CYBERSECURITY
PROFESSIONAL PROGRAM
This program is not a lecture series — it is a structured transition from student to practitioner. You will graduate with a portfolio of real professional deliverables, not just a certificate.
Training Certificate
Months 1–3 · Core Security Skills · Guided Labs · Mid-Program CTF
Foundations & Engagement Methodology
Practice Tools
What You Learn
Ethical hacking lifecycle, legal framework, note-taking, report structure.
What You Do
Establishing engagement boundaries, documenting findings, preparing report templates.
Linux, Windows & Networking Core
Practice Tools
What You Learn
Command line, TCP/IP, DNS, protocols, and OS architecture.
What You Do
Command-line drills, packet analysis, and service administration.
Reconnaissance & OSINT
Practice Tools
What You Learn
Passive recon, subdomain enumeration, Shodan, and metadata extraction.
What You Do
Building target profiles, mapping external footprints, analyzing digital exhaust.
Network Scanning & Enumeration
Practice Tools
What You Learn
SMB/SNMP/LDAP enumeration, banner grabbing, and service fingerprinting.
What You Do
Nmap scanning, identifying running services, extracting directory info.
Vulnerability Assessment & Validation
Practice Tools
What You Learn
CVSS 3.1 scoring, false positive analysis, risk ranking.
What You Do
Running Nessus/OpenVAS scans, validating findings, prioritizing risks.
Web Application Penetration Testing
Practice Tools
What You Learn
OWASP Top 10, SQLi, XSS, SSRF, IDOR, JWT, and API security.
What You Do
Exploiting web logic, intercepting traffic, attacking APIs.
Social Engineering & Delivery Attacks
Practice Tools
What You Learn
Phishing simulation, email header analysis, macro delivery chains.
What You Do
Crafting phishing campaigns, analyzing headers, delivering payloads.
Windows Privilege Escalation
Practice Tools
What You Learn
Weak services, token abuse, unquoted paths, AlwaysInstallElevated.
What You Do
Exploiting misconfigurations, analyzing WinPEAS output, escalating to SYSTEM.
Linux Privilege Escalation
Practice Tools
What You Learn
SUID/GTFOBins, sudo misconfig, cron abuse, capabilities.
What You Do
Exploiting SUID binaries, modifying cron jobs, leveraging LinPEAS.
Password Attacks & Credential Security
Practice Tools
What You Learn
Hash cracking, pass-the-hash, password spraying.
What You Do
Using Hashcat, capturing with Responder, generating custom wordlists with CUPP.
Internship Certification
Months 4–6 · Simulated Professional Internship · Client Engagements
Pivoting, Tunneling & Lateral Movement
Practice Tools
What You Learn
SSH tunnels, Ligolo-ng, proxychains, WMI/PSExec lateral movement.
What You Do
Deploying pivots, tunneling traffic through compromised hosts, moving laterally.
Active Directory Penetration Testing
Practice Tools
What You Learn
Kerberoasting, AS-REP Roasting, ACL abuse, DCSync.
What You Do
Mapping AD with BloodHound, exploiting GOAD lab, extracting domain credentials.
Wireless Security Assessment
Practice Tools
What You Learn
WPA2 PMKID/EAPOL capture, evil twin, wireless report writing.
What You Do
Capturing handshakes, cracking WPA2 with Hashcat, spoofing access points.
Mobile Application Security
Practice Tools
What You Learn
Android APK analysis, certificate pinning bypass, OWASP MSTG.
What You Do
Decompiling APKs, hooking apps with Frida, static analysis with MobSF.
Cloud & Container Security
Practice Tools
What You Learn
AWS IAM privesc, Docker escape, Kubernetes RBAC abuse.
What You Do
Exploiting flaws.cloud and CloudGoat, escaping containers, abusing RBAC.
IoT & OT/ICS Security
Practice Tools
What You Learn
Firmware analysis, OT protocols, Shodan exposure mapping.
What You Do
Extracting firmware with Binwalk, analyzing IoTGoat, mapping exposures.
SOC Operations & Detection Engineering
Practice Tools
What You Learn
Sysmon, Sigma rules, ATT&CK Navigator, alert triage.
What You Do
Analyzing Elastic/Splunk logs, writing Sigma rules, triaging alerts.
Incident Response & Threat Hunting
Practice Tools
What You Learn
IR timeline building, threat hunting hypotheses, memory analysis.
What You Do
Analyzing memory with Volatility3, using KAPE and EZ Tools, hunting threats.
Professional Reporting & Client Delivery
Practice Tools
What You Learn
Executive summary writing, debrief skills, evidence packaging.
What You Do
Writing executive summaries, using Dradis/Serpico, presenting debriefs.
Capstone Engagement
Everything learned throughout the program comes together.
Practice Tools
What You Learn
Full external→internal→AD→web app chain, professional reporting.
What You Do
Executing a full lifecycle pentest, delivering final report, panel debrief.
Practice Ecosystem
You do not need to spend anything beyond the program fee to practice. Every platform below is free or has a free tier and is woven into the module schedule as part of your self-study time.
TryHackMe
Guided learning rooms covering Linux, Windows, OWASP Top 10, AD Basics, SOC, Phishing — used across Modules 1–10
OWASP Juice Shop
100+ web app challenges covering every OWASP vulnerability — your primary web app practice environment in Module 6
PortSwigger Web Security Academy
World-class free SQL injection, XSS, SSRF, CORS, OAuth, and Business Logic labs — mandatory for Module 6
DVWA & WebGoat
Classic vulnerable web apps — additional practice for Module 6 at adjustable difficulty levels
OverTheWire: Bandit
Online Linux wargame — no install needed, perfect for Module 2 and 9 command-line drills
VulnHub
Downloadable vulnerable VMs for offline practice — Windows and Linux privilege escalation and AD machines
GOAD – Game of Active Directory
Pre-built multi-VM vulnerable AD lab covering every AD attack from Module 12
flaws.cloud & flaws2.cloud
AWS exploitation challenges run entirely in the browser — no AWS account or setup needed for Module 15
CloudGoat by Rhino Security
Terraform-deployed intentionally vulnerable AWS environment for hands-on IAM and cloud exploitation
AndroGoat
Vulnerable Android app covering all OWASP mobile vulnerabilities — used in Module 14 mobile security labs
OWASP IoTGoat
Vulnerable IoT firmware for Binwalk extraction and credential hunting in Module 16
CyberDefenders
Blue team forensics and SOC investigation challenges — used in Modules 17 and 18
Blue Team Labs Online
Incident response, log analysis, and phishing analysis challenges for Phase 2 defensive modules
GTFOBins & LOLBAS
Reference databases for Linux SUID/sudo abuse (Module 9) and Windows living-off-the-land (Module 8)
Sigma Community Rules
Open-source detection rule repository — students read, write, and submit Sigma rules in Module 17
How You Are Assessed
PHASE 1
- Lab Reports 40%
- Mid-Program CTF 25%
- Platform Proof 20%
- Monthly Quiz 15%
PHASE 2
- Capstone Report 35%
- Client Deliverables 30%
- Capstone Debrief 20%
- Portfolio Evidence 15%