Ethical Hacking

Master the ethical hacking engagement lifecycle and passive reconnaissance — OSINT, Google dorking, Shodan, theHarvester, and intelligence gathering without touching the target.

Go beyond intro-depth OSINT: certificate transparency logs, Amass, Maltego's transform model, Recon-ng, and metadata extraction as passive attack-surface mapping.

Actively probe targets with Nmap, Nessus, and enumeration tools to discover open ports, services, OS fingerprints, and vulnerabilities — building a complete attack surface map.

Master the Metasploit Framework for vulnerability exploitation — searching, selecting, configuring, and launching exploits, generating payloads with msfvenom, and managing sessions.

Escalate from a low-privilege shell to root on Linux using SUID binaries, sudo misconfigurations, cron jobs, weak file permissions, capabilities, and kernel exploits.

Escalate privileges on Windows systems using service misconfigurations, unquoted service paths, DLL hijacking, token impersonation, and AlwaysInstallElevated — from low-privilege user to SYSTEM.

Master offline password cracking with hashcat and John the Ripper, online brute force with Hydra, credential stuffing, and Windows-specific attacks like pass-the-hash and pass-the-ticket.

Understand and simulate social engineering attacks — spear phishing, pretexting, vishing, and physical attacks — to evaluate human security controls and train employee awareness.

Execute network-level attacks — ARP poisoning, MITM traffic interception with Wireshark, Responder for credential capture, and network protocol exploitation.

Learn the AD hierarchy, GPOs, LDAP, and the Kerberos/NTLM authentication protocols that the next lesson's attacks (Kerberoasting, DCSync, Golden Ticket) all build on.

Attack Windows Active Directory environments using BloodHound enumeration, Kerberoasting, AS-REP roasting, DCSync, Pass-the-Ticket, and Golden Ticket attacks.

Attack Wi-Fi networks — capture and crack WPA2 handshakes, perform evil twin attacks, exploit WPS, and probe for insecure enterprise authentication.

Understand and exploit classic stack-based buffer overflows — memory layout, EIP control, bad characters, shellcode generation, and exploit development with GDB and pwndbg.

Chain every step from Buffer Overflow Fundamentals into one working exploit: fuzzing, offset discovery, bad characters, a JMP ESP redirect, and final shellcode delivery.

Move through segmented networks using port forwarding, dynamic SOCKS proxies, chisel tunnels, and ProxyChains — reaching hosts that aren't directly accessible from the attacker machine.

Write professional penetration testing reports — executive summaries, technical findings, CVSS scoring, remediation recommendations, and evidence documentation that deliver real value to clients.

Understand advanced red team operations — simulating sophisticated adversaries with C2 frameworks, OPSEC techniques, detection evasion, and adversary simulation using MITRE ATT&CK.

A 30-question practice set covering the practical syllabus areas of INE's eJPT (eLearnSecurity Junior Penetration Tester) certification.

A 30-question practice set covering the practical methodology areas of OSCP/PWK-style penetration testing: enumeration, buffer overflow, privesc, AD attacks, and web attacks.