This learning path will take you into the wonderful world of ethical hacking.

We'll start with the basics, learning about installing different tools, using Linux, networks, HTTP protocol, programming, web applications and databases.

We'll then go through different attacks and practice them safely in the Hakatemia lab environment. The path progresses step by step towards more challenging topics, and after completing the path you should be ready to apply for an entry-level job in the cybersecurity field.

What is ethical hacking?

Important warning

Intro

Linux operating system

Linux Command Line - video

First touch to the command line

Navigating the command line

Creating directories

Creating and editing files

Controlling the output

Moving files and folders

Deleting files and folders

File system permissions

Linux basics - Practice

Linux command line

Hello world

Variables

Arithmetic

Input

Data types

Conditional sentences

Imports and Random numbers

Lists

A while loop

A for loop

Functions

Python Programming

How the Internet works - video

The beginning of the Internet

The structure of information networks

Internet addresses

Client-server model

Data networks

BurpSuite: installation and usage video

A few words about tools

BurpSuite: Installation

First touch with BurpSuite

Kali Linux virtualization video

Installation and use of tools

Browser side and server side

URL structure

HTTP protocol

HTTP methods

HTTP headers

HTTP status codes

Cookies

HTML markup language

JavaScript

Let's build a simple website

Website basics

Multi-stage information retrieval from the web

OSINT and metadata

Tracking a location from a photo

OSINT

BurpSuite - Proxy

BurpSuite - Scope

BurpSuite - Repeater

BurpSuite - Decoder

BurpSuite - Comparer

BurpSuite - Logger

BurpSuite - Organizer

BurpSuite - Extensions

BurpSuite - Session Manager

BurpSuite - Community

Chest challenge

Challenge yourself

Vulnerabilities

Hack into a website

First exposure to vulnerabilities

Why JavaScript?

Hello World - Your First Program

Variables – Storing Data

Let vs. Const: Declaring Variables in JavaScript

Data Types

Arrays - Storing Multiple Values

Working with Strings

Operators and Expressions

More Operators and Expressions

Conditional Logic - If / Else

For loops - Repeating an action X times

While Loops - Repeating an action until a condition is true

For...Of Loop - Repeating an Action for Each Item in a List

Functions - Reusable Blocks of Code

Named vs. Anonymous Functions

Arrow Functions in JavaScript

Working with Arrays

Objects: Grouping Data with Key–Value Pairs

Exercise: Grade Calculator

What are Cross-Site Scripting Vulnerabilities?

Stored XSS and stealing session cookies

Bleeding of cookies over the network

Introduction to XSS Attacks

What are SQL Injections?

(MySQL) Changing WHERE clauses to bypass authentication (specific user)

(MySQL) Modifying WHERE clauses to bypass authorization

(MySQL) Using the UNION technique to steal data

Introduction to SQL Injection Attacks

What are command injections?

Command injection - exercise

Introduction to Command Injection Attacks

Dictionary Attack

Credential Stuffing attacks in data breaches

Guessing OTP codes using brute force technology

Introduction to Password Attacks

What are XXE attacks?

XXE SSRF

Introduction to XXE Attacks

What are Template Injections (SSTI)?

Python Jinja2 Template Injections

Introduction to Template Injection Attacks

Access control - Often the Weakest Link in Application Security

Introduction to access control vulnerabilities

JWT Tokens

Do Not Check This Token Thanks - JWT's Notorious 'None' Algorithm

JWT and Encryption Key Cracking

Introduction to JWT Attacks

Exfiltration

WYSIWYG XSS and SoMe worms

XSS in JavaScript strings 1

XSS in JavaScript strings 2

XSS in file uploads - HTML

XSS Advanced

The first BurpSuite extension

Editing HTTP requests on the fly with the BurpSuite extension

Developing an extension with Extender API: automatic session management part 1

Running tools through BurpSuite proxy

Session Handling Action - Extending Burp's Session Handling with Extensions

Automatic session management - Practice

Building Burp Suite extensions with the legacy Extender API

IntelliJ - Setting up development environment (Montoya API + Java)

Developing an extension with the Montoya API: automatic session management part 2

What are PDF export injections?

PDF export injection - using JavaScript

PDF export injection - Blind injection

What are type juggling vulnerabilities?

Insecurely constructed URLs or URL injection

URL injection + Insecure security controls

LFI vulnerability in a PHP application

RFI vulnerability in PHP application

Do you manage LFI/RFI vulnerabilities?

Fun little web vulnerabilities

What are deserialization attacks?

Introduction to Deserialization Attacks

Defining the destination

Detection of hosts

Host discovery techniques

Introduction to port scanning

Saving the output and determining the resolution of the output

Configuring ports

Choices related to timing

IPv6 scanning

TCP SYN scan

TCP connect scan

TCP FIN, NULL and Xmas scan

TCP ACK scan

UDP scan

IP protocol

Identification of services (-sV)

Nmap

What is cryptography? Basic concepts and uses

Caesar Cipher: The Ancient Code That Changed Communication

The Enigma Machine: How WWII Codebreakers Unlocked the Greatest Mystery of the War

What are hash functions and what are they used for?

Cracking Hashes: How Does It Work?

MD5 hash - a broken classic

What is symmetric cryptography?

What is asymmetric cryptography?

Encoding methods

 TLS (Transport Layer Security): The foundation of Internet security

SSL/TLS threats

What is key management and why is it important?

CertBot and automatic renewal of certificates

Auditing SSL/TLS settings with Qualys' SSL Labs scanner

Auditing SSH settings with Nmap

CyberChef - A browser-based cryptographic Swiss army knife

Cryptography - Learned Practice

Crypto 101

crackme

Haasta itseäsi

Data networks and the TCP/IP model

Physical media of information networks

Hubs and switches

MAC addresses

ARP (Address Resolution Protocol)

IP addresses

Subnets, netmasks and CIDR notation

Gateways and routing

ICMP (Internet Control Message Protocol)

TCP (Transmission Control Protocol)

UDP (User Datagram Protocol)

DNS (Domain Name System)

DHCP (Dynamic Host Control Protocol)

Computer Networks - Practice the Learned Material

Networks - Advanced

Cracking password policies

Password Spraying attacks

Account lockout DoS attacks

Password attacks - Advanced

Ethical Hacking