The Attacker Kill-Chain

How real network attacks actually go

Forget the movies. Breaking into a network is a methodical process, not a lucky keystroke. Every engagement follows the same loop, and this course drills each stage until it's muscle memory:

1. Discovery — which hosts are alive?
2. Scanning — which ports/services do they run?
3. Enumeration — squeeze every service for info (versions, files, users).
4. Exploitation — weak creds, exposed data, misconfig → a foothold.
5. Privilege escalation — user → root.
6. Pivoting & looting — use one box to reach the next.

🎯 Your range: "MegaCorp"

Your Live-Lab is a real, isolated cloud network with 3 target machines waiting to be owned:

10.0.0.2   web01     internal web portal
10.0.0.3   ssh01     staff jump box
10.0.0.4   cache01   redis cache

Your attack box already has the tools: nmap, dirb, hydra, ssh, redis-cli, curl. No internet — you only ever touch this range.

ping -c1 10.0.0.2
# 64 bytes from 10.0.0.2 ... → the range is live and reachable.

⚖️ Authorized testing only — attack the lab range, or systems you own / have written permission to test.

What's in Network & System Security

• 1. The Attacker Kill-ChainFree
• 2. Host Discovery — Who Is Alive?🔒 Recon
• 3. Port Scanning with Nmap🔒 Recon
• 4. Service & Version Detection🔒 Enumeration
• 5. Web Enumeration — Finding the Hidden🔒 Enumeration
• 6. Credential Harvesting🔒 Exploitation
• 7. Password Attacks with Hydra🔒 Exploitation
• 8. Getting a Shell & On-Box Recon🔒 Exploitation
• 9. Attacking Data Services (Redis)🔒 Exploitation
• 10. Privilege Escalation — User to Root🔒 Post-Exploitation
• 11. Masscan — Internet-Scale Scanning🔒 Core
• 12. Final Exam — Own MegaCorp🔒 Certification

Continue in the interactive course reader →