Hands-On Hacking Course

Lesson 1 • The Hacker Mindset and Ethics

Defines offensive security roles, attacker motivations, and the ethical boundaries that separate authorised testing from criminal activity. Anchors all subsequent technical work in professional responsibility.

Lesson 2 • Introduction to Kali Linux and Core Tools

Orients students to the Kali Linux filesystem, package management, and the essential toolset used throughout the course. Builds command-line fluency required for all later modules.

Lesson 3 • Core Networking Concepts for Hackers

Reviews TCP/IP, DNS, HTTP, and routing fundamentals through an attacker's lens. Provides the protocol literacy needed to understand every subsequent exploitation technique.

Lesson 4 • Building a Safe Lab Environment

Guides students through hypervisor setup, vulnerable VM deployment, and network isolation. A functional lab is the prerequisite for every hands-on exercise in the course.

Lesson 1 • Network Scanning and Host Discovery

Applies Nmap and similar tools to identify live hosts, open ports, and operating systems across a target network. Results form the foundation for service-level enumeration.

Lesson 2 • DNS and Domain Enumeration

Demonstrates zone transfers, brute-force subdomain discovery, and DNS record analysis to map an organisation's internet-facing footprint. Feeds directly into port scanning and service enumeration.

Lesson 3 • Organising and Reporting Recon Data

Structures collected intelligence into a target profile using mind maps, spreadsheets, and note-taking tools. Prepares students to translate raw data into actionable attack plans.

Lesson 4 • Service and Version Enumeration

Extracts service banners, version strings, and configuration details from open ports to identify exploitable software. Bridges raw scan data to vulnerability identification.

Lesson 1 • Manual Vulnerability Verification

Teaches techniques to confirm scanner findings without triggering exploits, reducing false positives before reporting. Reinforces the difference between detection and exploitation.

Lesson 2 • Vulnerability Scoring and Prioritisation

Applies CVSS scoring, asset criticality, and exploitability factors to rank vulnerabilities by business risk. Enables students to focus exploitation efforts on highest-impact targets.

Lesson 3 • Using Nessus and OpenVAS

Provides hands-on configuration and execution of industry-standard scanners against lab targets. Students interpret raw scan output and export findings for analysis.

Lesson 4 • Web Application Vulnerability Scanning

Introduces DAST tools such as Nikto and OWASP ZAP for automated web vulnerability discovery. Prepares students for the manual web exploitation techniques covered in later chapters.

Lesson 1 • Exploiting Common Network Services

Targets vulnerable versions of SMB, FTP, and SSH services using both Metasploit modules and manual exploits. Reinforces the link between enumeration findings and exploit selection.

Lesson 2 • The Exploitation Lifecycle

Maps the stages from vulnerability selection through payload delivery to session establishment. Provides a repeatable mental model applied in every subsequent exploitation exercise.

Lesson 3 • Metasploit Framework Mastery

Covers the Metasploit console, module taxonomy, and option configuration for rapid exploit deployment. Students run their first successful exploit against a vulnerable lab service.

Lesson 4 • Post-Exploitation Basics

Covers immediate post-shell actions: system enumeration, privilege checking, and persistence setup. Bridges initial access to the deeper post-exploitation chapter that follows.

Lesson 1 • Injection Attacks: SQL and Beyond

Teaches manual and tool-assisted SQL injection, command injection, and LDAP injection against vulnerable applications. Students extract database contents and achieve OS-level command execution.

Lesson 2 • Authentication and Authorisation Flaws

Exploits weak passwords, broken access controls, insecure direct object references, and JWT vulnerabilities to escalate privileges within web applications. Directly applicable to real-world assessments.

Lesson 3 • Web Application Architecture for Attackers

Maps client-server communication, authentication flows, and session management from an attacker's perspective. Establishes the technical context for every web vulnerability class that follows.

Lesson 4 • Advanced Web Exploitation Techniques

Covers SSRF, XXE, file upload bypasses, and deserialisation vulnerabilities that lead to remote code execution. Prepares students for complex, chained web attack scenarios.

Lesson 1 • ARP Poisoning and MitM Attacks

Executes ARP cache poisoning with Ettercap and Bettercap to position an attacker between hosts and intercept traffic. Demonstrates real-time credential theft and session hijacking.

Lesson 2 • Packet Capture and Traffic Analysis

Uses Wireshark and tcpdump to capture, filter, and decode network traffic for credential and session data. Provides the analytical foundation for all active network attack techniques.

Lesson 3 • Password Cracking and Hash Analysis

Applies Hashcat and John the Ripper with wordlists, rules, and mask attacks to crack captured hashes offline. Reinforces credential harvesting outcomes from the post-exploitation chapter.

Lesson 4 • Wireless Network Attacks

Targets WPA2 handshake capture, PMKID attacks, and evil-twin access points to compromise wireless networks. Extends MitM skills to the wireless attack surface.

Lesson 1 • Persistence and Defence Evasion

Establishes covert persistence through scheduled tasks, registry run keys, and backdoored services while evading common defences. Teaches students to maintain access across reboots.

Lesson 2 • Linux Privilege Escalation

Identifies SUID binaries, cron job misconfigurations, writable paths, and kernel exploits that elevate a low-privilege shell to root. Builds systematic enumeration habits for Linux targets.

Lesson 3 • Active Directory Attacks

Covers AS-REP roasting, DCSync, Golden Ticket, and domain trust abuse to achieve full Active Directory compromise. Represents the culmination of the privilege escalation chapter.

Lesson 4 • Windows Privilege Escalation

Targets unquoted service paths, weak registry permissions, token impersonation, and AlwaysInstallElevated to gain SYSTEM on Windows hosts. Mirrors real-world Windows assessment workflows.

Lesson 1 • Simulated Full-Scope Engagement

Students execute a complete black-box penetration test against a multi-service lab environment from recon to report. Serves as the capstone assessment integrating all course competencies.

Lesson 2 • Engagement Planning and Scoping

Defines rules of engagement, scope boundaries, communication protocols, and emergency contacts before testing begins. Prevents legal and operational incidents during real engagements.

Lesson 3 • Evidence Collection and Chain of Custody

Establishes practices for timestamped screenshots, command logs, and hash-verified artefacts that support findings. Ensures findings are defensible and reproducible during client review.

Lesson 4 • Writing Professional Penetration Test Reports

Structures executive summaries, technical findings, risk ratings, and remediation guidance into a polished deliverable. Translates technical exploitation outcomes into business-relevant language.