Attack paths and their defence

19 courses, 295 lessons. A real Kali Linux lab in the browser.

Introduction to vulnerabilities: CVE, CVSS and patching (Level 101, 14 lessons): You learn what a vulnerability is, its shared language (CVE, CWE, CVSS) and its life cycle; you read vendor advisories, list installed versions, apply patches and verify they are in place.
Introduction to validating findings safely (Level 101, 13 lessons): You see the gap between what a scanner says and what is true: you confirm findings in your own lab with the least-impact principle, separate false alarms, fix the configuration and retest with before-and-after evidence.
Introduction to misconfiguration audits on a Linux server (Level 101, 14 lessons): Starting from least privilege you audit accounts, file permissions, SUID files, listening services and update status on a Linux server, and apply a first hardening list with CIS benchmarks and Lynis.
Introduction to Windows configuration audits (Level 101, 13 lessons): You audit local administrators, UAC, services, updates, the firewall, endpoint protection and shares on a Windows machine with PowerShell, read the event logs and apply a first round of hardening.
Vulnerability scanning: planning, running and interpreting (Level 201, 20 lessons): You plan a vulnerability scan and set its scope, compare authenticated and unauthenticated scans, weed out false positives, group findings by root cause and rescan after remediation.
Validating your own systems with Metasploit (Level 201, 15 lessons): Validating findings in a controlled way, seeing the defence-side traces and re-validating a patch.
Access control on Linux: accounts, sudo, SSH and service permissions (Level 201, 17 lessons): You audit account policy, PAM, sudo rules, privilege-granting groups, service users and systemd hardening on Linux, get to know AppArmor and SELinux, and watch critical changes with auditd.
Finding and closing privilege misconfigurations on Windows (Level 201, 17 lessons): You audit and close service, registry and scheduled-task permissions, unquoted paths, credentials left on disk and risky user rights on Windows, roll out LAPS and credential protections, and monitor with Sysmon and the audit policy.
The vulnerability management cycle: prioritisation, tracking and deadlines (Level 301, 18 lessons): You run vulnerability management as a cycle: you prioritise with asset criticality, CVSS environmental metrics, EPSS and known-exploited lists, manage deadlines and exceptions, and report with metrics.
Meterpreter and investigating a compromised system (Level 301, 16 lessons): After a compromise: process, network and file evidence, containment and recovery.
Closing Linux privilege escalation paths: SUID, sudo, cron (Level 301, 17 lessons): Auditing SUID, sudo, cron and sensitive files, and detecting escalation attempts.
Active Directory configuration audit (Level 301, 20 lessons): You build the directory inventory of the lab domain; you audit privileged groups, password policies, service accounts, object permissions, delegation, group policies, certificate templates and legacy protocols, harden them and monitor changes.
Risk-based vulnerability prioritisation and automation (Level 401, 14 lessons): You merge findings from different scanners and sources into one model, score risk with privilege-path and threat context, test the model against past incidents and automate ticketing and dashboards.
Finding validation and post-fix retesting: controlled evidence (Level 401, 14 lessons): You write validation plans with stop conditions for critical findings, gather evidence with non-destructive methods in a staging copy, read defence telemetry alongside, and use retesting to confirm the fix closed the root cause, caused no regression and covers similar systems.
Auditing container and orchestration boundaries (Level 401, 17 lessons): You learn how container isolation works; you find and remove privileged containers, mounted docker.sock, host-path mounts and excess capabilities, scan images, audit Kubernetes permissions and set up runtime detection.
Seeing and stopping lateral movement (Level 401, 15 lessons): Internal segmentation, spotting tunnels and scans, and splitting the network fast during an incident.
Job role: vulnerability analyst (Level 501, 15 lessons): You do a vulnerability analyst’s job at the fictional Turnalı Retail for a quarter: you run the baseline scan, analyse the impact of an urgent advisory, drive a remediation campaign, review exceptions and present the quarterly report.
Configuration compliance across a Linux fleet: auditing as code (Level 501, 12 lessons): You write the organisation’s Linux configuration standard, turn auditing and fixing into code with OpenSCAP and Ansible, catch configuration drift, record exceptions and measure and report the fleet’s compliance.
Enterprise identity: measuring privilege paths and tiered administration (Level 501, 14 lessons): You graph directory relationships in the lab domain and measure the privilege paths to critical assets; you close them with tiered administration, privileged access workstations and time-bound admin access, and review hybrid identity and the recovery plan.

Projects

Turn security advisories into a patch priority list: You match the software versions on Ayçiçeği Gıda’s lab servers with the security advisories you are given and read the severity score of each weakness. You write the patch priority list, apply the top patch and confirm the version changed.
A first misconfiguration audit on a Linux server: You audit Karaçam Mobilya’s lab stock server against a checklist and find unneeded services, world-writable files and unused accounts. You fix the gaps and write the findings and fixes report.
Plan and run a vulnerability scan, then triage the results: You write a scan plan with scope, timing and method for Mercanköşk Otelcilik’s lab network and run the scan according to it. You weed out the false alarms and report the real findings with a fix for each.
Validate scanner findings safely and retest: For Turnalı Perakende’s own lab server you confirm, inside the written permission and scope, whether three scanner findings are real using Metasploit’s check steps. You patch the real ones, retest and write the validation record.
Tidy up Linux access control: accounts, sudo, SSH: You audit the accounts, sudo rules, SSH settings and service file permissions on Kuzeyyıldızı Kargo’s lab dispatch server. You narrow the rights that are wider than needed and write each change with its reason in a change record.
Close privilege escalation paths on Linux and re-check: You take stock of SUID files, sudo rules and scheduled jobs on Ilgıntepe Tekstil’s lab production server and identify the settings that could allow privilege escalation. You close them and show they are closed with a script that repeats the audit.
An Active Directory configuration audit report: You audit the password policy, unused accounts, broad group memberships and delegations in Saklıvadi Üniversitesi’s lab domain. You report the findings in order of importance, fix the top three and audit again.
Investigate a compromised server: timeline and clean-up: On a prepared compromised server in Lodoskaya Denizcilik’s lab you examine the traces an outside session left behind (processes, accounts, persistence settings). You collect the incident timeline, the clean-up steps and checks that would catch a repeat in one report.
Internal compromise and privilege escalation: In your own lab you study an internal compromise scenario from the defender's side, close the weaknesses that allowed privilege escalation, and write rules that would detect it.
A risk-based vulnerability ranking and tracking queue: You write a ranking script that combines Lavinya Klinikleri’s prepared scan output with severity score, likelihood of exploitation and asset importance. You add owners, deadlines and exception records to the queue and prepare the summary for management.
Make lateral movement visible and stop it with segmentation: You map which management paths are open from one segment to another in Demirsu Enerji’s lab network and close the unneeded ones with firewall rules. You write detection rules that catch unusual connections between segments and show it all in a verification record.
Compliance auditing as code across a server fleet: You turn the hardening rules for Yakamoz Telekom’s four lab Linux servers into checks written as code and run them on all of them. You produce the compliance report, fix two rules automatically and show the result holds on a second run.