULUM
Level 2 · Security practice
Explore attack principles and responses in learning labs.
Before you begin A foundation in programming and networking · Step 96–175
80 lessons
Reset filtersL2First wargamesStep 96–10510 lessons
- 096 Bandit 0–5 — The Wargame Solving CycleConnect to a remote server over SSH and specify a port
- 097 Bandit 6~10 — Mastering Conditional Searches with findCombine find conditions (-user, -group, -size, -perm, -mtime, -writable) with AND to extract exactly the files…
- 098 Bandit 11~15 — Encoding and Network ConnectionsPerform character substitutions like ROT13 with tr and explain the principle
- 099 Bandit 16~20 — First Encounter with setuidFind open services with a port-range scan and check whether they use TLS
- 100 Bandit 21~25 — The cron Exploitation MindsetRead /etc/cron.d/ and interpret "who runs what, with whose privileges, when"
- 101 Bandit 26~30 — Digging Secrets from git History, and the Finish LineExplain the concept of bypassing a restricted shell by reading files via more/vim
- 102 Natas 0~5 — Opening the Door to Web WargamesPerform the reconnaissance routine — view source → search comments → robots.txt → guess paths — when you meet…
- 103 Natas 6~10 — Reading Server Code and Command InjectionFind and read include paths and comparison logic in PHP source
- 104 Natas 11~15 — XOR Analysis and Your First SQL InjectionRecover the key from a repeating-key XOR cipher with a known-plaintext attack
- 105 ★ Review — Cataloging Wargame TechniquesList every technique you used in Bandit 0–30 and Natas 0–15 without omissions
L2Linux securityStep 106–1105 lessons
- 106 Linux Permissions Deep Dive — setuid, setgid, sticky bitExplain how setuid, setgid, and the sticky bit each work in one sentence
- 107 Exploring Linux Logs — /var/logState the roles of the main files in /var/log (auth.log, syslog, kern.log, wtmp, etc.)
- 108 Environment Variables and PATH InjectionExplain what environment variables are, and read and write them with export and $VARIABLE
- 109 Symbolic Links and Hard Links — Another Name for a FileExplain the structure in which a file's substance (inode) and its name are separated
- 110 Project: "The Gaps in Linux's Permission Model" Reference Document — Reviewing Through an Attacker's EyesOrganize 4 types of Linux privilege-bypass points into the 4-part structure "conditions / discovery / exploita…
L2Labs & penetration testingStep 111–13020 lessons
- 111 Installing Kali Linux — Setting Up the Attacker's WorkbenchExplain what Kali Linux is and why it's the security industry's standard working environment
- 112 Installing Metasploitable2 and Building the Isolated Lab — Completing a Safe Firing RangeExplain what an intentionally vulnerable VM is and why it exists
- 113 Reconnaissance 1: A Complete Survey of the Target's Services — Attacks Begin with Building a ListExplain what the attack surface is and enumerate it with a full scan
- 114 Reconnaissance 2: Vulnerability Scanners and Reading Their Results — A Scanner Is a Candidate GeneratorAutomatically collect vulnerability candidates with nmap's vuln script category
- 115 How to Read a CVE: NVD and Exploit-DB — The Story Packed into a Single NumberExplain the structure of a CVE number (year + serial number) and state the difference in roles among CVE, NVD,…
- 116 Getting Started with Metasploit — The Standard Assembly Plant of AttacksLaunch msfconsole and recognize the change in the prompt (ordinary shell → msf shell)
- 117 ★ Your First Shell: Taking Over MS2 with the vsftpd Backdoor — Your Life's First Remote Command ExecutionRun exploit in Metasploit and obtain your first remote shell
- 118 Bind Shells vs. Reverse Shells — The Connection's Direction Is EverythingBuild a bind shell and a reverse shell with nc and execute commands through each
- 119 Mastering netcat — The Swiss Army Knife of NetworkingChoose between nc's two modes (listener/client) appropriately for the situation
- 120 Manual Exploitation 1: Attacking Without a Framework — Reproducing the Button's Inner Workings by HandManually trigger the vsftpd backdoor with nc alone, without Metasploit
- 121 Manual Exploitation 2: Expanding Your Repertoire — Every Service Opens a Different DoorProve the principle of hidden-path discovery (directory busting) with a server you build yourself
- 122 Password Attack 1: hydra Online Brute Force — An Attack That Knocks on a Living DoorExplain the principle of online brute force (wordlist submission) with a tool you built yourself
- 123 Password Attack 2: John the Ripper Offline Cracking — Stolen Hashes Break in SilenceRead the format of one /etc/shadow line (account, algorithm, salt, hash)
- 124 Password Attack 3 — hashcat and Attack ModesExplain why GPU cracking is faster than CPU, in terms of core structure
- 125 Introduction to Privilege Escalation — From Shell to rootRun reconnaissance commands that enumerate system info, accounts, and privileges from a restricted shell
- 126 Enumeration Automation — linPEASRun a bundle of manual enumeration commands and know what information comes out
- 127 The Post-Exploitation Checklist — The Beginning After the ShellClassify and state the items of information to collect right after acquiring a shell
- 128 ★ Project — The MS2 Full-Compromise ReportExplain the standard structure of a penetration test report (summary through remediation)
- 129 Attacking Another VulnHub Vulnerable VM — Apply the Whole Routine to a Target You've Never SeenPick a beginner-friendly machine on VulnHub and add it to your Host-only lab
- 130 ★ Checkpoint: Time-Attack Mock Penetration — Run the Entire Process in 6 HoursMake and keep a time-allocation table for a 6-hour penetration exercise
L2Web security foundationsStep 131–15525 lessons
- 131 Build Your Own Web Server — Login and SessionsCreate accounts in a sqlite3 DB and implement login verification
- 132 Burp Suite 1: Intercepting with a Proxy — Slipping Between Browser and ServerExplain what a proxy does between a browser and a server
- 133 Burp Suite 2: Repeater and Intruder — The Repeat Experiment Bench and the Automatic Machine GunSend a caught request to Repeater and run repeated experiments
- 134 Cookie and Session Attacks — Shaking the ID Card the Server TrustsExplain the structure by which cookies and sessions maintain login state, at the request/response header level
- 135 DVWA Setup and SQLi Basics — Crossing Low and MediumLaunch DVWA with Docker and adjust its security difficulty
- 136 SQLi Advanced — Dumping the Entire Database with UNIONExplain UNION SELECT's rule for combining two results (matching column counts)
- 137 Blind SQLi & sqlmap — Extracting Even When Nothing ShowsExplain the oracle (true/false answering device) principle of Boolean-based Blind SQLi
- 138 XSS Basics — Reflected & Stored, the Traitor Inside the BrowserExplain how XSS differs from SQL injection (the attack target is the browser)
- 139 XSS Advanced: Cookie Theft & Filter Bypass — Beyond alert, Stealing SessionsWrite a real-world XSS payload that sends document.cookie to the attacker's server
- 140 CSRF: Request Forgery — The Victim's Browser Clicks for YouExplain how the browser's automatic cookie-sending trait enables CSRF
- 141 File Upload Attack: Web Shell — From a Board Post to Server TakeoverExplain what a web shell is and the chain by which "one upload" leads to "server takeover"
- 142 Web Shell Advanced: Writing Your Own & the Principles — Building the One-Line Door YourselfExplain a web shell's core structure (input → execute → output) line by line
- 143 Command Injection — The Moment a Search Box Becomes the Server's TerminalFind command injection's two conditions (input concatenation + shell execution) in code
- 144 File Inclusion: LFI/RFI — I Choose the File the Server "Reads for Me"Explain the difference between LFI and RFI in terms of how include works
- 145 Directory Busting & Information Exposure — The "If They Don't Know the Address, It's Safe" FallacyExplain the principle of forced browsing and the basic usage of gobuster
- 146 Authentication Attacks, Combined — Four Ways to Knock on the Front DoorExplain why a default-credential check is the "first five minutes" of a real penetration test
- 147 ★ DVWA All Difficulty Levels + the Three-Tier Summary Table — What It Means to "Completely" Know One VulnerabilityExplain at the code level how defense code evolves as DVWA's difficulty rises
- 148 OWASP Juice Shop 1: Introduction to the Modern Web App — The Attack Stage Has ChangedExplain the structural difference between an SPA (single-page application) and a traditional web app
- 149 Juice Shop 2 — Access Control and IDORExplain the condition under which IDOR arises ("authenticates but doesn't authorize")
- 150 Juice Shop 3 — JWT and Business LogicBreak a JWT into its three chunks (header.payload.signature) and read its contents
- 151 Dreamhack Web Introduction — Your First Real ProblemsKnow the components of a Dreamhack wargame problem (title, description, URL, flag submission)
- 152 Dreamhack Web (Cumulative 16) — Recognizing Techniques in DisguiseExplain how the same vulnerability hides in different features (search box, download, basket)
- 153 DreamHack Web (Running Total: 24) — Breaking Through with ResearchIdentify the tech stack (Flask, PHP, etc.) in a challenge and use it as search-keyword material
- 154 DreamHack Web (Running Total: 32) — Your Weakness List and Problem-Picking StrategyMaintain solve records in CSV format (date, problem name, type, minutes spent, result)
- 155 ★ Project — Independent Assault on a Vulnerable Web Target, with a ReportCarry out the recon → feature mapping → hypothesis → verification sequence on an unknown web target, on your o…
L2Networks & authenticationStep 156–16611 lessons
- 156 MITM Primer — ARP Spoofing 1: A Protocol with No ID CardExplain the structure and fields of ARP requests (who-has) and replies (is-at)
- 157 ARP Spoofing 2 — Bidirectional Interception and the End of PlaintextExplain the difference between one-way and bidirectional spoofing in terms of "what becomes visible"
- 158 Packet Sniffing Advanced — The Two Faces of Filters and Reassembling ConversationsExplain the difference between capture filters (BPF syntax) and display filters (Wireshark syntax), and use ea…
- 159 DNS Spoofing and bettercap — Swapping Out the Phone BookExplain the structure of DNS query/response packets (question record and answer record)
- 160 SSL/TLS and HSTS — The ID-Card System That Stops the Man in the MiddleExplain the TLS handshake's stages (Client Hello → certificate → key agreement → encrypted communication)
- 161 Firewalls and iptables — Designing the Gatekeeper's RulesExplain the meaning of chains (INPUT/OUTPUT/FORWARD) and targets (ACCEPT/DROP/REJECT)
- 162 Proxies and Anonymity — The Art of Hiding Behind a Stand-In, and Its LimitsExplain the difference between a forward proxy and a reverse proxy by "whom it represents"
- 163 SSH Tunneling and Port Forwarding — Loading Other Roads onto an Encrypted PassageExplain the directional differences of local (-L), remote (-R), and dynamic (-D) forwarding with diagrams
- 164 Enumeration Tools, Complete Review — A System for Flipping Every StonePick the right tool for each enumeration situation (external network / web / host internals) without hesitatio…
- 165 Password Spraying and Credential Stuffing — Attacks That Walk Sideways Past the LockClassify online password attacks into vertical (brute force) / horizontal (spraying) / reuse (stuffing)
- 166 Wireless Security: WPA2 and the Handshake — Key Material Floating in the AirExplain the four messages of the WPA2 4-way handshake in order
L2Security perspectives & practiceStep 167–1759 lessons
- 167 Social Engineering: Hacking Humans — One Email That Bypasses the FirewallExplain with examples that social engineering is a technique "attacking psychology, not technology"
- 168 Malware Structure: Trojans and Ransomware — Dissecting Without BuildingDistinguish viruses/worms/Trojans/ransomware by the criterion of reproduction method
- 169 Encryption and Detection Evasion Concepts — The Arms Race Between the Hiders and the SeekersExplain the difference between obfuscation and encryption from the perspective of "the key that reverses it"
- 170 Introduction to OSINT — Social Media Collection and Digital FootprintsExplain the definition of OSINT and the boundary of legality (public information, purpose, consent)
- 171 OSINT Advanced — Subdomain and Asset EnumerationExplain the difference between passive and active enumeration
- 172 ★ Capstone Scenario 1 — From Recon to ShellPerform the kill chain — recon → scan → enumerate → hypothesize → verify → shell — independently
- 173 Scenario 1 Review and Penetration Report — The Skill of Weaving Records into a DocumentReconstruct the attack path from timeline records
- 174 Capstone Scenario 2: Web Intrusion → Internal Expansion — One Entrance Opens EverythingExplain what a chain attack is and list the five stages from web intrusion to root
- 175 Level 2 Comprehensive Assessment: The Attack/Defense Response Table — Completing Two-Sided ThinkingExplain Level 2's major attack techniques as pairs with their matching defenses