Structured Training
Learning Paths
Guided curricula mapped to real certification exams. Work through sequential modules, each building on the last, with hands-on labs at every step.
OSEP · PEN-300 · Advanced Red Team NEW
OSEP Track
Where OSCP ends and the red team begins. Restricted-shell breakouts, filter & defense evasion, lateral movement & pivoting, advanced Active Directory, and insecure deserialization — getting a shell isn't enough here, you have to get it past the defences.
Certified Modern Web App Pentester
CMWAP Practice
Practice for the CMWAP exam: methodology-first, no-flag web-app engagements. Warm up on the core bug classes, then run full 24-hour engagements — plan, report, and a debrief video, exactly like the exam.
OffSec PEN-200
OSCP Preparation
Nine modules covering every technique that appears on the OSCP exam — from DNS recon and cleartext protocols through to Active Directory and buffer overflows. Work in order for the best results.
HTB Certified Penetration Testing Specialist
CPTS Preparation
Seven modules aligned to the HTB CPTS curriculum — network footprinting, common service attacks, web exploitation, databases, LDAP enumeration, and a full Active Directory engagement. Deeper coverage of modern enterprise attack paths than OSCP.
Tool Mastery · ⭐ Premium
Port Scanning Mastery
Eight modules of professional-grade scanning technique — host discovery, TCP scan types, UDP scanning, service & version detection, OS fingerprinting, NSE scripting, masscan/RustScan pipelines, and firewall evasion. Every module includes structured per-lab assignments practised against live machines, not screenshots.
Protocol Exploitation · ⭐ Premium
FTP Exploitation Mastery
Six modules covering every FTP attack technique — anonymous access, banner grabbing, credential brute-force, TFTP unauthenticated file retrieval, writable FTP shell delivery, and full protocol chaining across FTP, SMB, and rsync. Practised against live machines with structured per-lab assignments.
SMB Exploitation · ⭐ Premium
SMB Mastery
Null sessions, share enumeration, SYSVOL credential harvesting, and GPP decrypt. Progress from anonymous access to domain credential extraction across live Windows-like machines.
SNMP Exploitation · ⭐ Premium
SNMP Mastery
UDP discovery, community string brute-force, full MIB tree walking, and credential extraction from NET-SNMP extend OIDs. One machine, two modules, root shell.
SSH Exploitation · ⭐ Premium
SSH Mastery
Service fingerprinting, auth method probing, credential attacks, and full SSH tunneling. Local port forwards, dynamic SOCKS proxies, ProxyJump, and sshuttle VPN pivoting.
LDAP Exploitation · ⭐ Premium
LDAP Mastery
Anonymous bind, root DSE queries, full object enumeration, and credential extraction from description fields. Module 2 scales to Active Directory with windapsearch and ldapdomaindump.
Professional Skills
Pentest Reporting
Learn to write PTES-aligned pentest plans and reports. From pre-engagement scope to executive summary — with hands-on practice on real labs.
How the free unlock works
Modules beyond the free tier show an unlock button on their card.
Click "Unlock Free (24h)". A countdown begins. You can only unlock one module at a time — choose wisely.
When the timer hits zero the module opens. No action required — just come back and train.
Premium gives instant access to all modules on all paths, unlimited daily labs, and walkthroughs.