— Learning Catalogue
All Lessons
Browse every published lesson across all roadmaps
Convert between decimal, binary, and hex — essential for reading shellcode, network packets, and hashes.
CPU, RAM, storage, the OS kernel, and how process memory is laid out — essential for understanding exploits.
The OSI model, IP and ports, common protocols, and how a packet travels from browser to server.
Hash functions, symmetric vs asymmetric encryption, TLS, and common algorithms you'll encounter in security.
Understand what a network is, how LAN differs from WAN, key components, topologies, and the ARP protocol.
Learn 802.11 standards, 2.4GHz vs 5GHz tradeoffs, SSID/BSSID, WPA2/WPA3, and channel planning — the non-attack foundation for the Ethical Hacking roadmap's wireless attacks.
Master IPv4 address structure, subnet masks, CIDR notation, and how to calculate network ranges.
Read IPv6 address notation, learn its address types, and understand NDP/SLAAC and dual-stack deployment — the modern counterpart to the IPv4 lesson right before this one.
Understand how the OSI and TCP/IP models layer network functions, how data travels from app to wire.
Understand how DNS resolves domain names, how DHCP assigns IPs automatically, and troubleshoot both.
How switches learn MAC addresses, how routers forward packets, VLANs, and reading a routing table.
Compare leased lines, MPLS, and internet-based VPN, understand why SD-WAN emerged, and weigh the security tradeoffs of local breakout versus centralized backhauling.
Learn the Filesystem Hierarchy Standard every distro follows, and how apt, dnf, and pacman solve the same dependency-resolution problem with different syntax.
Write reliable POSIX shell scripts — variables, conditionals, loops, functions, exit codes, and the quoting rules that keep automation from breaking in production.
Understand systemd as PID 1, read and write unit files, control services with systemctl, and use signals to manage running processes correctly.
Inspect live network state with ss, capture and filter packets with tcpdump, and route/rotate logs correctly with syslog, journald, and logrotate.
Install Python, set up a virtual environment, and write your first scripts using variables, types, and input/output.
Master if/elif/else, for and while loops, and write reusable functions with arguments, return values, and default parameters.
Work with Python's core built-in containers: lists, tuples, dictionaries, and sets — and apply them to real security use cases.
Read, write, and parse files in Python — including text logs, CSV reports, and JSON configuration files used in security tools.
Build classes and objects to model security tools — encapsulate scanner logic, extend base classes, and use dunder methods.
Use Python's socket module to build TCP/UDP clients and servers, scan ports, grab banners, and understand low-level network communication.
Use the requests library and BeautifulSoup to make HTTP calls, scrape web content, probe APIs, and automate form submissions.
Master Python's re module to write patterns that extract IPs, timestamps, usernames, and anomalies from real-world log files.
Run shell commands from Python using subprocess, automate system tasks with the os and pathlib modules, and build security automation scripts.
Understand the full request-response cycle: DNS resolution, HTTP/HTTPS, TCP handshakes, status codes, and browser rendering.
Build the structure of web pages with semantic HTML5: elements, attributes, forms, tables, and accessibility best practices.
Style web pages with CSS: selectors, the box model, Flexbox, responsive design, and CSS variables for maintainable stylesheets.
Learn JavaScript fundamentals: variables, types, functions, arrays, objects, and control flow — the engine behind interactive web pages.
Select, modify, and create DOM elements with JavaScript, and respond to user actions through event listeners — the core of interactive web UIs.
Handle form submission in JavaScript, implement client-side validation, and communicate with APIs using the Fetch API and async/await.
Build server-side web applications with Node.js and the Express framework — routes, middleware, request handling, and JSON APIs.
Design and consume RESTful APIs: resource naming, HTTP methods, status codes, authentication patterns, and API security basics.
A capstone review process: validate-input/encode-output, insecure framework defaults, a structured code review checklist, and dependency scanning as secure coding, not just ops.
Understand the relational model and write foundational SQL: CREATE TABLE, INSERT, SELECT, WHERE, ORDER BY, and basic JOINs.
Master GROUP BY aggregates, subqueries, CTEs, and window functions to answer complex analytical questions from your data.
Design well-structured relational schemas: entity-relationship modeling, normal forms (1NF–3NF), and schema design patterns for real security applications.
Make queries fast with indexes, protect data integrity with transactions, and understand how query planners work — critical for building reliable, performant security tools.
Explore document (MongoDB) and key-value (Redis) NoSQL databases — their data models, query languages, use cases, and security considerations.
Master SQL injection — how it works, classic and blind techniques, UNION attacks, and how to defend with parameterized queries, ORMs, and least privilege.
CIA Triad, threat actors, common attack types, defence-in-depth, and how security teams operate.
Understand the OSI model, TCP/IP stack, subnetting, common protocols, and how attackers exploit each layer — the foundation of all network security work.
Understand symmetric and asymmetric encryption, hashing, digital signatures, PKI, and TLS — the mathematical backbone of all secure communication.
Master authentication factors, password security, MFA, session management, OAuth 2.0, and common identity attacks like credential stuffing and session hijacking.
Learn how to defend networks with firewalls, IDS/IPS, VPNs, and network segmentation — and understand the attacker's perspective on each control.
Harden Linux systems through file permissions, user management, privilege escalation prevention, kernel hardening, and system auditing.
Survey the OWASP Top 10 vulnerabilities — from broken access control to injection — understand how each works, how to find it, and how to fix it.
Learn malware types, infection chains, and basic static and dynamic analysis techniques — the skills to understand what a suspicious file actually does.
Learn the IR lifecycle — preparation, detection, containment, eradication, recovery, and lessons learned — plus digital forensics techniques for collecting and analyzing evidence.
Understand how Security Operations Centers work — SIEM log aggregation, alert triage, threat intelligence integration, and the daily reality of defending an organization.
Learn how organizations decide which risks to fund, who is accountable, and how ISO 27001 turns risk management into an auditable, certifiable system.
Map real business scenarios to the compliance frameworks that govern them, and learn what each one actually requires — PCI-DSS, HIPAA, GDPR, and SOC 2.
Tailgating, badge cloning, pretexting, and dumpster diving — the foundational, often-overlooked layer of defense in depth that no firewall can substitute for.
BCP vs DRP, calculating RTO/RPO, hot/warm/cold recovery sites, the 3-2-1 backup rule, and why tabletop exercises are the cheapest way to find a plan's real gaps.
Why a vendor's security posture becomes your own risk, fourth-party risk, key contractual protections, and why not every vendor deserves the same scrutiny.
Master HTTP/HTTPS internals — request/response structure, security headers, cookie attributes, Same-Origin Policy, CORS, and how attackers exploit each.
Master Burp Suite Community Edition for web application security testing — intercepting, modifying, and replaying HTTP traffic to find vulnerabilities.
Deep dive into SQL injection — in-band, blind, out-of-band, second-order, and WAF bypass techniques — with sqlmap and full defensive countermeasures.
Master all three types of XSS — reflected, stored, and DOM-based — including filter bypass, CSP bypass, advanced payloads for cookie theft and keylogging, and robust defenses.
Learn how prototype pollution corrupts the JavaScript prototype chain, how a 'gadget' turns it into XSS, and the exact origin-validation mistake that breaks postMessage.
Understand and exploit Cross-Site Request Forgery and Clickjacking — two attacks that abuse browser trust — and implement robust defenses for each.
Explore and exploit authentication vulnerabilities — JWT attacks (alg:none, weak secrets, kid injection), OAuth misconfigurations, session management flaws, and MFA bypass techniques.
Learn to identify and exploit Server-Side Request Forgery (SSRF) to access internal services and cloud metadata, and XML External Entity (XXE) injection to read local files and conduct SSRF.
Exploit insecure file upload features to achieve remote code execution, and use path traversal to read arbitrary server files — plus robust defense strategies.
Exploit OS command injection to achieve remote code execution, and Server-Side Template Injection (SSTI) in Jinja2, Twig, and Freemarker to escape sandboxes and execute arbitrary code.
Identify and exploit business logic flaws and Insecure Direct Object References — vulnerabilities that scanners miss because they require understanding how the application is supposed to work.
Understand how WAFs work and how attackers bypass them using encoding, obfuscation, protocol-level tricks, and application-specific evasion — enabling realistic security assessments.
Exploit disagreements between front-end and back-end servers about where one HTTP request ends and the next begins — and understand why it's a favorite WAF-bypass technique.
Systematically test REST and GraphQL APIs for security vulnerabilities — broken authentication, IDOR, mass assignment, excessive data exposure, injection, and GraphQL-specific attacks.
Understand introspection leaks, query depth/complexity and batching attacks, why authorization must be per-field, and persisted queries as production lockdown.
Master the ethical hacking engagement lifecycle and passive reconnaissance — OSINT, Google dorking, Shodan, theHarvester, and intelligence gathering without touching the target.
Go beyond intro-depth OSINT: certificate transparency logs, Amass, Maltego's transform model, Recon-ng, and metadata extraction as passive attack-surface mapping.
Actively probe targets with Nmap, Nessus, and enumeration tools to discover open ports, services, OS fingerprints, and vulnerabilities — building a complete attack surface map.
Master the Metasploit Framework for vulnerability exploitation — searching, selecting, configuring, and launching exploits, generating payloads with msfvenom, and managing sessions.
Escalate from a low-privilege shell to root on Linux using SUID binaries, sudo misconfigurations, cron jobs, weak file permissions, capabilities, and kernel exploits.
Escalate privileges on Windows systems using service misconfigurations, unquoted service paths, DLL hijacking, token impersonation, and AlwaysInstallElevated — from low-privilege user to SYSTEM.
Master offline password cracking with hashcat and John the Ripper, online brute force with Hydra, credential stuffing, and Windows-specific attacks like pass-the-hash and pass-the-ticket.
Understand and simulate social engineering attacks — spear phishing, pretexting, vishing, and physical attacks — to evaluate human security controls and train employee awareness.
Execute network-level attacks — ARP poisoning, MITM traffic interception with Wireshark, Responder for credential capture, and network protocol exploitation.
Learn the AD hierarchy, GPOs, LDAP, and the Kerberos/NTLM authentication protocols that the next lesson's attacks (Kerberoasting, DCSync, Golden Ticket) all build on.
Attack Windows Active Directory environments using BloodHound enumeration, Kerberoasting, AS-REP roasting, DCSync, Pass-the-Ticket, and Golden Ticket attacks.
Attack Wi-Fi networks — capture and crack WPA2 handshakes, perform evil twin attacks, exploit WPS, and probe for insecure enterprise authentication.
Understand and exploit classic stack-based buffer overflows — memory layout, EIP control, bad characters, shellcode generation, and exploit development with GDB and pwndbg.
Chain every step from Buffer Overflow Fundamentals into one working exploit: fuzzing, offset discovery, bad characters, a JMP ESP redirect, and final shellcode delivery.
Move through segmented networks using port forwarding, dynamic SOCKS proxies, chisel tunnels, and ProxyChains — reaching hosts that aren't directly accessible from the attacker machine.
Write professional penetration testing reports — executive summaries, technical findings, CVSS scoring, remediation recommendations, and evidence documentation that deliver real value to clients.
Understand advanced red team operations — simulating sophisticated adversaries with C2 frameworks, OPSEC techniques, detection evasion, and adversary simulation using MITRE ATT&CK.
A 30-question practice set covering the practical syllabus areas of INE's eJPT (eLearnSecurity Junior Penetration Tester) certification.
A 30-question practice set covering the practical methodology areas of OSCP/PWK-style penetration testing: enumeration, buffer overflow, privesc, AD attacks, and web attacks.
Analyze malicious software safely — static analysis with strings, PE header inspection, and YARA rules; dynamic analysis with sandbox environments, Process Monitor, and network capture.
Disassemble and decompile binaries with Ghidra to understand program logic, find vulnerabilities, bypass license checks, and solve CTF reverse engineering challenges.
Acquire and analyze RAM dumps to detect active malware, injected code, hidden processes, network connections, encryption keys, and attacker artifacts using Volatility 3.
Go hands-on with the forensic imaging and analysis workflow — write-blocking, hash verification, the NTFS MFT, file carving, and timeline reconstruction in Autopsy.
Analyze captured traffic in Wireshark: display filters, TCP stream reconstruction, beaconing detection, DNS tunneling, and extracting IOCs for detection engineering.
Execute a structured incident response process — from detection through containment, eradication, and recovery — with proper digital forensic evidence collection, disk imaging, and timeline analysis.
Collect, analyze, and operationalize cyber threat intelligence — understanding threat actors, TTPs, and IOCs — and proactively hunt for adversary activity in your environment before alerts fire.
Turn raw telemetry into tested, tuned, ATT&CK-mapped detections — Sigma rules, EDR telemetry, and the log correlation that catches a multi-stage attack.
How purple teaming collapses the red/blue feedback loop, MITRE ATT&CK-scoped exercises, Atomic Red Team, detection gaps, and breach and attack simulation (BAS).
Learn the shared responsibility model, IAM basics, and why misconfiguration — not provider infrastructure — causes most cloud breaches, before attacking AWS and Azure.
Identify and exploit cloud misconfigurations — IAM privilege escalation, S3 public buckets, metadata service SSRF, storage account exposure, and cloud-native detection with CloudTrail and Azure Monitor.
Map the AWS/Azure cloud security concepts onto GCP's resource hierarchy, IAM roles, service account keys, VPC Service Controls, and Cloud Audit Logs.
Attack and defend containerized environments — Docker escape techniques, Kubernetes RBAC misconfigurations, privilege escalation in pods, secrets management, and runtime security with Falco.
Go beyond container basics: RBAC misconfiguration, admission control, NetworkPolicy, container-escape vectors, and why Kubernetes Secrets aren't encrypted by default.
Go beyond basic stack overflows to ROP chain construction, format string exploitation, heap spraying, and bypassing modern mitigations: ASLR, NX/DEP, stack canaries, and PIE.
Chain Kerberoasting, DCSync, and Golden Ticket into one escalation path, and learn exactly where in that chain defenders get the cheapest, highest-leverage stop.
The blue-team mirror of the AD attack chain: tiering, LAPS, gMSA, honeytokens, and the specific detection signals for Kerberoasting, DCSync, and Golden Ticket attacks.
Master applied cryptography: symmetric and asymmetric algorithms, TLS handshake internals, PKI and certificate management, and common crypto implementation attacks like padding oracle and BEAST.
Integrate security into every phase of software development — threat modeling with STRIDE, SAST/DAST automation, dependency scanning, secrets management, and DevSecOps pipeline security.
Design and implement Zero Trust security: identity-centric access, microsegmentation, device health verification, continuous authentication, and the BeyondCorp model for workforce access.
Understand why organizations formalize security through an Information Security Management System, and the core vocabulary — assets, threats, vulnerabilities, and risk — that ISO/IEC 27001 is built on.
Understand how ISO/IEC 27001 fits into a wider family of related standards, and how the standard itself is organized — mandatory management clauses versus the Annex A control reference.
Learn what clauses 4 and 5 actually require: defining the ISMS scope, identifying interested parties, and the specific, auditable things top management must demonstrably do.
Learn the concrete steps of ISO/IEC 27001's risk assessment and treatment process — from setting criteria through to the four treatment options and information security objectives.
Learn what clause 7 requires for resources, competence, awareness, communication, and documented information — and how clause 8 turns risk treatment plans into day-to-day operational reality.
Learn what clause 9 requires for monitoring, internal audit, and management review, and how clause 10 turns findings into corrective action that closes the PDCA loop back to clause 6.
Survey the 37 Organizational controls by cluster — policies, asset management, access control, supplier relationships, incident management, and compliance — rather than memorizing each in isolation.
Cover all 8 People controls, from pre-hire screening through post-termination responsibilities, and learn when it's legitimate to mark a control 'not applicable' in a small organization's SoA.
Cover all 14 Physical controls, and learn how the shared responsibility model with cloud providers changes — but doesn't eliminate — an organization's physical control obligations.
Survey the largest Annex A theme — 34 controls covering access, operations, data protection, networks, and secure development — grouped into 7 practical clusters.
Learn how to actually build a Statement of Applicability that an auditor would accept — the single document where risk assessment, Annex A, and evidence all have to agree with each other.
Learn the real mechanics of getting certified — the Stage 1/Stage 2 audit split, how findings are classified, the surveillance and recertification cycle, and who accredits the certification bodies themselves.
Walk through a realistic gap analysis on a fictional cybersecurity training platform, applying everything from clauses 4-10, all 93 Annex A controls, and the SoA in a single connected narrative.
Learn why an ISMS implementation must be run as a real project with executive sponsorship and a RACI matrix — not a side task handed to IT — and map out a realistic implementation timeline.
Learn the three-tier policy hierarchy, what makes a policy actually implementable rather than aspirational, and how to avoid the classic mistake of copy-pasting a template no one follows.
Go beyond Foundation's simple risk matrix — build a real, living risk register, understand risk appetite vs. tolerance, and learn when quantitative risk analysis is worth the extra effort.
Build a real asset inventory and classification scheme, and design a working identity lifecycle (joiner-mover-leaver) with role-based access and a real access review cadence.
Build a real key management lifecycle and cryptography standard, and implement physical security appropriately whether your organization has an office, is fully remote, or somewhere in between.
Build a real change management process, an actually-monitored logging pipeline, a segmented network design, and a backup strategy that includes tested restores — not just scheduled dumps.
Integrate security into every SDLC phase rather than bolting it on at the end, choose testing types appropriately across the pipeline, manage third-party dependencies, and stay accountable for outsourced code.
Build a tiered supplier risk program — due diligence proportional to risk, contractual security clauses that mean something, ongoing monitoring, and a secure offboarding process.
Build a real incident response plan with named roles, scenario-specific playbooks, and a tabletop exercise program — because an untested incident plan is exactly as risky as an untested backup.
Run a real Business Impact Analysis to set RTO/RPO targets, build BCP and DRP as distinct but connected plans, and choose the right level of test rigor for each.
Design an internal audit program that achieves real independence even in a small organization, follow a repeatable audit methodology, write findings as objective evidence rather than impressions, and track them to closure.
Run a management review that produces real decisions instead of a rubber stamp, build an ISMS metrics dashboard, and funnel findings from every source into one continual improvement register.
Learn the seven auditing principles behind every credible management system audit, why they exist, and how violating any one of them can invalidate an otherwise technically correct audit finding.
Learn how an audit program manager plans a multi-year cycle of audits, allocates competent auditors to each one, and monitors the program itself for effectiveness — the layer of management above any single audit.
Learn the three defining parameters of any single audit — objectives, scope, and criteria — and why confusing 'criteria' with 'the standard' produces an audit no one can actually be held to.
Learn how to review an organization's documented information before ever setting foot on-site, and how to turn objectives/scope/criteria into a concrete, working audit plan and checklist.
Learn what a real opening meeting needs to establish before any evidence-gathering begins, and how to keep on-site activities aligned to the audit plan as the day unfolds.
Learn the core techniques for actually gathering audit evidence — asking effective interview questions, sampling records credibly, and triangulating between what people say, what documents show, and what direct observation reveals.
Learn how to move from collected evidence to a defensible audit finding — separating a fact from an inference, checking evidence against criteria rather than personal opinion, and recognizing when evidence is too thin to support a conclusion either way.
Learn how certification audits classify findings into major nonconformity, minor nonconformity, and observation — and why this classification, not just the finding itself, is what actually determines the consequences for certification.
Learn what a defensible audit report actually contains, why every finding must be traceable back to its evidence, and how to write a report that survives scrutiny from someone who wasn't in the room.
Learn how to present findings at the closing meeting without ambush, handle a disputed finding professionally, and verify that corrective actions actually close a nonconformity rather than just paper over it.
Learn what specific competencies an auditor actually needs beyond knowing the standard, how auditors themselves are evaluated and maintained, and how to reason through ethical situations that don't have a clean rule to fall back on.
Learn how certification bodies themselves are held accountable — accreditation, impartiality safeguards, audit duration and multi-site sampling rules, and what happens when a certificate is suspended or withdrawn.
The vocabulary every other CISSP domain assumes you already have: confidentiality/integrity/availability precisely defined, the policy-standard-procedure-guideline hierarchy, due care vs due diligence, and the manager-vs-technician reflex the whole exam is built around.
How CISSP actually measures risk in dollars: single loss expectancy, annualized rate of occurrence, annualized loss expectancy — and why the manager answer sometimes rejects a safeguard that would work perfectly.
The vocabulary behind 'no read up, no write down' and its mirror image: Bell-LaPadula for confidentiality, Biba for integrity, and Clark-Wilson's process-based alternative — enough to answer D1/D5 policy questions before the full D3 architecture treatment.
DAC/MAC/RBAC/ABAC as the practical mechanisms behind D1's theoretical models, plus SAML and OAuth/OIDC federation vocabulary — the domain where Keycloak-style IAM experience converts fastest into CISSP terminology.
The joiner-mover-leaver lifecycle those access-control mechanisms actually run inside — why de-provisioning, not provisioning, is where real breaches happen, plus the authentication-factor vocabulary CISSP tests precisely.
The OSI model read as a security map, why segmentation exists beyond performance, the secure-protocol replacements for every legacy insecure one, and ARP poisoning as the canonical layer-2 attack — the domain where Nginx/Cloudflare experience maps almost directly onto CBK vocabulary.
The formal NIST incident-response lifecycle behind the DDoS/intrusion response you already do by instinct, containment vs eradication vs recovery, and the RTO/RPO/MTD vocabulary that decides which disaster-recovery site strategy is actually justified.
Who classifies data and who protects it are different people with different jobs — data owner vs custodian vs steward, the full data lifecycle, and the NIST Clear/Purge/Destroy framework for choosing the right media sanitization method.
Black/gray/white-box testing as a knowledge spectrum, why a vulnerability assessment, a penetration test, and an audit are three different deliverables, and SAST vs DAST as complementary rather than competing tools — the domain closest to pentest/audit coordination work.
The first real cold-start gap: why symmetric and asymmetric encryption solve different problems and are usually combined, why hashing isn't 'weak encryption' but a different tool entirely, and how the PKI trust chain lets you trust a stranger's public key.
The second and final cold-start gap: why 'shift-left' isn't a slogan but a cost argument, why parameterized queries structurally eliminate injection rather than just filtering it, and aggregation/inference as the two ways a database can leak more than any single query should — closing the loop back to Lesson 1's opening SQL injection example.
The exam's legal vocabulary is GDPR/US-anchored, not DGSSI/Loi 09-08 — this lesson gives the specific framework the exam actually tests: GDPR breach notification, contract/liability basics, and the four IP protection types, each precisely distinguished from the others.
What a Trusted Computing Base actually is and why it must stay minimal, the security-mode vocabulary for systems handling mixed classification levels, Common Criteria evaluation assurance levels as a trust signal, and the physical-security layering that protects everything else in this domain.
How cryptography actually fails in practice — brute force, known-plaintext, and birthday-style collision attacks — plus the key management lifecycle CISSP treats as more operationally important than algorithm choice: generation, distribution, storage, rotation, and destruction.
Three more code/data confusion vulnerability classes precisely distinguished from each other and from injection, plus CMMI and SAMM as two different lenses for measuring how mature a secure development process actually is — beyond any single vulnerability finding.
Where RTO and RPO actually come from — the Business Impact Analysis process that produces them — and why an untested continuity plan is, for CISSP purposes, functionally indistinguishable from no plan at all, through the five levels of plan testing.
The firewall generations from packet-filtering to next-gen, IPsec's two modes and why one leaks routing metadata the other doesn't, and the WPA2-to-WPA3 handshake fix that closed the KRACK-class vulnerability — the second network lesson, past OSI and segmentation.
Privacy by design as an architectural stance, not a policy afterthought; why 'keep everything forever, just in case' is a liability rather than a safety net; and why a vendor's security posture is the client organization's risk regardless of whose staff caused the breach.
Why a good security metric must be actionable, not just measurable; log review as a distinct discipline from log collection; and continuous monitoring as the structural answer to the gap point-in-time testing always leaves open.