Start

Where do you want to begin?

Four doors. Pick the one that matches today. You can switch later. If you want the order chosen for you, follow the first week. Search is in the header if you already know the name.

New

I am new to this

Start with scope and authorization. Every later lesson assumes you know what you are allowed to touch.

Job

I have a job in mind

Pick SOC, network defense, cloud, identity, forensics, or a first certification. Each path ends in a lab.

Tool

I want to learn a tool

Wireshark, Nmap, Burp, Ghidra, and the rest. Open the workbench and follow the lessons in order.

Lab

I want to practice now

Browser labs with a written scope. Read the evidence, name the failure, and unlock the walkthrough if you get stuck.

The map

Guide

Start, the first week, topics, the situation notes, cheatsheets, findings, and career paths, listed on one page.

A schedule

First week

Seven days, one page a day. Day one is scope and authorization. The last day is a packet you put in order.

Before a pile of tools

A small lab

A hypervisor, one Linux guest, and Wireshark on the host. The browser labs do not need another install.

I already have a question

Topics

A strange email, a packet, a logon, an open port, a disk, or an interview. Each one names the hubs and labs to open. Longer notes: a new sign-in, a message that looks internal, a host that keeps connecting, a ransom note, a file from email, and a cloud key in a log.

The note

How to write a finding

What failed, who can reach it, and what you would change. One filled example comes from the email header lab.

A card you can keep open

Cheatsheets

Four short sheets: display filters, Windows event IDs, email authentication, and the first hour of an incident.

Job paths

All paths