Guided production scenarios with step-by-step environments.
IP addresses identify hosts; subnet masks and CIDR define neighborhoods; and understanding both tells you what a packet will do next — a skill you use for every scan, firewall rule and incident.
DNS translates names to addresses through a hierarchy of resolvers and authoritative servers. It is the internet's most abused protocol — and a primary sensor for both attackers and defenders.
HTTP is the request/response protocol of the web; HTTPS adds TLS underneath it. Every web attack is expressed in HTTP verbs, headers and bodies — so defenders read HTTP fluently.
Switches forward frames inside a subnet; routers forward packets between subnets. Knowing where traffic crosses a boundary is knowing where the security control must live.
Well-known ports identify common services (22 SSH, 80/443 web, 3389 RDP). Knowing the default service map tells an analyst what SHOULD be listening — and what's suspicious when it isn't.
Linux powers most servers, cloud instances and attack tools. A security analyst reads processes, logs, permissions and the filesystem the same way a pilot scans instruments — constantly and confidently.
Authentication proves who you are; authorization decides what you may do. Getting the two mixed up — or using weak authN — is the root of most access-control breaches.
Hashing protects integrity, symmetric encryption protects confidentiality at scale, asymmetric crypto enables TLS and signatures — and PKI certifies identity. Analysts read the crypto layer in every trail.
Threat modeling is structured pre-mortem thinking: what are we building, what could go wrong, and what must we do about it — using STRIDE per component and DREAD to prioritize.
Risk = likelihood × impact, expressed in a language executives and auditors understand. Risk management decides what to accept, mitigate, transfer or avoid — and where budget is actually spent.
Learn to inspect raw network traffic with tcpdump and Wireshark so you can see exactly what travels across a link, where it is going, and whether it is expected.
Go under the hood of TLS: handshake, certificate chains, cipher suites, and the common misconfigurations that undo an 'https' padlock.
Understand signature- and behavior-based detection, the IDS-to-IPS decision, and how to tune alerts so your SOC hears the fire, not every bird.
Design the trust boundaries that contain an attacker: VLANs and subnets, east-west filtering, and what next-gen firewalls add beyond port 80/443 luck.
Defend the channel and the envelope: SPF, DKIM, and DMARC alignment, plus phishing-resistant practices and the honest limits of any email control.
A repeatable checklist approach to making every device on the wire harder to break into: base configs, service minimization, RBAC on admin, and change control.
Learn how untrusted input becomes code in the database, and the layered defenses — parameterization, least privilege, and WAF — that make it boring.
How the browser itself becomes the victim: reflected, stored, and DOM-based XSS, and the output-encoding rules that eradicate the class.
When the browser itself is the weapon: how forged cross-site requests ride the user's own session, and the four defenses that stop them.
When your server fetches on the attacker's behalf: how SSRF tunnels into internal metadata, clouds, and admin services, and how to make fetching boring again.
The most common silent killer: horizontal and vertical access-control gaps, the Insecure Direct Object Reference subset, and how to test authorization like a two-account puzzle.
Secure the keys to the kingdom: password storage, MFA, session lifetime, cookie flags, and the account-recovery paths attackers weaponize.
APIs are the new front door: authentication, rate limiting, schema validation, mass assignment, and the top API-specific risks that web scanners miss.
Enlist the browser itself in your security team: HSTS, X-Content-Type-Options, Referrer-Policy, and a properly-shaped Content-Security-Policy.
Control who can touch what in the cloud: users, roles, policies, and least privilege as enforceable code rather than good intentions.
Turn 'encrypted at rest' from a checkbox into engineering: key hierarchy, rotation, envelope encryption, and who actually holds the keys.
Build the evidence trail that makes cloud audits and incident response possible: who did what, when, from where, and what the provider actually logs.
Apply segmentation thinking in the cloud: VPC design, security groups and NACLs, and the default-deny posture that keeps a compromise contained.
Secure the control plane, the workload plane, and the supply of both: RBAC, admission policy, network policies, and secrets-in-etcd without a plaintext excuse.
Stop treating secrets as config and start treating them as identity: vaulting, rotation, short-lived credentials, and the pre-commit scan that catches them early.
The SIEM as the SOC's nervous system: ingestion, normalization, correlation, and the storage math that decides what you can afford to keep.
Write detections like code: hypotheses, atomic tests, false-positive budgets, and the unit-test-for-alerts pipeline that keeps the queue honest.
The framework that lets security teams agree: tactics, techniques, groups, and how to map your detection coverage to what adversaries actually do.
The discipline of deciding fast and honestly: triage criteria, enrichment, the deny-of-action before escalation, and the queue hygiene that keeps analysts sane.
The disciplined lifecycle from preparation to lessons learned: detection, containment, eradication, recovery — and the documentation audit requires.
Digital forensics & incident response: acquisition order, memory-first preservation, file/artifact analysis, and timelines that stand up in a review.
Before any packet flies: why written authorization, clear scope, and Rules of Engagement are not paperwork but the ethical and legal foundation of all testing.
Learn everything before you touch anything: OSINT, DNS enumeration, certificate transparency, and the passive-recon discipline that needs no permission because it needs no access.
Now that you may touch: host discovery, port scanning with nmap, service/version detection, and the etiquette of scanning only what scope allows.
Match what you found against known weakness databases: scanners, plugins/checks, false positives, and how a good scan becomes a ranked remediation list.
From finding to proof: the disciplined turn from discovery to proof-of-concept, in lab environments only, and the ethics that make 'can we' different from 'should we'.
Turn theory into reps: DVWA, Juice Shop, and local ranges as your forever lab, plus the playbook that makes every drill safe and reviewable.
Read the code for bugs before it ever runs: how SAST works, its blind spots, rule tuning, and the triage discipline that keeps the findings believable.
Test the running application the way an attacker would: crawling, injection probes, and authen-thresholding — on environments you control.
The supply-chain of code you didn't write: software composition analysis, SBOM generation, CVE reachability, and the incident-readiness puzzle that Log4j built.
Your cloud is now source code — so the code must be reviewed, scanned, and diffed: IaC linting (checkov/tfsec), drift, and state-as-a-privilege.
The pipeline is the blast radius center: hardened runners, least-privilege credentials, unsigned artifacts, and the supply-chain attacks that target build infrastructure itself.
Audit evidence as CI artifacts: policy-as-code, control mapping, continuous evidence, and the difference between 'we claim' and 'we can prove'.
Never trust, always verify: how to turn 'trust the network' inside out with identity, device posture, microsegmentation, and continuous evaluation.
From AEAD cipher suites to key derivation, rotation, and the failures that matter: how cryptography shows up in real systems and where implementations go wrong.
Write detections that survive real data: grounded in ATT&CK, tuned against noise, versioned like code, and measured by false positives as well as hits.
Hypothesis-driven hunts beyond the alert queue: forming hypotheses from intelligence, hunting across telemetry, and proving or ruling out suspicious activity.