Site map
Linux
Linux quick start
First lab: open the terminal, meet the server
Know your identity: whoami, id and groups
Moving around: pwd, cd and ls
File operations: mkdir, cp, mv and rm
Reading and comparing content: cat, less and diff
Quick task: find the altered configuration file
File permissions: read, write, execute and chmod
Changing ownership: chown and chgrp
Quick task: lock down a team folder left wide open
Account management: useradd, passwd, usermod and userdel
Final task: prepare a secure account and folder for a new hire
Linux fundamentals
What Linux is and why security teams use it
The terminal and the shell: your first commands
Getting help: man, info, --help
The directory tree and moving around
Knowing your files: ls, hidden files, types
Creating, copying, moving, deleting and wildcards
Links and finding files
Reading contents: cat, less, head, tail -f
Redirection, stdout and stderr, and pipes
Filtering and counting: grep, sort, uniq, wc, cut
Exit status and chaining commands
Variables, PATH and .bashrc
Aliases, command substitution and history
Editing files: first steps with nano and vim
Capstone: investigate an incident folder and find the suspicious IP
Linux commands practice
Users, groups and permissions: chmod, chown, sudo
PowerShell fundamentals: cmdlets, pipeline, scripting
First steps on the Linux desktop
Linux distributions and release cycles
How Linux is put together: hardware, kernel and user space
Vim fundamentals
Terminal sessions with tmux
Files and disks: inodes, mounts and disk space
Installing software on Linux: apt, dnf, Snap and Flatpak
Regular expressions and grep: first steps
First steps in Bash scripting
A first look at processes and services
A first look at logs
Troubleshooting fundamentals
First steps in backups
Job role: Linux support technician
Linux skills assessment: beginner
Processes and systemd: ps, top, systemctl
Packages and storage: apt, dnf, LVM, tar
Text processing: grep, sed, awk
Shell scripting (Bash)
Logs and scheduled tasks: journalctl, cron, at
100 days of Linux
Linux practice challenges: workplace scenarios
Command line mastery: the shell, history and workflow
Advanced Vim: macros, registers and text objects
Bash scripting challenges
PowerShell scripting: functions, modules and error handling
Server monitoring basics: vmstat, iostat and sar
Hardware and drivers: udev, modules and devices
Virtual machines with KVM and libvirt
Publishing a website on Linux
System settings: time, locale, host name and kernel parameters
Backups on Linux: tar, rsync and snapshots
Advanced access control: ACLs, attributes, capabilities and sudoers
Linux desktop administration
Job role: junior system administrator
Linux skills assessment: intermediate
Boot process and recovery: GRUB, systemd
Web servers: Nginx and Apache
Centralised log management: Loki, Promtail, Grafana
Advanced Bash scripting: reliable and secure automation
The command-line toolbox: ripgrep, fd, fzf and parallel
Vim on servers: remote editing, large files and ex scripts
Advanced storage: LVM, RAID, LUKS and snapshots
Package repositories and version pinning
Programming with awk
Automation with PowerShell: remoting, testing and scheduling
systemd in depth: units, dependencies and socket activation
rsyslog and journald in depth
Server monitoring with Prometheus and Grafana
Linux performance tuning: CPU, memory and disk
Breakage scenarios: solve them yourself
System containers with LXC and Incus
Enterprise backups: restic, Borg and immutable backups
PAM and NSS: the login chain
Release upgrades and distribution migration
Job role: Linux system administrator
Linux skills assessment: advanced
Build challenges: a working system from scratch
File systems in depth: ext4, XFS, Btrfs and ZFS
Patch management: planned updates and live patching
Structured data on the command line: jq, yq, CSV and XML
Building tools in Bash: testing, libraries and distribution
Advanced PowerShell: performance, runspaces and tool design
Resource control and service isolation with systemd
Alerting and on-call: Alertmanager, SLOs and post-incident reviews
Performance analysis with perf and eBPF
Outage drills
The Linux kernel: building, configuring and tuning
Container internals: namespaces, cgroups and chroot
Advanced Nginx: load balancing, caching and rate limiting
Advanced Apache: MPMs, PHP-FPM and performance
Server disaster recovery: back from bare metal
Central identity: LDAP, SSSD and Kerberos
Fleet operations: managing many servers
Job role: site reliability engineer (SRE)
Linux skills assessment: expert
Linux expert challenges
Storage failures and data recovery
Building packages: .deb and .rpm
Working with huge logs: speed, scale and accuracy
Bash internals: parsing, performance and portability
Process internals: /proc, signals, strace and ptrace
Hard failures in production
Kernel debugging: kdump, crash and ftrace
Advanced virtualisation: performance, live migration and high availability
Running the web stack: deployments, certificates and capacity
Joining Linux to Active Directory
Job role: senior Linux engineer
Linux mastery challenges
Networking and network services
Network fundamentals: TCP/IP, ARP, DNS
Linux networking: ip, ss, ping, dig
Addressing and subnetting practice
Talking to protocols by hand: nc, telnet, openssl
Secure file transfer with SSH, scp and rsync
DNS (BIND) and DHCP services
File sharing with NFS and Samba
TCP/IP in depth: IP, ICMP, TCP, UDP
IPv6 in practice: addressing, SLAAC, DHCPv6
Routing fundamentals: routes, metrics, policy routing
Switching and VLANs: bridges, 802.1Q, STP
VPNs with WireGuard
Network infrastructure services: NTP, SNMP, PXE and IPAM
Windows networking: ipconfig, netsh, PowerShell
Wireless networks: Wi-Fi, WPA2/WPA3 and enterprise Wi-Fi
Network troubleshooting: layer by layer
Network fault challenges: fix broken networks
TCP performance: windows, congestion and latency
IPv6 transition and security: NAT64, DNS64, RA guard
Dynamic routing with OSPF (FRRouting)
NAT and the packet path on a Linux router: nftables, conntrack
LAN security: ARP, DHCP and 802.1X
Linux virtual networking: namespaces, veth, macvlan
Enterprise VPNs: IPsec (strongSwan) and OpenVPN
Mail services: Postfix, Dovecot, SPF, DKIM, DMARC
Proxies and load balancing: HAProxy, Squid
DNS security: DNSSEC, Unbound, DoT and DoH
Network monitoring: SNMP, flow data and Prometheus
From RFC to packet: verifying protocol behaviour against the spec
BGP: routing between autonomous systems (FRRouting)
Redundant gateways and load sharing: VRRP, ECMP, bonding
Tunnels and overlay networks: GRE, VXLAN, EVPN
Traffic control and QoS: tc and queueing disciplines
Network automation: Ansible, Netmiko and templates
Enterprise network design: segmentation, redundancy, documentation
Job role: network administrator
Internet routing security: RPKI, route leaks, incident response
Zero-trust network access: identity, mTLS, micro-segmentation
Job role: network engineer, a multi-site enterprise network
Python
Python fundamentals
Data structures and functions
Python first exercises
Files, modules and errors
Python libraries: pip, requests, argparse
Python practice
Object-oriented programming with Python
Python iterators, generators and functional tools
Text processing and regular expressions with Python
File formats with Python: CSV, JSON, YAML, XML, SQLite
Testing in Python: pytest, mocks and coverage
Debugging and logging in Python
Command-line tools with Python
Concurrency in Python: threads, processes and asyncio
Network programming with Python: sockets, HTTP, TLS
Building web APIs with Python: Flask and FastAPI
Database programming with Python: sqlite3 and SQLAlchemy
System automation with Python
Python code quality: type checking, formatting and project tooling
Python intermediate challenges
Secure Python coding: common mistakes
Advanced Python: the depths of the language
Advanced asyncio: highly concurrent services
Python performance: measure, speed up, extend with C
Design and architecture in Python
Python advanced challenges
Inside CPython: bytecode, memory and the interpreter
Binary data and protocol parsing with Python
Python project workshop
Programming languages: Java, Go, C and C++
C language fundamentals
C++ fundamentals
Go fundamentals
Java fundamentals
Rust fundamentals
C: pointers and memory management
Strings, files and data formats in C
Data structures and algorithms in C
C practice
C++: classes, the STL and safe memory
The C++ standard library: containers and algorithms
C++ practice
Go concurrency and HTTP services
Go practice
Testing, debugging and code quality in Go
Command-line tools with Go
Java collections, generics and streams
Object-oriented design and design patterns in Java
Java practice
Building, testing and debugging in Java
Rust: ownership, borrowing and traits
Debugging and development tooling for C
Linux system programming in C
Network programming in C
Modern C++: C++17, C++20 and C++23
C++ build, testing and quality tools: CMake and beyond
Systems and network programming in C++
Network programming with Go
Web services and REST APIs with Go
Concurrency and virtual threads in Java
Network and HTTP programming with Java
Databases with Java: JDBC and JPA
Web services with Spring Boot
Command-line and systems tools with Rust
Concurrency in C: POSIX threads
Secure coding in C: common mistakes
C++ templates and generic programming
Concurrency and the memory model in C++
Secure coding in C++: common mistakes
Advanced concurrency patterns in Go
Secure coding in Go and common mistakes
Secure coding in Java and common mistakes
Concurrency and async in Rust
C binaries: ELF, linking and hardening
C projects: a shell, an HTTP server and a log collector
Performance in C++: measuring and speeding up
C++ projects: a tool, an integrity monitor and a network service
Go internals and performance
Go project workshop
JVM internals and performance
Java project workshop
Rust: unsafe, FFI and security review
Web basics
How the web works: HTTP, DNS, TLS
Browser developer tools
HTML fundamentals
CSS fundamentals
JavaScript fundamentals
JavaScript practice
Build and publish your first website
HTTP in depth: methods, headers, bodies
Web server basics: publishing a site
HTML forms in depth
Semantic HTML and search engines
CSS layout: Flexbox and Grid in depth
Responsive design: pages that fit every screen
JavaScript: the DOM and fetch
Node.js fundamentals: JavaScript on the server
React fundamentals and secure component writing
REST APIs: using and building them
Web accessibility fundamentals
Web debugging challenges
HTTP caching and content delivery
Inside the browser: parsing, rendering and the security model
Media and graphics in HTML: responsive images, SVG, canvas
CSS architecture for large projects
Motion in CSS: transitions and animations
JavaScript in depth
Asynchronous JavaScript and the event loop
Type-safe JavaScript with TypeScript
JavaScript tooling and testing
Building applications with React
API design: contracts, versions, resilience
Accessible interface components
Web performance fundamentals
Front-end project workshop
HTTP/2, HTTP/3 and QUIC
Web components: custom elements and the Shadow DOM
Modern CSS: :has, container queries, colour spaces
Browser APIs: workers, offline and real time
API authentication: sessions, tokens, OAuth 2.0
Accessibility auditing and reporting
Writing an HTTP server from scratch
HTML parsing and sanitising: inside the standard
CSS and rendering performance
The JavaScript engine, performance and memory
Advanced web performance engineering
End-to-end web application capstone
Databases
Database concepts: why, how and which one
SQL fundamentals (MySQL)
SQL query practice
PostgreSQL quick start
SQLite fundamentals
MongoDB
Redis
Data modelling and schema design
Intermediate SQL: joins, subqueries and set operations
MySQL administration: installation, configuration, monitoring
PostgreSQL
Advanced SQLite: durability, search and encryption
MongoDB data modelling
MongoDB administration
Application patterns with Redis
Database project: a library system
Analytical SQL: window functions and reporting
Transactions and concurrency
SQL puzzles and challenges
Advanced MySQL: performance, replication and security
MySQL backup and recovery
PostgreSQL administration
PostgreSQL backup and recovery
Server-side programming in PostgreSQL: PL/pgSQL
Advanced PostgreSQL: performance, replication and security
SQLite in applications
Advanced MongoDB: aggregation, replication and security
MongoDB aggregation pipeline in depth
Advanced Redis: streams, replication and security
Database backup strategy and disaster recovery
Database monitoring and observability
Schema migrations and zero-downtime change
Database troubleshooting challenges
SQL query optimisation
MySQL replication and high availability
MySQL performance tuning
PostgreSQL performance tuning
PostgreSQL replication and high availability
The SQLite file format and data recovery
MongoDB replica sets and sharding
MongoDB performance tuning
Redis high availability and Redis Cluster
Database security: authorisation, encryption, backup and auditing
Inside a database engine: storage, indexes and logs
MySQL internals and advanced troubleshooting
PostgreSQL internals and extension development
Extending SQLite: extensions and virtual tables
MongoDB internals and advanced operations
Redis internals and performance
Database hardening and security audit practice
Designing highly available data architectures
Data analysis and big data
Introduction to data analysis
Data analysis at the command line
Statistics basics for analysts
Python and Jupyter for data analysis
Introduction to big data
Numerical computing with NumPy
Data analysis and log review with Pandas
Data visualisation with Matplotlib
Hadoop and HDFS: distributed storage and batch processing
SQL over big data with Hive
Data cleaning and preparation
Parsing logs and text data
Statistics 201: distributions, correlation and tests
Analytical SQL with DuckDB
Reporting and storytelling with data
Machine learning and anomaly detection with Scikit-learn
Event streaming with Apache Kafka
Big data processing with Apache Spark
Advanced Pandas: reshaping and performance
Advanced visualisation: seaborn, Plotly and dashboards
Time series analysis of event data
Data pipelines with Airflow
Data quality and validation
Security log analytics
Data lake design
Hadoop cluster operations and security
Case studies: investigating incidents with data
Advanced Spark: performance and stream processing
Advanced Kafka: Connect, Streams and operations
Advanced anomaly detection in security data
Data analysis for threat hunting
Privacy and security in analytics
Data pipeline security and operations
Open table formats: Apache Iceberg
Job role capstone: security data analyst
Designing a security data platform
Detection at scale: streaming analytics and correlation
Job role capstone: security data engineer
Git and Docker
Git fundamentals
Docker fundamentals
VS Code fundamentals
Teamwork with Git: branches and workflows
Shaping Git history: rebase, cherry-pick, bisect
Git practice: real situations from a team
Multi-service apps with Docker Compose
Docker networking and storage
Docker practice: real situations
PowerShell scripts, functions and modules
Debugging and remote development with VS Code
Git internals and hooks
Large repositories: submodules, worktrees, LFS and signing
Advanced image building: multi-stage, BuildKit and registries
Troubleshooting and monitoring Docker
Remote management and automation with PowerShell
Host your own Git server: SSH and Gitea
Running Docker in production: Swarm
Testing and configuration management in PowerShell: Pester and DSC
Job role: build and release engineer
Recovery and forensics in Git
Inside Docker: namespaces, cgroups, OCI and runc
Toolmaking with PowerShell
Kali and penetration testing basics
Hands-on introduction to cybersecurity: a tool tour
Introduction to Kali Linux
Penetration testing fundamentals
Introduction to CTFs
Auditing a server with Kali, from the defender’s side
Scope, rules of engagement and the law
Practice assessment: the Mavikaya Logistics small office
Assessment methodology: standards, workflow and evidence handling
Building your own assessment lab: virtual network, targets and snapshots
Practice assessment: Lavinya Clinics
Writing assessment reports and retesting
Automating the assessment workflow: scripts, templates and reproducibility
Practice assessment: the Demirsu Energy enterprise network
Running an in-house assessment programme
Job role: security assessor
Reconnaissance and scanning
Nmap fundamentals
Introduction to open-source information: your organisation’s online footprint
Introduction to auditing network services
Nmap: host discovery and port scanning
OSINT and passive recon: whois, dig, theHarvester
Auditing file-sharing services: SMB, NFS, FTP
Nmap: fingerprinting and the scripting engine
External attack surface management: from inventory to prioritisation
Auditing infrastructure services: LDAP, SMTP, SNMP and databases
Writing organisation-specific audit scripts with the Nmap scripting engine
Auditing the external exposure of cloud assets
Auditing remote access paths: SSH, remote desktop and VPN
Continuous asset inventory on large networks: distributed scanning and change tracking
Building a continuous exposure management programme
Safely auditing IoT and industrial device services
Traffic analysis
Packets through an analyst’s eyes
First steps in traffic CTFs
Wireshark fundamentals
Wireshark install and capture permissions
The Wireshark interface: packet list, details, bytes; columns and profiles
Wireshark coloring rules
Live capture with Wireshark
Saving PCAPNG in Wireshark
Wireshark display filters
Wireshark capture filters (BPF)
Following a TCP stream in Wireshark
Telling encrypted (TLS) from cleartext traffic with Wireshark
Filtering and watching DNS traffic with Wireshark
Wireshark statistics: hierarchy, conversations, I/O
Exporting from Wireshark
IPv6 and ICMPv6 traffic with Wireshark
Wireshark: extracting fields with tshark
Capstone: find the suspicious traffic with Wireshark
Packet capture with tcpdump
Protocol analysis with tshark
Going deeper in Wireshark: expert info and TCP analysis
TCP/IP in depth: IPv4, IPv6, TCP, ICMP, ARP
Reading DNS traffic in depth
Cleartext protocols: FTP, Telnet, SMTP, POP/IMAP, SNMP, syslog
Zeek fundamentals: turning traffic into logs
Flow analysis with NetFlow and IPFIX
Intrusion detection with Snort
Network detection and prevention with Suricata
HTTP and TLS in depth: HTTP/2, QUIC, TLS 1.3
Windows network protocols: SMB, Kerberos, NTLM, LDAP, RDP
Zeek scripting and threat intelligence
Capture operations with tcpdump
PCAP analysis with Python: Scapy and pyshark
Case file: ransomware precursors on the Harborline Freight network
Traffic CTF arena
Advanced Suricata rule writing and performance
Network detection engineering
Analysing encrypted traffic without decrypting it
Hunting command-and-control traffic: beacons, tunnels, exfiltration
Threat hunting with Zeek logs
Case file: insider data leak at Veloxa Pay
Network sensor architecture and full packet capture at scale
Detection evasion and protocol anomalies: the defender’s side
Job role capstone: a SOC network analyst’s shift
Passwords and cryptography
Introduction to password security: policy, strength and multi-factor authentication
Introduction to cryptography: AES, SHA-256, RSA
Introduction to certificates: behind the browser padlock
Defending against password guessing with Hydra
John and hashcat: password hashes and storage security
Applied cryptography: OpenSSL and GPG
Auditing TLS configuration
Measuring the corporate password policy: a weak-password audit
Auditing and hardening SSH and GPG
Building and running an internal certificate authority
Auditing the authentication architecture: MFA, SSO and passwordless sign-in
Reviewing how applications use cryptography
Certificate lifecycle management: inventory, renewal and revocation
Secrets management: vaults, rotation and leak monitoring
Crypto agility and the post-quantum transition
PKI governance and trust architecture
Web application security
The web and browser security model: HTTP, origin, cookies, CORS and CSP
Web vulnerabilities fundamentals (OWASP)
Introduction to Burp Suite
First steps in web CTFs
Web surface review with ffuf and proxies
Injection flaws (SQL, command) and closing them
Burp Suite in depth: Intruder, session rules and extensions
Application scanning and automation with ZAP
Authentication security: passwords, MFA and login flows
Session management: from token to logout
Access control: IDOR and privilege checks
Cross-site scripting (XSS): reflected, stored and DOM
CSRF, SameSite and clickjacking
File upload and path traversal flaws
REST API security fundamentals
Security headers and TLS for web apps
Web server hardening with nginx and Apache
Reporting web security findings
Server-side flaws: SSRF, XXE, JWT and defence
Client-side flaws: XSS, IDOR and authentication defence
SQL injection in depth
Injection beyond SQL: command, template, NoSQL, LDAP and header
XSS and CSP in depth
Server-side request forgery (SSRF) in depth
XXE and insecure deserialization: not trusting the parser blindly
OAuth 2.0, OpenID Connect and JWT security
Business logic flaws
The OWASP API Security Top 10 classes
GraphQL security
Client-side security: code that runs in the browser
Advanced Burp Suite: automation and extension development
Detecting web attacks from logs
Writing and tuning WAF rules: ModSecurity and OWASP CRS
Secure code review fundamentals
Threat modelling for web applications
Bug bounty programmes and responsible disclosure
Practice assessment: Lunarbay Market (e-commerce)
Web CTF arena
SAML and enterprise single sign-on security
Race conditions and concurrency flaws
Protocol-level HTTP flaws: request smuggling and cache poisoning
Secure code review by language: PHP, Python and JavaScript
Secure code review by language: Java, C# and Go
Practice assessment: Corvane Clinic (patient portal and API)
Application security at scale: programme, automation and variant analysis
Practice assessment: Velmora Bank (online banking)
Job role capstone: web security tester
Job role capstone: application security engineer
Attack paths and their defence
Introduction to vulnerabilities: CVE, CVSS and patching
Introduction to validating findings safely
Introduction to misconfiguration audits on a Linux server
Introduction to Windows configuration audits
Vulnerability scanning: planning, running and interpreting
Validating your own systems with Metasploit
Access control on Linux: accounts, sudo, SSH and service permissions
Finding and closing privilege misconfigurations on Windows
The vulnerability management cycle: prioritisation, tracking and deadlines
Meterpreter and investigating a compromised system
Closing Linux privilege escalation paths: SUID, sudo, cron
Active Directory configuration audit
Risk-based vulnerability prioritisation and automation
Finding validation and post-fix retesting: controlled evidence
Auditing container and orchestration boundaries
Seeing and stopping lateral movement
Job role: vulnerability analyst
Configuration compliance across a Linux fleet: auditing as code
Enterprise identity: measuring privilege paths and tiered administration
Defence and hardening
System security fundamentals: UFW, sudoers
Windows security basics: accounts, UAC, Defender
Endpoint protection basics: antivirus and EDR
Network defence basics: segments, firewalls, VPN
Log management basics: syslog and the Windows event log
Introduction to vulnerability management: CVE, CVSS and patching
Domain administration basics: users, groups, GPO
Security monitoring basics: alerts, events, cases
Linux server hardening: SSH, PAM, sysctl
Windows server hardening: security policy, GPO, RDP, SMB
Windows telemetry with Sysmon
Malware detection with ClamAV and YARA
Firewalling with firewalld
Email security: SPF, DKIM, DMARC and phishing analysis
SOC fundamentals: SIEM, alert triage and playbooks
SIEM with Wazuh: agents, rules, active response
Introduction to detection engineering: Sigma rules
Introduction to threat hunting: hypothesis, data, ATT&CK
Vulnerability management: Nikto, Nuclei, Exploit-DB
Network vulnerability scanning with OpenVAS
Patch management: Linux and Windows
Active Directory security: auditing and hardening
First audit: get to know the domain, find the privileged accounts
What Active Directory is: domain, forest, OU
Domain controllers and DNS: SRV records
Authentication: Kerberos and NTLM
Querying the directory with LDAP: filters and attributes
Privileged groups: Domain Admins, Enterprise Admins, Backup Operators
Finding unused and disabled accounts
Service accounts and passwords that never expire
Password policy and fine-grained password policies (FGPP)
Local administrator passwords: LAPS
Auditing SMB shares and their permissions
Group Policy (GPO) basics
Delegation risks
Object permissions (ACLs) and dangerous rights
Windows event IDs that matter for AD
Detecting password spraying
Detecting and preventing Kerberoasting
DCSync and the abuse of replication rights
The tiered administration model (tier 0/1/2)
SMB and LDAP signing, LDAPS
The krbtgt password, backup and recovery
Capstone: the CORP.LAB audit report
Incident handling: from preparation to recovery
Scenario: your first week at Ardic Logistics
Auditing Linux against CIS benchmarks: Lynis, OpenSCAP
Confining applications with AppArmor
SELinux administration
Windows security baselines: CIS and Microsoft benchmarks
Host security and auditing: AIDE, auditd
Endpoint visibility with osquery
Firewalling with nftables
Security analytics with Elastic: ECS, KQL, EQL, dashboards
Network-based detection with Suricata
Network security monitoring with Zeek
Network threat hunting: beaconing, DNS, unusual flows
Endpoint threat hunting: persistence, process trees, legitimate tools
Risk-based prioritisation: CVSS v4, EPSS, KEV, SSVC
Hardening Active Directory in practice
Alert investigation practice: phishing, identity, endpoint, network
Containment and eradication: network, accounts and hosts
Scenario: ransomware night at Sedir Hospital
Career capstone: SOC analyst
Kernel, boot and service isolation
Advanced Windows protection: AppLocker, WDAC, Credential Guard, ASR
EDR operations: collection, isolation and response with Velociraptor
Web application firewall: ModSecurity and OWASP CRS
SIEM engineering: data model, correlation, capacity
Detecting Windows attacks
Detecting Linux attacks: auditd, Falco, eBPF
Intelligence-driven hunting: MISP, IOCs and TTPs
Running a vulnerability management programme: inventory, SLAs, exceptions, metrics
Detecting Active Directory attacks
Case management and SOAR: TheHive, Cortex, Shuffle
Ransomware readiness and response
Hardening a server fleet: Ansible, drift detection, compliance evidence
Segmentation and zero trust architecture
Detection as code: rule repository, tests and coverage
Long-haul hunting: tracing an intrusion campaign end to end
Recovering a compromised domain
Building and running a SOC
Career capstone: security engineer
Forensics, incident response and malware
Introduction to digital forensics and incident response
Files and metadata: what a file tells you
Forensics practice: first puzzles
Digital forensics fundamentals: dd, Foremost, ExifTool
Evidence acquisition: disk, live system and remote collection
File system forensics: FAT, NTFS and ext4
Linux forensic artefacts: logs, history and persistence
Windows forensic artefacts: what the user did
Log analysis: from syslog to web server logs
Browser and email forensics
Memory forensics: avml and Volatility
Malware analysis fundamentals: strings, strace, ltrace
Incident response: from preparation to lessons learned
Timeline analysis: from mactime to the super timeline
Windows registry forensics
Tracing attacks with Windows event logs
Disk examination with The Sleuth Kit and Autopsy
Windows memory analysis with Volatility 3
Document and script triage: macros, PDFs, PowerShell
Response playbooks and tabletop exercises
Forensics practice arena
Advanced memory analysis: injection, hiding and Linux memory
Dynamic triage in an isolated sandbox
Responding to a ransomware incident
Live response across a fleet: Velociraptor and osquery
Endpoint threat hunting: Sysmon and auditd
Case file: patient data access at Orchard Clinic
Case file: an inside job at Tidewater Savings
Detecting anti-forensics
Hunting rootkits in memory
Leading a major incident: incident command
DFIR analyst capstone project
Python for security
First steps in Python for security
Python for security operations: sockets and requests
Network programming for security: sockets and asyncio
Automating web and API checks with Python
Log analysis and threat hunting with Python
Using cryptography correctly in Python
Python for security practice
Build your own defence tools (Python)
Packet crafting and pcap analysis with Scapy
Web application security testing with Python
Detection engineering with Python: Sigma and YARA
Forensic triage and malware pre-analysis with Python
Network detection with Python: live monitoring and protocol parsing
Active Directory auditing with Python: ldap3 and impacket
Security automation and threat intelligence with Python
Binary analysis with Python: capstone, lief and pwntools
Job project: security automation engineer
DevSecOps
Introduction to DevSecOps: Git, Semgrep, CI
The secure software development lifecycle
Code repository security: Git, signed commits and access
Introduction to container security: Docker
Linux security for DevSecOps
Docker security
30 days of DevSecOps
Secrets management: scanning, rotation and leak response
Threat modelling: STRIDE and data flow diagrams
Secure coding principles: Python and JavaScript
Static analysis (SAST): Semgrep and Bandit
Dynamic testing (DAST): scanning with OWASP ZAP
Dependency security (SCA): pip-audit, npm audit, OSV-Scanner
CI/CD security: pipeline configuration, runners and tokens
Scenario: Lale Pay’s first secure release pipeline
Advanced threat modelling: attack trees and models as code
Writing your own SAST rules: Semgrep and data flow
DAST in the pipeline: ZAP automation and API scanning
Security testing in the pipeline: unit, integration and fuzzing
Software bill of materials (SBOM): Syft, CycloneDX, Grype
Advanced secrets management with Vault
Secure container images: minimal bases, Hadolint, Trivy
Hardening CI/CD: isolation, OIDC and pinned dependencies
Security gates and findings management in the pipeline
Scanning configuration files: Ansible, Dockerfile, Compose
Software supply chain security: signing, provenance and SLSA
Container runtime security: seccomp, AppArmor, Falco
CI/CD attack paths and their defence
Scenario: Pusula Software’s compromised build pipeline
Career capstone: application security engineer
Building a DevSecOps programme: maturity, metrics and champions
Career capstone: DevSecOps engineer
Organisational security, ethics and compliance
Cybersecurity for everyone
Security awareness for employees
Cyber ethics and law
Introduction to GRC
Introduction to risk management
Introduction to privacy: personal data and rights
Data protection and privacy
Governance, risk and compliance (GRC)
Using AI safely at work
Information security in the public sector and critical infrastructure
Implementing ISO/IEC 27001: building an ISMS
Applying NIST CSF 2.0
Implementing the CIS Controls
Risk assessment in practice
Policy and procedure writing workshop
Introduction to IT auditing
Introduction to business continuity and disaster recovery
Running a security awareness programme
Third-party and supply chain risk
Business continuity, disaster recovery and ransomware readiness
Cybersecurity for leaders
ISO/IEC 27002 controls in practice
SOC 2: trust services criteria and audit readiness
NIS2 and DORA compliance programme
Quantitative risk analysis: FAIR and Monte Carlo
ISO/IEC 27001 internal auditing
Auditing IT general controls (ITGC)
Technical configuration auditing
GDPR in depth
Privacy laws around the world
Incident management governance
Security metrics and reporting
Leading an ISO/IEC 27001 project: the road to certification
NIST SP 800-53, RMF and multi-framework compliance
Enterprise risk management and cyber risk
Evidence automation and continuous control monitoring
Privacy engineering and DPIA in practice
Disaster recovery plans and recovery testing
Scaling a third-party risk programme
AI governance: ISO/IEC 42001 and the EU AI Act
Job role capstone: GRC analyst
Leading a security programme and strategy
Job role capstone: IT auditor
Job role capstone: data protection officer (DPO)
Mobile app security: Android and iOS
Introduction to mobile app security
Android fundamentals: architecture, permissions and updates
Getting started with Android development in Kotlin and Java
iOS fundamentals: architecture, permissions and safe use
The Android security model: sandbox, permissions, signing and SELinux
App components and intents: activity, service, receiver, provider
Testing and builds on Android: JUnit, Robolectric, Gradle and CI
Secure mobile development 1: storage, cryptography, authentication and network
Android static analysis fundamentals: apktool, jadx and aapt2
Reviewing data storage on Android: preferences, databases and backups
Mobile app traffic analysis: prepared captures, TLS and pinning
The iOS security model: secure boot, code signing, sandbox and data protection
Static analysis of an IPA: Info.plist, entitlements and bundled files
Mobile device management (MDM) fundamentals
Inside the Android platform: Binder, Zygote, ART and hardware-backed security
Secure mobile development 2: platform, code quality, resilience and privacy
Smali and native code review: dex bytecode and .so libraries
Reviewing WebViews, deep links and IPC
Mobile backend API security
Automated mobile scanning: MobSF, semgrep and triaging findings
Triage of suspicious Android apps
Secure development on iOS: Swift code review and fixes
Reviewing data storage on iOS: containers, backups and the Keychain
Managing Android Enterprise: work profile, full management and policy files
Apple device management: configuration profiles and declarative management
Reviewing cross-platform apps: React Native, Flutter and hybrid
Mobile app assessment with MASVS: method, evidence and report
Privacy review of mobile apps: SDKs, permissions and declarations
Reviewing app resilience: obfuscation, integrity and attestation
Android device triage and forensics
iOS binary analysis: Mach-O, Objective-C and Swift
iOS device triage and forensics
Fleet compliance, conditional access and app protection policies
Mobile threat modelling and secure architecture
Mobile DevSecOps: the build pipeline, signing keys and release security
Building and running a mobile application security programme
Case: the Yelkovan Bankası mobile banking assessment
Certification prep
CompTIA A+ preparation
A+ exam prep: performance-based labs
A+ exam prep: practice exams
CompTIA Security+ prep
CompTIA Network+ prep
CompTIA Linux+ prep
RHCSA prep
LFCS prep
Security+ exam prep: threats, vulnerabilities and mitigations
Security+ exam prep: security architecture
Security+ exam prep: security operations
Security+ exam prep: security program management
Security+ exam prep: performance-based labs
Security+ exam prep: practice exams
Network+ exam prep: network implementation
Network+ exam prep: network operations
Network+ exam prep: network security
Network+ exam prep: network troubleshooting
Network+ exam prep: performance-based labs
Network+ exam prep: practice exams
Linux+ exam prep: system management
Linux+ exam prep: security
Linux+ exam prep: automation and scripting
Linux+ exam prep: troubleshooting
Linux+ exam prep: performance-based labs
Linux+ exam prep: practice exams
RHCSA exam prep: objective-by-objective labs
LFCS exam prep: objective-by-objective labs
LPIC-1 exam prep: the first exam
LPIC-1 exam prep: the second exam
LPIC-1 exam prep: practice exams
RHCSA practice exam 1
RHCSA practice exam 2
LFCS practice exam 1
LFCS practice exam 2
RHCE: automation with Ansible
Security+ exam prep: final mock exam
Network+ exam prep: final mock exam
Linux+ exam prep: final mock exam
RHCSA exam prep: final mock exams
LFCS exam prep: final mock exams
CySA+ exam prep: security operations
CySA+ exam prep: vulnerability management
CySA+ exam prep: incident response
CySA+ exam prep: reporting and communication
CySA+ exam prep: performance-based labs
CySA+ exam prep: practice exams
PenTest+ exam prep: engagement planning and scoping
PenTest+ exam prep: reconnaissance and enumeration
PenTest+ exam prep: vulnerability discovery and analysis
PenTest+ exam prep: attacks and exploits
PenTest+ exam prep: performance-based labs
PenTest+ exam prep: practice exams
LPIC-1 exam prep: final mock exam
RHCE Enterprise Linux: troubleshooting and recovery
CySA+ exam prep: final mock exam
PenTest+ exam prep: post-exploitation and reporting
PenTest+ exam prep: final mock exam
Challenge packs
30 days of beginner tasks
First steps in CTF
30 days of cyber security
Weekly scenarios: season 1
CTF series: intermediate
Linux challenges: broken servers
Network challenges: clues in the traffic
Web challenges: find it, fix it
60 days of cyber security
Weekly scenarios: season 2
CTF series: challenging
Web challenges: advanced
Forensics challenges: what happened?
Blue team challenges: from alert to incident
100 days of cyber security
Weekly scenarios: season 3
CTF series: advanced
Active Directory challenges: defend the domain
CTF series: expert