SELECT A LESSON TO BEGIN
EVERY MODULE IN THE COURSE — CLICK ANY CARD TO OPEN IT
Navigate the hierarchy that controls everything. Inodes, permissions, mount points, and the hidden structures that make Linux tick from the ground up.
Own the system by understanding who owns what. SUID, SGID, sticky bits, ACLs, sudoers — the gatekeeping mechanisms and how to work with them.
Write scripts that execute your will. Loops, conditionals, functions, regex, and the art of piping data through a chain of commands like a pro.
Scan, probe, and map any network. Master netstat, ss, nmap, tcpdump, and understand how data moves through the layers beneath you.
See what's running in the dark. Control, kill, and resurrect processes. Understand cron jobs, systemd, and background daemon management.
Leave no trace — or find theirs. Parse system logs, analyze auth events, use grep and awk to extract signals from terabytes of noise.
What security actually means — CIA and AAA, control categories and types, and Zero Trust — taught in depth, with diagrams and an inline practice terminal in every lesson.
Make change safe: approval and CAB, maintenance windows, rollback plans, technical implications, and documenting to a version-controlled baseline.
Symmetric vs asymmetric vs hashing, PKI and certificates, digital signatures, salting and key stretching, TLS — and the traps the exam loves.
Who is attacking you, why, and through which doors — nation-states to script kiddies, phishing to supply chain.
Identify and understand the types of vulnerabilities, malware, and indicators that signal a breach.
Understand the types of attacks and how to mitigate them, from network and password attacks to cryptographic vulnerabilities.
From cloud to on-prem, understand the layers and components that make up a secure infrastructure — from network zones to security appliances.
Protect your data at rest, in transit, and in use. Learn about encryption, tokenization, masking, and the importance of backups and disaster recovery.
Establish secure baselines, harden systems, and manage asset inventory from cradle to grave.
Manage vulnerabilities, prioritize remediation efforts, and monitor systems for threats.
Manage user identities, access controls, and authentication mechanisms.
Understanding and deploying various security tools and capabilities to protect the enterprise from threats.
Automate security processes and manage incident response effectively. Understand the critical aspects of digital forensics.
From governance documents to risk management and business continuity, this module covers the essential frameworks and practices.
Managing third-party risk and ensuring compliance with legal requirements is crucial for organizational security.
The paperwork that keeps you out of prison and the frameworks that keep you thorough — scope, ROE, SOW/MSA/NDA, and the methodology you test against.
The law is part of the scope. CFAA boundaries, data-handling duties, the regulations that shape the test, and exactly what to do when you find something you were never meant to see.
The report is the product. Executive summary, risk-rated findings, evidence, remediation, and the communication triggers that can't wait for the final PDF.
Map the whole attack surface without sending a single packet to the target — DNS, certificate logs, Shodan, dorks, and breach data.
Now you touch the target: host discovery, port and service scanning, and the timing knobs that trade speed for stealth.
Turn open ports into names, shares, and users — SMB, LDAP, SNMP, DNS and web content discovery are where the target starts giving up its secrets.
Automate the boring parts — Bash and Python loops, output parsing, and reading/fixing a script you're handed. The exam tests whether you can read code, not just run tools.
Point a scanner at the target without knocking it over — authenticated vs unauthenticated scans, the tool landscape, and safe configs that respect the ROE.
Kill the false positives, prove what's real, and rank by true risk — CVSS plus EPSS, CISA KEV, and business context turn a scanner dump into a worklist.
Own the wire: poison name resolution, sit on-path, and relay authentication you never cracked.
Crack it, spray it, or roast it — passwords, hashes, Active Directory, and the climb from user to root.
Injection, client-side, and broken access control — the OWASP heavy-hitters, mapped to the weaknesses behind them.
Capture the handshake, crack the PSK, or stand up a convincing twin — attacking WPA2/WPA3 and the humans who connect.
The V3 frontier — leaked keys and metadata, container escapes, broken object-level auth, and prompt injection.
The human layer — phishing to pretexting to tailgating — done only against approved people, with evidence handled like it matters.
The foothold is the beginning, not the end — persist, pivot, move laterally to domain dominance, then leave the environment exactly as you found it.
Every domain, one engagement — scope to shell to report. Watch the whole chain against Meridian come together, then assemble it yourself.
The OSI/TCP-IP stack, encapsulation across a switched + routed path, the device→layer map, and TCP vs UDP — with a security lens on every layer.
The one CCNA skill you must do fast and in your head: block-size math, VLSM, wildcard masks, RFC 1918, and why NAT exists.
Compress addresses on sight, classify by prefix (GUA/LLA/ULA/multicast), generate EUI-64, and read the SLAAC vs DHCPv6 RA flags.
MAC learning, VLANs, 802.1Q trunks with a safe native VLAN, and routing between VLANs with router-on-a-stick vs SVIs — plus the VLAN-hopping trap.
Root-bridge election, port states, the edge guards (PortFast/BPDU Guard/Root Guard), LACP/PAgP bundling, and CDP vs LLDP.
RF/channels, autonomous vs lightweight APs, split-MAC over CAPWAP, WLAN config on the WLC, and WPA2/WPA3 vs 802.1X.
How a router chooses a path (longest-prefix match → AD → metric), reading the routing table, and static/default/floating/host routes for IPv4 and IPv6.
Link-state operation, router-ID selection, neighbor states, DR/BDR election, the cost formula, and why adjacencies fail silently.
Remove the default-gateway single point of failure: HSRP Active/Standby, the virtual IP/MAC, preempt behavior, and how it contrasts with VRRP/GLBP.
The whole IP-services grab-bag: NAT/PAT, DHCP + relay, DNS, NTP, SNMP, syslog, QoS, and secure management — each a quick, precise exam target.
CIA and threat vocabulary, AAA (local vs RADIUS vs TACACS+), password hardening, and site-to-site vs remote-access VPNs (IPsec vs SSL/TLS).
Standard/extended ACLs and placement, port security, DHCP snooping + Dynamic ARP Inspection, 802.1X, and device hardening.
Controller-based vs traditional networking, SDN planes, north/southbound APIs, REST + CRUD, JSON/XML/YAML, and Ansible/Puppet/Terraform.
Beyond CCNA: how ACLs/port-security/802.1X/VPN grow into the Cisco Secure portfolio (Secure Firewall/FTD, ISE, Umbrella, TrustSec/SGT) and the CCNP Security (SCOR) mindset.
Beyond CCNA: telemetry (NetFlow, syslog, SPAN, EDR), SIEM correlation, MITRE ATT&CK, and the incident-response lifecycle — bridging to CyberOps Associate (CBROPS).
The finale: take Harbor Point Logistics (HQ + branch + WAN) from a blank design to a verified, hardened build threading all six domains. Human-graded on a 100-point rubric.
Every value the server sees is attacker-controlled. Status codes, origins, cookies, sessions and JWTs — the mental model every web finding is built on, and how each request region maps to a Top-10 category.
Turn poking-at-things into a repeatable engagement: the recon→report lifecycle, correct WSTG test IDs, valid ASVS 5.0 requirement references, CWE precision, STRIDE, and a complete finding.
The #1 category. Horizontal (IDOR/BOLA) and vertical (forced browsing, function-level) access failures, why they live server-side, and how to prove them without touching anyone else's real data.
The app that ships insecure by default: debug on, default creds, permissive CORS, missing security headers, directory listing, and stack traces. Cheap to find, high-signal, everywhere.
New/expanded for 2025 (grew out of Vulnerable & Outdated Components). Risk you inherit from dependencies, registries, build pipelines and CI — where you didn't write the code but you own the blast radius.
Sensitive data exposed because crypto is missing, weak, or misused: plaintext transport, reversible 'encryption' of passwords, MD5/SHA1 for auth, hardcoded keys. It's about protecting data, not just algorithms.
When untrusted input crosses into an interpreter — SQL, a shell, an LDAP filter — and changes the command's structure. The classic, still-devastating class, and why parameterization (not escaping) is the fix.
Injection into a rendering context. Reflected, stored and DOM-based XSS; server-side template injection; and why the fix is context-aware output encoding plus a strict CSP — never the deprecated X-XSS-Protection.
Bugs you can't patch away because the flaw is in the design: a missing control, an unbounded flow, a trust assumption. Threat modeling, abuse cases, and secure-by-design thinking — distinct from implementation bugs.
Proving identity, and keeping it proven. Credential stuffing and brute force, weak recovery, session fixation/handling, and JWT pitfalls — the difference between authentication and session management.
Trusting code or data whose integrity you never verified: insecure deserialization, unsigned/auto-updates, tampered CI artifacts. Overlaps supply chain (A03) but centers on the verify-before-you-trust gap.
Renamed for 2025 to stress alerting. You can't respond to what you never saw: missing auth/authz logs, no alerting on abuse, and the opposite failure — logging secrets. Detection is a security control.
New for 2025 (24 CWEs). How apps behave when something goes wrong: fail-open logic, unhandled exceptions, verbose error leakage, and edge cases that bypass controls. The behavior at the boundary is the vulnerability.
The classes that lost a standalone Top-10 slot but not their teeth. SSRF and cloud metadata, XXE, and the separate OWASP API Security Top 10 (2023): BOLA, BFLA, BOPLA and API-side SSRF.
How single findings combine into critical impact, a repeatable bug-bounty workflow, CVSS that matches its vector, and a report a developer can act on. This module feeds the C01 capstone.
The graded finale: a full assessment of the MeridianShop app that threads all ten 2025 categories into one engagement, scored on a 100-point rubric (≥80 to pass). Find, chain, and report — correctly labeled.
The mental model: the CIA triad, threat taxonomy, the Cyber Kill Chain vs MITRE ATT&CK, the five phases, AI on both sides, and why written authorization is non-negotiable.
Phase 1: passive OSINT (WHOIS, DNS, CT logs, job posts), the tools used correctly (theHarvester, Amass, Shodan), zone transfers, and the countermeasures that shrink a public footprint.
Phase 2: host discovery, the TCP handshake and the scans that abuse it (-sS/-sT/-sU/-sA), port states, -sV/-O, banner grabbing, and scan-time evasion.
Service-by-service extraction of users, shares, and config — SMB null sessions, SNMP strings, LDAP anon binds, DNS/SMTP/NFS/RPC — each with its tool and countermeasure.
Read a scanner like a professional: vuln types, the assessment lifecycle, CVSS v3.1 scoring, NVD/CISA-KEV/EPSS prioritization, authenticated vs unauthenticated scans, and verification before you report.
Phases 3–5: crack or pass credentials, escalate on Windows/Linux, persist, hide data, and cover tracks — mapped to the correct hash modes and ATT&CK IDs.
Taxonomy by behavior, APT/living-off-the-land, trojan/C2, static → dynamic → memory analysis, distribution vectors, IoCs, and defense-in-depth.
Passive vs active sniffing, the switched-network attacks (MAC flood, ARP spoof, rogue DHCP, DNS spoof, LLMNR poison), cleartext exposure, and Layer-2 defenses.
Human/computer/mobile SE and Cialdini's principles; SET & GoPhish; the three DoS families (volumetric, protocol, app-layer), botnets, and layer-matched defenses.
App- and network-level session hijacking (theft/fixation/RST), cookie-flag fixes, IDS/firewall evasion (fragmentation, encoding, tunneling), and honeypot types + detection.
Web-server recon and flaws (version disclosure, CVE-2021-41773 path traversal, WebDAV/HTTP methods) and the app methodology across the OWASP Top 10 at CEH depth with Burp/ZAP/ffuf.
How untrusted input alters a query, the SQLi types (UNION, boolean vs time-based blind, OOB), information_schema enumeration, sqlmap, and the fix — parameterized queries.
802.11 basics, the WEP→WPA→WPA2→WPA3/SAE progression, the 4-way handshake + PMKID capture, offline cracking (hashcat 22000), evil-twin/WPS, and enterprise 802.1X attacks.
Android/iOS attack surface + OWASP Mobile Top 10 (2024), IoT protocols & OWASP IoT Top 10 (2018), firmware analysis, and OT/ICS (Modbus/502, Purdue model) where a wrong write causes physical harm.
The misconfiguration playbook — public S3, over-permissive IAM, SSRF→IMDS credential theft, docker.sock escape, exposed K8s — and the AWS defenses. CEH Domain 8.
Tell encryption/hashing/encoding apart, know what's broken (MD5/SHA-1/ECB/TLS 1.0), match each attack to its defense, and the hashcat modes. CEH Domain 9.
A signed, 5-phase engagement threading all 16 modules — 20 flags, pass 14/20 — CEH Practical-style, end to end with discipline.
What Kali is (Debian-testing, rolling, OffSec), how to verify an image two ways, the run modes, and the non-root kali+sudo model.
The daily operator skills: bash + sudo, the FHS layout, files, rwx/SUID permissions, systemd services, and pipes.
Installer types, guided vs manual partitioning, LVM for flexibility, and LUKS encrypted LVM for data at rest.
The desktop networking default (NetworkManager), NM-managed DNS, the ssh unit, non-root users with visudo, and the single official kali-rolling APT line.
The self-sufficiency loop: man sections, --help/info, finding packages (apt-cache/dpkg/apt policy), reading journalctl, and filing a reproducible report at the right tracker.
The operator security stack: scoped sudo, SSH hardening, ufw/nftables firewall, fail2ban, patching, log monitoring, AIDE/auditd, and LUKS at rest.
The two layers — dpkg (single .deb, no deps) and apt (resolves deps) — plus sources, keyring-signed repos, pinning, holds, and recovery.
Metapackages carry no binaries — only deps. The kali-linux-*/kali-tools-* sets, dependency inspection, the kali-tweaks ncurses menu, and Kali Undercover.
Build a custom Kali ISO with live-build, add plain and LUKS-encrypted persistence, and arm the cryptsetup-nuke-password self-destruct.
Provision fleets with PXE/preseed, enforce config with SaltStack, and govern packages with a signed reprepro repo — repeatable, controlled, auditable.
Rebuild Debian packages from source, build one from scratch, host a signed local repo, and compile a custom kernel — standard Debian packaging.
Match the mission to the variant: NetHunter editions, Kali Purple, WSL + Win-KeX, Docker, cloud, and ARM — each with its real constraints.
The final challenge: five phases from a verified, encrypted install to a hardened, packaged, persistence-enabled, fleet-deployed environment — capture all 16 flags.
The CIA triad and its extensions, governance vs management, security roles, due care/due diligence, and the ISC2 Code of Ethics — the foundation every other domain builds on.
The risk lifecycle, quantitative math (SLE = AV×EF; ALE = SLE×ARO), inherent vs residual risk, appetite vs tolerance, the four risk responses, and control cost-justification.
Legal systems and regulations (GDPR, HIPAA, PCI), intellectual property, governance frameworks, and business continuity — the BIA, MTD, and RTO vs RPO.
Data classification, the owner/custodian/processor roles, the data lifecycle, retention and remanence, and protecting data at rest, in transit, and in use.
Security models done precisely — Bell-LaPadula (no read up / no write down), Biba, Clark-Wilson, Brewer-Nash — plus evaluation criteria and secure design principles.
Symmetric vs asymmetric, hashing and digital signatures, PKI and key management, TLS 1.3 forward secrecy, and matching the mechanism to confidentiality / integrity / authenticity / non-repudiation.
CPTED and layered defense, fire suppression (clean agents are safe for occupied spaces; CO2 is the hazard), power anomalies, HVAC, and media handling.
Where controls live in the OSI/TCP-IP stack, secure protocols (TLS 1.3, IPsec AH vs ESP), segmentation and zero trust, firewalls and VPNs, and wireless (WPA3/SAE).
The AAA chain, true MFA (different factor types), biometric accuracy (CER is the FAR=FRR crossover), access-control models, SSO/federation, and the JML lifecycle.
Assessment vs audit vs test, vulnerability assessment vs penetration test, SOC 1/2/3 and Type I vs II, code testing (SAST/DAST), and security process metrics (KPI/KRI/KGI).
Operational principles (least privilege, SoD, dual control), logging/SIEM/UEBA, change and patch management, backups and the 3-2-1 rule, RTO vs RPO, RAID, and recovery sites.
The (ISC)2 7-step incident lifecycle (Detection -> Response -> Mitigation -> Reporting -> Recovery -> Remediation -> Lessons Learned), digital forensics (order of volatility, chain of custody), and evidence admissibility.
The secure SDLC and shift-left, maturity models (CMMI vs OWASP SAMM vs BSIMM), secure coding and the OWASP Top 10 (2021), CI/CD and SBOM, database security, and API/third-party risk.
One healthcare-tech company run through 15 governance decision points across all eight domains and a live cross-domain breach — where life-safety is literal and every domain is exercised.