security-offensive

Offensive Security

How attacks actually work, lab-framed and ethics-first: recon, web and infrastructure exploitation, and pentest methodology — so you can defend and read a findings report.

6 units·22 lessons·~6 h

Start track →

Start here

The attacker mindset for defenders — and the ethics, scope, and authorization that make it legal.

01 Ethics, scope, and the attacker mindset 16 min

Recon and enumeration

Map the attack surface before touching it: OSINT, footprinting, scanning, and service enumeration — ethics first.

01 OSINT and footprinting 15 min 02 Attack surface mapping 15 min 03 Port and service scanning 15 min 04 Enumeration techniques 15 min

Web exploitation

The attacker's view of OWASP: how injection, XSS, SSRF, IDOR, and auth bypass are found and proven — lab-framed.

01 Injection attacks 15 min 02 XSS in practice 15 min 03 SSRF and IDOR 15 min 04 Auth bypass and session attacks 15 min 05 Finding and proving bugs 16 min

Network and infrastructure attacks

How attackers move below the app: MITM, privilege escalation, password attacks, and lateral movement — conceptually.

01 MITM and interception 15 min 02 Privilege escalation 15 min 03 Password attacks and cracking 15 min 04 Pivoting and lateral movement 18 min

Exploitation and post-exploitation

From a vulnerability to control, and what attackers do after — so defenders can detect each step.

01 From vulnerability to exploit 15 min 02 Payloads and shells 15 min 03 Command and control 15 min 04 Persistence and post-exploitation 18 min

Tooling and methodology

The pentester's toolkit and process: Burp, nmap, a repeatable methodology, and a finding/report that lands.

01 The pentest toolkit 15 min 02 Pentest methodology 15 min 03 Writing findings 15 min 04 The pentest report 18 min

Build with this track

Guided projects that exercise what you learn here.

◆ Projects

Authorized Recon-to-Remediation Lab

Stand up an intentionally-vulnerable target you own — a deliberately-broken app in a local container or a CTF box on your own machine — and run a full offensive engagement against it, end to end, on a scope you signed off yourself. You recon the box, pick one class of vulnerability, prove it with a working exploit in the lab, and then turn around and write the fix and the detection. The point isn't to 'pop a box'; it's to live the whole loop a real engagement runs — scope, evidence, impact, remediation — on a target where nobody gets hurt.

Next track

Defensive Security

Detect, respond, and harden: logging and detection engineering, incident response, defense-in-depth, and the security operations an engineer runs in production.