Kali and penetration testing basics

15 courses, 261 lessons. A real Kali Linux lab in the browser.

Hands-on introduction to cybersecurity: a tool tour (Level 101, 20 lessons): You learn the core ideas of security, try tools like Nmap, Netcat, Wireshark, OpenSSL and Tripwire in your own lab, and protect a small server.
Introduction to Kali Linux (Level 101, 18 lessons): The Kali environment, tool categories, rules of engagement and safe lab work.
Penetration testing fundamentals (Level 101, 17 lessons): Scope, method, reporting and the legal framework.
Introduction to CTFs (Level 101, 16 lessons): How capture-the-flag works and your first puzzles.
Auditing a server with Kali, from the defender’s side (Level 201, 17 lessons): Finding, validating, closing and reporting the weaknesses of your own lab server.
Scope, rules of engagement and the law (Level 201, 22 lessons): You put a security assessment on paper before it starts: you pick its type, draw the scope and limits, write the rules of engagement and get to know computer-misuse and data-protection laws around the world.
Practice assessment: the Mavikaya Logistics small office (Level 201, 18 lessons): You assess the small-office network of the fictional Mavikaya Logistics from scope to report: you build an inventory, audit shares, the printer, the intranet and passwords, and retest the fixes.
Assessment methodology: standards, workflow and evidence handling (Level 301, 21 lessons): You get to know public methodology frameworks, build your own checklist, plan an assessment phase by phase and back every finding with solid, storable evidence.
Building your own assessment lab: virtual network, targets and snapshots (Level 301, 15 lessons): You design an isolated, rebuildable assessment lab, prepare targets with deliberate misconfigurations, reset them with snapshots and describe the lab as code.
Practice assessment: Lavinya Clinics (Level 301, 18 lessons): You assess the fictional Lavinya Clinics, which handle patient data, under extra rules: you audit the external surface, the patient portal, segmentation, the database and legacy devices, and write a healthcare-aware risk report.
Writing assessment reports and retesting (Level 401, 17 lessons): You write a clear report for different readers, explain findings with evidence and practical advice, present the results and close the assessment by retesting the fixes.
Automating the assessment workflow: scripts, templates and reproducibility (Level 401, 14 lessons): You turn repetitive assessment work into scripts with a scope guard, automate how findings and evidence are kept, compare two assessments and generate reports from templates.
Practice assessment: the Demirsu Energy enterprise network (Level 401, 17 lessons): You assess the fictional multi-site Demirsu Energy: you audit the identity infrastructure and group policies, verify the separation of the branch and monitoring segments with passive methods and present a roadmap to the board.
Running an in-house assessment programme (Level 501, 15 lessons): You turn an organisation’s security assessments into a yearly programme: you plan goals and coverage, track metrics, work with the defence team and set up governance.
Job role: security assessor (Level 501, 16 lessons): You do a security assessor’s job end to end: you take the fictional Yelkovan Bank’s request, prepare the proposal and rules, run the external and internal assessment, report an urgent finding, write the report and close with a retest.

Projects

Get a Kali workstation ready for an assessment: You update the Kali workstation for Göktaşı Yazılım’s first authorised assessment, set up the working folders and a notes template, and confirm each tool runs. You hand in a readiness checklist at the end.
A first assessment plan for a small workshop network: You write a one-page plan for Karaçam Mobilya’s lab workshop network: the assessment phases, what is done in each and what is not allowed. You try the plan with a short first look at the one permitted server and attach your observation notes.
Does signing out really end the session?: You check on your own test application whether signing out also ends the session on the server, and report how to fix it if it does not.
A scope document and rules-of-engagement pack: You prepare the scope document, rules of engagement, written authorisation text and emergency contact list for an assessment at Sedirli Hukuk Bürosu. You then compare the lab target list with the scope and mark what falls outside it.
Small office assessment: the findings report: You run an authorised assessment of Mavikaya Lojistik’s small office network in the lab, staying inside the scope document you are given. You collect the weaknesses you find in a report with evidence, severity and a fix for each.
A single-server audit: the before and after record: You audit Ayçiçeği Gıda’s lab order server from Kali with a defender’s eye and fix the gaps you find on the server yourself. You hand in a record showing the earlier state, your change and the later state for each item.
A scan template for exposed diagnostic pages: You write a Nuclei scan template that finds diagnostic pages accidentally left open on your organisation's own lab systems, and report the findings with fix suggestions.
Build an assessment lab: network, targets and rollback: You build an assessment lab for Saklıvadi Üniversitesi’s security club: a virtual network closed to the outside, two practice targets and a way back to a clean state. You test the isolation and the rollback and write the lab usage document.
Clinic assessment: the test plan and the evidence log: You draw up a standards-based test plan for Lavinya Klinikleri’s appointment systems in the lab and follow it in the authorised assessment. You enter the evidence for every finding in an evidence log with a timestamp and a hash.
A retest record after the fixes: You take the earlier assessment report for Demirsu Enerji’s enterprise lab network and test each finding again after the fixes. You write a retest record showing which findings are closed, partly closed or still open, plus an updated executive summary.
An automation kit for the assessment workflow: You write scripts for Yakamoz Telekom’s assessment team that set up the working folder, run only against the lab targets in the scope file and turn the output into a report skeleton. You run them twice on the same input and show the result is the same.
An in-house assessment programme: the annual plan: Using prepared data from three past assessments at Yelkovan Bankası, you set the annual assessment calendar, the coverage by asset importance and the metrics to follow. You bring the open findings together in a tracking table with owners and deadlines.