Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Latest modules
Most recent practitioner playbooks across every track. Filter by topic, level, or search in the sidebar.
Vulnerability Management Programme
Module 13 (DevSecOps) covered triage. This module is the program around it. Programme components Asset inventory — what to scan; tagged with owner, criticality Scanning cadence — Tenable / Qualys / Rapid7 weekly for infrastructure; daily for cloud (CSPM) Triage process — EPSS + KEV + reachability Patch SLAs — by criticality and exposure Exception […]
John & Hashcat — Cracking Workflow
Why this module. Cracked hashes power lateral movement. Knowing how to crack quickly turns a low-impact LSASS dump into a Domain Admin compromise. Identify the hash hashid 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0' # Output: NTLM Hashcat modes (the ones you need) Mode Hash 0 MD5 100 SHA1 1000 NTLM 5500 NetNTLMv1 5600 NetNTLMv2 1800 sha512crypt (Linux) 13100 Kerberos 5 […]
Impacket — The Swiss Army Knife
Python toolkit for SMB/MSRPC/Kerberos. Used in nearly every AD pentest. Top scripts secretsdump.py — dump SAM, LSA, NTDS psexec.py / smbexec.py / wmiexec.py — remote command execution GetUserSPNs.py — Kerberoasting GetNPUsers.py — AS-REP roasting ntlmrelayx.py — NTLM relay attacks ticketer.py — forge Kerberos tickets (Golden/Silver) addcomputer.py — create computer accounts (RBCD) rbcd.py — Resource-Based Constrained […]
CrackMapExec / NetExec
CrackMapExec (now NetExec / nxc) is the parallel-executor that makes Impacket scriptable across hundreds of hosts. Workflow # Enumerate SMB hosts nxc smb 10.0.0.0/24 # Test credentials across the subnet nxc smb 10.0.0.0/24 -u alice -p 'Password@2026' --continue-on-success # Pass-the-hash nxc smb 10.0.0.0/24 -u admin -H aad3b435b51404ee...:31d6cfe... # Once you have admin somewhere nxc smb […]
Responder & MITM6
Most internal pentests start with passive listening. Responder + MITM6 capture authentication attempts and convert them to crackable hashes. Responder — LLMNR/NBT-NS poisoning When Windows can’t resolve a name via DNS, it falls back to LLMNR/NBT-NS broadcasts. Responder answers them, claiming to be the target. Victim authenticates to Responder; NetNTLMv2 hashes captured. sudo responder -I […]
BloodHound — Operator Guide
Module 3 (AD track) and Module 174 covered BloodHound conceptually. This is the operator manual. Collection # SharpHound from Windows (any domain user) SharpHound.exe -c All # bloodhound-python from Linux bloodhound-python -u alice -p 'Pass' -d corp.local -ns 10.0.0.10 -c all # AzureHound for Entra ID azurehound list -o azure-data.json Cypher queries that matter # […]
OSINT & External Recon
Recon is the cheapest, highest-yield phase of any engagement. Tools that pay back the time investment. Subdomain enumeration # Passive (no traffic to target) subfinder -d target.com -all -silent amass enum -passive -d target.com crt.sh search ("%.target.com") # Active (more thorough) amass enum -active -d target.com ffuf -w subdomains.txt -u https://FUZZ.target.com Search engines for hackers […]
EvilGinx — Modern Phishing
For defensive understanding only. Don’t deploy without clear authorisation. EvilGinx is the proof that “MFA stops phishing” was true in 2018, false by 2024. How proxy phishing works Attacker hosts EvilGinx with a phishlet for the target service (Microsoft, Google, etc.). EvilGinx is a transparent reverse proxy: requests come in, get forwarded to legitimate service, […]
sqlmap — Automated SQL Injection
Why this module. sqlmap automates 80% of SQLi work. Mastering it means going from “I think this is injectable” to “here’s the database dump” in 15 minutes. The base workflow # Detect sqlmap -u "https://target.com/page?id=1" --batch --level=3 --risk=2 # Confirm with banner sqlmap -u "https://target.com/page?id=1" --batch --banner # Enumerate sqlmap -u "https://target.com/page?id=1" --batch --dbs sqlmap […]
API DDoS & Bot Mitigation
Why this module. APIs are bot magnets. Credential stuffing against /login, scraping of /products, account creation abuse, comment spam. Volumetric DDoS is solved at the edge; L7 abuse is a per-API battle. Bot patterns by endpoint /login — credential stuffing, brute force /signup — fake account creation for fraud / spam /api/search — scraping / […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.