Tools
Tool workbenches
Step-by-step lessons for the tools defenders and testers use every day. Each workbench starts with the interface, works through real evidence, and ends with what you write down and what you change.
- 19 workbenches
- 426 workbench lessons
- 12 tool guides
Workbenches
Grouped by the kind of work. Open one to see its lessons in order.
Networks and traffic
Captures, discovery scans, and the records a network leaves behind.
- 30 lessons · 6 hWiresharkLessons on reading a packet capture: who talked, which protocol carried it, and whether the payload is still visible.Open workbench
- 24 lessons · 6 hNetwork toolsLessons on captures and discovery: what an interface was allowed to see, and how that record becomes a finding.tcpdumpTSharkZeekNetworkMinerOpen workbench
- 25 lessons · 4.5 hNmap and network discoveryTutorials on scanning your own lab with Nmap: scan types, timing, NSE categories, reading output, and how a defender sees a scan.Getting startedScan typesNmap Scripting EngineReading outputDefender sideOpen workbench
Systems and identity
Linux, Windows, and Active Directory from the side that keeps them running.
- 28 lessons · 4.5 hLinux command line for securityTutorials on the Linux commands defenders use every day: permissions, processes, logs, journalctl, SSH hardening, cron, sudo, and file integrity.Permissions and accountsHardeningProcessesLogsSSHPersistence checksIntegrityOpen workbench
- 27 lessons · 4.5 hWindows security and Event LogsTutorials on Windows Event IDs, PowerShell logging, Microsoft Defender, local accounts, services, and the audit policy that decides what gets recorded.Event IDsLog toolingPowerShell loggingHardeningMicrosoft DefenderAccounts and servicesOpen workbench
- 23 lessons · 4 hActive Directory defenseTutorials on Kerberos, NTLM, delegation, Group Policy, privileged groups, tiering, and auditing, written from the defender’s side of the domain.FoundationsKerberos and NTLMDirectory hygieneAttack path thinkingMonitoringOpen workbench
Cloud and containers
Accounts, policies, clusters, and the logs that show who changed what.
- 24 lessons · 4 hCloud securityTutorials on AWS IAM, S3 exposure, CloudTrail, GuardDuty, Azure and Entra ID basics, and least privilege you can verify.FoundationsAWS IAMS3 and storageLogging and detectionAzure and Entra IDGoogle CloudTools and postureOpen workbench
- 20 lessons · 3.5 hContainers and Kubernetes securityTutorials on container images, Dockerfile hardening, secrets, Kubernetes RBAC, Pod Security, network policy, and audit logs.Cluster foundationsWorkload policyAuditing and detectionImages and supply chainOpen workbench
Detection and response
Writing detections, running an incident, preserving evidence, and reading mail headers.
- 24 lessons · 4 hSIEM and detection engineeringTutorials on Splunk SPL, Elastic KQL and ES|QL, Microsoft Sentinel KQL, Sigma rules, alert tuning, and triage.Query languagesRule formatsDetection patternsDetection practiceOpen workbench
- 20 lessons · 3 hIncident response playbooksStep-by-step response tutorials for phishing, ransomware, account compromise, lost devices, and evidence handling.IR foundationsEvidence handlingCollection toolsPlaybooksOpen workbench
- 25 lessons · 6.5 hForensics toolsLessons on preserving and reading disks, memory, and logs from systems you were asked to examine.AutopsyVolatilityYARACyberChefSysmonOpen workbench
- 18 lessons · 2.5 hEmail securityTutorials on SPF, DKIM, DMARC, reading email headers, MTA-STS, BIMI, and how to investigate a suspicious message.Sender authenticationTransport securityInvestigationOpen workbench
Applications and code
Web requests, binaries, cryptography, and the scripts that automate the checks.
- 23 lessons · 6 hWeb testing toolsLessons on reading the requests an application makes, and on sorting scanner alerts into false leads, minor issues, and findings.BurpZAPDevToolsOpen workbench
- 22 lessons · 6 hGhidraLessons on reading a program you are allowed to study, and on writing down what it does and what should change.Open workbench
- 20 lessons · 3 hCryptography and passwords in practiceTutorials on hashing versus encryption, password storage, TLS certificates, OpenSSL, GPG, SSH keys, password managers, and MFA.Command-line toolsCertificates and TLSCrypto in codeConcepts by experimentOpen workbench
- 20 lessons · 3.5 hPython and Bash for security automationTutorials on parsing logs, hashing files, calling APIs safely, writing regex that does not explode, and small Bash and Python tools for defenders.Python for defendersShell and automationPowerShellOpen workbench
Research and study
Capture-the-flag practice, open-source research with privacy in mind, and certification prep.
- 18 lessons · 3 hCTF categories for beginnersHow capture-the-flag challenges are structured in web, crypto, forensics, reversing, OSINT, and misc, and how to approach each without spoilers.Getting startedForensics challengesCrypto challengesWeb challengesReversing challengesLearning and communityOpen workbench
- 17 lessons · 2.5 hEthical OSINT and privacy self-defenseTutorials on open-source research done with consent and purpose, verifying images and claims, and shrinking your own public footprint.Method and ethicsOrganization exposurePersonal privacyVerificationOpen workbench
- 18 lessons · 2.5 hSecurity certification study guidesStudy plans and concept guides for Security+, CySA+, eJPT, PNPT, OSCP, CISSP, and other common security certifications.PlanningExam techniqueFoundational certificationsPractitioner certificationsOpen workbench
Tool guides
Single-lesson introductions to the rest of the tool set.
- 01Nmap: reading a map of hosts and portsNmap answers which machines respond and which services are willing to talk. This lesson is how to read that answer and what a defender does with it.14 min
- 02Burp Suite: the proxy between you and the appBurp sits in the middle of your browser and the application you are allowed to test. You use it to see, change, and repeat requests the interface hid.14 min
- 03OWASP ZAP: automated looking, human judgmentZAP is a free proxy and scanner. The value is the list of leads it produces, not the score it prints.11 min
- 04Nessus and vulnerability scannersA vulnerability scanner matches what it can see against a database of known issues. The work is what you do with the matches.12 min
- 05Metasploit: a framework, not a permission slipMetasploit organizes known checks and modules so a tester can validate a specific issue in a lab. The output that matters is still a finding and a fix.12 min
- 06Kali and the lab operating systemKali is a Linux distribution with security tools preinstalled. It is a workbench. It is not an identity, and it is not a network you should join to your real life.11 min
- 07Snort and intrusion detectionSnort watches traffic and raises an alert when a rule matches. A rule is a hypothesis. An alert is a question for a person.12 min
- 08Password storage, and what cracking tools proveJohn the Ripper and Hashcat test whether a stored secret is guessable. The lesson is the storage and the policy, not a recipe for guessing.12 min
- 09Wireless tools and what they are allowed to hearAircrack-ng and its neighbors listen to radio and test Wi-Fi protections. Listening to a network you do not administer is not a student project.11 min
- 10Cloud command lines: reading identity, not touring productionThe AWS, Azure, and Google Cloud CLIs are how you ask a cloud account what it believes. In a lab account, that question is the whole assessment.12 min
- 11Secret scanning in git and in pipelinesSecrets belong in a manager, not in a repository. Scanners exist to catch the moment someone forgets.11 min
- 12A method for any tool you have not met yetNew tools show up every year. The way you read them does not change: question, evidence, impact, control.10 min