Strip away the fear of the terminal and master basic filesystem navigation
Prerequisites: NoneThe shell is a command-line interpreter that provides a text-based interface to interact with the operating system. Unlike GUI (Graphical User Interface) where you click icons, the CLI (Command Line Interface) lets you type commands directly. Understanding the CLI is essential for cybersecurity because most servers, cloud instances, and security tools are managed through command-line interfaces rather than graphical interfaces. GUIs are convenient for everyday use, but CLI provides more power, precision, and automation capabilities.
Key Navigation Commands: pwd shows your current directory location, ls lists files, cd changes directory, cd .. goes up one level, and cd ~ goes to your home directory. These five commands are the foundation of all filesystem navigation.
Key File Operations: cat displays file contents, echo prints text, touch creates empty files, grep searches for patterns within files, and find locates files by name. The pipe operator | connects commands — it takes the output of one command and feeds it as input to another. For example, ls -la | grep ".txt" lists all files and filters for those ending in .txt.
What does the Linux command "cat" do?
What does the pipe operator "|" do in Linux?
Which command would you use to find files by name on a Linux system?
What does "grep" do in Linux?
Demystify HTTP traffic, browsers, and basic web structure
Prerequisites: Room 1When you type a URL into your browser, your computer (client) sends an HTTP request to a remote server. The server processes the request and sends back an HTTP response containing the webpage. This client-server model is the foundation of all web communication. Understanding HTTP is crucial for cybersecurity because most attacks target web applications.
HTTP Methods: GET fetches data (like loading a webpage), POST submits data (like a login form), PUT updates data, and DELETE removes data. The key security concern is that GET requests often include data in the URL itself, which can be logged by servers, proxies, and browser history. That's why sensitive actions should always use POST.
Status Codes: 200 (OK - request succeeded), 301/302 (Redirect - moved to another URL), 401 (Unauthorized - need to log in), 403 (Forbidden - logged in but not allowed), 404 (Not Found - the page doesn't exist), and 500 (Server Error - something broke on the server). Attackers pay close attention to status codes because a 403 instead of 404 can reveal that a hidden directory exists.
What does HTTP status code 404 indicate?
What is the key difference between HTTP GET and POST methods?
What does HTTP status code 403 (Forbidden) tell an attacker?
What are cookies used for in web applications?
Understand how data travels across networks
Prerequisites: Room 1IP Addresses are like street addresses for devices on the internet. Every device connected to a network has an IP address that identifies it. MAC Addresses are physical hardware addresses burned into network cards — like a serial number for your device's network interface.
Ports: Ports are like apartment numbers in an IP address building. Port 22 is for SSH (secure remote access), port 80 for HTTP (unencrypted web traffic), port 443 for HTTPS (encrypted web traffic), and port 8080 is often used for alternative HTTP services like proxies or development servers. Understanding which ports correspond to which services is critical for both defense (firewall configuration) and offense (vulnerability scanning).
Network Tools: ping tests if a remote host is reachable by sending ICMP echo requests and measuring response time. traceroute shows the path packets take through the internet — every router hop between you and the target. nmap is the most famous port scanner, used to discover open ports and running services on target machines.
What does the "ping" command test?
Which port does HTTPS use by default?
What does nmap do?
What is the difference between an IP address and a MAC address?
Learn why security professionals script and write your first Python automation
Prerequisites: Room 1Scripting automates tedious tasks that would be impossible to do manually. Security professionals use scripting for: parsing millions of log lines to find attack patterns, sending hundreds of HTTP requests to test for vulnerabilities, bulk-processing data like IP addresses and domain names, automating repetitive reconnaissance tasks, and extracting and analyzing data from multiple sources.
Python is the most popular language for security scripting because it has a vast ecosystem of libraries (requests for HTTP, scapy for packet manipulation, beautifulsoup for HTML parsing, paramiko for SSH automation). A security professional who can script is exponentially more effective than one who can't — it's the difference between manually checking 10 servers and automatically checking 10,000.
The Caesar Cipher: Named after Julius Caesar, this is one of the simplest encryption techniques. Each letter in the plaintext is shifted by a fixed number of positions in the alphabet. For example, with a shift of 5, A becomes F, B becomes G, and so on. Understanding basic cryptography concepts like this is important because encryption is at the heart of cybersecurity — from TLS/HTTPS to password hashing to secure communications.
Why is Python the most popular language for security scripting?
What is a Caesar cipher?
What task would a security professional automate with scripting?
If a message encrypted with a Caesar cipher with shift 5 produces "FQJ", what was the original message?
Your First Micro-CTF — Tie together CLI, Web, Networking, and Automation skills
Prerequisites: Rooms 1-4This capstone brings together CLI navigation, web understanding, networking, and scripting concepts. In cybersecurity, these skills are never used in isolation — they complement each other. When investigating a potential breach, you might use the command line (CLI) to examine log files, use web knowledge to understand what happened through web server logs, use networking tools to trace connections back to source IPs, and use scripting to automate the analysis of thousands of affected systems.
The Kill Chain: The cyber kill chain describes the stages of an attack — from reconnaissance (gathering information) to weaponization (preparing the exploit) to delivery (sending it) to exploitation (triggering it) to installation (establishing persistence) to command & control (remotely controlling the compromised system) to actions on objectives (stealing data, encrypting files). Understanding this chain helps you think like both an attacker and a defender.
You discover suspicious traffic from an internal server to an unknown IP. What skills do you need to investigate?
In the cyber kill chain, what phase comes after "Delivery" (sending the exploit to the target)?
You need to check if there are any web servers running in your company's IP range. What approach should you use?
Why is combining CLI, web, networking, and scripting skills more powerful than knowing just one?