Ethical Hacking & Penetration Testing Lessons
85 free lessons, from fundamentals to advanced offensive security — many with hands-on labs you can practice in safely.
Foundations & Mindset
What pentesting is, how to stay legal, and how a pro thinks.
- What Is Penetration Testing?The difference between hacking, pentesting, and bug bounty — and where you fit.
- The Pentest Methodology (Your Repeatable Process)The 5-phase loop every engagement follows, from recon to reporting.
- Ethics, Law & Rules of EngagementScope, authorization, and staying on the right side of the law.
- Building Your Hacking LabKali/Parrot, VMs, and a safe isolated network to practice in.
Core Technical Skills
Networking, Linux, and HTTP — the ground every attack stands on.
Programming & Scripting for Pentesters
Stop being a tool-user. Read, modify, and build your own offensive tools.
- Why Every Pentester Must CodeThe line between a script-kiddie and a top-1% operator is code.
- Python for Pentesters (+ Build a Port Scanner)The offensive Python toolkit — sockets, requests, and your first tool.
- Bash Scripting & AutomationGlue your tools together into fast recon and exploitation pipelines.
- PowerShell for Offensive OperationsThe attacker's language on Windows and Active Directory.
- JavaScript & TypeScript for Web AttacksThe language of the web is the language of web exploitation.
- Go, C# & Rust for Offensive ToolingCompiled languages for fast, portable, evasion-friendly tools.
- Build Your Own Tools (Project Track)A portfolio of tools that proves — and sharpens — your skills.
Reconnaissance & Enumeration
Map the target completely before you touch a single exploit.
Web Application Hacking (Hands-On)
The OWASP heavy-hitters — each with a live lab you exploit yourself.
- The OWASP Top 10 MapYour checklist of the most common, high-impact web vulnerabilities.
- SQL Injection — Concept + Live LabBreak authentication and steal data by injecting SQL. Then do it for real.
- Cross-Site Scripting (XSS) — Concept + Live LabInject JavaScript that runs in a victim's browser. Pop it live in the lab.
- Command Injection — Concept + Live LabTurn a web feature into a shell by injecting OS commands.
- Broken Access Control / IDOR — Concept + Live LabAccess other users' data just by changing an ID. Extremely common.
- Authentication Attacks — Concept + Live LabUsername enumeration and dictionary attacks against weak logins.
- Path Traversal / LFI — Concept + Live LabEscape a folder with ../ to read arbitrary files off the server.
- Server-Side Request Forgery (SSRF) — Concept + Live LabMake the server make requests for you — into its own internal network.
- NoSQL Injection — Concept + Live LabBypass MongoDB-style logins by injecting query operators.
- JWT Attacks — Concept + Live LabForge JSON Web Tokens via alg:none and weak signing secrets.
- XXE Injection — Concept + Live LabAbuse XML external entities to read server files.
- Cross-Site Request Forgery (CSRF)Force a logged-in victim's browser to perform actions they didn't intend.
- Insecure File Upload → RCETurn a file upload into remote code execution with a web shell.
- Server-Side Template Injection (SSTI)Inject template syntax that the server evaluates — often leading to RCE.
Advanced Web, API & Modern Stack
Beyond OWASP Top 10 — API, business logic, and JS/Node/React attacks.
- Business Logic Vulnerabilities — Concept + Live LabBugs scanners can't find: price tampering, coupon abuse, OTP & workflow flaws.
- API Pentesting MethodologyREST, GraphQL, SOAP & gRPC — and the BOLA/BFLA bugs that dominate APIs.
- Mass Assignment — Concept + Live LabSet fields the form never showed — like role:admin — to escalate.
- Prototype Pollution (Node.js) — Concept + Live LabPoison Object.prototype so every object inherits attacker-controlled props.
- Parameter Pollution & Rate-Limit BypassDuplicate params, type juggling, and tricks to slip past limits.
- Node.js & Express SecurityServer-side JS bugs: injection, SSRF, path traversal, and supply chain.
- NestJS Security Deep DiveGuards, DTO validation, and the auth pitfalls specific to NestJS.
- React & Next.js AttacksXSS via dangerouslySetInnerHTML, SSRF in API routes, and SSR pitfalls.
Network & System Exploitation
From a foothold to full control — exploitation and privilege escalation.
Advanced Offensive Security
Specializations that separate senior pentesters from the rest.
- Active Directory AttacksKerberoasting, AS-REP roasting, Pass-the-Hash, and BloodHound.
- Password Cracking (Hashcat & John)Turn captured hashes into plaintext with wordlists, rules, and masks.
- Wireless Network AttacksCapture WPA2 handshakes, crack them, and understand evil-twin attacks.
- Binary Exploitation & Buffer OverflowsSmash the stack, control execution, and understand modern mitigations.
- Insecure DeserializationAbuse object deserialization to tamper with logic or achieve RCE.
- GraphQL API Attacks — Concept + Live LabUse introspection to map the schema and pull over-exposed fields.
- Race Conditions (TOCTOU) — Concept + Live LabExploit the gap between a check and its use with concurrent requests.
- HTTP Request SmugglingDesync front-end and back-end servers to poison other users' requests.
- OAuth 2.0 & SAML AttacksBreak federated login: redirect_uri abuse, token theft, SAML bypasses.
- Cloud Pentesting (AWS / Azure / GCP)IAM misconfig, exposed storage, metadata SSRF, and privilege escalation in the cloud.
- Container & Kubernetes SecurityContainer escapes, exposed APIs, and lateral movement in orchestration.
- Red Teaming, C2 & AV/EDR EvasionAdversary emulation, command-and-control, and staying undetected — ethically.
- Social Engineering & PhishingThe human attack surface — pretexting, phishing, and awareness testing.
AI & LLM Security
The fastest-growing attack surface of 2026 — securing and attacking AI systems.
- AI/LLM Security & the OWASP LLM Top 10Why AI apps are a whole new attack surface, and the risks that define it.
- Prompt Injection — Concept + Live LabOverride an AI's instructions to leak its system prompt or misbehave.
- Jailbreaks & Guardrail BypassCoaxing a model past its safety alignment — and why it's hard to stop.
- RAG & Vector Database AttacksPoison the knowledge base and exploit retrieval-augmented pipelines.
- AI Agents, Tool-Use & MCP SecurityWhen an LLM can take actions, prompt injection becomes remote code execution.
- AI Supply Chain & Model PoisoningAttacking the models, data, and dependencies behind an AI product.
B2: Enterprise Deep Ops
Active Directory, Windows internals, and Linux privilege escalation at operator depth.
- Active Directory Deep: DCSync, Relay, Tickets & DelegationHow enterprise identity breaks: replication rights, NTLM relay, Kerberos abuse, and delegation risk.
- AD CS ESC1-15: Certificate Abuse MindsetUnderstand certificate-template risk, enrollment rights, mapping, and the ESC family without getting lost in tool output.
- Windows Internals for PentestersProcesses, tokens, handles, services, registry, LSASS, and why Windows privilege boundaries matter.
- Linux Privilege Escalation DeepA complete escalation methodology: identity, files, services, kernel, containers, sudo, SUID, capabilities, and secrets.
B3: Cloud, Containers & Kubernetes
AWS, Azure, GCP, container escape thinking, K8s RBAC, and etcd risk.
- Cloud Pentesting Deep: AWS, Azure & GCPCloud identity, storage, metadata, logging, lateral movement, and assessment tools.
- AWS/Azure/GCP Assessment PlaybooksProvider-specific checklists for authorized reviews and lab practice.
- Container Security Deep: Escapes, Images & Runtime RiskHow containers fail: privileged mode, mounts, sockets, capabilities, image secrets, and runtime boundaries.
- Kubernetes Deep: RBAC, Service Accounts, etcd & AdmissionMap cluster identity, workloads, secrets, network policy, admission controls, and control-plane data.
B4: Exploit Development, RE & Malware Analysis
Binary exploitation, reverse engineering, exploit reliability, and defensive malware analysis.
- Binary Exploitation Deep: Heap, Format String, UAF & ROPMemory corruption primitives, exploit mitigations, and safe CTF/lab practice.
- Reverse Engineering WorkflowStatic and dynamic analysis with strings, symbols, control flow, debuggers, and decompilers.
- Malware Analysis: Safe Lab, Triage & DetectionAnalyze suspicious binaries safely and produce indicators, behavior, and defensive recommendations.
B5: Mobile, Wireless & Hardware
Android/iOS testing, Frida/Objection/MobSF, BLE/NFC/RFID/SDR, and hardware hacking fundamentals.
- Mobile Pentesting: Frida, Objection & MobSFA mobile testing workflow covering storage, traffic, runtime behavior, auth, crypto, and platform controls.
- Wireless Deep: BLE, NFC, RFID & SDRUnderstand wireless attack surfaces, legal boundaries, signal capture, protocol analysis, and defensive hardening.
- Hardware Hacking FundamentalsUART, JTAG/SWD, firmware extraction, boot chains, debug ports, and safe device assessment.
B6: Detection, DevSecOps & Secure Code Review
Sysmon, Sigma, YARA, CI/CD security, SAST/DAST/SCA, and language-specific review.
- Blue Team Detection: Sysmon, Sigma & YARAThink like a defender: telemetry, detections, validation, tuning, and response context.
- DevSecOps Deep: CI/CD, SAST, DAST, SCA & SecretsAssess pipelines, build systems, dependencies, artifacts, secrets, and deployment controls.
- Secure Code Review: PHP, Java, .NET & PythonSource-first vulnerability hunting across common enterprise stacks.
B7: Professional Delivery & Capstone
CVSS v4, attack chains, soft skills, certification strategy, and full enterprise assessment simulation.
- Reporting Deep: CVSS v4, Attack Chains & Executive RiskTurn technical findings into severity, narrative, evidence, and remediation decisions.
- Soft Skills for Elite PentestersScope negotiation, client communication, note discipline, debriefs, and calm under pressure.
- Certification Roadmap: From Junior to SpecialistChoose certs by role: web, AD, exploit dev, cloud, red team, blue team, and leadership.
- Capstone: Full Enterprise Pentest SimulationRun an end-to-end assessment: scope, recon, web foothold, AD/cloud path, privilege escalation, detection, and final report.
Becoming a Pro (Top 1%)
Reporting, bug bounty, certifications, and never-ending practice.