Ethical Hacking
Zero to Hero

Introduction to Ethical Hacking

The CIA triad (confidentiality, integrity, availability); difference between threat, vulnerability, risk, and exploit; hacker types (white / black / grey hat) and real threat actors including APTs; the five phases of hacking and the cyber kill chain; scope, written authorization, and the laws that separate ethical hacking from crime.

How Networks Really Work

The OSI & TCP/IP models and data encapsulation; IP addressing and subnetting basics, MAC vs IP; core protocols (HTTP/S, DNS, DHCP, ARP, ICMP); ports and services; the TCP three-way handshake — the foundation everything else builds on.

Linux Command Line + Traffic Analysis

Linux filesystem, users & permissions, and essential bash; networking commands (ip, ss, netstat, dig); capturing and reading live packets in Wireshark — apply filters, follow a TCP stream, and watch a handshake happen in real time.

Security Controls & Ethics

Defense-in-depth and control types (preventive / detective / corrective); responsible disclosure and bug-bounty ethics; first mini-CTF: analyze a provided packet capture to recover a hidden flag.

Reconnaissance Fundamentals

Passive vs active recon and why the distinction matters legally; footprinting methodology; mapping the attack surface across three angles — network, organization, and people; what information leakage looks like in the real world.

The OSINT Toolkit

WHOIS and DNS enumeration; subdomain discovery (Amass, subfinder); Shodan & Censys for exposed devices; advanced Google dorking; email/username harvesting with theHarvester; relationship mapping in Maltego; social-media and metadata OSINT.

Build a Full Target Profile

Compile a complete passive profile of an authorized target — domains, hosts, emails, tech stack, and leaked data; then use an LLM assistant to correlate and summarize scattered findings into a briefing at speed.

Anti-Recon & Reporting

Reducing your organization's digital footprint and OSINT hygiene; graded task: deliver a footprinting report on a sandbox company.

Network Scanning Theory

Host discovery techniques; scan types (SYN, Connect, UDP) and how TCP flags drive them; service/version and OS fingerprinting; how firewalls and IDS see your scans.

Nmap Mastery & Service Enumeration

Nmap flags, timing templates, output formats, and the NSE scripting engine; enumerating the services that matter — SMB, SNMP, LDAP, NFS, SMTP, RPC — to pull users, shares, and versions.

Map an Entire Network

Run discovery across the lab range, identify every live host and open service, and build a topology & asset inventory you'll attack in later weeks.

Evasion & Timed Challenge

Scan detection, rate-limiting, and IDS-aware scanning; timed CTF: find a deliberately hidden service and enumerate it for the flag.

Vulnerability Management

The vulnerability lifecycle; reading CVE entries and CVSS scores; using EPSS and the KEV catalog to prioritize what actually gets exploited; true vs false positives.

Vulnerability Scanners

Driving Nessus, OpenVAS, and Nuclei; authenticated vs unauthenticated scans; interpreting scanner output and separating signal from noise.

Assess & Validate Findings

Scan the lab network, triage results, and manually confirm top findings; map vulnerabilities to public exploits with searchsploit / Exploit-DB.

Month 1 Capstone Report

Deliverable: a complete recon → scan → vulnerability-assessment report with risk ratings and prioritized remediation — your first professional artifact.

Exploitation Fundamentals

How exploits and payloads work; bind vs reverse shells, staged vs stageless; the Metasploit framework model (msfconsole, modules, Meterpreter); finding and adapting public exploits safely.

Privilege Escalation & Password Attacks

Windows & Linux privesc vectors — misconfigurations, SUID binaries, weak services, token abuse; password attacks (brute force, dictionary, spraying); hash cracking with John and Hashcat.

Full Kill Chain on a Live Box

Exploit → get a shell → escalate to root/SYSTEM → establish persistence → clear tracks; dump and crack credentials with Mimikatz.

Logging Awareness & Boot-to-Root

How EDR and logging catch attackers, and evasion basics; challenge: a full boot-to-root CTF machine.

Web Architecture & the OWASP Top 10

How HTTP, cookies, sessions, and same-origin policy work; the flaws that dominate real bugs — SQL injection, XSS (stored/reflected/DOM), SSRF, IDOR, CSRF, and broken authentication.

Burp Suite & API Attacks

Burp Suite proxy, Repeater, and Intruder for intercepting and tampering; JWT attacks; abusing REST and GraphQL APIs; mass assignment and broken object-level authorization.

Exploit a Web App + API

Automated injection with sqlmap, working XSS payloads, and an SSRF pivot to an internal service; chain multiple flaws into a full application compromise.

Secure Coding & Web CTF

Input validation, output encoding, security headers, and WAF concepts; web CTF: an SSRF + injection chain to capture the flag.

Malware & Analysis Basics

Malware families — viruses, worms, trojans, RATs, ransomware — plus fileless and APT techniques; the difference between static and dynamic analysis; indicators of compromise (IOCs) and sandboxing.

Sniffing & the Human Attack Surface

ARP/DNS spoofing and man-in-the-middle interception; the psychology of social engineering; phishing, vishing, and pretexting; running a campaign with a phishing framework.

Analyze a Sample & Simulate Phishing

Detonate a malware sample in a sandbox and extract IOCs; build and launch a controlled phishing simulation against consenting lab users with GoPhish.

AI-Era Threats & Awareness

Deepfake video and AI-voice phishing — how they work and how to detect them; designing awareness training and social-engineering countermeasures.

Network Attacks & Evasion

Session hijacking; DoS/DDoS techniques and amplification; how firewalls, IDS/IPS, and honeypots work — and the fundamentals of evading them.

Wireless Security

Wi-Fi standards and the security of WEP / WPA2 / WPA3; handshake and PMKID capture; Evil Twin and rogue access points; deauthentication attacks.

Crack Wi-Fi + Run a MITM

Capture and crack a WPA2 handshake with Aircrack-ng and Hashcat; perform an authorized man-in-the-middle on the lab network and harvest traffic.

Month 2 Capstone

Multi-stage attack: recon → exploit → establish a network foothold → loot — chaining everything from the last four weeks.

Cloud Attack Surface

Cloud service models and the shared-responsibility model; the flaws that cause real breaches — IAM misconfigurations, over-permissive roles, public storage buckets, leaked keys, and metadata-service SSRF.

Containers & Kubernetes

Docker fundamentals, image vulnerabilities, and container escapes; Kubernetes attack surface — exposed API server, RBAC abuse, secrets exposure, and pod breakout.

Break the Cloud

Exploit a deliberately misconfigured cloud account with Pacu / CloudGoat; attack a vulnerable Kubernetes cluster with kube-hunter and escalate.

Cloud Hardening & CTF

Least privilege, CSPM, and image scanning (Trivy); challenge: escalate privileges through a misconfigured IAM policy.

OWASP Top 10 for LLMs

Prompt injection (direct and indirect) and jailbreaks; training-data poisoning; insecure output handling; model theft, excessive agency, and sensitive-information disclosure — the vulnerabilities unique to AI systems.

AI-Assisted Offense

Using LLM copilots for recon, payload generation, exploit drafting, and automated report writing; automating repetitive tasks to work faster; the ethics and limits of AI-assisted hacking.

Break a Vulnerable AI App

Use prompt injection and jailbreaks to bypass a chatbot's guardrails, leak its system prompt, and extract secrets; run an automated LLM red-team pass with Garak, PyRIT, and Promptfoo.

Securing AI Applications

Guardrails, input/output filtering, allow-lists, and monitoring for AI apps; AI red-team CTF.

Active Directory Attacks

AD structure, Kerberos, and NTLM; enumeration and attack-path mapping with BloodHound CE; Kerberoasting, AS-REP roasting, pass-the-hash, lateral movement, DCSync, and AD Certificate Services (ESC) attacks with Certipy — how modern enterprises actually fall.

IoT/OT & Cryptography

IoT, OT, and ICS/SCADA architecture and threats; cryptography, hashing, and PKI/TLS in practice; the quantum risk to today's encryption and post-quantum cryptography readiness.

Own the Domain

Compromise a full lab Active Directory environment — from a single low-privilege user all the way to Domain Admin — using Impacket, Rubeus, and CrackMapExec.

Zero Trust & Detection

Zero Trust architecture, tiered admin, and detection engineering; challenge: an AD attack-path CTF.

Engagement Methodology

Industry methodologies — PTES, OWASP, and MITRE ATT&CK; rules of engagement and scoping; OPSEC and an evasion recap; how to run an assessment safely and professionally.

Professional Reporting

Report structure and the difference between executive and technical sections; assigning risk ratings; writing clear evidence, remediation, and retest guidance; communicating findings to non-technical stakeholders.

Live Capstone Engagement

A full engagement against a modern emulated organization spanning network, web, cloud, and Active Directory — applying the entire five-phase kill chain against a real, live lab environment.

Submit, Defend & Plan Ahead

Submit and defend your final penetration-test report; then a career and certification roadmap session — PenTest+, eJPT, OSCP, and building a portfolio.