
Understand blockchain as a distributed, immutable ledger governed by a decentralized network of nodes, enabling cryptocurrencies and smart contracts on web3 platforms.
Explore the core components of a blockchain—decentralized networks (permissioned and permissionless), cryptography, immutable ledgers, consensus, and smart contracts that read and write data across client, backend, and blockchain interface.
Explore how blockchain preserves data integrity through hashing, nonce-based proof of work, and chain linking, including tamper resistance and 51% attack protection.
Explore how Ethereum's blockchain, nodes, miners, gas, and immutable smart contracts enable decentralized applications by running a virtual machine that executes code and stores results on the blockchain.
Learn how smart contracts run on the blockchain, written in solidity, rust, go, or python, and executed by the EVM on Ethereum, with addresses, gas fees, and wallets like Metamask.
Explore metamask as a web3 wallet for connecting apps and storing ether, tokens, and NFTs. Install the Firefox extension, create a wallet, and safeguard the 12-word recovery phrase.
Explore how decentralized applications use smart contracts on decentralized networks, learn about dApps and DAOs, and examine AMMs and exchanges like Uniswap and Sushiswap.
Learn how a dApp uses a wallet like MetaMask to send ether to an externally owned address, connect accounts, switch to a test network, and sign transactions.
Explore Remix IDE in the browser, compile and deploy Solidity contracts like Storage.sol using the Solidity compiler, and test interactions in the JavaScript VM with store and retrieve functions.
Explore solidity fundamentals, including contract syntax and data types, to detect vulnerabilities in smart contracts. Practice with Remix IDE to understand the address datatype and declarations like int, uint, bool.
Explore Solidity data types in Remix IDE, including uint, int, bool, and address, with size variations and visibility modifiers (public, private, internal, external) using a 0.6.0 compiler.
Explore the three types of Solidity variables—local, state, and global—and learn which are stored on the blockchain, plus global vars like msg.sender, msg.value, msg.data, and block.timestamp.
Distinguish state and local variables, apply visibility modifiers, and use global vars like msg.sender to return the caller's address in a deployed Solidity contract.
Learn how to read and write to a blockchain using smart contract functions. Reading is free via view functions, while writing costs gas and transactions to update state.
Solidity functions provide reusable code you can call anywhere, avoiding repetition. Define a function with name, arguments, scope, and a return value, illustrated by add numbers example in Remix IDE.
Deploy a simple addNumbers function in Remix, taking two uints A and B and returning A+B as C; no output without view or pure, so learn about these keywords.
Explore Solidity variable types, including state, local, and global variables, and learn how a public function returns multiple values, updates a state variable, and uses msg.sender for global context.
Explore Solidity view and pure functions: return public uint state variable num via a view function, and convert to pure when not reading or changing state; note the auto getter.
Constructors in Solidity run only once during contract creation to initialize the contract, such as setting an owner or initial state via arguments like _num.
Learn how to use constructors in Remix to initialize contract state by setting num1 to six and owner to the deployer (msg.sender) during deployment.
Explore solidity function modifiers, including an only owner access control modifier and re-entrancy guard; see how the underscore replaces function code and how required enforces and reverts.
Learn how to implement solidity modifiers to enforce access control with only owner, using require and msg.sender to guard functions like changeNumber in a MyContract.
Explore Solidity mappings as key-value data structures, retrieve values by address keys, and understand nested mappings with public visibility and practical examples.
Learn to interact with one smart contract from another using Remix by deploying contracts, creating contract instances, and invoking functions such as changeNum to update public state.
Explore smart contract vulnerabilities through the Ethernaut CTF, using Metamask, Web3, and ABI details to obtain a new instance, reveal a password, and authenticate to complete the level.
Explore how Solidity fallback functions handle calls not matching any function signature and ether from external contracts, including payable restrictions and the receive function for externally received ether.
Learn to claim ownership and drain a contract in the ethernaut fallback challenge by triggering the receive function with external ether, then use withdraw to zero the balance.
Explore how private variables in Solidity relate to public, private, internal, and external visibility, how storage slots work, and why private data isn't safe on the blockchain.
discover how to unlock a vault by reading a contract's storage and exploiting private variables, retrieving the password from storage and passing it as a bytes32 input.
Examine legacy Solidity constructors before version 0.4.22 that relied on case-sensitive names, exposing vulnerabilities where ownership could be assigned to the first caller.
Demonstrate Solidity 0.4.22 constructors by deploying a contract that sets owner to the deployer, and show how a misnamed constructor can let anyone alter ownership.
Identify the fallout challenge vulnerability in the Ethernaut contract: a misnamed constructor Fal1out creates a public function that lets anyone claim ownership.
Explore integer overflow and underflow in solidity by examining an 8-bit unsigned integer (0-255) and how values wrap around when adding or subtracting beyond limits, with practical contract examples.
Demonstrate overflow and underflow in a solidity contract using uint8 variables and a simple increase/decrease function; number1 wraps to zero on overflow, number2 to 255 on underflow, via Remix VM.
Explore the Ethernaut token challenge and exploit an integer underflow in the transfer function to turn 20 tokens into a max uint256 balance.
Explore the selfdestruct function in solidity, which takes an address, removes the contract's bytecode, transfers all ether to that address, and enables destroying contracts or forcefully sending ether.
learn to force ether into a contract with no code using a dedicated attack contract and self-destruct on the ethernaut force challenge, deploying on rinkeby and verifying balance changes.
Explore the reentrancy vulnerability that lets an attacker drain a contract's ether via a faulty withdraw pattern and how a fallback function enables repeated withdrawals, as in 2016 dao hack.
Examine the re-entrancy challenge from ethernaut, focusing on a withdrawal function, an attack contract, and a fallback recursion that drains the victim contract.
Learn to craft proof-of-concept demonstrations for smart contract vulnerabilities, using simulated blockchain environments with tools like hardhat, while safeguarding users and avoiding mainnet impact.
Install and configure nvm to manage node and npm versions, then initialize a Hardhat project with npm and npx, creating Hardhat config, contracts, and scripts folders for deployment and interaction.
Set up Hardhat and learn to compile, run, and test contracts in a structured project. Work with contracts, scripts, tests folders and compile with npx hardhat compile using Solidity 0.8.4.
Learn how to use Hardhat's run task to execute scripts, deploy a greeter contract, and interact with it by calling greet and setGreeting to update the greeting.
Learn to use mocha with hardhat to run tests on smart contracts, verify outputs like greet and set greeting, and run tests with npx hardhat test to expose exploits.
this lecture presents a PoC of the parity wallet hack, showing how an uninitialized parity library contract enables ownership takeover and self-destruct via initialize and kill.
Learn about Web 3 Security and How to identify vulnerabilities in Smart Contracts for Pentesting & Bug Bounties.
Here's a more detailed breakdown of the course content:
In all the sections we will start the fundamental principle of How the attack works, Exploitation and How to defend from those attacks.
In this course you will learn about :
What is Blockchain
What are DApps
What is a smart contract
LAB setup to pentest smart contracts
Metamask and its usage
Installation of Hardhat
Setup Remix IDE
Practical on Functions in Remix
Practical on View and Pure Functions in Solidity
Mappings in solidity
Deploying a smart contract
Security Vulnerabilities in solidity
Practical Example of Integer Overflow and Underflow
How to find issues using Ethernaut Playground
Selfdestruct in Solidity
Fallback Functions
Force Challenge
Reentrancy Issues
Private Variables in Solidity
Using Hardhat for testing smart contracts
An example PoC on the Parity Wallet Hack
How to hunt on Web 3 bug bounty platforms like Immunefi & Hackenproof
How to write a professional report
With this course, you get 24/7 support, so if you have any questions you can post them in the Q&A section and we'll respond to you as soon as possible.
Notes:
This course is created for educational purposes only and all the websites I have performed attacks are ethically reported and fixed.
Testing any website which doesn’t have a Responsible Disclosure Policy is unethical and against the law, the author doesn’t hold any responsibility.