Certified WhiteHat Hacker Level 1 ( CWHH Level 1)

Identify information gathering methods across physical and online domains, including social engineering, dumpster diving, social media, and search engines, and explain defenses like proper disposal and privacy settings.

Explore practical information gathering using whois lookups to reveal domain ownership, registration dates, contact details, and administrator information, illustrated with Google.com and Facebook.com.

Explore how hash functions secure passwords and verify file integrity, then examine password cracking methods like brute force and dictionary attacks, and learn to create strong passphrases over 15 characters.

Demonstrate password cracking through dictionary attack and brute-force methods on hash files using a cracking tool. Show practical results by cracking passwords such as admin and 123456.

Explore how John the Ripper cracks password hashes by combining a dictionary file with a passwords file, revealing usernames and corresponding passwords.

Explore session hijacking by learning how attackers guess or steal session ids, sniff traffic, and use phishing or crafted links to capture cookies and impersonate users.

Demonstrates xss-based session hijacking by injecting scripts to steal and reuse a victim's cookies and session id, enabling the attacker to impersonate the user.

Demonstrates practical session hijacking with Wireshark, capturing traffic, exporting data with Network Miner, and intercepting login credentials to hijack a user session.

Explore Google hacking theory by learning how to refine searches with operators such as site, file type, text, anchor, and date range to obtain precise results.

Explore Google hacking techniques using search operators to discover sensitive data and exposed directories within sites, including passwords and misconfigured servers.

Shodan searches IP addresses, ports, and banners to locate devices like routers or servers, with filters by country, host name, IP range, and port.

Demonstrates a practical Shodan search, showing how to filter by country, device type, and services such as webcams. It discusses the potential risks of default passwords and hacking.

Explore how the surface web differs from the deep web, how hidden services conceal data, and how sites like Silk Road and Hidden Wiki operate.

Explore sandboxing as a security mechanism that runs software in an isolated space, preserves the main system from changes, and enables secure web browsing with tools like Sandboxie.

Demonstrates sandboxing by running an untrusted application inside a sandbox, ensuring changes stay isolated from the main system and teaching how to delete sandbox contents after testing.

Learn to use Sandboxie to run a browser in a sandbox and apply restrictions. Safely install, test, and analyze programs within a contained environment.

Explore sandboxing and virtual machines to isolate software in a virtual space, prevent permanent host changes, and understand how hypervisors manage multiple guest operating systems for secure web browsing.

Create and configure a virtual machine, install an operating system such as Windows XP Professional, and explore a Windows XP environment through the VM console.

Begin with VirtualBox introduction, configure CPU, storage, and network, insert the CD with deception tools, and manage snapshots and shared folders between host and guest.

Create a new virtual machine in VirtualBox, configure dynamically allocated storage, and prepare for an operating system install using a Windows XP 32-bit ISO.

Explore what a web application is and how a web server serves dynamic pages using databases for shopping sites, social media, and search engines.

Master web application pentesting by following four phases: information gathering, locating security bugs, exploitation, and documenting findings. Identify vulnerabilities such as cross-site scripting, cross-site request forgery, and secure object references.

Examine SQL injection theory, a vulnerability that lets attackers inject malicious SQL, bypass login screens, and compromise authentication through crafted queries.

Explore SQL injection practical through a login form, showing how crafting queries like or one is equal to one bypasses authentication and grants a session.

understand how cross-site request forgery enables actions by a logged-in user via a crafted page, potentially changing passwords or money, and how tokens defend form submissions.

Demonstrates a csrf attack by crafting a malicious page that changes a victim's profile description and photo without auth, illustrating practical exploitation and defenses.

Explore click jacking theory, a technique that tricks users into clicking hidden frames to perform actions such as liking pages, and learn defenses like i frames and frame restrictions.

Demonstrates a practical click jacking attack from the victim’s perspective, showing how an attacker uses an i-frame to prompt account deletion and hijack a history page.

Understand local file inclusion and remote file inclusion, their impacts such as code execution, information disclosure, and denial of service, with case studies and practical examples.

Demonstrates local file inclusion (lfi) techniques, showing how an attacker uses dot dot slash to access server files and locate a text file with default credentials.

demonstrate file inclusion by loading arbitrary files into a vulnerable app, showing how an attacker can execute a shell, browse files, and access the database.

Explore cross-site scripting (xss) theory, including reflective and stored variants, and how attackers inject scripts into pages to steal cookies, infect users, and manipulate web sites.

demonstrates a practical reflected xss attack by submitting input in a search form, showing how unsanitized user input is echoed and scripts execute on the page.

Demonstrates stored XSS in a forum by posting unsanitized text, injecting a script that prints the user cookie in an alert, illustrating how cookies can be stolen.

Kali Linux evolved from backtrack to a Debian-based penetration testing toolkit, built by Offensive Security, with a complete security toolset, installation options, and portable live or virtual deployment.

Boot Kali Linux from a live cd in a virtual machine, navigate the interface, and explore Kali's tool categories, from information gathering and fuzzing to exploitation, wireless, backdoors, and forensics.

Explore how social engineering manipulates people to reveal information and access systems by exploiting emotions like excited and scared through phishing emails, fake alerts, and spearfishing.

Understand how phishing attackers create fake pages of legitimate sites to steal usernames and passwords; identify signs like mismatched domains and missing padlocks to detect threats.

This lecture demonstrates how a phishing login page is created and used to harvest usernames and passwords, exposing attacker-led code changes and credential collection.

discover how to detect phishing pages by scrutinizing domain names, subdomains, and security indicators, then verify the site before entering credentials such as email and password.