The Beginners Guide to Practical Cyber Hacking Skills

Learn the key principles of cyber security, including the CIA triad and the D&D triads, and understand why these terms matter to every cyber security professional.

Master the cia triad of confidentiality, integrity, and availability, and the dad triad of disclosure, alteration, and deniability, and learn protections like encryption, hashing, and authentication to safeguard data.

Explore core cybersecurity principles, including non-repudiation, access control, and authentication, with examples of passwords, key cards, biometrics, and multi-factor setups, plus mac, dac, and rbac models and the trade-off.

Learn to use the CWE and CVE to identify design flaws and real vulnerabilities, with cookies and data integrity examples, and how the National Vulnerability Database aids tracking.

Refresh your understanding of threats and attacks by reviewing malware, social engineering, ransomware, and hacking methodology, and test your knowledge with the attached quiz.

Meet the bad guys in cybersecurity, including black hats, gray hats, script kiddies, hacktivists, and insider threats from disgruntled employees.

Discover how malware types—viruses, worms, trojans, rootkits, spyware, adware, keyloggers, and ransomware—differ in activation, self-replication, and network spread.

Ransomware encrypts victim files and demands a bitcoin ransom to regain access. It details delivery methods like phishing, malvertising, drive-by downloads, and USB drives, and notes healthcare targets and losses.

Expose how social engineering exploits human emotions and weaknesses to extract information, and identify the five main tactics: baiting, pretexting, quid pro quo, phishing, and vishing.

Examine the general hacking methodology from reconnaissance and exploitation through privilege escalation, persistence, attack, and cover up, including passive and active reconnaissance, backdoors, and data exfiltration.

Explore virtualization with VirtualBox and Kali Linux, learn how to install Kali on VirtualBox, and grasp Kali's file system and commands for ethical hacking basics.

Install VirtualBox from virtualbox.org, download the extension pack for extra features, install both, and launch the VirtualBox manager for hands-on setup.

Download Kali Linux ISO, set up a VirtualBox VM, configure memory, processors, and storage, attach the ISO, and perform a graphic install before testing internet access.

Resolve common NAT network visibility issues in Kali Linux by adding a new NAT network in VirtualBox preferences, then enable it in Kali Linux network settings.

Explore Kali Linux's hacker-oriented design, navigate its information gathering, vulnerability analysis, and web application tools, and master the terminal emulator to run commands and manage applications.

Explore essential Kali Linux commands for navigating and organizing files, including pwd, cd, ls, ls -l, mkdir, cat, and clear, with attention to case sensitivity and the root directory.

Review the completion of the Kali Linux and VirtualBox tools groundwork, including installation and basic commands, and preview upcoming use of tools for brute force attacks and reconnaissance.

learn to create phishing links with Black Eye and Z Fisher, and craft phishing emails using Kali Linux, all for educational purposes and updated course guidance.

Learn how to use the Black Eye phishing tool to clone a LinkedIn login page, with Kali Linux file setup and the provided Black Eye gs tar js file.

Learn how to create a phishing site that clones LinkedIn using the black eye tool, showing how attackers harvest credentials and why verifying links matters.

Explore how to use zphisher to craft phishing sites for security testing, including cloning repositories, generating fake login pages, and evaluating link behavior and detection.

Explains how phishing emails impersonating PayPal are crafted to deceive victims, using logos, urgency, and spoofed branding, and how attackers harvest credentials.

Spot phishing emails by recognizing spoofed domains like paypal.net or paypal.biz and by inspecting hover links that reveal the true destination, then educate others to avoid clicking and protect credentials.

Discover how easily phishing websites and emails can be created and explore ethical, safe testing with trusted friends or family, while respecting legal boundaries.

Discover core networking principles essential to cybersecurity, including DHCP, DNS, ports and protocols, TCP three-way handshake, network hardening, and configuring the Windows 10 firewall.

Explore a simple home router setup connecting multiple devices, and learn how IP and MAC addresses govern network communication, with practical insights into networks and cyber security.

Explore how dhcp automatically assigns ip addresses to devices through leases, and how dns translates domain names into ip addresses, with home routers acting as servers.

Explore how dhcp assigns ip addresses and dns settings, view lease details, and renew or release addresses on Windows 10 and Mac, with manual ip options and troubleshooting dhcp issues.

Explore how dns caching works, how to flush dns with ipconfig, and how the hosts file maps domains to ip addresses for faster access to websites.

Explore ports and protocols, including http, https, ftp, smtp, and arp, and learn how virtual ports create network access points and potential security vulnerabilities.

Explore how devices use internal IP addresses behind a single public IP, as a router translates requests with network address translation for internet access and security.

Demonstrate the tcp three way handshake: a client sends a syn, the server replies with syn-ack, and the client sends an ack to start data transfer.

Hardening networks with IDS and IPS, using signature based and anomaly based detection, and applying a playbook to change default credentials, patch systems, enforce secure protocols, and disable unused ports.

Explore how firewalls filter traffic using the Windows 10 firewall, focusing on inbound and outbound rules across domain, private, and public profiles, with logging and monitoring.

Block internet access for Google Chrome by creating an outbound rule in Windows 10 firewall, selecting the chrome.exe program and applying the rule to all profiles.

Consolidate your understanding of networking principles and network security from this section, and complete the attached quiz to gauge progress and move on to the next section.

Learn Nmap, the network scanner, to identify IPs, open ports, and operating systems or services, and use its command line or graphical user interface for ethical hacking and security analysis.

download and install nmap from nmap.org on Windows, Linux, or Mac, including the optional Npcap driver, then run nmap from the command prompt or via Zenmap.

Learn how to use nmap to discover live hosts, open ports, and service versions, with IP address targets and OS detection, using tcp/udp scans and port ranges.

Identify the six Nmap port states—open, closed, filtered, unfiltered, open filtered, and closed filtered—and explain how probes reveal or obscure port status, including syn and ax scans.

Nmap uses icmp echo, icmp timestamp, and tcp syn probes to identify active hosts and open ports, and explains stealth (-sL, -sn) and intrusive (-P) host discovery scans.

Explore Nmap scan techniques, including tcp syn, udp, and tcp connect scans, and master port ranges, scan orders, and service, version, and os detection.

Explore advanced firewall and intrusion detection system evasion techniques, including packet fragmentation, decoys, port spoofing, and data strings used in Nmap scans.

Learn to use nmap scripts for brute force attempts, vulnerability assessments, and discovery, exploring categories like authentication and dos, with the default -sC script and verbose -V output.

Learn Zenmap, the graphical user interface for Nmap, and run scans with administrative privileges to view open ports, host details, and saved scans.

Practice using Nmap to scan for IP addresses, open ports, and live systems on a network. Proceed with extreme caution in public spaces, like coffee shops, to build your skills.

Explore hashing in cybersecurity, learn how hash values transform files into compact one-way representations with MD5 and SHA algorithms, and support malware research and integrity verification.

Learn to calculate hash values for various file types using PowerShell, with sha256 as the default and md5 as an alternative, and explore hashing for integrity verification and collisions.

Explore hashcat, a free, fast tool for brute-force password attacks across macOS, Linux, and Windows. Learn how to download binaries, unzip, and verify GPU support to maximize speed.

Set up hashcat by cleaning folders and preparing dict and hash text files. Run a test md5 crack using swordfish in dict one and explore hashcat attack modes.

Launch a word list attack with Hashcat by specifying md5, providing a hash file and a dict file, and running the command to crack the hash, as demonstrated with swordfish.

Learn to perform a combinator attack with Hashcat using two wordlists and rockyou.txt to crack an MD5 hash, illustrating why two distinct lists are required.

Explore how a mask attack replaces brute force by exploiting known password patterns for lowercase, uppercase, digits, and special characters, with examples in hashcat targeting an md5 hash.

Explore passwords and hashes, understand brute force attacks, and learn to use Hashcat to launch different kinds of brute force attacks.

Explore how websites work, including HTML, CSS, JavaScript, and PHP, and inspect and manipulate code. Review OWASP top ten; study cross-site scripting and SQL injection; get started with Burp Suite.

Explore how a website loads: the browser checks local cache or queries DNS for an IP, then fetches content from the web server, with cache clearing tips.

Discover how HTML forms the web page skeleton and structure. See how CSS adds styling, JavaScript adds interactivity, and PHP enables server-side communication.

Explore how to inspect and manipulate web page code using browser tools, learn html and css basics, and understand the code behind headlines, divs, and styles.

Explore how cookies identify users and store data via session, persistent, and analytic cookies, and learn how GDPR rules, hijacking risks, and cookie management affect web security.

Explore the OWASP top ten, a security risk checklist for web apps used by developers and testers to identify injection, broken authentication, and other critical vulnerabilities.

Explore how sql injection attacks exploit malicious inputs to access databases, extract login details, or corrupt data, and learn prevention techniques like parameterized statements, escaping inputs, and sanitizing inputs.

Explore cross-site scripting, a client-side web attack that targets browsers via malicious scripts. Learn how XSS can hijack cookies and enable session access, and how input filtering prevents malicious input.

Explore burp suite, a core tool for scanning website vulnerabilities in ethical hacking, and compare editions—enterprise, professional, and community—with a 30-day free pro trial.

Install Burp Suite pro, enter license keys, and integrate it with Foxy Proxy in Firefox by configuring 127.0.0.1:8080, then launch a temporary project and explore the Burp Suite UI.

Learn to crawl and audit a demo site with Burp Suite, set scope, run fastest crawl and light active audit, review severities and confidence, and generate html or xml reports.

Explore the basics of reconnaissance by learning how to gather information about a target, and see how free tools like Maltego and the recon engine support this process.

Learn how hackers perform target reconnaissance, gathering email addresses and business relationships to stage phishing campaigns using tools like Maltego.

Install maltego from maltego.com on Mac, Windows, or Kali Linux; choose community edition, register an account, install transforms, create a new graph, use domain transformations, save and reopen graphs.

Explore gathering information about a domain, identify email addresses, verify their existence, and examine domain owner details using Maltego transformations and VeriSign insights for reconnaissance.

Learn to gather target domain information using DNS transformations, uncover Cloudflare and VeriSign connections, and assess phishing attack options.

Learn to strategize a phishing attack, including impersonating Cloudflare, cloning a login page, and crafting deceptive emails, while stressing permission and ethical safeguards.

Master reconnaissance concepts and use maltego and recon-ng to gather target information for ethical hacking and pentesting.