Ethical Hacking from Scratch: Complete Bootcamp

Explore the hacking lab environment by using Linux as the hacking OS; install Kali in a VM on Windows or Mac, and access hundreds of tools for penetration testing.

Learn how to install Kali Linux in a virtual machine using VirtualBox or VMware, including prerequisites, downloading software, importing a VDI, and first boot steps.

Log in as the kali user and become root with sudo su. Install VirtualBox guest additions for better mouse, shared folders, clipboard, and update apt.

Set up a hands-on penetration testing lab by installing metasploitable, configuring a host-only network with Kali Linux, and preparing a vulnerable VM for safe practice.

Demonstrates using Metasploit to conduct reconnaissance, scan for vulnerabilities, and exploit a vulnerable vsftpd service on a lab network, gaining a remote shell and full control over a target VM.

Learn to use the msfconsole interface to access metasploit modules, run exploits, and navigate options with show exploits, search, and info for targeted payloads and auxiliaries.

Explore the common Metasploit workflow from discovering vulnerable services with scanners, choosing an exploit and payload, gaining a reverse shell, to post-exploitation for persistent access.

discover how to use routersploit to scan and exploit routers and embedded devices, including modules for exploits, credentials, scanners, and payloads, with legal guidelines and installation steps.

Learn to use RouterSploit to scan a network's default gateway for vulnerabilities with autopwn, identify exploits and payloads, and emphasize updating firmware and changing default credentials to mitigate IoT risks.

Explore rootkits and their stealth techniques, learn using rkhunter and chkrootkit to scan Linux systems, compare file properties and hashes, and interpret logs from rescue disk scans.

Explore hashes as cryptographic functions that produce deterministic, unique outputs called hashes, with examples like sha256, md5, sha1, and sha-3 across Linux tools and blockchain contexts.

Explore the properties of cryptographic hash algorithms, including determinism, one-way transformation, fixed-length outputs, and the avalanche effect. Learn about collisions, compression, efficiency, and preimage resistance, with SHA256 and SHA512 examples.

Explore the applications of hash algorithms across password verification, file integrity, and digital signing, and learn how salt, rainbow tables, and hash tables influence security and data structures.

Explore collision, preimage, and second preimage attacks on hash algorithms, with MD5, SHA-1, and SHA-256 examples and practical implications.

Learn full disk encryption with dm-crypt and luks on Linux, encrypting entire drives to protect data at rest, offer plausible deniability, and ensure transparent kernel-level security.

Encrypt a Linux disk with dm-crypt and LUKS, including backups, setting up cryptsetup, creating a LUKS mapping, formatting with ext4, and mounting the encrypted filesystem.

Unlock LUKS encrypted drives by adding a random key file as an extra authorization, then use cryptsetup luks open to mount the drive.

Install and use VeraCrypt on Windows, Mac, Linux for full disk encryption, including creating, mounting, and managing standard and hidden volumes for plausible deniability.

Explore GnuPG, the open source GNU Privacy Guard implementation of OpenPGP, which manages public and private keys, and enables encryption, decryption, and symmetric or asymmetric signing and verification.

Learn symmetric encryption with gpg, using AES256 or Blowfish to securely encrypt files and choose binary or ASCII output. Encrypt with a passphrase, decrypt, and manage the passphrase with gpg-agent.

Generate and protect gpg key pairs with gpg --gen-key and a passphrase. Manage keys in the keyring with --list-keys, --list-secret-keys, --export, --import, and delete commands, using --armor for text output.

Explore how GnuPG public keys are distributed via public key servers, import keys with gpg --recv from pgp.mit.edu, and publish keys with --send-keys.

Explore how public key cryptography uses asymmetric key pairs for encryption. Encrypt with a recipient's public key, decrypt with the private key, and manage keys with gpg.

Create and verify digital signatures with gpg to ensure authenticity and integrity of files and messages. Learn about clear-text, binary, and detached signatures and how to verify using public keys.

Demonstrate symmetric and asymmetric file encryption with gpg, signing the encrypted file in one step. Use recipient public keys and your private key to encrypt, sign, transfer, and verify decryption.

EncryptPad is an open source, cross-platform text editor with on-the-fly encryption that protects text files and other content using passwords or keys, AES, SHA-256, and GPG-compatible formats.

Explore steganography, hiding information in plain sight by embedding data into images or audio as stego files. See how to extract hidden messages and digital watermarking.

Master steganography by embedding data in RGB image pixels using least significant bits, preserving image appearance. Discover LSB manipulation, color channels, and recovery of hidden information.

Learn to hide and extract data with steghide, using images or audio, advanced encryption standard, and PRNG-based embedding, while checking capacity and detecting steganalysis.

Explore how Linux authentication relies on /etc/passwd and /etc/shadow, detailing user fields, login, and shell. Demonstrate how shadow hashes passwords with salt, showing unique hashes per user and root-only access.

Learn how password hashes are cracked through brute force, dictionary attacks, and rainbow tables. Compare the time and storage tradeoffs of these methods and see how breaches expose hashes.

Learn how to crack passwords with John the Ripper using brute force attack, dictionary, and incremental modes on Kali Linux.

Learn to build a custom password dictionary by combining multi-language word lists and deduplicating entries, then run John the Ripper with shell and user filters and incremental mode.

Create passwords with at least 12 random characters, mixing lower and upper case letters, digits, and symbols, avoiding dictionary words; store encrypted with a password manager and enable two-factor authentication.

Explore how Hydra brute forces remote service passwords with parallelized dictionary attacks across 50+ protocols, then learn mitigation like strong passwords and ssh public key authentication.

Explore rainbow tables and the time-memory tradeoff that precomputes hashes to crack password hashes quickly, highlighting storage tradeoffs, md5 and sha256 examples, and why strong passwords resist such attacks.

Learn to generate rainbow tables with rtgen, sort them with rtsort, and crack sha256 hashes using rcrack on Kali Linux; understand charset, plaintext length, and chain parameters.

Explore how rainbow tables crack passwords and how salts thwart them by making each hash unique, using real-world Linux shadow file examples and salted hashes.

Explore how online tracking identifies you across sites via cookies, browser fingerprinting, and third-party trackers, and learn how privacy tools like the Brave browser protect you.

Explore multiple techniques to stay anonymous online, from incognito mode and ad blockers to VPN, Tor, and tails, and learn how each method hides your IP address and traffic.

Explore how temporary and disposable e-mail addresses protect privacy, avoid tracking, and minimize spam when signing up for websites, including using throwaway inbox services and verification steps.

Protect privacy by using disposable numbers or second-number apps for sms verifications, while understanding online receive services and the limits of non-sensitive verification.

Explore onion routing and Tor to understand how layered encryption protects traffic through relays and how Tor hidden services relate to privacy on the dark and deep web.

Explore onion routing and Tor in depth, learning how entry guards, three relays, and layered encryption create private circuits that conceal source and destination from observers.

Install and run the Tor Browser on Windows or Linux, verify its digital signature with the public key, and learn about bridges to bypass censorship.

Compare vpn and Tor as ways to hide your identity online, noting that vpn knows your real identity, which is not applicable to Tor.

Examine the surface, deep, and dark web layers, including surface at about 4–5% and the deep web at 96%, with onion services accessed through the Tor browser.

Compare surface web browsing with Tor and dark web access to understand how anonymity and privacy differ. Learn how Tor relays, guard and exit nodes, and onion services protect identity.

Only visit the dark web with a legitimate purpose, using the Tor browser and known onion addresses, due to risks and possible trauma.

Explore Tor’s anonymity, the dark web’s legality, and vulnerabilities like compromised exit relays, then follow best practices with tails or a dedicated system, avoiding non-https sites and torrents.

Explore reconnaissance as a foundational hacking phase, covering passive and active methods, OSINT sources, footprinting, scanning, and enumeration, with tools like nmap to map a target.

Learn how to use nmap for network discovery and security auditing, including tcp syn (half-open) scans, connect scans for non-root users, port and service detection with -sV, and udp/icmp scans.

Master advanced nmap features to bypass icmp ping blocks with -Pn and decoys, then perform OS and version detection, file-based targets, and fast scans with -T4 and -A.

Explore the Nmap scripting engine, enabling Lua scripts to automate DNS enumeration, vulnerability scanning, brute-force testing, and malware discovery, using the default installation's about 600 scripts for reconnaissance.

Zenmap provides a multi-platform graphical interface to the Nmap security scanner, enabling beginners and experienced users to run scans, save results, compare scans, and manage profiles for repeatable network audits.

Compare two Nmap scans saved as a.xml and b.xml using ndiff or Zenmap to identify differences, such as port 22 changing status.

Discover how arp-scan and netdiscover perform arp scanning on your local lan using the arp protocol, including stealthy hosts and active or passive modes.

Explore vulnerability assessment systems (VAS) and how they identify, prioritize, and report vulnerabilities with tools like Nessus, OpenVAS, and Nexpose, including resource needs and integration with Metasploit.

Explore Google hacking, or Google dorking, to identify vulnerabilities by crafting advanced search queries, using quotes, filetype, site, intitle, or operators, and applying time filters and exclusions.

Learn how Google dorks and operators like allintext and filetype uncover exposed data from misconfigured servers. Identify credentials, phpinfo data, WordPress directories, and sensitive files with ethical cautions.

Learn to use Google dorking to locate publicly accessible webcams and IoT devices, compare with Shodan, and review legal and ethical constraints, including that unauthorized access is illegal.

Explore Shodan, the search engine designed to find internet of things devices, and learn from an ethical hacker’s perspective how to assess and protect critical infrastructure, including energy utilities.

Discover how Shodan interrogates ports and grabs banners to index IoT devices for search, enabling vulnerability assessment and targeted penetration testing.

Explore how to use Shodan for automated target discovery with filters like country, city, subnet, port, and product, and combine terms to locate vulnerable devices and reveal service vulnerabilities.

Learn to install and use the Shodan CLI with Python, initialize API keys, and run searches and queries (counts, fields, hosts) to identify internet-connected devices such as Chromecast.