Cybersecurity and Ethical Hacking

Learn what an IP address is, the IPv4 and IPv6 difference, and how subnet masks, class A to E, and public and private IPs, loopback, and network address translation relate.

Explore data transmission fundamentals by examining data packets, headers, and trailers, and compare TCP and UDP, including three-way and four-way handshakes, reliability, and speed.

Unpack the OSI model’s seven layers from application to physical and compare it with the four-layer TCP/IP model. Learn encapsulation and decapsulation, routing, and layer roles in network security.

Explore the roles of routers, switches, hubs, servers, and firewalls in building and securing networks, including core and edge routers, VLANs, NAT, DHCP, and DMZ.

Explore dns, dhcp, icmp, and arp. Understand dns lookup, resolver roles, root and authoritative servers, dhcp discovery, icmp ping, and arp mapping ip to mac.

Explore http and https, ssl and tls, and how encryption secures web communication, while outlining http methods and response codes along with smtp and ftp basics.

Explore network commands like ports, ping, traceroute, and netstat to diagnose connectivity, measure reachability, trace routes, and monitor active connections.

Build and configure a simple network in Cisco Packet Tracer, connecting end devices, switches, and routers, then configure IP addresses, DHCP or static options, and test connectivity.

Explore how an operating system acts as the intermediary between user and hardware, coordinating resources for execution. Understand processes and threads, memory management, I/O, file systems, and the kernel's role.

Explore the Linux operating system, its open source foundation, and Kali Linux for ethical hacking. Learn to set up Linux with VirtualBox, install Kali Linux, and use its security tools.

Master basic kali linux commands for file, network, and process management. Navigate with pwd, cd, and ls, and manage files with cat, rm, touch, mkdir, and chmod.

Explore how Windows operating system manages processes, services, memory, and the registry, using Task Manager, RamMap, and Registry Editor, along with Defender, Firewall, user account control, and Windows Hello.

Explore Windows and Linux file systems, comparing FAT32, exFAT, NTFS, and FAT16, and learn file permissions, journaling, and the master file table for secure system understanding.

Explore operating system security by identifying threats and preventing malware, including viruses, ransomware, spyware, Trojan horse, adware, and worms; learn defenses like patching, encryption, antivirus, firewall, and endpoint security.

Learn how to manage users and privileges across Windows and Linux, including SAM file authentication, Active Directory, domain controllers, and admin versus standard accounts.

Discover how operating system hardening strengthens your fortress by patching, closing unused ports, removing unnecessary software, and enforcing secure configurations, firewalls, and endpoint protection to reduce attack surface.

Explore log management basics: log types (system, application, security, event, access, error, performance, dns, firewall), log parsing, and sim/cim with tools like Splunk, QRadar, and Exabeam for monitoring and audits.

Explore reconnaissance as the first stage of ethical hacking, then dive into footprinting and fingerprinting to gather target-specific data, map open ports, and identify vulnerabilities.

Explore footprinting methods for reconnaissance and OSINT, including search engine queries, website and email footprinting, DNS and WHOIS lookup, and network footprinting with tools like Nmap and Wireshark.

Explore active reconnaissance in digital footprinting, using tools like Nmap, Nessus, and Dmitri to perform real time port scans, vulnerability checks, and targeted OSINT, while noting legal and detection risks.

Explore how nmap enables host discovery, port scanning, and version detection to assess an attack surface, with practical exercises on a Metasploitable target from a Kali Linux setup.

Discover how enumeration actively extracts detailed information about a target—usernames, network resources, services and open ports, and Active Directory, LDAP, and SNMP data—using NetBIOS, LDAP, SNMP, and Nmap.

Explore open source intelligence (osint), gathering public data from social media, public records, forums, blogs, and websites using the osint framework and tools like spiderfoot, maltego, and shodan.

Explore enumeration, the active process of extracting detailed information from a target system, including usernames and services, contrasted with footprinting, using NetBIOS, SNMP, LDAP.

Practice footprinting and passive information gathering through a hands-on OSINT exercise, locating IP addresses, domain registrations, and geographic details using DNS lookups, whois, and reverse DNS tools.

Conduct vulnerability assessment by identifying, verifying, and remediating hardware, software, network, and organizational vulnerabilities, using scanning tools such as Burp Suite, Nmap, Nessus, and OpenVAS, addressing false positives.

Prioritize vulnerabilities using CVE and CVSS to assess severity and exploitability, and learn how base, temporal, and environmental scores shape risk.

Identify and assess risks by analyzing threats, vulnerabilities, and potential impact. Apply remediation and continuous monitoring, with patch management, access controls, and incident response planning.

Learn to perform risk assessment using quantitative and qualitative methods, quantify impact with asset value and exposure, and evaluate supply chain risk through risk matrix and scenarios.

Penetration testing simulates attacks to identify and exploit vulnerabilities in networks, applications, and assets. It contrasts with vulnerability assessment and covers reconnaissance, scanning, exploitation, post-exploitation, and reporting.

Learn how exploits leverage vulnerabilities to gain unauthorized access, with network, web, and social engineering exploits, plus payloads, threats, and examples like buffer overflow and phishing.

Learn the Mitre attack framework and matrix, with tactics, techniques, sub-techniques and IDs, and compare it to the cyber kill chain for detecting and countering attacks.

Practice a practical penetration testing exercise using a legal vulnerable system with a template, documenting reconnaissance, vulnerability identification, exploitation with Metasploit, and post-exploitation steps including mitigation.

Explore web application architecture, including front end elements (HTML, CSS, JavaScript) and back end components (servers, databases, APIs). Understand HTTP, URL structures, and how these parts interrelate.

Explore Burp Suite, a premier web application security toolkit, and learn to use proxy, repeater, intruder, and scanner to identify vulnerabilities such as SQL injection and XSS.

Learn about cross-site request forgery (CSRF) attacks through a practical DVWA exercise, showing how an attacker can change a password and perform actions through a legitimate session.

Explore server side request forgery (ssrf), its impact on internal resources and data, types including basic and blind ssrf, with a practical lab and mitigation techniques to protect web apps.

Learn how cross-site scripting (xss) enables client-side attacks and the three main types: stored, reflected, and dom-based, along with practical mitigations like input validation, sanitization, encoding, and content security policy.

Understand how SQL injections exploit web applications by manipulating database queries, including booleans such as true or false, and learn mitigation with input validation, length limits, and prepared statements.

Explore http host header attacks and how host headers can direct requests to an admin interface, including a lab with burp suite to delete Carlos.

Explore how HTTP header security mitigates cross-site scripting and clickjacking by enforcing content security policy, strict transport security, X-content-type-options, X-frame-options, and referrer policy.

Learn how to implement input validation and secure coding: sanitize inputs on both sides, apply whitelisting and format checks, and use dynamic analysis to prevent SQL injection and XSS.

Explore wireless security concerns, including eavesdropping, man-in-the-middle attacks, rogue access points, and IoT device risks, and learn encryption, authentication, access control, firewalls, and IDS/IPS mitigation strategies.

Explore wireless security standards from WEP to WPA, WPA2, and WPA3, highlighting RC4 weaknesses, TKIP and AES-CCMP, and the move to PSK and enterprise authentication with replay protection.

Explore wifi security fundamentals, including access points, ssid, bssid, and wifi standards. Apply hacking steps and tools like aircrack-ng, net surveyor, and wifi analyzer for practical assessment.

Define mobile operating systems, compare iOS and android, and outline security concerns such as routing, malicious apps, and outdated software.

Explore Android architecture across its five layers—Linux kernel, Android runtime, libraries, application framework, and application layer—and learn about open source roots and security risks like privilege escalation and zero-day vulnerabilities.

Explore how the internet of things connects sensors and devices to the internet and cloud, enabling data collection and autonomous actions, while highlighting security challenges and practical mitigations.

Explore how social engineering exploits human trust and psychology to breach physical security, revealing impersonation, phishing, pretexting, baiting, tailgating, and other attack types.

Learn to identify phishing attacks, including email phishing, spear phishing, whaling, smishing, vishing, and qr code phishing, and recognize how attackers steal credentials and money.

Defend against phishing by deploying layered defenses such as DNS filtering with Quad9 or OpenDNS, firewalls, IPS/IDS, EDR, and logging, while recognizing phishing topologies and indicators of compromise.

Explore defense in depth and physical security, including deterrence, detection, and delay frameworks, to protect devices, networks, and data in IoT and cloud contexts.

Analyze email header components to trace sender paths, detect spoofing, and verify authenticity using SPF, DKIM, and DMARC, while examining from and return-path, received lines, and message IDs.

Explore advanced exploitation techniques and countermeasures, revisiting vulnerabilities and exploits like buffer overflow, SQL injection, and cross-site scripting, and emphasize defense in depth with DEP and ASLR.

This lecture covers typosquatting, punycode attacks, and unicode-based homograph tricks, and explains fuzzy hashing, rootkits, and steganography as advanced attack techniques.

Explore advanced evasion techniques to bypass detection and test security, covering network methods like fragmentation and protocol tunneling, and host techniques such as process injection and living off the land.

Explore malware evasion techniques like polymorphic and metamorphic malware, packers, log tampering, and fileless memory evasion, plus countermeasures such as behavior-based detection and sandboxing.

Explore virtual private networks and IPsec, detailing VPN types (point-to-point, site-to-site, cloud) and components (gateway, client, server) to secure remote access and privacy.

Master incident response by learning how to detect, analyze, contain, and recover from cyber threats, and apply post-incident analysis to strengthen security posture.

Explore an incident response scenario in financial services, detecting malware activity and data exfiltration, isolating a workstation, eradicating threats, restoring from backups, and applying lessons to strengthen blue-team readiness.