A complete knowledge path for penetration-testing work and OSCP preparation. Lessons explain mechanisms, decisions, remediation, and detection through safe written scenarios; every module ends with a knowledge check and no lab downloads.
A welcoming start with no assumed knowledge: meet the role, launch Kali Linux in a safe virtual machine, become comfortable with the desktop and terminal, and then learn how risk, controls, and legal boundaries connect. The module ends with a knowledge check, with no downloads or required exercises.
Turn an ambiguous brief into a safe engagement: understand scope, RoE, communication, minimum proof, cleanup, and retesting, then decide whether a realistic assessment is ready to begin. The module ends with a knowledge check, with no downloads or required exercises.
Understand a current 2026 workstation, Linux, Bash, Windows, PowerShell, and the packet path through routing, TCP/DNS, HTTP, and SMB The module ends with a knowledge check, with no downloads or required exercises.
Turn an uncertain observation into a decision: keep replayable notes, protect evidence integrity, design a minimum-impact PoC, separate CVSS from risk, and write for both engineers and executives. The module ends with a knowledge check, with no downloads or required exercises.
Build an external organisation map without mistaking a clue for a target: use current RDAP, DNS, Certificate Transparency, search, archives, code, metadata, supplier relationships, banners, and confidence to create a safe handoff to active testing. The module ends with a knowledge check, with no downloads or required exercises.
Use Nmap as a measurement instrument: move from scope and host discovery through TCP states, complete coverage, UDP, service and OS detection, deliberate NSE, timing, XML, and troubleshooting. The module ends with a knowledge check, with no downloads or required exercises.
Learn to converse with a service instead of guessing from its port number: move from DNS, SMB, SMTP, FTP, NFS, and SNMP through RDP, WinRM, LDAP, and databases. Every workshop combines safe Kali commands with output interpretation, authorisation boundaries, and defender telemetry. The module ends with a knowledge check, with no downloads or required exercises.
Build a defensible map of a web application without jumping straight to exploits: move from the engagement contract and HTTP/TLS model through curl, DevTools, fingerprinting, metafiles, controlled content and virtual-host discovery, Burp Community, JavaScript, APIs, and authenticated perspectives. The module ends with a knowledge check, with no downloads or required exercises.
Turn noisy scanner output into a defensible decision: distinguish a signal from a finding, connect CVE, CWE, CVSS 4.0, EPSS, and KEV, design safe and authenticated scans, work through Nessus, Greenbone, Nmap NSE, and Nuclei, validate results by hand, and build a hypothesis matrix. The module ends with a knowledge check, with no downloads or required exercises.
Learn to move tools and evidence like a responsible operator: choose direction and protocol, use curl, wget, SCP/SFTP, smbclient, and Windows-native methods, verify SHA-256 integrity, handle encoding, proxies, and interrupted transfers, then clean up safely. The module ends with a knowledge check, with no downloads or required exercises.
Understand what really happens between code execution and a useful session: model stdin, stdout, and stderr; choose bind or reverse direction from routes and network policy; work with Ncat and socat on Kali; diagnose missing TTY behaviour; establish Linux and Windows context; and reason about payload architecture and staged versus stageless delivery. The module ends with a knowledge check, with no downloads or required exercises.
Learn to use Metasploit Framework as a controlled workbench instead of an automatic hacking button: prepare it on Kali, distinguish module types, verify exploit sources and prerequisites, use search/info/options/targets/check, manage workspaces and database evidence, select payloads, inspect msfvenom, operate handlers, jobs, sessions, Meterpreter, post modules, and resource scripts. The module ends with a knowledge check, with no downloads or required exercises.
Learn to treat credentials as controlled evidence rather than a password collection: distinguish online guessing from offline cracking; understand hashing, salts and KDF cost; identify formats; build contextual username and password candidates with Username Anarchy; operate Hashcat, rules, masks and John the Ripper; then conduct tightly governed Hydra testing with attempt budgets and lockout awareness. You will also separate spraying, credential stuffing, MFA and secret-handling concerns. The module ends with a knowledge check, with no downloads or required exercises.
Learn to attack common services with professional restraint: separate visibility, authentication, read, write and execution; work with FTP, SMB, NFS, SMTP, databases, SSH, RDP, WinRM, Redis and rsync using Kali tools; reason about PtH/relay prerequisites and review public exploits without magical shortcuts. The module ends with a knowledge check, with no downloads or required exercises.
Learn to build and explain paths through a network: route tables, listener/dialer reasoning, socat, SSH -L/-D/-R, ProxyChains, ProxyJump, sshuttle, Windows portproxy, Chisel and current Ligolo-ng 0.8 with TUN routes and listeners. Understand TCP, DNS and raw-socket limits, telemetry and cleanup. The module ends with a knowledge check, with no downloads or required exercises.
Understand Active Directory as a graph of identity and trust: move from DNS, RootDSE, LDAP, SMB, and Kerberos through controlled username validation, manual enumeration, BloodHound CE and its collectors, then into roasting, relay prerequisites, ACLs, delegation, AD CS, and lateral-movement boundaries. Kali tools answer defined questions instead of becoming a command catalogue. The module ends with a knowledge check, with no downloads or required exercises.
Learn to sit between a browser and application without creating chaos: start with HTTP anatomy and the TLS model, then operate Burp Community on Kali, its built-in browser, CA, scope, history, Intercept, Repeater, and separated sessions. Continue through Decoder, Comparer, Sequencer, HTTP/2, WebSocket, and a current ZAP workflow. The module ends with a knowledge check, with no downloads or required exercises.
Learn to build an application surface rather than a URL pile: move from scope, baselines, soft 404s, metafiles, and JavaScript through Burp/Katana crawling, contextual wordlists, ffuf 2.2.1, feroxbuster, Gobuster, recursion, and vhosts into parameter and API inventory. The module ends with a knowledge check, with no downloads or required exercises.
Treat authentication as a complete system: map web/API/mobile/SSO channels and states, TLS, forms, cookies, enumeration, lockout, rate limiting, Burp Intruder, and Hydra 9.7; then validate sessions, recovery, MFA, passkeys, federation, and telemetry. The module ends with a knowledge check, with no downloads or required exercises.
Learn to see SQL injection as a broken data-syntax boundary: from relational basics and HTTP-to-query input mapping through Burp Repeater baselines, string and numeric contexts, boolean logic, errors and fingerprinting, to manual UNION and blind channels. The module ends with a knowledge check, with no downloads or required exercises.
Understand SQLMap as an engine for automating a defined hypothesis rather than a button for bulk data extraction: move from authorisation and request anatomy through level, risk, technique, response comparison, sessions, and traffic limits into result interpretation, false conclusions, remediation, detection, and retesting. The module ends only with a knowledge check; there is nothing to download or run.
