Structured Training
Learning Paths
Guided curricula mapped to real certification exams. Work through sequential modules, each building on the last, with hands-on labs at every step.
Applied Web Hacking · Bug Bounty NEW
Web & Bug Bounty
The bug classes that actually get paid, in the order a hunter meets them: map the attack surface, then walk the classes one by one, and finish on a real programme with a written policy, a scope you have to respect, and findings of genuinely different severity.
OSEP · PEN-300 · Advanced Red Team NEW
OSEP Track
Where OSCP ends and the red team begins. Restricted-shell breakouts, filter & defense evasion, lateral movement & pivoting, advanced Active Directory, and insecure deserialization — getting a shell isn't enough here, you have to get it past the defences.
Certified Modern Web App Pentester
CMWAP Practice
Practice for the CMWAP exam: methodology-first, no-flag web-app engagements. Warm up on the core bug classes, then run full 24-hour engagements — plan, report, and a debrief video, exactly like the exam.
OffSec PEN-200
OSCP Preparation
Nine modules covering every technique that appears on the OSCP exam — from DNS recon and cleartext protocols through to Active Directory and buffer overflows. Work in order for the best results.
HTB Certified Penetration Testing Specialist
CPTS Preparation
Seven modules aligned to the HTB CPTS curriculum — network footprinting, common service attacks, web exploitation, databases, LDAP enumeration, and a full Active Directory engagement. Deeper coverage of modern enterprise attack paths than OSCP.
Tool Mastery
Port Scanning Mastery
Eight modules of professional-grade scanning technique — host discovery, TCP scan types, UDP scanning, service & version detection, OS fingerprinting, NSE scripting, masscan/RustScan pipelines, and firewall evasion. Every module includes structured per-lab assignments practised against live machines, not screenshots.
Every module and machine is free — walkthroughs are Premium.
Protocol Exploitation
FTP Exploitation Mastery
Six modules covering every FTP attack technique — anonymous access, banner grabbing, credential brute-force, TFTP unauthenticated file retrieval, writable FTP shell delivery, and full protocol chaining across FTP, SMB, and rsync. Practised against live machines with structured per-lab assignments.
Every module and machine is free — walkthroughs are Premium.
SMB Exploitation
SMB Mastery
Null sessions, share enumeration, SYSVOL credential harvesting, and GPP decrypt. Progress from anonymous access to domain credential extraction across live Windows-like machines.
Every module and machine is free — walkthroughs are Premium.
SNMP Exploitation
SNMP Mastery
UDP discovery, community string brute-force, full MIB tree walking, and credential extraction from NET-SNMP extend OIDs. One machine, two modules, root shell.
Every module and machine is free — walkthroughs are Premium.
SSH Exploitation
SSH Mastery
Service fingerprinting, auth method probing, credential attacks, and full SSH tunneling. Local port forwards, dynamic SOCKS proxies, ProxyJump, and sshuttle VPN pivoting.
Every module and machine is free — walkthroughs are Premium.
LDAP Exploitation
LDAP Mastery
Anonymous bind, root DSE queries, full object enumeration, and credential extraction from description fields. Module 2 scales to Active Directory with windapsearch and ldapdomaindump.
Every module and machine is free — walkthroughs are Premium.
Professional Skills
Pentest Reporting
Learn to write PTES-aligned pentest plans and reports. From pre-engagement scope to executive summary — with hands-on practice on real labs.
How the free unlock works
Modules beyond the free tier show an unlock button on their card.
Click "Unlock Free (24h)". A countdown begins. You can only unlock one module at a time — choose wisely.
When the timer hits zero the module opens. No action required — just come back and train.
Premium gives instant access to all modules on all paths, unlimited daily labs, and walkthroughs.