Offensive Security

Course 01

Recon and OSINT

Map the target before touching it: attack surface, exposed services, and the open-source footprint that hands an attacker the first move.

4 lessons · ~6 h

1. 01Scoping and rules of engagementWhat you may and may not touch, in writing, before anything else.90 min
2. 02Passive reconThe open-source footprint; what leaks from DNS, certs and public repos.90 min
3. 03Active reconService discovery and fingerprinting; the difference between noisy and quiet.90 min
4. 04Mapping the surfaceEverything reachable, ranked by likely reward, each item confirmable.90 min

Course 02

Web and API attacks

The OWASP families as things you exploit and then fix: injection, broken auth, IDOR and the API-specific top ten against a real target.

4 lessons · ~8 h

1. 01The web attack surfaceWhere trust boundaries break; how a request becomes a compromise.90 min
2. 02InjectionSQL, command and template injection against a real target; the fix that actually closes it.120 min
3. 03Broken access controlIDOR and privilege escalation; object-level authorization from the attacker's side.120 min
4. 04API attacksThe API top ten; mass assignment, broken object-level auth, and rate-limit abuse.120 min

Course 03

Network exploitation

From a foothold to more: service exploitation, privilege escalation on Linux, and pivoting through a segmented network.

3 lessons · ~6 h

1. 01Getting a footholdService exploitation into a first shell; stabilizing it.120 min
2. 02Linux privilege escalationSUID abuse, capability misconfiguration, cron path injection; and when a kernel exploit is the wrong move.120 min
3. 03Pivoting and tunnellingThrough segmentation to a target you could not reach directly.120 min

Course 04

Active Directory attack paths

The enterprise's soft center: enumeration, credential attacks, and the delegation and trust abuses that turn one account into domain control.

3 lessons · ~6 h

1. 01AD enumerationThe graph of who can do what to whom; the query that finds the path.120 min
2. 02Credential attacksKerberoasting, AS-REP, and the hygiene failures that enable them.120 min
3. 03Delegation and trust abuseThe misconfigurations that collapse a domain; the fix for each.120 min

Course 05

Cloud, container and mesh attacks

Attack the exact stack the platform paths build: cloud IAM, a Kubernetes cluster, a container escape, and abuse of a service mesh.

4 lessons · ~8 h

1. 01Cloud IAM attacksOver-permissive roles, the metadata endpoint, and privilege escalation in the cloud control plane.120 min
2. 02Attacking KubernetesExposed workloads, RBAC gaps, and secrets reachable from a pod.120 min
3. 03Container escapesThe misconfigurations and capabilities that let a process leave its container.120 min
4. 04Mesh and gateway abuseTurning a mesh's trust against it; what the platform path's mTLS and policy actually prevent.90 min

Course 06

Reporting that gets fixed

A finding nobody acts on is wasted. Write reports engineers fix from: reproduction, impact, and a remediation they can ship.

3 lessons · ~5 h

1. 01The report is the productWhy the write-up, not the shell, is what the client paid for.90 min
2. 02Reproduction and impactSteps anyone can follow, and impact stated without inflation.90 min
3. 03Remediation that shipsFixes an engineer can act on; mapping each to the control that prevents recurrence.90 min