Passwords and cryptography

16 courses, 248 lessons. A real Kali Linux lab in the browser.

Introduction to password security: policy, strength and multi-factor authentication (Level 101, 13 lessons): You learn why passwords are the weak link and what strength and entropy mean; you write a password policy based on current guidance, block breached passwords and apply multi-factor authentication to lab accounts.
Introduction to cryptography: AES, SHA-256, RSA (Level 101, 15 lessons): Hashes, encryption, keys and signatures.
Introduction to certificates: behind the browser padlock (Level 101, 13 lessons): You learn what the browser padlock tells you, what is inside a certificate and how the chain of trust works; you create a signing request, get a certificate with ACME, install it on a web server, watch its expiry and recognise common errors.
Defending against password guessing with Hydra (Level 201, 20 lessons): How guessing shows in logs, rate limits, lockouts and automatic blocking.
John and hashcat: password hashes and storage security (Level 201, 16 lessons): How passwords are stored, weak hashes, policy and slow hashing.
Applied cryptography: OpenSSL and GPG (Level 201, 17 lessons): TLS, certificates, key management and common mistakes.
Auditing TLS configuration (Level 201, 18 lessons): You understand the TLS handshake, versions, cipher suites and forward secrecy; you audit servers with openssl s_client, testssl.sh and Nmap, harden Nginx, Apache and non-web services to the company TLS policy and audit them again.
Measuring the corporate password policy: a weak-password audit (Level 301, 18 lessons): You plan an approved, privacy-preserving password-quality audit; in the lab domain you measure empty, shared, breached and never-changed passwords and patterns, audit how Linux and applications store passwords, improve things with a banned list and stricter policy, and measure again.
Auditing and hardening SSH and GPG (Level 301, 15 lessons): You understand the SSH handshake and algorithms and narrow them to company policy, verify host keys, scale access with a key inventory and SSH certificates, and set up a GPG key policy, an offline primary key and a revocation process.
Building and running an internal certificate authority (Level 301, 17 lessons): You design and build a two-tier hierarchy with an offline root and an intermediate CA; you set extensions and name constraints, publish revocation, issue client certificates for mutual TLS, distribute the root certificate and audit the CA.
Auditing the authentication architecture: MFA, SSO and passwordless sign-in (Level 401, 16 lessons): You map the organisation’s authentication flows; you audit single sign-on, multi-factor coverage, legacy protocols, account recovery, session and token settings and conditional access, and write a roadmap towards passwordless sign-in.
Reviewing how applications use cryptography (Level 401, 16 lessons): You find common crypto mistakes in application code such as ECB mode, IV reuse, hard-coded keys and weak randomness, and fix and verify them with authenticated encryption, high-level libraries, correct password storage and a key management service.
Certificate lifecycle management: inventory, renewal and revocation (Level 401, 14 lessons): You build a certificate inventory from the network and certificate transparency logs, automate renewal with internal ACME, monitor expiry, and rehearse revocation and migration for events like key compromise and CA distrust.
Secrets management: vaults, rotation and leak monitoring (Level 501, 14 lessons): You find and revoke secrets scattered across code, configuration and scripts; you centralise them with a vault, dynamic credentials and privileged account management, automate rotation and monitor for leaks.
Crypto agility and the post-quantum transition (Level 501, 13 lessons): You build the organisation’s cryptographic inventory and bill of materials, understand the risk from quantum computers and the new standards, try hybrid key exchange in the lab and write a migration plan that retires old algorithms.
PKI governance and trust architecture (Level 501, 13 lessons): You compare trust models, root programmes and e-signature regulations with examples from around the world, and prepare a PKI governance document covering the key ceremony, HSM operations, separation of duties, audit and disaster recovery.

Projects

Write a password policy and switch on a second factor: You write a clear password policy for teacher accounts at Gelincik Okulları and turn it into settings on the lab server. You switch on a second verification step for a test account and keep a check record showing it all works.
Find devices with default passwords: You identify which devices in your own lab still use their factory password and produce a password replacement plan for each one.
Audit password reuse after a breach: After a data breach you check whether employees reuse the same password in several places, and prepare an action list for the risky accounts.
Verify the results of login attempts: You review login attempt records on your own test system, confirm successes and failures are handled correctly, and report any inconsistencies.
Fix login attempt limits: You find that a login page has a missing or faulty limit on attempts, fix it, and show with a test that the limit now works.
Audit and fix the TLS settings: You audit the certificates and TLS settings of Turnalı Perakende’s three lab web servers and identify old protocols, weak cipher suites and faulty certificates. You fix the settings, audit again and write the before/after report.
Secret recovery and a password audit: In your own lab you recover a forgotten secret by safe means, then audit the password policy and report its weak points.
Build an internal certificate authority and issue certificates: You build a certificate authority with a root and an intermediate for Göktaşı Yazılım’s internal services, then issue and install certificates on two services. You revoke one certificate, show that clients see the revocation and write the operating guide.
SSH and GPG audit: a hardening baseline: You audit the SSH settings and keys on Sedirli Hukuk Bürosu’s lab servers, and the team’s GPG keys. You remove weak algorithms and non-expiring keys and hand in the baseline document to follow from now on.
Review how a payment service uses cryptography: You review how the code of Yelkovan Bankası’s small lab payment service encrypts, hashes and stores keys. You report the misuses with line references, fix the code and confirm the fix with tests.
Set up a certificate inventory and renewal tracking: You write a script that finds every certificate on Mavikaya Lojistik’s lab network and records owner, expiry date and issuer in an inventory. You raise warnings for those close to expiry, renew one, revoke one and keep the lifecycle record.
Move secrets into a vault, rotate them and scan for leaks: You find the secrets embedded in code and settings files of Kuzeyyıldızı Kargo’s lab parcel-tracking application and move them into a secrets vault. You rotate one password without downtime, scan the repository history for leaks and write the migration report.