The Hacker Methodology — How Pros Plan an Attack | Pencheff Academy

Pencheff Academy

Ethical Hacking pencheff.com ↗

Ethical Hacking Mastery

00Foundations 01What Ethical Hacking Actually Is (and the Law)02How the Internet Works — the 15-Minute Mental Model 03HTTP Deep Dive — the Language of the Web 04setup-your-lab 05Linux & the Terminal for Hackers 06The Hacker Methodology — How Pros Plan an Attack 07your-toolkit

01Reconnaissance 01Passive Recon — OSINT & Google Dorking 02asset-discovery 03nmap-from-scratch 04Web Fingerprinting — Identify the Stack 05Directory & Parameter Fuzzing 06Turning Recon into an Attack Plan

02Web Attacks I — Injection & XSS 01SQL Injection — the Theory 02SQLi in Practice — the UNION Attack That Dumps Tables 03Blind SQLi & sqlmap — When the App Hides Its Errors 04Cross-Site Scripting (XSS) — Reflected, Stored, DOM 05CSRF — Riding the Victim's Session 06Auth Attacks & IDOR — Juice Shop and a Real Bank

03Web Attacks II — Server-Side Exploitation 01Command Injection — Running Your Commands on the Server 02file-upload-webshells 03SSRF — Making the Server Fetch for You 04xxe 05SSTI — Server-Side Template Injection 06Insecure Deserialization 07api-hacking

04Network Attacks 01Networking Refresher — ARP, Switches and the LAN 02arp-spoofing-mitm 03password-attacks 04hash-cracking 05Wi-Fi Attacks — WPA2 and the Evil Twin 06Sniffing with Wireshark — Reading the Wire

05Exploitation & Post-Exploitation 01reverse-shells 02metasploit 03Exploit Development 101 — Fuzzing & Buffer Overflows 04Linux Privilege Escalation 05Windows Privilege Escalation & Active Directory Basics 06Pivoting & Lateral Movement

06Modern Targets 01Cloud Attacks — S3, IAM & Misconfiguration 02Containers & Kubernetes 03CI/CD & Supply Chain Attacks 04mobile-hacking 05IoT & Firmware Analysis 06Social Engineering & Phishing

07Think Like a Defender 01Logs, SIEM & Detection 02WAFs & How to Bypass Them 03Hardening, Patching & Incident Response

08Capstone — Full Engagement 01The Engagement — Scope & Rules of Engagement 02Capstone — Reconnaissance Phase 03capstone-exploit 04Capstone — Post-Exploitation & Privilege Escalation 05the-report 06next-steps

Links

← Course syllabus

© 2026 Pencheff Academy · Free courses, real demos · pencheff.com

All hacking demos are performed exclusively against deliberately vulnerable targets you own or have written permission to test. Never attack systems you do not own.