Updated weekly · L opens Learn

Master ethical hacking with lab-first lessons

Learn recon, web/API testing, upload hardening, scripting, and blue-team detection through guided, step-by-step slides. Every module begins with rules of engagement and ends with defense.

  • Zero-prod policy: labs run locally or in containers.
  • Copyable commands with safe defaults.
  • Defense-in-depth: headers, auth, rate limits, logging.
  • Blue-team tie-ins: detections, triage, IR basics.
Browse TutorialsTry a Demo Lesson
Modern UI
Progress tracking
Slide-by-slide learning
Mobile-first design
Copyable code blocks
Quick quizzes
/lab/targets/api
$ nmap -p 80,443,8080 -sV target.lab
80/tcp   open  http    nginx 1.24
443/tcp  open  https   nginx 1.24
8080/tcp open  http    gunicorn/uvicorn

$ curl -s -i https://target.lab/login | head -n 5
HTTP/1.1 200 OK
Server: nginx
Content-Security-Policy: default-src 'self'
tip: respect scope; never test production
Recon: hosts: 4
Ports: 80/443/8080
Headers: CSP,HSTS
XSS → encode output, set CSP
SQLi → parameterize queries
SSRF → allowlist + IP vetting
Uploads → MIME + AV + signed URL
New this week: Memory & ROP lab · AI prompt defense refresher
Important: Tutorials are for authorized testing and education only. Practice in labs you own/control, respect laws and policies, and prioritize defense.
0+
Interactive lessons
0+
Hands-on labs
0+
Sample scripts
0+
Free modules

Hacking Curriculum Overview

Guided paths with clear outcomes: understand risk, break down attack paths, and harden defenses.

🧭

Recon & OSINT

People, companies, infra, metadata hygiene.

🌐

Web App Basics

HTTP, cookies, sessions, headers & TLS.

🧪

OWASP Top 10

Input validation, auth, access control, more.

🔗

API Security

REST/GraphQL, rate limits, auth schemes.

📦

File/Upload Safety

MIME checks, storage patterns, signed URLs.

🕳️

XSS & Clickjacking

Encoding, CSP, frame-ancestors, sandbox.

🧰

Scripting for Hackers

Python, Bash, PowerShell automation.

🖥️

Privilege Escalation

Linux misconfigs, PATH, sudo basics.

🐳

Containers/K8s

RBAC, network policies, secrets, images.

🛰️

Pivoting (Lab)

Tunnels & forwarding in isolated labs only.

🧬

AI Prompt Safety

Prompt injection & data exfiltration risks.

🛡️

Blue-Team View

Logging, EDR/SIEM basics, triage & IR.

See lesson catalog

Tooling you’ll use (in labs)

Burp SuiteIntercept, modify, replay HTTP(S)
ffufWordlist fuzzing & discovery
nmapPort scan, service enum, NSE
curl/httpieQuick API probes
jqParse/shape JSON output
mitmproxyScriptable intercept
kubectlCluster introspection (lab)
WiresharkPackets & protocols
Burp SuiteIntercept, modify, replay HTTP(S)
ffufWordlist fuzzing & discovery
nmapPort scan, service enum, NSE
curl/httpieQuick API probes
jqParse/shape JSON output
mitmproxyScriptable intercept
kubectlCluster introspection (lab)
WiresharkPackets & protocols
Burp SuiteIntercept, modify, replay HTTP(S)
ffufWordlist fuzzing & discovery
nmapPort scan, service enum, NSE
curl/httpieQuick API probes
jqParse/shape JSON output
mitmproxyScriptable intercept
kubectlCluster introspection (lab)
WiresharkPackets & protocols
Burp SuiteIntercept, modify, replay HTTP(S)
ffufWordlist fuzzing & discovery
nmapPort scan, service enum, NSE
curl/httpieQuick API probes
jqParse/shape JSON output
mitmproxyScriptable intercept
kubectlCluster introspection (lab)
WiresharkPackets & protocols

What you’ll practice

Scenario-driven modules designed for practical understanding and safer real-world application.

Systematic recon checklists & note-taking
Threat modeling and attack surface mapping
Building safe scrapers & automation scripts
Hardening uploads, auth flows, and headers
Detecting common findings in logs/EDR
Creating reproducible lab environments
Is this safe and legal?❯

Yes — you’ll practice only in lab environments you own/control or have explicit permission to test. Every lesson starts with rules of engagement.

Do I need prior experience?❯

Basic web and scripting knowledge helps. Modules are progressive: beginner-friendly intros build toward advanced labs.

How are the lessons structured?❯

Slide-by-slide walkthroughs with commands, screenshots, and checks. Many include copyable snippets and quick quizzes.

Start learning ethicallyBy using this site you agree to our Responsible Use Policy.