Navigate the Linux filesystem using real commands. Locate hidden files, inspect inodes, and use find to hunt SUID binaries like a penetration tester.

Set and exploit file permissions. Create SUID binaries, configure sudo rules, and understand where misconfigurations lead to privilege escalation.

Write a functional recon script from scratch. Variables, loops, functions, argument parsing, and output formatting all in the live terminal.

Discover live hosts, identify open ports, and extract service versions using nmap and ss. Practice the core recon workflow from every engagement.

Monitor running processes, analyze open file descriptors, set up cron jobs, and understand what systemd services are running on startup.

Analyze auth logs, extract attacker IPs, build grep+awk pipelines to surface anomalies from system noise. Real forensics in the terminal.

A full-screen SOC investigation: detect the brute force, find the successful login, trace the post-compromise moves. (Bite-size practice terminals also live inside each lesson now.)

Analyze email headers and system logs to identify signs of a phishing attack and indicators of compromise (IoCs).

Configure a segmented network and audit backup configurations to ensure data integrity.

From brute force attack to containment, analyze logs and data sources.

A hands-on lab to practice risk calculations and vendor contract evaluations.

A full engagement packet has landed. Read the SOW, ROE, and scope, and answer the go/no-go questions a real tester must clear before starting.

OSINT, a port scan, and enumeration output are sitting in files. Read them, correlate, and answer where you'd strike first.

Read a raw vulnerability report, throw out a false positive, and order the real findings by true risk — CVSS plus KEV plus context.

Assign the right crack modes, spot the web access-control flaw, and identify the cloud exposure — then check the ethics before you act.

Read host and AD artifacts and rebuild the attacker's path — pivot, credential, lateral hop, domain takeover — then name the cleanup done right.

Read evidence from every phase, order it into the chain that reached Domain Admin and PHI, and name the single remediation that breaks it earliest.

Three users report 'no connectivity.' Read the interface, routing, and addressing captures, name the OSI layer of each fault, and state the fix.

VLAN 10 users can't reach the VLAN 20 server and trunks are unstable. Read show vlan brief, show interfaces trunk, and the L3-switch config; name each fault and the fix.

A branch can't reach HQ and the gateway won't fail over. Read show ip route, show ip ospf neighbor, and show standby brief; find the missing route/return path and the missing preempt.

External connectivity is down, clients aren't getting addresses, and management isn't secure. Read the captures; find the overload-syntax, helper-address, NTP-keyword, and Telnet faults.

A campus claims best practices but a VLAN-10 client can't reach the web server and the perimeter is exposed. Read the captures; fix the ACL, DHCP-snooping trust, AAA fallback, and Telnet.

A pipeline (controller + Ansible + Terraform) is failing. Read the payloads and responses; fix the JSON boolean, the 401 vs 403, the YAML indentation, and the NETCONF port.

The HQ+branch build is 'done.' Read the verification captures across all six domains, confirm end-to-end operation, and identify the one security-first fault that fails the rubric.

You're handed a proxy capture of an app walkthrough. Enumerate what exists, spot the two access-control tells, and file each with the correct WSTG/CWE/Top-10 labels.

A capture bundle from an engagement: object endpoints, an admin route, response headers, and a CORS preflight. Classify each finding and tie it to the right ASVS chapter.

You're reviewing a service you didn't build. Read the dependency + CI artifacts and the crypto config, then classify each issue as supply-chain or cryptographic and map it to ASVS.

A mixed bundle: SQL/OS probes, three render outputs, and two multi-step flows. Confirm each injection with its evidence, separate the logic flaws, and map to CWE/WSTG/ASVS.

Four capture files map to A07, A08, A09 and A10. Read each, state the vulnerability and CWE, and tie it to the right ASVS chapter — including the fail-open case that decides A10.

The capstone rehearsal. Work a MeridianShop capture bundle end to end: enumerate, hit every 2025 category with correct labels, identify the account-takeover chain, and check yourself against the rubric key.

Planning only — no scanning. Turn a fictional authorized brief into the artifacts a competent tester prepares: an authorization/scope checklist, a five-phase plan, a kill-chain + ATT&CK annotation, and a go/no-go under pressure. Then spot what makes a sloppy plan illegal.

Passive OSINT plus one real, authorized zone transfer against DigiNinja's training domain zonetransfer.me: WHOIS/DNS, AXFR, CT-log + Amass subdomains, and Shodan (with honest limits). Then spot the footprinting violations.

Scan an authorized lab host at 192.168.100.10 the full way: host discovery → SYN/connect/stealth port scans → service & OS fingerprinting → evasion. Read every port state from real Nmap output, then spot the scanning violations.

Authorized enumeration of SMB, SNMP, LDAP, DNS, SMTP, NFS, and RPC across an in-scope VM lab — one technique per protocol, each leak paired with its fix — then spot the flaws in a sloppy run.

Analyze an outdated lab VM: discover services, scan with GVM, score CVE-2019-14287 from its real CVSS v3.1 vector (7.8, not 9.8), prioritize with KEV+EPSS, and verify by inspection — then spot the flaws in a bad report.

Run Gaining Access (offline cracking, Pass-the-Hash), privilege escalation (Linux SUID, Windows unquoted path), persistence, steganography, and covering tracks on lab VMs — then spot the flaws in a sloppy engagement.

Analyze a benign lab sample static → dynamic → memory, map behaviors to the correct ATT&CK IDs, and apply layered defenses — then spot the analysis flaws.

Capture cleartext credentials passively then actively (ARP spoofing), harvest a NetNTLMv2 hash with Responder, and pair each attack with its Layer-2 defense — then spot the flaws.

Stand up a SET credential harvester and a GoPhish campaign, run a correctly-labeled hping3 SYN flood, reason through a tailgating tabletop — then spot the flaw in a sloppy engagement, each attack paired with a control.

Inspect an unprotected session cookie, steal it via stored XSS, forge a TCP RST over an MITM, then evade a signature NIDS and tunnel out over DNS — each step with a correct ATT&CK tag and a countermeasure.

Run the web pipeline on DVWA — recon (headers, nmap, ffuf), map with Burp, prove stored XSS, and upload a webshell for RCE — then spot the OWASP-mislabeling flaw, each exploit paired with its defense.

Walk the SQLi chain on DVWA (2-column id lookup): confirm the injection, UNION-enumerate via information_schema, dump credentials, then automate with sqlmap --cookie — and spot the flaws in a sloppy engagement.

Walk the full WPA2-PSK chain on your own lab AP: stand up hostapd, discover with airodump-ng, deauth to capture the 4-way handshake, convert with hcxpcapngtool, crack with hashcat -m 22000 — then note WPS/enterprise and spot the flaws.

Walk a scoped edge-device engagement on your own lab: pull a hardcoded key + exported component from an APK, subscribe to an unauthenticated MQTT broker, carve firmware with binwalk, read/write a simulated PLC over Modbus — mapping each finding to its list and spotting the flaws.

Audit a deliberately misconfigured lab AWS sandbox, read a public S3 secret, ride SSRF→IMDSv1 to steal the instance role's credentials, and escape a container via a mounted docker.sock — then spot the flaws in a bad writeup.

Recognize and crack an unsalted MD5, flag a weak TLS stack (RSA key transport, no forward secrecy), decrypt an OpenSSL file with a known weak passphrase, and sign/verify with GPG — then spot the crypto flaws.

Trace the whole signed engagement against “Meridian Freight” — recon → scan/enum → gaining access → post-exploitation → reporting — capturing the 20 MER-FLAG{...} flags with the exact commands, then self-score against the key.

Obtain an official Kali image, prove it's genuine two ways (SHA-256 + GPG), boot it live, and confirm the non-root model — then spot the flaw in a sloppy setup.

Run the daily operator drills — user/environment, filesystem, permissions, the SUID-on-scripts gotcha, systemd services, and pipes — then spot the flaw in a bad workflow.

Walk the verified install of Kali with LUKS encrypted LVM: non-root user, the LUKS→LVM layering, post-boot verification — then spot the flaws in a bad install writeup.

Walk the real configuration of a fresh Kali: NetworkManager networking, NM-managed DNS, the ssh unit + host-key regeneration, a non-root sudo user, timezone, and the single official APT line — then spot the flaws in a bad setup.

Work the self-sufficiency loop on a real Kali: man sections and --help, finding the package behind a tool, reading service failures out of journalctl, and drafting a versioned, reproducible bug report — then spot the flaws in a bad help workflow.

Harden accounts, SSH, and the firewall; add fail2ban; patch; and set up monitoring, integrity, and LUKS on a Kali box reachable over SSH — then spot the flaws in a sloppy setup.

Confirm the platform, install and inspect a package, install a local .deb with deps, recover a broken state, hold and pin versions, and confirm keyring-signed repos — then spot the flaws.

Confirm your context, explore the core and role metapackages, inspect what they pull in, use the kali-tweaks ncurses menu, and toggle Kali Undercover — using only official names, then spot the flaws.

Build a custom Kali ISO with live-build, set up plain and LUKS-encrypted persistence, and arm the nuke — then spot the flaws in a sloppy build.

Build the enterprise chain: a PXE/preseed unattended install (root locked), a signed reprepro repo, and a Salt state — then spot the flaws in a bad deployment.

Enable deb-src, rebuild a package with a quilt patch, build one from scratch, host a signed repo, and compile a kernel — then spot the flaws in a bad workflow.

Match each mission to the right Kali variant and its real constraints — NetHunter editions, Purple, WSL/Win-KeX, Docker, cloud, ARM — then spot the flaws.

Walk the whole capstone: verify + FDE, harden, package + persist, deploy at scale, and choose platforms — capturing every flag and spotting the auto-fail moves.