100 days of cyber security
Over 100 days in four-day blocks you solve advanced tasks in servers, networks, web, Active Directory and incident response.
Level 401 · 25 lessons · 24 practice labs
Lessons
Days 1–20: server defence
- Days 1-4: measure the security of a server you inherited
- Days 5-8: harden against a benchmark checklist
- Days 9-12: watch critical files with audit rules
- Days 13-16: confine services with systemd
- Short task: Days 17-20, write the server's drift-detection script
Days 21–40: network defence
- Days 21-24: build an asset inventory from traffic
- Days 25-28: catch a scan with an IDS rule
- Days 29-32: find beacon traffic with statistics
- Days 33-36: detect data exfiltration over DNS
- Short task: Days 37-40, tune the network detection rules for false positives
Days 41–60: web and application defence
- Days 41-44: separate attack attempts from application logs
- Days 45-48: tune web application firewall rules
- Days 49-52: find and patch a flaw in source code
- Days 53-56: add a security scan to the build pipeline
- Short task: Days 57-60, prioritise the app's vulnerability list
Days 61–80: Active Directory
- Days 61-64: map privileged accounts in the domain
- Days 65-68: clean up risky permissions and stale accounts
- Days 69-72: find identity-attack traces in event logs
- Days 73-76: apply the tiered admin model
- Short task: Days 77-80, write a five-point domain hardening report
Days 81–100: incident response
- Days 81-84: triage the alert queue
- Days 85-88: find the initial access point
- Days 89-92: contain the attacker's spread
- Days 93-96: eradicate, recover and verify
- Capstone: Days 97-100, end-to-end incident response and executive report
Practice labs
- Which services run under a profile?: You read the state of the mandatory access control profiles and write the service not in enforce mode to the result file.
- Fix a profile blocking a legitimate path: You find the denial record of a service unable to write to its new log directory, add the narrowest permission to the profile and submit the flag the checker gives.
- Confine a small service with your own profile: You write a profile for a file-upload service allowing only the directories and network access it needs and record the refused escape attempt in the result file.
- Find the rule that lets everything out: You read the firewall ruleset and write the number of the rule that allows unrestricted outbound traffic to the result file.
- Limit a service account's egress to what it needs: You write rules letting the application account reach only the database and update server and submit the flag the checker gives.
- Catch and block a process calling back out: On your lab server you find from egress logs the process opening a connection back out, block it with a rule and write the process and target to the result file.
- Count alerts by signature: In a day of intrusion detection output you write the three most triggered signatures and their counts to the result file.
- Write a rule catching cleartext FTP logins: You write a rule catching FTP passwords sent in the clear, replay the capture and submit the flag in the alert.
- Cut the noise without losing the real alert: You set a threshold and exception for a noisy signature triggered by the backup server and record in the result file that the real attack still alerts.
- Most visited domains in a proxy log: From a day of proxy logs you extract the five domains receiving the most requests and write them to the result file.
- Find the rare client that connects on the hour: You find the user agent seen on a single machine that connects to the same domain every hour and write the machine and domain to the result file.
- Catch an abnormally large upload: You calculate the deviation in upload sizes and write the machine making the abnormal upload, its target and total size to the result file.
- Which rule blocked the legitimate request?: In the web application firewall log you find the ID of the rule that blocked a customer's search request and write it to the result file.
- Write a rule that stops directory traversal attempts: You write a rule blocking plain and encoded directory traversal attempts and submit the flag given once every test request is blocked.
- Close the flaw in a download function in code: In your own lab app you fix a function that reads files without checking the name with safe path resolution and submit the flag given when tests pass.
- Find the package with an advisory in a component list: You compare a software bill of materials with an offline advisory database and write the affected package and version to the result file.
- Pin and upgrade a vulnerable package: You pin the vulnerable package to a safe version in the dependency file, pass the tests and submit the flag in the build output.
- Add a secret-scanning gate to the build pipeline: You add a step to the build script that stops the pipeline when it finds a secret and record in the result file that it stops on a commit with a leaked key.
- List accounts that do not require a password: You find accounts flagged as not requiring a password in the lab domain with a directory query and write their names to the result file.
- Find the excess delegated right on an organisational unit: You inspect an organisational unit's access list, find the unexpected group able to reset passwords, remove the right and write the outcome to the result file.
- Fix service accounts using weak encryption: You find accounts with service names that allow an old encryption type, move them to a strong one and write the before-and-after list to the result file.
- Rank five alerts by severity: You rank five alerts from one shift by severity based on their evidence lines and write them with reasons to the result file.
- Map the path of spread across three servers: You merge the login records of three servers and write which account the attacker used and in what order to the result file.
- Prove the clean-up is complete: On a server after response you look for leftover persistence, unchanged passwords and open sessions, close the one item missed and write the verification report to the result file.
About this course
Over 100 days in four-day blocks you solve advanced tasks in servers, networks, web, Active Directory and incident response.
What you will learn
- Days 1–20: server defence
- Days 21–40: network defence
- Days 41–60: web and application defence
- Days 61–80: Active Directory
- Days 81–100: incident response
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.