Learn the work. Then do it in the lab.

• Read

  The course

  Short lessons in order. Each one names a failure, who it affects, and what you change.

  235 lessons in 11 paths
  Browse the course
• Learn a tool

  Tool workbenches

  One tool at a time, Wireshark to Ghidra. How it thinks, and how to read what it shows.

  699 lessons in 27 workbenches
  Open the tools
• Practice

  Labs

  Hands on, in the browser, against a written scope. The evidence is on the desk. You name the failure.

  204 labs and missions
  Open the labs

• FoundationsAuthorization, threat models, and the vocabulary the rest of the course depends on.18
• EnvironmentsLegal labs, the 2026 attack surface, and the places systems actually run.2
• ApplicationsWeb and API failure classes: what breaks, who is affected, and what you change.69
• NetworksProtocols, exposure, spoofing, and what defenders watch on the wire.17
• WirelessWi-Fi, Bluetooth, and radios you are actually allowed to test.12
• PeopleSocial engineering, the human path into an account, and the controls around it.18
• CryptographyHashes, TLS, passwords, and the failures that come from using them badly.10
• MalwareWhat hostile software does, how it is recognized, and how you get it off a system.18
• Identity and cloudSessions, phishing-resistant sign-in, cloud identities, containers, and build pipelines.29
• OperationsLogs, incident response, ransomware resilience, and how to write the work down.16
• ToolsHow the common lab tools think, how to read what they show, and what you change because of it.26

• Engagement workstationMissions on a scoped lab host. Read the files, name the failure, submit the finding.3 missions
• Evidence deskA query review and a server-side fetch, already collected. Name the failure and the fix.3 cases
• Scope deskReal situations. Decide whether the work is in scope, needs a written change, or stops.8 situations
• Control benchA failure is on the table. Choose the control that changes the outcome.8 failures
• Tenant deskTwo companies, one API. Turn the ownership check on and off and watch who can open a record.Live toggle
• Interactive labsJWTs, CORS, firewall rules, Sigma, IAM. Edit the policy and see who gets in.31

• WiresharkLessons on reading a packet capture: who talked, which protocol carried it, and whether the payload is still visible.30 lessons
• Network toolsLessons on captures and discovery: what an interface was allowed to see, and how that record becomes a finding.24 lessons
• Nmap and network discoveryTutorials on scanning your own lab with Nmap: scan types, timing, NSE categories, reading output, and how a defender sees a scan.25 lessons

All 27 workbenches

• Where do I start?Four doors. New, a job, a tool, or a lab.
• Your first weekSeven days. One lesson or one lab each day.
• I have a situationStart from the question already in front of you.
• All guidesStart, the situation notes, and the short reference pages.