Everything here is open. Lessons are ordered, but nothing is locked, read in order if you're starting out, or jump straight to what you need.
Master the fundamentals of security and how the web works.
The core ideas every later lesson builds on: the CIA triad, identity, and how attacks unfold.
Trace one page load end to end: the network overview, the request's journey, and the HTTP conversation underneath.
Go deeper on the languages machines speak and how they're addressed, how names resolve to IPs, and how attackers target people instead.
What the padlock really means: the TLS handshake and the chain of trust behind it.
Capture, read, and filter packets in an in-browser Packet Lab, no install required.
Learn Linux, networking, and how to find your target.
Hands-on shell skills: navigating files, permissions, processes, and network commands.
How traffic is routed, how networks are segmented, and how firewalls hold the line.
Information gathering end to end: the big-picture flow, dorking, search engines and crawlers, then subdomains, port scanning, service and web fingerprinting, wordlists, content discovery, and deeper web recon.
Administer a server the real way: SSH login and hardening, scp/sftp transfers, tunnels, and FTP.
Exploit vulnerabilities and escalate privileges.
Zoom out on the whole engagement, see what Phase 2 already covered, and what's still ahead.
Turn the web apps you found in recon into a way in: the OWASP Top 10, 2025 updates, then SQL injection, cross-site scripting, broken access control, command injection, and CSRF, hands-on.
From a low-privilege foothold to root: enumerate the box, then abuse SUID binaries and sudo rules with GTFOBins.
Once you're in and you're root, how attackers stay in: backdoored accounts and SSH keys, and startup, cron, and service implants, plus how defenders spot them.