BSD Kernel Security Internal for Ethical Hackers

Name: BSD Kernel Security Internal for Ethical Hackers
Rating: 3.7 (7 reviews)

If you want to know how BSD kernel security internals works then this course is for you.

Created bySwapnil Singh

Last updated 9/2026

English

ArabicGerman

What you'll learn

Primary goal is to expose the learners to rootkits and rootkit writing. After completing this course they have a better understanding of rootkits
You will understand the theory and practical of rootkits. You will start enjoying by creating your own rootkits.
You will have a better understanding of kernel working in the operating system by understanding rootkits design.
This course will build a strong foundation on the kernel hacking area. So after finishing this course you will feel very confident in kernel hacking.

Course content

5 sections • 38 lectures • 12h 7m total length

Goal of this course2:38
Learn to code rootkits in Linux, explore kernel components, and develop skills to detect and remove rootkits, gaining practical insights into kernel security.
Who can take this course2:47
Welcome hackers and pentesters who want to learn kernel hacking, programmers curious about introductory kernel hacking, and computer science students pursuing cybersecurity as a career.
What skills are needed to follow this course ?1:29

Lab Setup Part 14:45
Set up your lab by downloading the linux kernel exploitation virtual machine image, importing the appliance in VirtualBox, configuring host-only adapter, and booting as root with password two.
Lab configurations part 25:37
Step 1: Create a file named mylab.sh in your main host machine from which you want to access the lab machine
Step 2: Now paste below line in your mylab.sh file,
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss root@<your_ip_address>
Step 3: save the file mylab.sh
Step 4: Give the execute permissions,
user@Linux:$ chmod +x mylab.sh
Step 5: just run the file to login into your lab machine,
user@linux:$ ./mylab.sh

What is a Kernel in OS ?7:28
Learn how the kernel sits at the core of the operating system, acting as the bridge between user applications and hardware, managing communication and protecting hardware from malicious software.
How to load a Kernel Module inside a running kernel ?13:24
Discover how to load a module into a running kernel using an event handler and the declare_module macro, printing hello world on load and goodbye on unload.
How we can interact with the kernel ?6:57
Learn how kernel modules provide an interface to interact with the kernel, enabling admins to add or remove functionality and framing kernel exploitation concepts across Linux distributions and FreeBSD.
Writing our first Hello World Kernel Module25:11
Learn to write and load your first hello world kernel module, printing hello world on load and goodbye on unload, with a Makefile and declare module macro.
Basic Components to load a syscall module inside kernel10:50
Coding our own System call module in kernel27:51
Calling and Executing our own syscall function from the kernel17:16
Learn how to create and load a custom kernel syscall, determine its offset number, and call it with a string argument to print messages in the kernel.
Core functions for data transmission between user space and kernel space14:52
Master core data transmission functions for moving data between user space and kernel space, including copy in, copy in string, copy out, and copy string.
Understanding Character device module by some practical examples19:01
Explore how character device modules enable data transfer between user space and kernel space, appear as special files in /dev, and power terminal communication with byte-by-byte read/write.
Understanding Character device module structure25:12
Coding our Character device module31:54
Writing code for reading and writing data to the character Device33:19
Learn Linux kernel exploitation for beginners by creating two small programs to write to and read from a character device module across two terminals.

What is Hooking ?7:57
Discover hooking as a technique that modifies a function's control flow while preserving its original behavior, with practical examples of injecting statements and hooking system calls.
Understanding System Call Hooking10:12
Writing code for Syscall Hooking25:08
Learn to write a kernel module that hooks the mkdir syscall, replace the original system call with a hooked version, and test loading and unloading to restore normal behavior.
Understanding the concept of accessing the hooked syscall arguments18:00
Learn to access mkdir path and mode arguments by hooking the system call, creating a mkdir_args structure, linking it to the syscall args, and printing the directory name and permissions.
Writing code for accessing the hooked syscall arguments28:22
Explore Linux kernel exploitation basics by hooking the mkdir system call to access path and mode arguments, declare a UAP, link to syscall args, and print directory details.
Concept of creating a rootkit for keylogging linux admin login panel7:13
Explore the concept of a Linux rootkit keylogger by hooking the read system call to capture login panel keystrokes and inspect the input buffer.
Coding a rootkit which sends the linux admin login panel data to the hacker31:05

What is Kernel Object Manipulation ?4:51
Explore direct kernel object manipulation by examining kernel data structures and the q dot h header file, using five macros from sixty-one to perform exploitation and rootkit creation.
Code structure of a rootkit which hides a running process29:16
Writing code for rootkit which hides the running process37:36
Making our process hiding rootkit more reliable19:33
Demonstrates why a Linux process hiding rootkit is not reliable and explains hiding a process from both the proc list and the pid hash table to achieve complete concealment.
Concept of creating a rootkit which hides a tcp port in Linux23:04
Explore how a Linux kernel rootkit hides a TCP port by implementing a system call module and iterating a port list with proper locking.
Coding and Testing our port hiding rootkit in Linux39:34
Explore Linux kernel exploitation concepts by coding and testing a port-hiding rootkit in a lab setting, following slides to understand TCP port concealment and system call techniques.
Basic design concept of a rootkit which redirects the binary execution19:58
Learn how a rootkit redirects binary execution on Linux by hooking the execve system call, manipulating the argument buffer, and swapping in a trojan binary.
Creating binary files for proof of concept3:21
Coding and testing our rootkit which redirects the binary execution41:19
Examine how to create and test a kernel module that redirects binary execution by hooking the execve system call, illustrating a rootkit prototype within an ethical hacking context.
But there is a problem with our rootkit, lets fix that10:34
Building a rootkit that hides a file from the system21:50
Coding the rootkit that hides a file from the system47:09
How to create a rootkit which hide a running kernel module25:20
Coding the rootkit which hide a running kernel module25:26

Requirements

Linux basics
Basic C programming

Description

In this course I will teach you how a kernel security internal works inside BSD operating system.This course is for educational purpose don't use these skills for offensive purpose. Use these skills to understand the different aspects of rootkits inside an operating system for defensive purpose.

In this course I will start from the very basics of kernel and will go into indepth adventure of rootkits. So you will feel very curious day by day by following this course.

If you are feeling that you don't know about kernel at all don't worry I have made this course such a way that you will not stuck at any point because I have started from very basics as to keep in mind that the learner does'nt know about kernel at all.

What are kernel rootkits:

A kernel rootkit is a type of malicious software that is designed to operate at the kernel level of an operating system. It is designed to remain hidden and to operate without the knowledge or consent of the user.

Kernel rootkits are very dangerous and can be very difficult to detect and remove, because they operate at such a low level of the operating system.
They have full access to control all the system resources, including memory, I/O, and system calls, and can intercept and modify system calls to hide their own actions.

Kernel rootkits can be used for a variety of malicious purposes, such as allowing an attacker to gain unauthorized access to a system, to steal sensitive information, or to disrupt the operation of the system.
They can also be used to create a "backdoor" into a system, allowing an attacker to regain access at a later time.

Learning about kernel security and how they work can help individuals and organizations to better understand and defend against these types of threats.

For example, understanding the techniques and tactics used by rootkits can help security professionals to design more effective defenses and to identify and mitigate rootkit infections. It can also help individuals to make more informed decisions about the security measures they use to protect their own systems and data.

Who this course is for:

Ethical Hackers
Penetration testers
Programmers
Cyber security Analysts
Computer Science Students
Malware Analysts
System Administrator

BSD Kernel Security Internal for Ethical Hackers

What you'll learn

Explore related topics

Course content

Introduction3 lectures • 7min

Lab Setup2 lectures • 10min

Linux Kernel Module Basics12 lectures • 3hr 53min

Hooking7 lectures • 2hr 8min

Manipulating Kernel Objects in Linux14 lectures • 5hr 49min

Requirements

Description

Who this course is for: