Cybersecurity

Builds the TCP/IP and protocol foundation every security role and interviewer expects you to know cold.

• OSI model vs TCP/IP model layer-by-layer mapping
• IPv4/IPv6 addressing, subnetting, and CIDR notation
• TCP three-way handshake and UDP connectionless behavior
• Common ports and services (HTTP/S, DNS, SSH, FTP, SMTP)
• Switching, VLANs, and ARP resolution
• Routing fundamentals: static vs dynamic (RIP, OSPF, BGP basics)
• DNS resolution flow and DNS record types (A, MX, TXT, NS)
• DHCP lease process and rogue DHCP risks
• Network topologies and segmentation (DMZ, VLAN isolation)
• Packet capture and protocol analysis with Wireshark filters
• Firewalls, proxies, and NAT fundamentals
• Wireless networking basics: SSID, WPA2/WPA3, access points
• Troubleshooting connectivity with ping, traceroute, netstat

Gets you fluent in the Linux command line and the Kali toolkit that every penetration test runs on.

• Linux filesystem hierarchy and file permissions (chmod, chown)
• Shell navigation, piping, and redirection in Bash
• User and group management, sudo privilege model
• Package management (apt, dpkg) and Kali repository setup
• Kali Linux toolkit overview: recon, exploitation, post-exploitation categories
• Process management, services, and systemd basics
• Bash scripting for automating recon and reporting tasks
• Networking commands: ifconfig/ip, ss, iptables basics
• Log file locations and syslog fundamentals
• Setting up and hardening a Kali VM lab environment
• SSH key-based authentication and remote access
• Version control with Git for tracking pentest scripts and notes
• Cron jobs and persistence-adjacent scheduling concepts

Anchors every later module in the CIA triad, risk models, and governance concepts tested on Security+ and CEH.

• CIA triad: confidentiality, integrity, availability
• AAA framework: authentication, authorization, accounting
• Threat, vulnerability, and risk terminology and risk formulas
• Security control types: preventive, detective, corrective, deterrent
• Defense in depth and zero-trust architecture principles
• Common threat actors: script kiddies, hacktivists, APTs, insider threats
• MITRE ATT&CK framework and the cyber kill chain
• Governance, risk, and compliance (GRC) basics
• Regulatory landscape: GDPR, HIPAA, PCI-DSS, ISO 27001 overview
• Security policies, standards, and acceptable use documentation
• Social engineering fundamentals: phishing, pretexting, baiting
• Business continuity and disaster recovery concepts (RTO/RPO)
• Ethics and legal boundaries of authorized penetration testing

Trains you to find and responsibly exploit real web application flaws using the same methodology as professional pentesters.

• VAPT methodology: reconnaissance, scanning, exploitation, reporting
• OWASP Top 10 2021 walkthrough: A01 Broken Access Control to A10 SSRF
• SQL injection: detection, exploitation, and parameterized-query fixes
• Cross-site scripting (XSS): reflected, stored, and DOM-based
• Cross-site request forgery (CSRF) and same-origin policy
• Authentication and session management flaws
• Burp Suite proxy, Intruder, and Repeater for manual testing
• OWASP ZAP automated scanning and spidering
• Insecure direct object references and broken access control
• Security misconfiguration and outdated component exploitation
• Server-side request forgery (SSRF) exploitation basics
• API security testing fundamentals (REST/GraphQL)
• Writing a professional VAPT findings report with CVSS scoring

Puts the industry-standard scanning, exploitation, and monitoring stack in your hands so you're job-ready on day one.

• Nmap scan types: SYN, TCP connect, UDP, and stealth scans
• Nmap scripting engine (NSE) for service enumeration
• Metasploit framework structure: exploits, payloads, auxiliary modules
• Building and delivering a Metasploit exploit chain safely in a lab
• Meterpreter post-exploitation basics
• Wireshark deep packet inspection and following TCP streams
• Nessus vulnerability scanning setup and severity triage
• Splunk log ingestion and building basic search queries
• Correlating scan output across tools into one attack narrative
• Reporting vulnerabilities with CVSS and remediation guidance
• Tool selection: choosing the right tool for recon vs exploitation vs monitoring
• Maintaining an ethical, authorized-scope testing checklist

Demystifies how passwords are stored, cracked, and protected so you can enforce genuinely strong authentication.

• Symmetric vs asymmetric encryption fundamentals (AES, RSA)
• Hashing algorithms: MD5, SHA-1, SHA-256, and collision risks
• Password storage: salting, peppering, and key stretching (bcrypt, PBKDF2)
• Offline password attacks: dictionary, brute-force, and mask attacks
• John the Ripper: hash identification and cracking modes
• Hashcat GPU-accelerated cracking and rule-based attacks
• Rainbow tables and why salting defeats them
• Password policy design and multi-factor authentication (MFA)
• Public key infrastructure (PKI) and digital certificates
• TLS/SSL handshake and HTTPS certificate validation
• Common cryptographic attacks: replay, downgrade, padding oracle
• Steganography basics and detection concepts
• Applying cryptographic controls to protect data at rest and in transit

Equips you to harden endpoints, servers, and network perimeters against real-world intrusion attempts.

• Operating system hardening baselines (CIS Benchmarks)
• Patch management and vulnerability lifecycle
• Firewall rule design and access control lists (ACLs)
• Intrusion detection and prevention systems (IDS/IPS) concepts
• Endpoint detection and response (EDR) fundamentals
• Network segmentation and micro-segmentation strategies
• Malware categories: viruses, worms, trojans, ransomware, rootkits
• Antivirus/anti-malware evasion and detection basics
• VPN technologies and secure remote access design
• Wireless network security: WPA3, rogue AP detection
• Privilege escalation vectors on Linux and Windows
• Active Directory security basics and common misconfigurations
• Backup strategy and ransomware-resilient architecture

Prepares you to detect, contain, and investigate breaches while securing modern cloud workloads.

• Incident response lifecycle: preparation, detection, containment, eradication, recovery
• Building and using a SIEM with Splunk for alert triage
• Log analysis and correlation for anomaly detection
• Digital forensics fundamentals: chain of custody and evidence handling
• Memory and disk forensics basics
• Threat hunting methodology and indicators of compromise (IOCs)
• Incident classification and severity scoring
• Post-incident reporting and lessons-learned documentation
• Cloud shared responsibility model (AWS, Azure, GCP)
• Cloud misconfiguration risks: S3 buckets, IAM over-permissioning
• Cloud-native security tools: CSPM, security groups, key vaults
• Container and Kubernetes security basics
• Building a cloud incident response runbook

Turns your skills into real-world impact by teaching you to responsibly disclose findings and build a bug bounty track record.

• Bug bounty ecosystem: HackerOne, Bugcrowd, and program scopes
• Responsible disclosure and coordinated vulnerability disclosure (CVD)
• Reconnaissance for bug bounty: subdomain enumeration and asset mapping
• Choosing targets and reading program scope/rules of engagement
• Chaining low-severity bugs into high-impact findings
• Writing a proof-of-concept (PoC) that reviewers can reproduce
• CVSS scoring and severity justification in bounty reports
• Report structure: summary, steps to reproduce, impact, remediation
• Using Git to version-control PoC scripts and evidence
• Common reasons bug bounty reports get rejected (duplicates, out of scope)
• Building a public portfolio: write-ups, CVEs, and platform reputation
• Legal and ethical boundaries of bug bounty hunting
• Transitioning bug bounty experience into a security career