academy / courses / ethical-hacking
Ethical Hacking Mastery
From “what is a packet?” to full professional engagements — hands-on, with a real demo at every single step.
The complete path to professional ethical hacking, taught the only way that works: by doing. You build your own legal hacking lab (DVWA, OWASP Juice Shop, WebGoat), then work through reconnaissance, web exploitation, network attacks, privilege escalation and report writing. Every lesson shows real commands and real screenshots captured against deliberately vulnerable targets — nothing is faked, everything is reproducible on your own machine. No prerequisites: if you can open a terminal, you can finish this course.
Syllabus
Foundations
The absolute basics: what hacking legally is, how the internet actually works, HTTP, building your own lab, Linux, and the professional methodology. No experience needed.
- 01What Ethical Hacking Actually Is (and the Law)What "hacking" really means, who ethical hackers are, the one law that matters, and the Lab Rules that keep you safe and legal.
- 02How the Internet Works — the 15-Minute Mental ModelPackets, IP addresses, DNS and TCP — exactly as much networking as a hacker needs, explained with pictures in your head.
- 03HTTP Deep Dive — the Language of the WebEvery web attack is a conversation in HTTP. Learn to read requests, responses, headers, cookies and sessions — with real captures from our own lab.
- 04setup-your-lab
- 05Linux & the Terminal for HackersWhy Linux is the hacker's operating system, and the ten shell commands that cover 90% of every engagement — shown against a real Linux server.
- 06The Hacker Methodology — How Pros Plan an AttackThe repeatable 6-phase methodology (based on PTES) that separates professionals from script kiddies — the skeleton this whole course hangs on.
- 07your-toolkit
Reconnaissance
Information gathering — the phase where real hackers spend most of their time. OSINT, subdomain hunting, Nmap scanning, fingerprinting and fuzzing, then turning it all into an attack plan.
- 01Passive Recon — OSINT & Google DorkingEverything you can learn about a target without touching it — search engines, DNS records, certificate logs, metadata — and how to organize it.
- 02asset-discovery
- 03nmap-from-scratch
- 04Web Fingerprinting — Identify the StackRead a website's identity from its HTTP responses — server, framework, language, headers — and know which vulnerabilities to test next.
- 05Directory & Parameter FuzzingFind hidden files, directories and parameters the app never links to — with a real brute-force against DVWA and the tools that automate it (gobuster, ffuf).
- 06Turning Recon into an Attack PlanCombine OSINT, asset maps, port scans and fuzzing into one prioritized attack plan — the deliverable that makes recon worth doing.
Web Attacks I — Injection & XSS
The classic web vulnerabilities that still break the internet: SQL injection, cross-site scripting, CSRF, broken authentication and IDOR. Every technique demonstrated live against DVWA, Juice Shop and real online test sites.
- 01SQL Injection — the TheoryWhat SQL injection is, why it exists, and how a single quote turns a search box into a database dump — demonstrated live on DVWA.
- 02SQLi in Practice — the UNION Attack That Dumps TablesGo from "the app is injectable" to "I have every username and password hash" — the full UNION attack on DVWA, step by step, with real screenshots.
- 03Blind SQLi & sqlmap — When the App Hides Its ErrorsThe app shows nothing — no errors, no data. Extract a database one true/false question at a time, by hand, then let sqlmap do it in seconds.
- 04Cross-Site Scripting (XSS) — Reflected, Stored, DOMMake a website run your JavaScript in every visitor's browser — steal sessions, deface pages, and understand why XSS is the most common web bug of all.
- 05CSRF — Riding the Victim's SessionChange a password, transfer money, or delete an account — using the victim's own logged-in browser, without ever reading a response. Real demo on DVWA.
- 06Auth Attacks & IDOR — Juice Shop and a Real BankHack a modern REST API's login with SQLi, become admin via a forged token, and see reflected XSS on a real banking demo — auth broken in every way it can be.
Web Attacks II — Server-Side Exploitation
Command injection, file uploads and web shells, SSRF, XXE, template injection, deserialization — and hacking APIs (REST, JWT, GraphQL) the way modern bug bounty hunters do.
- 01Command Injection — Running Your Commands on the ServerWhen a web app hands your input to the operating system's shell, you get a remote shell of your own. Full real demo on DVWA — from ping to reading /etc/passwd.
- 02file-upload-webshells
- 03SSRF — Making the Server Fetch for YouThe server sits on the internal network — so trick features that fetch URLs into reaching internal services. Full live demo against our own internal admin panel.
- 04xxe
- 05SSTI — Server-Side Template InjectionWhen user input lands inside a template engine, template syntax becomes code. From {{7*7}} to remote code execution — the Jinja2 chain, live.
- 06Insecure DeserializationApps that accept serialized objects let attackers smuggle in code. Watch a crafted Python pickle execute a command on the server — then learn the defenses.
- 07api-hacking
Network Attacks
Inside the network: ARP spoofing and man-in-the-middle attacks, password spraying with Hydra, cracking password hashes, Wi-Fi attacks and traffic analysis with Wireshark.
- 01Networking Refresher — ARP, Switches and the LANWhat actually happens on the wire inside a local network — addresses, ARP, routing — with the real facts from our lab network.
- 02arp-spoofing-mitm
- 03password-attacks
- 04hash-cracking
- 05Wi-Fi Attacks — WPA2 and the Evil TwinCapture WPA2 handshakes, crack them offline, and understand evil twins and WPA3's fixes — with the complete lab plan for your own adapter.
- 06Sniffing with Wireshark — Reading the WireCapture traffic and find credentials in plaintext protocols — DNS queries you can hear from neighbors, and HTTP logins once you're in the path.
Exploitation & Post-Exploitation
From a foothold to full control: reverse shells, Metasploit, exploit development fundamentals, Linux and Windows privilege escalation, and moving laterally through a network.
- 01reverse-shells
- 02metasploit
- 03Exploit Development 101 — Fuzzing & Buffer OverflowsWhen there's no ready-made exploit, you write one. Fuzz the target, find the crash, control the return address — live on our lab binary.
- 04Linux Privilege EscalationYou're a normal user. You want root. The systematic checklist and two real escalations — sudo vim and a SUID binary — end to end on our lab box.
- 05Windows Privilege Escalation & Active Directory BasicsThe corporate world runs Windows + Active Directory. Learn the Windows privesc checklist and the AD attacks that dominate real engagements.
- 06Pivoting & Lateral MovementOne foothold is never the goal. Tunnel through it to reach the internal network — live demo with ssh -L — and respect the scope boundary.
Modern Targets
Cloud misconfigurations (S3, IAM), containers and Kubernetes, CI/CD and supply-chain attacks, mobile apps, IoT firmware, and the human element: social engineering and phishing.
- 01Cloud Attacks — S3, IAM & MisconfigurationThe cloud is someone else's computer with its own misconfigurations. Watch a "private" S3 bucket hand over customer data with zero credentials.
- 02Containers & KubernetesContainers aren't a security boundary. Watch a mounted docker socket become full host compromise — then map the Kubernetes parallels.
- 03CI/CD & Supply Chain AttacksThe build pipeline is the crown jewel. Watch leaked secrets live forever in git, and understand dependency confusion and typosquatting.
- 04mobile-hacking
- 05IoT & Firmware AnalysisThe smart toaster is a computer with no patching pipeline. Scan a real router firmware, extract its filesystem, and find the default-credential root.
- 06Social Engineering & PhishingThe human firewall fails more than any software. Pretexting, phishing and the strict ethical rules of authorized social testing.
Think Like a Defender
To be the best attacker, understand the defense: logs and detection, SIEMs, WAFs and how to bypass them, patching, hardening and incident response — so your reports actually get fixed.
- 01Logs, SIEM & DetectionEvery attack you've learned leaves traces — and this course's own attacks are sitting in our lab's logs. Learn to read them like a defender.
- 02WAFs & How to Bypass ThemThe firewall that blocks your payloads is a ruleset, not a wall. Watch a real signature WAF drop one payload and let the real attack sail through.
- 03Hardening, Patching & Incident ResponseClose the doors you learned to open — watch a real before/after hardening, then run the incident-response playbook.
Capstone — Full Engagement
Tie everything together in a complete, professional penetration test: scoping, recon, exploitation, privilege escalation and a real penetration test report — the document that gets you hired.
- 01The Engagement — Scope & Rules of EngagementEvery professional test starts with a contract. Scope, rules of engagement and authorization — the paperwork that separates you from a criminal.
- 02Capstone — Reconnaissance PhaseThe full recon phase of our capstone engagement — real scan of the target, real findings, a real attack plan.
- 03capstone-exploit
- 04Capstone — Post-Exploitation & Privilege EscalationTurn the foothold into full control — the NOPASSWD misconfiguration takes us from low-priv to root, and the flag proves impact.
- 05the-report
- 06next-steps