Learn how web applications fail under input manipulation and why trusting user input is the root of all evil
Prerequisites: "Getting Started" Web & CLI roomsThe Core Concept: Every piece of software contains bugs — coding errors that cause unexpected behavior. A bug becomes a vulnerability when that unexpected behavior can be leveraged to compromise security. Think of it like a door that accidentally unlocks from the outside; the faulty lock is the bug, but the fact that burglars can use it makes it a vulnerability.
Input Sanitization: The fundamental problem is that applications trust user input. They assume you'll type your name in a "Name" field and a number in an "Age" field. But attackers think differently — they type database queries, JavaScript payloads, or system commands. This is called injection, and it's the root cause of most web vulnerabilities.
Command Injection: Imagine a web app with a ping tool that runs ping . An attacker enters 8.8.8.8; cat /etc/passwd. The semicolon is a command separator, so the system runs TWO commands: ping AND cat /etc/passwd. The attacker has escaped the intended functionality.
Broken Authentication: Developers implement shortcuts like sending OTPs in URL parameters (/reset?otp=123456), using predictable session IDs (sequential numbers), storing passwords in plaintext, or not implementing rate limiting on login forms. Each of these shortcuts creates an exploitable vulnerability.
What is the root cause of most web application vulnerabilities?
What does the command injection payload "8.8.8.8; cat /etc/passwd" do?
Why is sending OTP tokens in URL parameters insecure?
What is a bug vs a vulnerability?
Learn to capture, read, and analyze packets flowing through a network
Prerequisites: "Getting Started" Networking roomHow Data Travels: When you load a webpage, your data is broken into thousands of tiny packets. Each packet has a header (source/destination IP, ports, sequence numbers) and a payload (the actual data). Understanding packet structure lets you reconstruct conversations from captures.
TCP 3-Way Handshake: Before data exchange, TCP establishes a connection: SYN (client: "hello?"), SYN-ACK (server: "I hear you"), ACK (client: "confirmed"). This three-step dance ensures both sides are ready. You'll always see these three packets at the start of a connection in a packet capture.
Cleartext vs. Encrypted: HTTP sends everything in cleartext — passwords, cookies, messages — all readable by anyone capturing traffic. HTTPS encrypts the payload with TLS, so even if packets are captured, attackers see only encrypted gibberish. This is why every website should use HTTPS, and why network security professionals use Wireshark filters like http.request.method == "POST" to find login credentials in packet captures.
What are the three packets in the TCP 3-way handshake?
What does a Wireshark filter of "http.request.method == POST" help you find?
What is the difference between HTTP and HTTPS at the packet level?
What information is in a packet header?
Move beyond basic port scanning to map out an entire target's attack surface
Prerequisites: Basic networking and CLIPassive Recon (OSINT): Gathering information WITHOUT interacting with the target. Sources include WHOIS databases, Google dorks (advanced search operators), Shodan (internet-connected device search), social media, and public code repositories. Passive recon is undetectable.
Active Recon: Direct interaction with the target through port scanning (nmap), service enumeration, version fingerprinting, and directory brute-forcing. Active recon can be detected by intrusion detection systems and firewalls.
Nmap Techniques: The -sV flag probes open ports to determine service/version info (e.g., "Apache 2.4.41"). -p- scans all 65,535 ports instead of the default 1000. -sS performs a stealth SYN scan that never completes the TCP handshake, making it harder to detect.
Directory Brute-Forcing: Tools like Gobuster and Dirb use wordlists of common directory names to find hidden paths on web servers. Finding /admin, /backup, or /.git can reveal sensitive information. This technique played a key role in the Equifax and SolarWinds breaches.
What distinguishes passive reconnaissance from active reconnaissance?
What does the nmap "-sV" flag do?
What is directory brute-forcing used for?
Why is active reconnaissance considered illegal without authorization?
Breaking in is only step one — getting administrative access is what counts
Prerequisites: Basic CLI and Web exploitsRoot vs. Regular Users: Every Linux system has a superuser called root (UID 0) with unlimited power. Regular users operate within strict boundaries. Most security breaches start with a low-privilege account compromise (through phishing, vulnerable web apps, or weak passwords). Privilege escalation is the step where attackers upgrade that low-access account to root, enabling data theft, backdoor installation, or complete system takeover.
SUID Executables: The Set User ID (SUID) bit allows a program to run with the file owner's permissions instead of the user's. For example, passwd needs SUID to modify /etc/shadow. The danger comes from root-owned scripts with SUID that are also world-writable — any user can modify the script and their modifications will run as root.
Common Escalation Vectors: Writable scripts executed by cron jobs as root, sudo misconfigurations allowing specific commands to run as root, kernel exploits (like Dirty COW CVE-2016-5195), and exposed credentials in configuration files or backups.
What does the SUID (Set User ID) bit do?
Why is a root-owned script with SUID AND world-writable permissions dangerous?
What is the first step attackers typically take after gaining initial low-privilege access?
How do attackers find SUID binaries on a Linux system?
A comprehensive multi-phase challenge — chain together recon, exploitation, and privilege escalation
Prerequisites: Rooms 1-4This capstone brings together vulnerability identification, network traffic analysis, reconnaissance, and privilege escalation into a comprehensive security review. In a real-world penetration test, these phases build on each other: reconnaissance identifies the target's attack surface, vulnerability analysis identifies exploitable weaknesses, exploitation gains initial access, and privilege escalation converts that access into full system compromise.
The Penetration Testing Methodology: 1) Planning & Reconnaissance (defining scope and gathering intelligence), 2) Scanning (identifying open ports and services), 3) Gaining Access (exploiting vulnerabilities), 4) Maintaining Access (establishing persistence), and 5) Analysis & Reporting (documenting findings and recommendations).
Critical Security Concepts: Understanding the full attack chain is essential for both offense and defense. Security professionals who understand how attacks work can build more effective defenses. The OWASP Top 10, network segmentation, least privilege, and defense in depth are principles that protect against every stage of the kill chain.
You find an open SSH port during a penetration test. What is your next step?
After exploiting a command injection vulnerability to get a shell as www-data, what should you do next?
What is the most important output of a professional penetration test?
How does understanding the full attack chain help defenders?