A route from foundations to advanced, without the noise.

You will be able to

• Read a packet capture and explain what each layer is doing
• Navigate Linux and Windows confidently from the command line
• Explain how authentication, authorisation and sessions actually work
• Set up an isolated lab you can safely break things in

Modules

1. Networking that matters

   TCP/IP, routing, NAT, DNS and TLS — enough to reason about what a service is doing before you touch it.

2. Operating system internals

   Processes, permissions, filesystems and the privilege model on both Linux and Windows.

3. Command line fluency

   Bash and PowerShell to the point where you write a one-liner instead of looking for a tool.

4. Scripting for automation

   Python for parsing output, driving APIs and turning a repetitive task into a script.

5. Lab construction

   Build the isolated environment described in the Practice Lab blueprint before running anything offensive.

You will be able to

• Test an application methodically instead of scanning it
• Find and chain access control flaws across tenants and roles
• Recognise business logic abuse that no scanner will ever report
• Write a finding an engineer can reproduce without asking you a question

Modules

1. HTTP and the browser security model

   Same-origin policy, cookies, CORS and CSP — the rules everything else bends around.

2. Access control

   IDOR, horizontal and vertical escalation, and multi-tenant isolation. Start every assessment here.

3. Injection

   SQL, NoSQL, command, template and deserialization, including blind and out-of-band detection.

4. Server-side request forgery

   Reaching internal services and cloud metadata endpoints, plus the filter bypasses that keep working.

5. Business logic

   Race conditions, workflow state manipulation, quota and pricing abuse. Requires understanding the product, not just the protocol.

6. Client-side

   DOM XSS, prototype pollution and postMessage handling in single-page applications.

You will be able to

• Enumerate a domain and identify escalation paths from a low-privileged account
• Explain and demonstrate Kerberos abuse in your own words
• Move laterally while understanding what each technique leaves behind in logs
• Write a hardening plan ranked by effort against risk reduction

Modules

1. Domain enumeration

   Users, groups, computers, ACLs and trusts — collected and graphed rather than listed.

2. Kerberos

   Kerberoasting, AS-REP roasting, and constrained, unconstrained and resource-based delegation abuse.

3. Credential access

   LSASS, DPAPI, cached credentials and what modern EDR actually detects when you touch them.

4. Lateral movement

   WMI, WinRM, SMB and scheduled tasks, with the telemetry each one generates.

5. ADCS

   Certificate template misconfigurations — one of the most reliable escalation paths in modern estates.

6. Detection engineering

   Write the Sigma rule that would have caught you. This is what separates a report from an improvement.

You will be able to

• Read an IAM policy and predict what it actually permits
• Map privilege escalation paths within an account
• Identify the blast radius of one compromised workload
• Recommend detections that would have caught the path you used

Modules

1. Identity and access management

   Roles, trust policies, assume-role chains and the escalation paths hidden in permission combinations.

2. Workload identity

   Instance metadata, service accounts and pod identity — how SSRF becomes cloud credential theft.

3. Storage and data exposure

   Buckets, snapshots, registries and managed databases, including the accidental-public patterns.

4. CI/CD and supply chain

   Pipeline secrets, over-permissioned deploy roles and the OIDC trust misconfigurations that undo them.

5. Cloud detection

   CloudTrail, Azure activity logs and GCP audit logs: what they capture and what they quietly miss.

You will be able to

• Navigate a stripped binary in a disassembler without losing orientation
• Recover program logic from compiled code
• Instrument a running process to observe and change behaviour
• Triage a suspicious sample safely in an isolated environment

Modules

1. Assembly and calling conventions

   x86-64 and ARM64 to the level where decompiler output is a hint you can verify, not gospel.

2. Static analysis

   Ghidra and IDA workflow: identifying structures, renaming as you go, and recovering control flow.

3. Dynamic analysis

   Debuggers, breakpoints and runtime instrumentation with Frida.

4. Anti-analysis

   Packing, obfuscation and anti-debug techniques, and the practical ways around them.

5. Malware triage

   Safe handling, indicator extraction and behavioural reporting in an isolated network.