60 days of cyber security
With a new task every two days you connect Linux, networks, web, detection and response, and after two months you defend an environment on your own.
Level 301 · 30 lessons · 27 practice labs
Lessons
Days 1–14: strengthen the basics
- Days 1-2: inventory a server
- Days 3-4: switch off unneeded services
- Days 5-6: switch SSH to key-only login
- Days 7-8: write a firewall policy from scratch
- Days 9-10: find and fix wrong file permissions
- Days 11-12: audit scheduled jobs
- Short task: Days 13-14, show the before-and-after of hardening in a table
Days 15–28: network and traffic
- Days 15-16: find every live host on the network
- Days 17-18: find a cleartext password in a capture
- Days 19-20: isolate suspicious DNS queries
- Days 21-22: find the host calling out at a regular interval
- Days 23-24: detect TLS certificate problems
- Days 25-26: block unauthorised traffic between segments
- Short task: Days 27-28, put the network map and risk notes on one page
Days 29–44: web and applications
- Days 29-30: map a web application's exposed surface
- Days 31-32: add security headers
- Days 33-34: find and fix a form without input validation
- Days 35-36: secure the session cookies
- Days 37-38: find and move a hard-coded secret
- Days 39-40: upgrade a vulnerable dependency
- Days 41-42: find scanning traces in a web log
- Short task: Days 43-44, write a three-point fix plan for the app
Days 45–60: detection and response
- Days 45-46: set up central log collection
- Days 47-48: write a rule for a failed-login storm
- Days 49-50: hunt for persistence traces
- Days 51-52: find altered system files with integrity checking
- Days 53-54: contain a compromised account
- Days 55-56: build an incident timeline
- Days 57-58: apply lasting post-incident fixes
- Capstone: Days 59-60, defend an environment under attack and report
Practice labs
- Find the account given full rights without a password: You scan the sudo rules, find the account that can run any command without a password and write its name to the result file.
- Close a rule that escapes to a shell through an editor: On your own lab server you show that a right granted to an editor allows opening a shell, narrow the rule and submit the flag the checker gives.
- Rewrite a sudo rule that uses a wildcard: You rewrite with least privilege a rule whose wildcard path opens the door to unwanted commands and write the before-and-after state to the result file.
- Find the SUID file that came from no package: You list the system's SUID files, find the one belonging to no package and write its path to the result file.
- Find the program holding too many capabilities: You scan file capabilities, find the program able to read any file, remove the capability and submit the flag the checker gives.
- Remove needless SUID bits and prove it: You identify three SUID programs the job doesn't need, clear the bit and write a report showing the required ones still work to the result file.
- Read the mount options of the temp directory: You find which options the temporary and shared-memory directories are mounted with and write the missing ones to the result file.
- Stop programs running from /tmp: You remount the temporary directory persistently without execute and SUID, show the test script no longer runs and submit the flag.
- Mount the log directory separately and restricted: You move the log directory to its own volume, mount it with restricted options, verify services still write and put the configuration in the result file.
- Is zone transfer open to everyone?: You attempt a zone transfer on your own lab DNS server and write the number of records returned to the result file.
- Find the clue in a leaked internal host name: In the records from an open zone transfer you find the internal machine and submit the flag in its associated text record.
- Allow transfers to the secondary only: You restrict zone transfers to the secondary server only, prove refusal from another address and write the outcome to the result file.
- Read the command typed in a Telnet session: You follow a Telnet session in a capture and submit the last command the admin typed as the flag.
- Extract an attachment from mail traffic: You extract and decode the attachment from an unencrypted mail transfer in a capture and submit the flag inside.
- Catch a port scan done slowly: From connection attempts spread over hours you find the scanning source and how many ports it tried and write both to the result file.
- Find the admin page that opens without a password: On your own lab web server you find the management path that opens without credentials and submit the flag on the page.
- Close the HTTP method that allows uploads: You test which methods the server accepts, find the one allowing file writes, disable it and submit the flag the checker gives.
- Put a request limit on the login page: You define a per-minute request limit for the login path on the reverse proxy, measure it with a test script and write the result to the result file.
- Find the secret in an env file committed to a repo: You find the environment file added to a project repository by mistake and submit the key in it as the flag.
- Recover a deleted secret from history: You find in the repository history which commit added a password since deleted and submit the password as the flag.
- Purge the secret from history and add a hook: You purge the leaked key from all history, install a pre-commit hook that blocks new secrets and write the test outcome to the result file.
- Catch a new account creation in the logs: You filter account-creation records in the system logs and write the unexpected account's name and time to the result file.
- Detect the access pattern of a web shell: You write a filter catching requests with command parameters to a file in the uploads directory and submit the file name it finds as the flag.
- Catch outbound connections from the web service user: You write an audit rule watching the web service account for outbound connections and write the triggered record and target address to the result file.
- Find the first login from a foreign address: You write the time and account of the first successful session from an unusual address in the login records to the result file.
- Unpick a backdoor dressed as a service: You find the service unit added to the system afterwards, decode the command it runs and submit the flag inside it.
- Derive the root cause from three logs: You merge web, authentication and scheduled-job logs into one timeline and write the initial access path and root cause to the result file.
About this course
With a new task every two days you connect Linux, networks, web, detection and response, and after two months you defend an environment on your own.
What you will learn
- Days 1–14: strengthen the basics
- Days 15–28: network and traffic
- Days 29–44: web and applications
- Days 45–60: detection and response
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.