EXPLORE THE CURRICULUM
Your learning map
See how it fits together. Find the lesson you want to learn next.
68 lessons · Penetration testing
Reset filtersL2Labs & penetration testingStep 111–13020 lessons
- 111 Installing Kali Linux — Setting Up the Attacker's WorkbenchExplain what Kali Linux is and why it's the security industry's standard working environment
- 112 Installing Metasploitable2 and Building the Isolated Lab — Completing a Safe Firing RangeExplain what an intentionally vulnerable VM is and why it exists
- 113 Reconnaissance 1: A Complete Survey of the Target's Services — Attacks Begin with Building a ListExplain what the attack surface is and enumerate it with a full scan
- 114 Reconnaissance 2: Vulnerability Scanners and Reading Their Results — A Scanner Is a Candidate GeneratorAutomatically collect vulnerability candidates with nmap's vuln script category
- 115 How to Read a CVE: NVD and Exploit-DB — The Story Packed into a Single NumberExplain the structure of a CVE number (year + serial number) and state the difference in roles among CVE, NVD,…
- 116 Getting Started with Metasploit — The Standard Assembly Plant of AttacksLaunch msfconsole and recognize the change in the prompt (ordinary shell → msf shell)
- 117 ★ Your First Shell: Taking Over MS2 with the vsftpd Backdoor — Your Life's First Remote Command ExecutionRun exploit in Metasploit and obtain your first remote shell
- 118 Bind Shells vs. Reverse Shells — The Connection's Direction Is EverythingBuild a bind shell and a reverse shell with nc and execute commands through each
- 119 Mastering netcat — The Swiss Army Knife of NetworkingChoose between nc's two modes (listener/client) appropriately for the situation
- 120 Manual Exploitation 1: Attacking Without a Framework — Reproducing the Button's Inner Workings by HandManually trigger the vsftpd backdoor with nc alone, without Metasploit
- 121 Manual Exploitation 2: Expanding Your Repertoire — Every Service Opens a Different DoorProve the principle of hidden-path discovery (directory busting) with a server you build yourself
- 122 Password Attack 1: hydra Online Brute Force — An Attack That Knocks on a Living DoorExplain the principle of online brute force (wordlist submission) with a tool you built yourself
- 123 Password Attack 2: John the Ripper Offline Cracking — Stolen Hashes Break in SilenceRead the format of one /etc/shadow line (account, algorithm, salt, hash)
- 124 Password Attack 3 — hashcat and Attack ModesExplain why GPU cracking is faster than CPU, in terms of core structure
- 125 Introduction to Privilege Escalation — From Shell to rootRun reconnaissance commands that enumerate system info, accounts, and privileges from a restricted shell
- 126 Enumeration Automation — linPEASRun a bundle of manual enumeration commands and know what information comes out
- 127 The Post-Exploitation Checklist — The Beginning After the ShellClassify and state the items of information to collect right after acquiring a shell
- 128 ★ Project — The MS2 Full-Compromise ReportExplain the standard structure of a penetration test report (summary through remediation)
- 129 Attacking Another VulnHub Vulnerable VM — Apply the Whole Routine to a Target You've Never SeenPick a beginner-friendly machine on VulnHub and add it to your Host-only lab
- 130 ★ Checkpoint: Time-Attack Mock Penetration — Run the Entire Process in 6 HoursMake and keep a time-allocation table for a 6-hour penetration exercise
L2Security perspectives & practiceStep 167–1759 lessons
- 167 Social Engineering: Hacking Humans — One Email That Bypasses the FirewallExplain with examples that social engineering is a technique "attacking psychology, not technology"
- 168 Malware Structure: Trojans and Ransomware — Dissecting Without BuildingDistinguish viruses/worms/Trojans/ransomware by the criterion of reproduction method
- 169 Encryption and Detection Evasion Concepts — The Arms Race Between the Hiders and the SeekersExplain the difference between obfuscation and encryption from the perspective of "the key that reverses it"
- 170 Introduction to OSINT — Social Media Collection and Digital FootprintsExplain the definition of OSINT and the boundary of legality (public information, purpose, consent)
- 171 OSINT Advanced — Subdomain and Asset EnumerationExplain the difference between passive and active enumeration
- 172 ★ Capstone Scenario 1 — From Recon to ShellPerform the kill chain — recon → scan → enumerate → hypothesize → verify → shell — independently
- 173 Scenario 1 Review and Penetration Report — The Skill of Weaving Records into a DocumentReconstruct the attack path from timeline records
- 174 Capstone Scenario 2: Web Intrusion → Internal Expansion — One Entrance Opens EverythingExplain what a chain attack is and list the five stages from web intrusion to root
- 175 Level 2 Comprehensive Assessment: The Attack/Defense Response Table — Completing Two-Sided ThinkingExplain Level 2's major attack techniques as pairs with their matching defenses
L3Practice machines & pentestingStep 251–27828 lessons
- 251 TryHackMe Intro Path + 3 Easy Rooms — Opening the Door to Real MachinesExplain the structure of a TryHackMe room (tasks, questions, hints, machines)
- 252 THM Easy ×5 (8 Cumulative) — Engraving the Routine into Your FingersApply the same routine to machines of different types (web-centric, SMB-centric, etc.)
- 253 THM Linux Privesc Rooms (13 Cumulative) — After the Shell, All the Way to rootRun the first command set right after getting a shell (sudo -l → SUID → cron → passwd permissions) in order
- 254 THM Windows/AD Intro Rooms (18 Cumulative) — Meeting the Protagonist of Corporate EnvironmentsBuild an approach strategy upon seeing a Windows machine's signature service ports (SMB 445, RDP 3389, WinRM 5…
- 255 Hack The Box Starting Point Complete Run — Up to a Stage One Level HigherExplain the structural differences between HTB and THM (hints, machine operation, flag style)
- 256 HTB Easy ×2 — Alone to root: The First Complete Run Without GuidanceExplain the boundary between allowed and forbidden resources under "solving alone"
- 257 HTB Easy x2 (Cumulative 4) — Widening Your Repertoire of Entry PointsClassify initial access vectors (entry points) by type and diagnose the skew in your own experience
- 258 HTB Easy x2 (Cumulative 6) — Time-Limit Training: Solving with the Clock OnSet per-phase time allocations (recon/exploitation/escalation) and enforce them with alarms
- 259 Linux Privilege Escalation, Fully Conquered — From Patterns to a ChecklistList the eight patterns of Linux privilege escalation and the discovery command for each
- 260 Windows Privilege Escalation, Fully Conquered — Doors of Services, Tokens, and SettingsRead whoami /priv output and understand what SeImpersonatePrivilege means
- 261 Active Directory 1 — Understanding Domain StructureDraw the relationship between domain, tree, forest, and domain controller (DC) as a diagram
- 262 Active Directory 2 — Kerberoasting and AS-REP RoastingExplain, on top of the Kerberos flow, why Kerberoasting is "abuse of a normal feature"
- 263 Active Directory 3 — Pass-the-Hash and BloodHoundExplain why the NTLM challenge-response structure creates "hash = password"
- 264 Pivoting, Deepened — Through the Compromised Machine into the Internal NetworkExplain with a diagram why pivoting is needed in a dual-network structure (an internal network inside the DMZ)
- 265 One HTB Medium Machine — Solve It Independently, Even If It Takes DaysExplain the structural differences between Easy and Medium (chains, misdirection, enumeration demands)
- 266 Medium Review + Re-Attack — How to Learn After SolvingReconstruct a timeline from your progress log and quantify "where the time went"
- 267 One HTB Medium Machine (Cumulative 2) — Read the Starring Service, Turn Stuck Points into StatisticsIdentify the machine's type (web-focused / service-focused / AD, etc.) and its "starring service" from the fir…
- 268 One HTB Medium Machine (Cumulative 3) — The Depth of EnumerationDistinguish enumeration's "wide" from "deep," and choose the side that fits the kind of stuck
- 269 One HTB Medium Machine (Cumulative 4) — Vulnerability ChainingExplain the concept of vulnerability chaining and the representative pattern (information disclosure → authent…
- 270 One HTB Medium Machine (Cumulative 5) + Medium Graduation ReviewIndependently attack a fifth Medium machine
- 271 One HTB AD-Track Machine — The Standard Route to Domain TakeoverRead an AD machine's scan results (SMB, LDAP, Kerberos ports) and judge that it's a domain environment
- 272 Completing Your Own Pentest Playbook — Taking a Photo of Your Current SkillIntegrate scattered routine documents into a playbook with an 8-section structure
- 273 HTB Hard Challenge 1 — Enumerate Deeper, Test HypothesesExplain the three traits that make Hard different from Medium (unknown techniques, hidden entrances, multi-sta…
- 274 HTB Hard Challenge 2 — Repaying Technical Debt: Turn What You Don't Know into a List and Pay It OffExtract "what I couldn't do because I didn't know" from an attack log using [UNKNOWN] tags
- 275 HTB Hard Debrief — Analyzing Top Players' Write-ups: Read the Reasoning, Not the ResultsApply a dissection method that reads a write-up not as an "answer key" but as "a record of a thought process"
- 276 Speed Training: Easy in Under 4 Hours — Push Your Routine to AutopilotBuild and keep a stage-by-stage budget table for a 4-hour Easy time attack
- 277 Speed Training: Medium in Under 8 Hours — Stamina and Pace Allocation for the Long GameBuild a stage-by-stage budget table for a Medium 8-hour run (enum 2h / foothold 3.5h / privesc 2h / slack 0.5h…
- 278 ★ Real-World Check: Medium Time Attack + Presentation Practice — Solving and Explaining Are Different MusclesAssault a Medium machine in an 8-hour time attack while simultaneously collecting presentation evidence (captu…
L4Advanced penetration testingStep 304–31310 lessons
- 304 Understanding the OSCP Exam and a Preparation Roadmap — The Rules of the 24-Hour Practical BattlefieldExplain the OSCP exam's structure (time, machine composition, report regulations)
- 305 Taking Down Practice Machines Begins — One Report per MachineSelect machines matching difficulty and type from an OSCP-like machine list
- 306 The Thoroughness of Enumeration — The Reality of "Try Harder"Define the true meaning of "Try Harder" as "regression to enumeration"
- 307 ★ Project — Finalizing the Exam-Format Report TemplateTranslate OSCP report requirements (reproducible description, evidence screenshot rules) into a template struc…
- 308 AD Set Takedown Training — From the Client to the Domain ControllerExplain the composition (client → server → DC) and scoring structure of the OSCP AD set
- 309 ★ The First 24-Hour Mock Exam — A Day of Learning to Fight the ClockCompose a 24-hour mock exam set under the real rules (prohibited tools, evidence collection, no external solut…
- 310 Mock Exam Failure-Pattern Analysis & Remediation — Unsolved Machines Come in Three KindsClassify unsolved machines by failure type (missing technique / missed enumeration / time management / stamina…
- 311 ★ The Second 24-Hour Mock Exam — Verification Day, Measuring Whether the Remediation WorkedOrganize Step 310's remedy deliverables into an "improvement list" and fix the items to apply on the second ex…
- 312 ★ Sitting the OSCP Practical Exam — 24 Hours of Doing Only What You PracticedExecute the day-before preparation checklist (equipment, rules, condition)
- 313 OSCP Retrospective & Next Plan — What to Do Before the Results Come OutReconstruct the exam's hour-by-hour timeline (what you solved when, and where you got stuck)