Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Advanced · modules
Modules tagged Advanced. Use the sidebar to narrow by track or topic.
Red Team in Cloud
Cloud red teaming is different from AD. No NT hashes; tokens. No Kerberos; OAuth/STS. Different tools, different OPSEC. The cloud kill chain Initial credential acquisition (phishing dev for AWS keys, or compromise endpoint with cached cli credentials) Discovery — what services, what permissions Privilege escalation — IAM-misconfig paths (covered Cloud Module 8-9) Lateral movement — […]
Data Exfiltration Techniques
Data exfiltration is the goal of most non-ransomware attacks. Network defenders should know patterns. Common channels HTTPS to attacker domain — most common; blends with legit traffic HTTPS to cloud storage — Dropbox, Google Drive, AWS S3 (attacker bucket); user-agents look legitimate DNS tunneling — covered Module 9 Networking ICMP tunneling — niche but possible; […]
Frida & Objection — Runtime Mobile Analysis
Frida injects JavaScript into running mobile apps. Objection wraps Frida with ready-made tools. Together: bypass any client-side check. Common bypasses # SSL pinning bypass (so Burp can intercept) objection -g com.example.app explore android sslpinning disable # Jailbreak/root detection bypass ios jailbreak disable android root disable # Hook a specific method android hooking watch class_method com.example.MyClass.checkLicense […]
Runtime Tampering Detection
Many apps add “tamper detection”: Frida hook detection, jailbreak/root detection, debugger detection. Attackers bypass them all (Module 7). Why bother? Why detection still has value Raises attacker effort Generates telemetry — when an account triggers tamper detection, treat as suspicious server-side Combined with server-side enforcement, raises bar significantly What to detect Frida-server processes / TCP […]
Cobalt Strike — Defender Perspective
Cobalt Strike is the most-used commercial C2 framework — by red teams and by the most ransomware operators. Defenders must know its capabilities and detection signals. Capabilities Beacon — implant; supports HTTP, HTTPS, DNS, SMB pipe Malleable C2 — operator customises traffic profile (mimic Outlook, Slack, etc.) Pivoting — beacon-to-beacon over SMB Built-in tools — […]
EDR Evasion — Defender View
Modern EDRs (CrowdStrike, SentinelOne, Defender for Endpoint, Carbon Black) hook into kernel and user space. Attackers evolved evasion. Knowing the techniques helps defenders evaluate detection coverage. Common evasion techniques Process injection variants — APC injection, atom bombing, CTRL injection, NtMapViewOfSection. Each evades signature-based hooks. AMSI bypass — disable Microsoft’s anti-malware scan interface in-process. Many published […]
Zero Trust Architecture
Zero trust is a posture, not a product. Module 16 (Cloud track) covered ZTNA specifically. This module is the architectural view. The seven pillars (NIST) User/identity Device Network/environment Application/workload Data Visibility/analytics Automation/orchestration Core principles Never trust; always verify Assume breach Least privilege Continuous verification Phased rollout (24-36 months realistic) Identity — strong IdP, MFA, conditional […]
Impacket — The Swiss Army Knife
Python toolkit for SMB/MSRPC/Kerberos. Used in nearly every AD pentest. Top scripts secretsdump.py — dump SAM, LSA, NTDS psexec.py / smbexec.py / wmiexec.py — remote command execution GetUserSPNs.py — Kerberoasting GetNPUsers.py — AS-REP roasting ntlmrelayx.py — NTLM relay attacks ticketer.py — forge Kerberos tickets (Golden/Silver) addcomputer.py — create computer accounts (RBCD) rbcd.py — Resource-Based Constrained […]
Responder & MITM6
Most internal pentests start with passive listening. Responder + MITM6 capture authentication attempts and convert them to crackable hashes. Responder — LLMNR/NBT-NS poisoning When Windows can’t resolve a name via DNS, it falls back to LLMNR/NBT-NS broadcasts. Responder answers them, claiming to be the target. Victim authenticates to Responder; NetNTLMv2 hashes captured. sudo responder -I […]
BloodHound — Operator Guide
Module 3 (AD track) and Module 174 covered BloodHound conceptually. This is the operator manual. Collection # SharpHound from Windows (any domain user) SharpHound.exe -c All # bloodhound-python from Linux bloodhound-python -u alice -p 'Pass' -d corp.local -ns 10.0.0.10 -c all # AzureHound for Entra ID azurehound list -o azure-data.json Cypher queries that matter # […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.