WEEK PROGRESS — DAY 1 OF 7
🎯
Goal: Understand the full mental model of cybersecurity — what you are protecting, from whom, and how attackers think. This is the foundation every single technique you learn later will build upon.
// 1.1 — THE CIA TRIAD
What is the CIA Triad?
Every security decision in existence maps back to three principles. These aren't guidelines — they are the atomic definition of security. If you can't explain an attack in terms of CIA, you don't yet understand it.
🔒 Confidentiality
Only authorized entities can access data. Violations: data breaches, credential theft, eavesdropping, insecure storage. Example attack: a hacker intercepts unencrypted login credentials on public Wi-Fi (Man-in-the-Middle).
✅ Integrity
Data is only modified by authorized entities in authorized ways. Violations: SQL injection altering a database, malware corrupting files, DNS poisoning. Example: an attacker changes a bank transfer amount mid-transit.
⚡ Availability
Systems are accessible to authorized users when needed. Violations: DDoS attacks, ransomware, hardware failure, misconfigured firewalls. Example: a DDoS flood takes down an e-commerce site during Black Friday.
💡
Mental model: Ask of any attack — "What did it break?" Ransomware breaks Availability AND Confidentiality. A misconfigured S3 bucket breaks Confidentiality only. This maps directly to how you report and prioritize vulnerabilities later.
// 1.2 — THREAT ACTORS
Who are the adversaries?
Understanding who attacks tells you how they attack. Motivation drives technique. A script kiddie uses existing tools blindly; a nation-state APT builds custom malware and operates for months undetected.
| ACTOR TYPE | MOTIVATION | SKILL LEVEL | TYPICAL ATTACK |
| Script Kiddie | Fun, ego, disruption | Low | Off-the-shelf exploit tools, DDoS stresser |
| Hacktivist | Political/ideological | Medium | Website defacement, data leaks, DDoS |
| Cybercriminal | Financial gain | Medium–High | Ransomware, phishing, fraud, credential theft |
| Insider Threat | Revenge, money, accident | Varies | Data exfiltration, sabotage, accidental exposure |
| Nation-State APT | Espionage, warfare | Elite | Zero-days, supply chain attacks, long-term persistence |
| Pen Tester (YOU) | Defense by offense | High | Authorized simulation of all above |
// 1.3 — ATTACK SURFACES
What can be attacked?
The attack surface is every point of entry that an attacker could exploit. Reducing attack surface is the most fundamental defensive strategy. You cannot protect what you don't know exists.
🌐 Network Surface
Open ports, exposed services, unencrypted protocols, firewall gaps. Every listening service is a potential door. Run nmap — you may find 50 open ports on a server that should have 3.
💻 Software Surface
Web apps, APIs, desktop applications, OS services. Every line of code is a potential vulnerability. Buffer overflows live here. SQL injection lives here.
👤 Human Surface
The most reliably exploitable surface. Social engineering, phishing, vishing, tailgating. "The human is the weakest link" isn't a cliché — it's statistically proven. 85%+ of breaches involve a human element.
🏢 Physical Surface
Unlocked server rooms, USB drops, dumpster diving, shoulder surfing. Air gaps are broken by physical access. Never underestimate this.
// 1.4 — CVE, CWE & THE VULNERABILITY ECOSYSTEM
The Language of Vulnerabilities
You need to speak the industry's language. These identifiers are how the entire security industry communicates about flaws.
| TERM | WHAT IT IS | EXAMPLE |
|---|
| CVE |
Common Vulnerabilities and Exposures — a unique ID for a specific, publicly known vulnerability in specific software |
CVE-2021-44228 = Log4Shell (critical RCE in Apache Log4j) |
| CWE |
Common Weakness Enumeration — a category of flaw types in code or design, not a specific bug |
CWE-79 = Cross-Site Scripting (XSS) as a class of flaw |
| CVSS |
Common Vulnerability Scoring System — a 0–10 score rating vulnerability severity |
CVSS 9.8 = Critical. CVSS 3.1 = Low. |
| Zero-Day |
A vulnerability unknown to the vendor — no patch exists. Extremely valuable; sold for millions. |
Stuxnet used 4 zero-days simultaneously (unprecedented) |
| Exploit |
Code or technique that takes advantage of a vulnerability |
A Python script that triggers a buffer overflow to get shell access |
| PoC |
Proof of Concept — a demonstration that a vulnerability is real and exploitable |
A PoC for Log4Shell was released within 24 hours of disclosure |
// 1.5 — HACKER ETHICS & LEGAL FRAMEWORK
⚠️
Critical: Unauthorized access to any system — even to "test" it — is illegal in virtually every jurisdiction. In the US: Computer Fraud and Abuse Act (CFAA). In UK: Computer Misuse Act. Always have written authorization before testing any system. "I was just testing" is not a legal defense. Ever.
The Hacker Spectrum
White Hat — Ethical hackers. Work with authorization. Report findings responsibly. Build defenses. This is where you're headed.
Grey Hat — Find vulnerabilities without authorization but don't exploit maliciously. Still illegal despite good intent.
Black Hat — Malicious actors. Exploit for personal gain, damage, or espionage. Criminal prosecution follows.
Bug Bounty — Authorized programs where companies pay you to find their vulnerabilities. Legal white-hat hacking for money.
// DAY 1 — KNOWLEDGE CHECK
1. A hospital's ransomware attack encrypts all patient records, making them inaccessible. Which CIA properties are violated?
A Confidentiality only
B Integrity only
C Availability and Integrity
D All three equally
2. You discover a critical vulnerability in a popular banking app. The right ethical action is:
A Post it publicly on Twitter immediately to warn users
B Notify the bank privately and give them time to patch before any public disclosure
C Exploit it once to prove it\'s real, then report it
D Ignore it since you didn\'t cause it
// DAY 1 — LAB EXERCISE
Practical Task
Research 3 Real-World Breaches
For each breach, identify: which CIA properties were violated, what threat actor type was responsible, what the attack vector was, and what the financial/reputational impact was.
- Research the 2017 Equifax breach (147M records exposed)
- Research the 2021 Colonial Pipeline ransomware attack
- Research the 2020 SolarWinds supply chain attack
- For each: write 3–5 sentences mapping to CIA Triad + threat actor type
- Bookmark: nvd.nist.gov (National Vulnerability Database) — your home for CVE research
WEEK PROGRESS — DAY 2 OF 7
🐧
Why Linux matters in cybersecurity: Kali Linux, Parrot OS, servers you'll attack, and most tools you'll use all run on Linux. You must be fluent — not just functional — in the command line. 90% of offensive security work happens in a terminal.
// 2.1 — THE FILESYSTEM
Linux Directory Structure
Linux has a single hierarchical tree rooted at /. No drive letters (C:, D:). Everything — files, devices, network sockets — is a file in this tree.
| DIRECTORY | WHAT LIVES HERE | SECURITY RELEVANCE |
|---|
| /etc | System configuration files | passwd, shadow (password hashes), SSH config, cron jobs — goldmine for attackers |
| /home | User home directories | SSH keys, bash history, browser data, personal files |
| /root | Root user's home | Target for privilege escalation — getting here = full system compromise |
| /var/log | System and application logs | Evidence of attacks; blue teamers live here; attackers try to clear it |
| /tmp | Temporary files, world-writable | Common place to drop exploit scripts; persists across logins unless cleared |
| /bin, /sbin | Essential binaries | SUID binaries here are a privesc target (explained Week 5) |
| /proc | Virtual FS for running processes | Real-time process info, memory maps, used in forensics |
// 2.2 — FILE PERMISSIONS (CRITICAL)
Understanding rwx Permissions
Misconfigured permissions are one of the top causes of privilege escalation. You must read permission strings instantly.
$ ls -la /etc/passwd
-rw-r--r-- 1 root root 2847 Jan 15 09:22 /etc/passwd
Breaking down: -rw-r--r--
- rw- r-- r--
│ │ │ │
│ │ │ └── Others: read only
│ │ └────────── Group: read only
│ └─────────────────── Owner: read + write
└───────────────────────────── Type: - = file, d = dir, l = symlink
$ ls -la /etc/shadow
-rw-r----- 1 root shadow 1547 Jan 15 09:22 /etc/shadow
# shadow = password hashes. Only root + shadow group can read. This is why you need privesc to crack passwords.
$ chmod 755 script.sh # 7=rwx(owner) 5=r-x(group) 5=r-x(others)
$ chmod +x script.sh # adds execute for all
$ chown root:root file # change owner to root
// 2.3 — ESSENTIAL COMMANDS
FILE NAVIGATION & MANIPULATION
$ pwd # Print Working Directory
$ ls -la # List all files with permissions + hidden files
$ cd /etc # Change directory
$ cat /etc/passwd # Display file contents
$ less /var/log/auth.log # Paginate through large files
$ find / -name "*.conf" 2>/dev/null # Find all .conf files (suppress errors)
$ grep -r "password" /etc/ # Search recursively for "password" string
$ cp file.txt /tmp/backup.txt # Copy file
$ mv old.txt new.txt # Move / rename file
$ rm -rf /tmp/testdir # Remove dir recursively (CAREFUL: irreversible)
// 2.4 — USERS, GROUPS & SUDO
User Management — Security Critical
Every privilege escalation attack targets this: becoming a higher-privileged user. Understanding how users and sudo work is the precursor to breaking them.
$ whoami # Current user
$ id # uid=1000(user) gid=1000(user) groups=...
$ cat /etc/passwd # All system users (username:x:uid:gid:info:home:shell)
$ cat /etc/shadow # Password hashes — needs root to read
$ sudo -l # What can THIS user run as root? (key privesc check)
$ su - root # Switch to root (needs root password)
$ ps aux # All running processes — look for interesting services
$ ps aux | grep apache # Filter processes
$ kill -9 1234 # Force-kill process with PID 1234
$ netstat -tulpn # What's listening on which ports?
// 2.5 — SSH (SECURE SHELL)
SSH — Your Primary Remote Access Tool
SSH is how you access remote machines, both legitimately and as part of post-exploitation. You'll use SSH keys constantly in CTFs and real engagements.
$ ssh user@192.168.1.10 # Connect to remote host
$ ssh -p 2222 user@target.com # Non-standard port
$ ssh-keygen -t ed25519 # Generate SSH key pair (stronger than RSA)
$ ssh-copy-id user@remote # Copy public key to remote (passwordless auth)
$ cat ~/.ssh/id_ed25519 # PRIVATE KEY — never share this!
$ cat ~/.ssh/id_ed25519.pub # PUBLIC KEY — safe to share/upload
# In CTFs: you'll often find SSH private keys in files like /home/user/.ssh/id_rsa
# Finding one = instant SSH access as that user
$ chmod 600 found_key.pem # Keys must be 600 or SSH refuses them
$ ssh -i found_key.pem user@target
// DAY 2 — KNOWLEDGE CHECK
A file shows permissions -rwsr-xr-x root root. The 's' in the owner execute position is called a SUID bit. What does this mean for a regular user who runs this file?
A The file runs with the permissions of the user who invokes it
B The file runs with root permissions regardless of who runs it
C Only root can execute this file
D The 's' has no practical effect on execution
// DAY 2 — LAB EXERCISE
Lab: Linux Filesystem Exploration (on your Kali VM)
- Open terminal. Run
cat /etc/passwd — identify the format: username:x:UID:GID:comment:home:shell
- Find all SUID binaries on the system:
find / -perm -4000 2>/dev/null — note what you find
- Check what sudo permissions your user has:
sudo -l
- Examine running processes:
ps aux | sort -k3 -rn | head -20 (top 20 by CPU)
- Check open network ports:
ss -tulpn (modern replacement for netstat)
- Generate an SSH key pair. Find where it's stored. Read both files.
- Create a file, set permissions to 600, verify with ls -la
WEEK PROGRESS — DAY 3 OF 7
⚙️
Today's goal: Master the power tools that make Linux lethal. grep, awk, and sed are not "nice to know" — they are how you process massive log files, extract credentials from dumps, and automate repetitive security tasks. A pentester who can't pipe commands is severely limited.
// 3.1 — grep: THE UNIVERSAL SEARCHER
# Basic: search for pattern in file
$ grep "failed" /var/log/auth.log
# Case-insensitive search
$ grep -i "password" config.txt
# Recursive search in all files in directory
$ grep -r "api_key" /var/www/
# Show line numbers
$ grep -n "root" /etc/passwd
# Invert match (lines NOT containing pattern)
$ grep -v "#" /etc/ssh/sshd_config # Strip comment lines
# Count occurrences
$ grep -c "Failed password" /var/log/auth.log
# Extended regex — find IPs in a file
$ grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" access.log
# REAL PENTEST USE: Find hardcoded credentials in web app source
$ grep -rn "password\|passwd\|secret\|api_key\|token" /var/www/ --include="*.php"
// 3.2 — PIPES & CHAINING COMMANDS
The Pipe | — Linux's Superpower
Pipe | sends the output of one command as input to the next. This lets you build powerful one-line processing pipelines. The best security analysts think in pipelines.
# Count failed SSH logins by IP address (real log analysis)
$ grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20
847 192.168.1.105 ← brute-force attack from this IP
312 10.0.0.23
45 172.16.0.5
# Extract usernames from /etc/passwd
$ cat /etc/passwd | cut -d: -f1
root
daemon
www-data
user1 ...
# Find the 10 largest files in /var
$ find /var -type f -exec du -sh {} \; 2>/dev/null | sort -rh | head -10
# Live monitoring: show new SSH failed logins in real-time
$ tail -f /var/log/auth.log | grep "Failed password"
// 3.3 — CRON JOBS (KEY PRIVESC VECTOR)
Cron — Scheduled Tasks in Linux
Cron runs commands automatically on a schedule. Misconfigured cron jobs running as root are one of the most common Linux privilege escalation techniques. If a cron job runs a script that's world-writable, you can modify that script to run your own commands as root.
# Cron syntax: minute hour day month weekday command
* * * * * /path/to/command
│ │ │ │ │
│ │ │ │ └── Day of week (0=Sunday)
│ │ │ └───── Month (1-12)
│ │ └──────── Day of month (1-31)
│ └─────────── Hour (0-23)
└────────────── Minute (0-59)
# View current user's cron jobs
$ crontab -l
# View system-wide cron jobs (check these for privesc)
$ cat /etc/crontab
$ ls -la /etc/cron.d/ /etc/cron.daily/
# Classic privesc scenario:
# /etc/crontab shows: * * * * * root /opt/backup.sh
# ls -la /opt/backup.sh shows: -rwxrwxrwx (world writable!)
# You add: echo 'chmod +s /bin/bash' >> /opt/backup.sh
# Wait 1 minute... then: /bin/bash -p → YOU ARE ROOT
// 3.4 — BASH SCRIPTING BASICS
TARGET=$1
echo "[*] Starting recon on $TARGET"
ping -c 1 $TARGET > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "[+] Host is UP"
else
echo "[-] Host appears DOWN"
exit 1
fi
echo "[*] Scanning common ports..."
nmap -sV --top-ports 1000 $TARGET -o /tmp/scan_$TARGET.txt
echo "[+] Done. Results in /tmp/scan_$TARGET.txt"
$ chmod +x recon.sh
$ ./recon.sh 192.168.1.100
[*] Starting recon on 192.168.1.100
[+] Host is UP
[*] Scanning common ports...
[+] Done. Results in /tmp/scan_192.168.1.100.txt
// DAY 3 — LAB
Lab: Log Analysis + Bash Script
- Download a sample auth.log from the internet. Use grep to find all failed SSH attempts.
- Build a pipeline to extract attacker IPs and count how many attempts each made (see example above).
- Write a bash script that accepts an IP as argument, pings it, and prints "UP" or "DOWN".
- Check your own cron jobs with crontab -l and inspect /etc/cron.d/ on your Kali VM.
- Use
find / -writable -type f 2>/dev/null | grep -v proc — what writable files exist?
WEEK PROGRESS — DAY 4 OF 7
🪟
Why Windows? Over 70% of enterprise environments run Windows. Most high-value targets (domain controllers, file servers, workstations) are Windows. Active Directory is the authentication backbone of almost every large organization — and it's riddled with attackable design decisions.
// 4.1 — WINDOWS REGISTRY
The Registry — Windows's Configuration Database
The Windows Registry is a hierarchical database storing OS and application settings. Attackers love it for persistence (making malware survive reboots) and credential storage.
| HIVE | CONTAINS | SECURITY RELEVANCE |
|---|
| HKLM\SOFTWARE | Installed applications settings (all users) | Find installed software, versions → look for vulnerable versions |
| HKLM\SYSTEM | Hardware config, services, network settings | SAM database location, service configs, sometimes credentials |
| HKCU\SOFTWARE | Per-user application settings | Putty saved sessions (often contain SSH credentials!) |
| HKLM\SAM | Local user accounts and password hashes | Extract with mimikatz or reg save — crack with hashcat |
| HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Programs that run on startup | Classic persistence location for malware — check this in forensics |
// 4.2 — ACTIVE DIRECTORY (AD) OVERVIEW
Active Directory — The Crown Jewel Target
Active Directory is Microsoft's centralized authentication and authorization system used in virtually every enterprise network. Compromising AD = compromising the entire organization. The Domain Controller (DC) is the most valuable target in any network.
🏰 Domain
A logical grouping of computers sharing a common authentication database. All managed by a Domain Controller. E.g., CORP.LOCAL
👑 Domain Controller (DC)
The server running AD. Handles all authentication (Kerberos/NTLM), stores all user/computer accounts, enforces Group Policy. Owning this = owning everything.
🎫 Kerberos
AD's primary authentication protocol. Uses tickets (TGT, TGS). Attacks like Kerberoasting, Pass-the-Ticket, and Golden Ticket attacks all target this. You'll learn these in Week 5.
📋 Group Policy (GPO)
Centralized configuration rules pushed to all domain machines. Can set password policies, install software, configure firewalls. Misconfigured GPOs = attack vector.
// 4.3 — POWERSHELL FOR SECURITY
PowerShell — The Swiss Army Knife
PowerShell is to Windows what bash is to Linux — but more powerful for security work. Modern malware and red teams use PowerShell extensively because it's built-in, trusted, and can do almost anything.
PowerShell — Windows Security Commands
# System information
Get-ComputerInfo
systeminfo
# Running processes (like ps aux on Linux)
Get-Process
Get-Process | Sort-Object CPU -Descending | Select -First 10
# Network connections (like netstat)
Get-NetTCPConnection | Where-Object State -eq "Listen"
# Find users and their privileges
Get-LocalUser
Get-LocalGroupMember -Group "Administrators"
# Services — look for vulnerable/unusual services
Get-Service | Where-Object Status -eq "Running"
# Scheduled Tasks (Windows equivalent of cron)
Get-ScheduledTask | Where-Object State -eq "Ready"
# Firewall rules
Get-NetFirewallRule | Where-Object Enabled -eq True
# Download and run in memory (fileless malware technique)
# Never run untrusted content — shown for EDUCATIONAL awareness only
# IEX (Invoke-Expression) + download = common attack pattern
# Defenders watch for this in PowerShell logs
// 4.4 — WINDOWS IMPORTANT LOCATIONS
| LOCATION | WHAT'S THERE | WHY IT MATTERS |
|---|
C:\Windows\System32\config\SAM | Local password hashes | Extract and crack to get local admin passwords |
C:\Windows\System32\drivers\etc\hosts | Local DNS overrides | Attackers modify to redirect domains |
C:\Users\[user]\AppData\Roaming | User app data, browser data | Browser credentials, saved passwords |
C:\Windows\Prefetch | Program execution cache | Forensics: proves what programs ran and when |
C:\Windows\System32\winevt\Logs | Event logs | Security.evtx, System.evtx — evidence of attacks |
%TEMP% | Temporary files | Malware often drops here; check in IR |
// DAY 4 — LAB
Lab: Windows Exploration (Windows VM)
- Open regedit.exe. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — what's there?
- Open PowerShell as admin. Run Get-LocalGroupMember -Group "Administrators"
- Run Get-NetTCPConnection | Where-Object State -eq "Listen" — what ports are open?
- Open Event Viewer → Windows Logs → Security. Find event ID 4624 (successful logon) and 4625 (failed logon)
- Run Get-ScheduledTask — identify any suspicious scheduled tasks
WEEK PROGRESS — DAY 5 OF 7
⚠️
Critical: Your lab must be isolated from the internet. Machines like Metasploitable are intentionally vulnerable — they will be compromised within minutes if exposed publicly. Use Host-Only or Internal Network mode in VirtualBox.
// 5.1 — YOUR LAB ARCHITECTURE
Target Lab Architecture
You need at minimum three virtual machines communicating on an isolated network:
🗡️ Kali Linux (Attacker)
Your primary attack machine. Pre-loaded with 600+ security tools. Download from kali.org/get-kali. Use the pre-built VM image.
🎯 Metasploitable 2 (Linux Target)
An intentionally vulnerable Linux server. Contains dozens of exploitable services. Download from SourceForge. Never expose to internet.
🪟 Windows 10/11 (Windows Target)
Get a free evaluation copy from Microsoft. Needed for Windows-specific attacks, Active Directory labs later.
// 5.2 — VIRTUALBOX NETWORK MODES
| MODE | VM → Internet | VM → VM | USE WHEN |
|---|
| NAT | Yes (via host) | No | Default. VMs can access internet but not each other |
| Host-Only | No | Yes | Isolated lab between VMs and host only. SAFE. |
| Internal Network | No | Yes | VMs talk to each other only — host excluded. SAFEST. |
| Bridged | Yes (own IP) | Yes | VM acts like a real device on your LAN. DANGEROUS with vuln VMs |
// 5.3 — STEP-BY-STEP SETUP
Lab Setup Procedure
- Step 1: Download VirtualBox from virtualbox.org and install. Also install the Extension Pack.
- Step 2: Download Kali Linux pre-built VM from kali.org/get-kali → Virtual Machines. Import the OVA file into VirtualBox.
- Step 3: Download Metasploitable 2. Unzip, create a new VM in VirtualBox pointing to the .vmdk file. Set type: Linux / Ubuntu.
- Step 4: In VirtualBox → File → Host Network Manager → Create a Host-Only network (e.g., 192.168.56.0/24).
- Step 5: For BOTH Kali and Metasploitable: Settings → Network → Adapter 1 → Host-Only Adapter (select your Host-Only network).
- Step 6: Boot Kali. Default credentials: kali / kali. Run
ip addr — you should see a 192.168.56.x address.
- Step 7: Boot Metasploitable. Default credentials: msfadmin / msfadmin. Run
ifconfig to find its IP.
- Step 8: From Kali, ping Metasploitable:
ping 192.168.56.101. If you get replies — your lab works!
// 5.4 — FIRST LOOK AT YOUR TARGET
KALI ATTACKING METASPLOITABLE — FIRST SCAN
kali$ nmap -sV 192.168.56.101
Starting Nmap 7.94 at 2024-01-15 10:00
Nmap scan report for 192.168.56.101
Host is up (0.00045s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4 ← known backdoor (CVE-2011-2523)
22/tcp open ssh OpenSSH 4.7p1
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
80/tcp open http Apache httpd 2.2.8
139/tcp open netbios-ssn Samba smbd 3.X
445/tcp open microsoft-ds Samba smbd 3.X ← EternalBlue-style attacks
3306/tcp open mysql MySQL 5.0.51a ← no root password!
5432/tcp open postgresql PostgreSQL 8.3.0
6667/tcp open irc UnrealIRCd ← known backdoor
8180/tcp open http Apache Tomcat 5.5
# This single scan reveals MASSIVE attack surface
# Every one of these services has known critical vulnerabilities
# You'll exploit them starting Week 3
🎉
If you see output like above: Your lab is working perfectly. You've just done your first security reconnaissance. Save this IP and output — you'll return to this machine many times in the coming weeks.
WEEK PROGRESS — DAY 6 OF 7
🐍
Why Python: Python is the de facto language of security tools. Metasploit modules, exploit scripts, automation, custom C2 tools — all Python. You don't need to be a developer. You need to read, modify, and write scripts that interact with networks and files.
// 6.1 — PYTHON CRASH COURSE FOR SECURITY
target_ip = "192.168.56.101"
port = 80
ports = [21, 22, 80, 443, 8080]
service_map = {21: "FTP", 22: "SSH", 80: "HTTP", 443: "HTTPS"}
if port in service_map:
print(f"Port {port} → {service_map[port]}")
else:
print(f"Port {port} → Unknown service")
for p in ports:
print(f"Checking port {p}...")
def banner(target):
print(f"="*40)
print(f" TARGET: {target}")
print(f"="*40)
banner(target_ip)
with open("/usr/share/wordlists/rockyou.txt", "r", encoding="latin-1") as f:
passwords = f.readlines()
print(f"Loaded {len(passwords)} passwords")
// 6.2 — SOCKETS: NETWORK PROGRAMMING
Sockets — How Programs Communicate Over Networks
A socket is a software endpoint for sending/receiving data. Every network tool — scanners, exploits, C2 frameworks — uses sockets under the hood. Understanding this is the difference between using tools blindly and understanding what they do.
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(1)
result = s.connect_ex(("192.168.56.101", 80))
if result == 0:
print("Port 80: OPEN")
s.send(b"HEAD / HTTP/1.0\r\n\r\n")
banner = s.recv(1024).decode("utf-8", errors="ignore")
print(f"Banner: {banner[:100]}")
else:
print("Port 80: CLOSED")
s.close()
// 6.3 — BUILD YOUR FIRST SECURITY TOOL: PORT SCANNER
import socket
import sys
from datetime import datetime
def scan_port(host, port, timeout=0.5):
"""Returns True if port is open, False if closed"""
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
result = s.connect_ex((host, port))
s.close()
return result == 0
except socket.error:
return False
def get_banner(host, port):
"""Try to grab service banner"""
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(1)
s.connect((host, port))
s.send(b"HEAD / HTTP/1.0\r\n\r\n")
banner = s.recv(100).decode("utf-8", errors="ignore").strip()
s.close()
return banner.split("\n")[0]
except:
return "(no banner)"
def main():
if len(sys.argv) != 2:
print("Usage: python3 scanner.py <target_ip>")
sys.exit(1)
target = sys.argv[1]
common_ports = [21,22,23,25,53,80,110,139,143,443,445,
3306,3389,5432,5900,6379,6667,8080,8443]
print(f"\n{'='*50}")
print(f" PORT SCANNER — Target: {target}")
print(f" Scan started: {datetime.now().strftime('%H:%M:%S')}")
print(f"{'='*50}\n")
open_ports = []
for port in common_ports:
if scan_port(target, port):
banner = get_banner(target, port)
open_ports.append(port)
print(f" [OPEN] Port {port:5d} → {banner}")
print(f"\n[+] {len(open_ports)} open ports found")
if __name__ == "__main__":
main()
kali$ python3 scanner.py 192.168.56.101
==================================================
PORT SCANNER — Target: 192.168.56.101
Scan started: 14:32:11
==================================================
[OPEN] Port 21 → 220 (vsFTPd 2.3.4)
[OPEN] Port 22 → SSH-2.0-OpenSSH_4.7p1
[OPEN] Port 23 → (no banner)
[OPEN] Port 80 → HTTP/1.1 200 OK
[OPEN] Port 139 → (no banner)
[OPEN] Port 445 → (no banner)
[OPEN] Port 3306 → (no banner)
[OPEN] Port 5432 → (no banner)
[+] 8 open ports found
# You just built a working security tool from scratch.
# Nmap does this + 1000x more. Now you understand HOW it works.
WEEK PROGRESS — DAY 7 OF 7 — WEEK COMPLETE
🏁
CTF = Capture The Flag. Security competitions where you solve challenges to find hidden "flags" (text strings like flag{y0u_f0und_1t}). This is how you build real skills — reading about security is theory; CTFs make it real.
// 7.1 — WEEK 1 KNOWLEDGE REVIEW
| TOPIC | KEY TAKEAWAY | STATUS |
|---|
| CIA Triad | Every attack breaks Confidentiality, Integrity, and/or Availability | Day 1 ✓ |
| Threat Actors | Motivation drives technique — know who you're defending against | Day 1 ✓ |
| Linux Permissions | rwx notation, SUID bits, chmod, chown — misconfigs = privesc | Day 2 ✓ |
| Linux Commands | grep, awk, pipes, find, process management, SSH | Day 3 ✓ |
| Windows / AD | Registry, Kerberos, PowerShell, Event Logs — enterprise fundamentals | Day 4 ✓ |
| Lab Setup | Isolated VirtualBox environment: Kali + Metasploitable + Windows | Day 5 ✓ |
| Python Scripting | Sockets, file I/O, loops — built a working port scanner | Day 6 ✓ |
// 7.2 — FINAL QUIZ: WEEK 1
1. You find a file: -rwsr-xr-x root root /usr/bin/find. What can a low-privilege user potentially do with this?
A Read files owned by root
B Execute commands as root using find's -exec flag
C Delete system files
D Nothing special — SUID on find is harmless
2. A pipeline shows: grep "Failed password" auth.log | awk '{print $11}' | sort | uniq -c | sort -rn. What is the purpose of uniq -c?
A Remove duplicate lines
B Count occurrences of each unique line and prefix each with its count
C Sort lines alphabetically
D Show only the first occurrence of each line
// 7.3 — YOUR FIRST CTF MISSIONS
Mission 1: PicoCTF (picoctf.org)
- Create a free account at picoctf.org
- Complete: Obedient Cat (General Skills) — learn to find flags in files
- Complete: Python Wrangling — run a Python script to decode a flag
- Complete: Wave a Flag — use --help flags and command arguments
- Complete: Nice netcat — use netcat (nc) to connect to a server
Mission 2: TryHackMe (tryhackme.com)
- Create a free account at tryhackme.com
- Complete the room: "Pre-Security" path (free) — perfect Week 1 review
- Complete the room: "Linux Fundamentals Part 1"
- Complete the room: "Introductory Networking" (preview for Week 2)
Mission 3: Metasploitable Exploration
- From your Kali VM, run your Python port scanner against Metasploitable.
- Navigate to http://192.168.56.101 in a browser — explore the Metasploitable web interface (DVWA, Mutillidae — these are vulnerable web apps for practice)
- From Kali:
ftp 192.168.56.101 — log in with anonymous / anonymous. What files can you see?
- Document everything in a notes file. This is your first reconnaissance report.
// 7.4 — WEEK 1 CHECKLIST
Before You Move to Week 2 — Verify You Can:
- Explain the CIA Triad and map any attack to it
- Navigate the Linux filesystem, read permissions, find SUID files
- Write a grep pipeline to analyze a log file and count attacker IPs
- Use PowerShell to enumerate users, services, and network connections
- Have a working VirtualBox lab: Kali ↔ Metasploitable on an isolated network
- Run your Python port scanner and understand every line of code
- Complete at least 3 PicoCTF or TryHackMe challenges
- Have a notes system set up (Obsidian, Notion, or even a text file)
🚀
Coming in Week 2: Networking & Protocols — OSI model, TCP/IP in depth, Wireshark packet analysis, DNS/HTTP/ARP internals, and understanding the attack surface at the network layer. Everything you'll do in offensive and defensive security requires this.