This course dives deep into the offensive security techniques used to bypass modern Antivirus (AV) and Endpoint Detection and Response (EDR) systems. Designed for red team operators, malware developers, and advanced penetration testers, you will learn practical methods for evading detection in real-world scenarios.

**What you'll learn:**

* How AV/EDR engines detect threats: signature, heuristic, behavioral, and ML-based detection.
* Windows internals, syscall evasion, and custom NTDLL implementations.
* Shellcode injection, encryption (XOR, AES, RC4), and entropy-lowering techniques.
* Advanced process injection (APC, Early Bird, Thread Hijacking, PPID spoofing).
* Anti-analysis techniques (Anti-VM, Anti-Debug, ETW bypass, hardware breakpoints).
* Real-world kernel-level evasion using BYOVD and protected process manipulation.
* Practical labs with direct and indirect syscalls, C/C++ payloads, and stealth loaders.

This is a hands-on, no-fluff training meant to equip you with modern offensive capabilities in hostile, monitored environments. 

Disclaimer: **Much of the content was helped by an LLM**

Advanced techniques to bypass modern Antivirus and EDR solutions through real-world offensive development strategies.

AV/EDR Evasion Practical Techniques

## Foundations of Log Analysis for Cyber Defense

Master enterprise log analysis, security telemetry correlation, SIEM investigations, and threat hunting methodologies used to detect, investigate, and respond to modern cyber threats across Windows, Linux, network, and cloud-connected environments.

## What this course is

 A comprehensive, hands-on cybersecurity training program focused on the collection, interpretation, correlation, and investigation of security telemetry generated throughout modern enterprise infrastructures. Beginning with the fundamentals of logging and telemetry management, the course progressively develops the skills required to analyze operating system events, network activity, authentication records, and security platform data before advancing into structured threat hunting, SIEM-driven investigations, and detection engineering techniques. The curriculum emphasizes the operational role of logs as primary evidence for identifying malicious activity, validating security events, and supporting incident response across complex environments.

 Each lesson combines practical laboratories, realistic defensive scenarios, guided investigations, and professional analytical workflows modeled after modern Security Operations Centers (SOC). Students work with authentic security data, investigate simulated attacks, correlate evidence across multiple log sources, develop detection logic using industry-standard query languages, and document investigative findings using methodologies that support repeatable, defensible, and operationally effective cyber defense practices.

## Objective

After completing this course, you will be able to collect, analyze, correlate, and interpret security telemetry from multiple enterprise systems to investigate suspicious activity, identify indicators of compromise, perform structured threat hunting, develop practical detection logic, document investigative findings, and improve organizational visibility through SIEM technologies and industry-standard defensive methodologies used by modern security operations teams.

## Who this is for

• SOC Analysts who want to strengthen their ability to investigate alerts, validate security events, and prioritize incidents using enterprise telemetry.
• Blue Team professionals responsible for improving organizational visibility, monitoring infrastructure, and strengthening defensive operations.
• Detection Engineers seeking practical experience building detections through log correlation, Sigma rules, KQL, SPL, and SIEM-based analytics.
• DFIR professionals who need to reconstruct attacker activity through evidence collected from operating systems, network infrastructure, and security platforms.
• Incident Responders responsible for triaging, investigating, documenting, and containing security incidents using reliable forensic evidence.
• Threat Hunters looking to develop hypothesis-driven investigations across multiple telemetry sources to uncover malicious activity that automated detections may miss.
• Security Engineers designing or maintaining logging pipelines, SIEM platforms, and enterprise monitoring architectures.
• Students entering Cyber Defense who want a practical foundation in enterprise log analysis before specializing in incident response, threat hunting, or detection engineering.

## What you will learn

1. Foundations of Security Logging — Understand how modern operating systems, applications, network devices, and security platforms generate telemetry, why logs represent one of the most valuable sources of forensic evidence, and how proper collection, normalization, timestamp synchronization, retention policies, and integrity directly affect investigation quality and incident response.

2. Enterprise Log Structures and Data Interpretation — Learn to interpret common log formats, identify meaningful fields, distinguish between normal operational events and security-relevant activity, and understand how structured telemetry enables efficient searching, filtering, and correlation across diverse enterprise environments.

3. Windows Security Event Analysis — Develop the ability to investigate Windows Event Logs, authentication events, privilege changes, process activity, and security-related system behavior while understanding how native Windows telemetry supports monitoring, detection, and forensic reconstruction.

4. Linux Logging and Authentication Investigation — Analyze Linux system logs, Syslog records, authentication events, service activity, and administrative actions to identify unauthorized access, configuration changes, persistence attempts, and abnormal operating system behavior.

5. Network Security Telemetry Analysis — Interpret firewall records, IDS and IPS alerts, DNS requests, proxy activity, authentication events, and access logs to understand how network telemetry reveals attacker movement, command-and-control activity, policy violations, and suspicious communications.

6. Multi-Source Log Correlation — Learn how to connect evidence originating from operating systems, network infrastructure, EDR platforms, authentication systems, and application logs to reconstruct attack timelines and improve investigative confidence through contextual analysis.

7. Threat Hunting Methodologies — Apply structured hunting techniques to develop investigative hypotheses, search for indicators of compromise, validate suspicious behaviors, and uncover attacker activity that may evade traditional alert-driven monitoring.

8. Detecting Lateral Movement and Persistence — Explore how attackers establish persistence, move between systems, abuse authentication mechanisms, and maintain access, while learning how these behaviors can be identified through correlated security telemetry.

9. Detection Engineering Fundamentals — Build practical detection logic using Sigma rules, Kusto Query Language (KQL), and Splunk Processing Language (SPL), transforming raw telemetry into repeatable detection strategies that improve defensive coverage.

10. SIEM Investigation Workflows — Understand how Security Information and Event Management platforms aggregate, enrich, correlate, and visualize enterprise telemetry to accelerate investigations, improve visibility, and support large-scale monitoring operations.

11. Security Analytics with the ELK Stack — Gain practical experience using Elasticsearch and Kibana to search, visualize, investigate, and analyze security events while developing efficient workflows for enterprise-scale telemetry analysis.

12. Threat Intelligence Integration — Learn how external intelligence can enhance log analysis by providing contextual indicators, improving prioritization, validating suspicious activity, and strengthening investigative decision-making throughout the incident lifecycle.

13. Investigation Methodology and Evidence Handling — Develop structured analytical processes for triaging alerts, validating evidence, documenting findings, maintaining investigative consistency, and communicating technical conclusions to security teams and stakeholders.

14. Defensive Simulation and Practical Investigations — Reinforce technical concepts through realistic laboratories that simulate enterprise attack scenarios, allowing students to apply investigative methodologies, perform threat hunting exercises, validate detections, and strengthen operational decision-making under realistic conditions.

15. Professional Security Reporting — Learn how to produce clear, technically accurate investigation reports that document observed activity, explain supporting evidence, describe defensive impact, and communicate actionable recommendations for remediation and future detection improvements.

## What you will be able to do by the end

• Analyze Windows, Linux, and network security logs to identify suspicious activity and reconstruct security events with confidence.
• Correlate telemetry from operating systems, authentication systems, DNS, proxy servers, firewalls, IDS/IPS platforms, and endpoint security solutions to build complete investigative timelines.
• Investigate security alerts using structured analytical methodologies that reduce false positives and improve incident validation.
• Detect attacker behaviors such as lateral movement, persistence, credential abuse, and anomalous authentication activity through evidence-driven analysis.
• Build practical detections using Sigma rules, KQL, SPL, and correlation techniques suitable for enterprise security operations.
• Perform SIEM investigations using the ELK Stack to search, visualize, filter, and interpret large volumes of security telemetry.
• Develop repeatable threat hunting workflows that combine multiple data sources, investigative hypotheses, and threat intelligence to uncover hidden adversary activity.
• Integrate defensive telemetry with contextual intelligence to improve prioritization, enrich investigations, and strengthen detection capabilities.
• Document investigative findings through professional reports that clearly communicate technical evidence, conclusions, and recommended defensive actions.
• Improve organizational security visibility by applying enterprise logging, telemetry correlation, detection engineering, and threat hunting practices aligned with modern Security Operations Center workflows.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**



Learn to detect threats, understand system behavior, and respond to incidents through structured log analysis.



Foundations of Log Analysis for Cyber Defense

# Introduction to Bug Bounty

Master the Foundations of Modern Hacker-Powered Security

Bug Bounty programs have become one of the most effective approaches to strengthening application security by connecting organizations with independent security researchers worldwide. Successful bug hunters combine reconnaissance, technical expertise, structured methodologies, and professional reporting to identify impactful vulnerabilities while operating safely, ethically, and within clearly defined program boundaries.

## What this course is

Introduction to Bug Bounty is a comprehensive introductory training designed for professionals who want to learn the complete vulnerability research workflow used in modern Hacker-Powered Security programs. From understanding how Bug Bounty ecosystems operate to performing structured reconnaissance and validating security findings, this course provides a practical foundation for participating responsibly in vulnerability disclosure programs.

The course combines manual testing methodologies, automation techniques, AI-assisted reconnaissance, professional reporting practices, and reproducible security workflows used by experienced security researchers across leading Bug Bounty platforms. Throughout the training, students are introduced to practical examples, modern tooling, and repeatable methodologies that can be applied across a wide variety of web applications while maintaining a strong focus on legal, ethical, and responsible security testing.

Topics covered include understanding the Bug Bounty ecosystem, HackerOne, Bugcrowd, Intigriti, and YesWeHack platforms, public and private programs, responsible disclosure, rules of engagement, reconnaissance methodologies, attack surface mapping, subdomain enumeration, asset discovery, hidden endpoint discovery, port and service scanning, technology fingerprinting, JavaScript endpoint mining, GitHub and OSINT integration, secret leakage identification, Bash and Python automation, AI-assisted reconnaissance using Gemini CLI, high-impact vulnerability classes including IDOR, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), SQL Injection, Cross-Site Request Forgery (CSRF), Open Redirect, Subdomain Takeover, HTML Injection, Server-Side Template Injection, Business Logic vulnerabilities, manual testing methodologies, Burp Suite, fuzzing, Proof-of-Concept creation, JWT security testing, API security testing, Cache Poisoning, multi-step attack chains, professional Bug Bounty toolchains, reporting methodologies, high-quality vulnerability reporting, demonstrating technical impact, duplicate handling, reputation building, and continuous learning within the evolving Bug Bounty ecosystem.

## Objective

Upon completing this course, students will be able to independently perform structured reconnaissance, identify and map attack surfaces, discover and validate common web application vulnerabilities, build reproducible testing workflows, leverage automation and AI-assisted techniques to improve efficiency, produce professional vulnerability reports, and responsibly participate in Bug Bounty programs using industry-recognized methodologies and modern security tools.

## Who this is for

• Aspiring Bug Bounty hunters beginning their vulnerability research journey.
• Penetration testers expanding into Hacker-Powered Security programs.
• Web application security professionals.
• Offensive security consultants.
• Security researchers interested in responsible disclosure.
• Application Security (AppSec) engineers.
• Red Team professionals improving web application assessment techniques.
• Developers who want to better understand real-world web vulnerabilities.
• Students preparing for careers in offensive cybersecurity.
• Anyone interested in modern vulnerability discovery methodologies.

## What you will learn

1. Foundations of Bug Bounty and Responsible Disclosure — Understand Hacker-Powered Security, Bug Bounty ecosystems, ethical hacking boundaries, program scopes, reputation systems, legal considerations, and responsible vulnerability disclosure practices.
2. Reconnaissance and Attack Surface Mapping — Perform structured reconnaissance through subdomain enumeration, asset discovery, endpoint mining, technology fingerprinting, OSINT integration, GitHub intelligence gathering, leaked secret identification, and AI-assisted reconnaissance using Gemini CLI.
3. Identifying High-Value Vulnerability Classes — Learn practical methodologies for discovering and validating IDOR, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), SQL Injection, Cross-Site Request Forgery (CSRF), Open Redirect, Subdomain Takeover, HTML Injection, Server-Side Template Injection, and Business Logic vulnerabilities.
4. Practical Web Application Testing Methodologies — Combine manual testing, Burp Suite workflows, fuzzing techniques, API security testing, JWT analysis, Proof-of-Concept creation, cache poisoning research, parameter discovery, and multi-step attack chains to evaluate application security.
5. Professional Bug Bounty Reporting — Produce clear, reproducible vulnerability reports, accurately demonstrate technical impact, communicate findings effectively, manage duplicate submissions professionally, and build long-term credibility with Bug Bounty program owners.
6. Automation and Modern Bug Bounty Tooling — Use Bash, Python, AI-assisted workflows, and professional tools including gau, waybackurls, ffuf, nuclei, httpx, and subfinder to streamline reconnaissance, validation, and testing activities.
7. Building a Sustainable Bug Hunting Career — Develop disciplined research methodologies, continuously improve technical capabilities, contribute responsibly to the security community, and establish a strong professional reputation within the global Bug Bounty ecosystem.

## What you will be able to do by the end

After completing this course, you will confidently navigate modern Bug Bounty programs, conduct structured reconnaissance, identify and validate common web application vulnerabilities, automate portions of your testing workflow, prepare high-quality vulnerability reports, communicate findings professionally with program owners, and responsibly contribute to improving application security across leading Hacker-Powered Security platforms.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**


Methods, Recon and Real-World Vulnerabilities

Introduction to Bug Bounty

**Introduction to Offensive Security with Artificial Intelligence** is a beginner-level course designed to bridge the gap between red teaming and modern AI tools. With a focus on hands-on learning and safe experimentation, this course introduces participants to foundational concepts, frameworks, and use cases where AI — particularly large language models (LLMs) — can augment traditional offensive security tasks.

Learners will explore topics such as:

* AI-augmented reconnaissance and social engineering
* Payload generation with LLMs and code models
* Simulated exploitation chains using autonomous agents
* Custom model workflows for OSINT and vulnerability analysis
* Safe deployment of generative agents with ethical guardrails

By the end of the course, students will be able to prototype AI-enhanced offensive tools, understand core risks associated with LLM use in red teaming, and align their work with best practices from OWASP, MITRE, and responsible AI research communities.

This course is ideal for cybersecurity professionals, red teamers, ethical hackers, and researchers looking to responsibly adopt AI capabilities in offensive security practices.

Disclaimer: **Much of the content was helped by an LLM**

Learn how Artificial Intelligence can empower Red Team operations through automation, reconnaissance, and offensive simulation

Introduction to Offensive Security with Artificial Intelligence

# Introduction to Python for Defensive Security

Python has become one of the most important programming languages in modern defensive cybersecurity, enabling security professionals to automate repetitive tasks, analyze large volumes of security data, integrate enterprise security platforms, and accelerate detection and response operations. Today, Python is widely adopted across Security Operations Centers (SOCs), Threat Hunting, Digital Forensics and Incident Response (DFIR), Malware Analysis, SIEM engineering, Threat Intelligence, and security automation initiatives.

## What this course is

 Introduction to Python for Defensive Security is a comprehensive introductory training program designed for cybersecurity professionals who want to develop practical Python programming skills specifically for defensive security operations. Rather than teaching Python as a general-purpose programming language, the course focuses on how it is applied across real-world blue team workflows, enabling security teams to automate repetitive processes, improve operational efficiency, and build reusable defensive tools.
 
 The course begins with a strong foundation in Python programming, covering essential language concepts including variables, data types, control flow, functions, modules, object-oriented programming, file handling, and writing clean, maintainable, Pythonic code. Students gradually progress toward practical automation techniques, learning how to build Python scripts that interact with operating systems, automate reconnaissance and scanning tasks, parse and analyze security logs, normalize data, consume APIs, schedule recurring jobs, and generate actionable reports.
 
 As the training advances, the curriculum expands into modern defensive security use cases commonly found in enterprise environments. Students learn how to automate Threat Intelligence workflows, enrich Indicators of Compromise (IOCs), perform static malware analysis, integrate YARA into automated detection pipelines, analyze memory dumps and network artifacts, interact with SIEM and EDR platforms, automate firewall operations, build detection engineering workflows, and create practical threat hunting automation. Every topic throughout the course is presented through practical defensive security scenarios, allowing students to immediately apply their programming knowledge to operational cybersecurity tasks.

## Objective

 The objective of this course is to teach students how Python can be effectively used as a practical programming language for defensive cybersecurity. Throughout the training, students learn how to automate common security operations, process and analyze security telemetry, interact with enterprise security platforms, enrich Threat Intelligence data, automate malware analysis activities, and develop scalable defensive workflows capable of supporting modern Security Operations Centers.
 By combining solid programming fundamentals with practical cybersecurity applications, the course enables students to build automation skills that can be immediately applied across enterprise security environments, helping improve operational consistency, increase analyst productivity, and support more efficient detection and response processes.

## Who this course is for

This course is intended for cybersecurity professionals, IT practitioners, and students who want to build practical Python programming skills focused on defensive security operations. Whether working in a Security Operations Center, supporting incident response activities, engineering detection pipelines, or transitioning into cybersecurity, participants will gain practical knowledge that can be applied across multiple defensive disciplines.

This course is particularly suitable for:

• SOC Analysts
• Blue Team Operators
• Threat Hunters
• Incident Responders
• Digital Forensics and Incident Response (DFIR) Analysts
• Security Engineers
• Detection Engineers
• SIEM Engineers
• Malware Analysts
• Threat Intelligence Analysts
• Cybersecurity Students
• IT Professionals transitioning into Cybersecurity
• Professionals interested in Security Automation with Python

## What you will learn

Throughout this course, students will progressively develop Python programming skills while learning how those skills apply to practical defensive cybersecurity operations. Topics covered include:

• Python programming fundamentals, including variables, data types, operators, control flow, functions, modules, packages, and reusable code development.
• Object-oriented programming concepts for building scalable and maintainable defensive security applications.
• File handling, exception management, and techniques for writing clean, readable, and Pythonic code.
• Automating operating system interactions and administrative security tasks through Python scripting.
• Automating reconnaissance activities and implementing basic network scanning techniques.
• Socket programming concepts for interacting with network services and performing custom network operations.
• Consuming REST APIs and integrating external security services into automated workflows.
• Monitoring file systems, scheduling recurring automation tasks, and collecting operational security data.
• Building data collection pipelines and generating structured security reports.
• Parsing, processing, and normalizing security logs from multiple sources.
• Correlating security events to identify suspicious activity across enterprise environments.
• Exporting structured data into CSV, Excel, JSON, and other commonly used reporting formats.
• Integrating Threat Intelligence platforms and automating IOC collection and enrichment workflows.
• Working with Threat Intelligence feeds to improve investigative context and defensive visibility.
• Generating actionable intelligence reports from automated data processing pipelines.
• Calculating file hashes and supporting automated file integrity verification workflows.
• Performing introductory static malware analysis using Python automation.
• Extracting strings, metadata, and Indicators of Compromise from suspicious files.
• Building Python-based malware analysis utilities to automate repetitive investigative tasks.
• Integrating YARA into defensive workflows and developing automated YARA scanning capabilities.
• Processing memory dumps and extracting relevant forensic artifacts for investigation.
• Automating shellcode extraction and supporting malware configuration analysis workflows.
• Integrating Hybrid Analysis into automated malware investigation pipelines.
• Parsing packet capture (PCAP) files and analyzing malware-related network communications.
• Identifying common anti-analysis and anti-debugging behaviors through automated inspection.
• Integrating Python with SIEM platforms using Syslog, HTTP, JSON, and UDP communication methods.
• Automating interactions with EDR platforms through available APIs.
• Building Python-based firewall automation workflows for repetitive security operations.
• Developing detection engineering pipelines and automated defensive workflows.
• Implementing real-time alerting and notification mechanisms.
• Generating dashboards and structured operational reports from collected security data.
• Automating Threat Hunting workflows to accelerate investigations and improve detection efficiency.

## What you will be able to do by the end

By completing this course, students will have the practical programming knowledge required to build Python-based automation for a wide variety of defensive cybersecurity tasks. They will understand how to combine programming fundamentals with real-world blue team workflows to reduce manual effort, improve operational consistency, and support scalable security operations across enterprise environments.
Upon successful completion of the course, students will be able to:

• Develop Python scripts to automate defensive cybersecurity operations.
• Automate repetitive Security Operations Center (SOC) activities.
• Process, parse, and normalize security logs from multiple sources.
• Analyze and enrich Indicators of Compromise (IOCs).
• Integrate external Threat Intelligence sources into automated workflows.
• Build automated IOC enrichment utilities.
• Develop Python-based malware analysis tools.
• Create YARA-powered detection and scanning utilities.
• Analyze files, memory dumps, and network artifacts using automated workflows.
• Integrate Python with SIEM and EDR platforms.
• Build reusable detection engineering pipelines.
• Automate security alerting and notification workflows.
• Generate structured operational security reports.
• Develop reusable defensive security automation tools for enterprise environments.
• Improve operational efficiency across Security Operations, Threat Hunting, Incident Response, and Detection Engineering teams.

This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.


A hands-on introduction to automating defensive security tasks with Python

Introduction to Python for Defensive Security

## Introduction to Python for Offensive Security

**Description:**

This hands-on course provides a solid foundation in Python programming with a direct application to offensive cybersecurity operations. Designed for aspiring red teamers, penetration testers, and ethical hackers, the course walks you from the basics of scripting to building powerful offensive tools inspired by _Black Hat Python_, _Offensive Toolchain_ patterns, and real-world adversary tradecraft.

Over the span of this training, you'll develop the skills to automate reconnaissance, craft exploits, bypass defenses, and build custom payloads — all in Python 3.12+, with a strong focus on OPSEC, modular design, and anti-detection techniques.

---

### What You Will Learn:

* Python fundamentals for hackers (no prior coding experience required)
* Network scanning, service fingerprinting & OSINT automation
* Exploitation scripting & custom enumeration tools (Linux/Windows)
* Payload generation, encoding, and evasion strategies
* Shellcode execution & staging using native Python
* Automation of common offensive web attacks
* Introduction to backdoors, covert channels & persistence

---

### Tools & Concepts Covered:

* `socket`, `asyncio`, `httpx`, `shodan`, `censys`, `ja3`, `hashlib`
* Custom LinPEAS/WinPEAS-like local enumeration
* Payload obfuscation pipelines and VM-safe testing
* XOR shellcode runners, Python-based droppers & backconnecters
* Web attack modules (SQLi, LFI/RFI, XSS) with automation

---

### Outcomes:

By the end of this course, you'll have built your own offensive security toolkit from scratch fully in Python — and gained the technical mindset required to understand and simulate modern adversarial techniques. You'll also be prepared for advanced topics like Red Team infrastructure, C2 design, and malware development.


Disclaimer: **Much of the content was helped by an LLM**

This course aims to provide participants with a practical and direct view of how to use the Python language in offensive security activities. Throughout the classes, you will learn the fundamentals of the Python language specific to creating tools and scripts used in penetration testing (pentesting), vulnerability exploitation, information gathering (reconnaissance) and automation of tasks common to security professionals.

Introduction to Python for Offensive Security

This advanced course is designed for cybersecurity professionals, technical leaders, and governance specialists seeking to build or manage effective Red Team capabilities within enterprise or regulated environments.

**Red Team Operation Management** goes beyond technical exploitation to deliver a comprehensive, threat-informed methodology for planning, executing, and institutionalizing red team campaigns that simulate real-world adversaries and deliver measurable value.

Over five structured modules, the course equips participants with the strategic and operational knowledge to:

* Develop red team campaigns aligned with the **MITRE ATT&CK** framework and sector-specific threats (e.g., FIN6, APT29)
* Integrate **compliance-driven requirements** (such as TIBER-EU and DORA) into engagement planning and reporting
* Coordinate **Rules of Engagement (RoE)**, deconfliction, OPSEC, and infrastructure lifecycle management
* Conduct advanced emulation in **cloud and hybrid environments**, with attention to identity systems, containers, and cloud-native tools
* Operationalize red team outputs into actionable improvements across SOC, IR, GRC, and engineering teams
* Build and evaluate red team maturity using roadmaps, capability models, and executive engagement strategies

Participants complete the course by developing and defending a **full-spectrum red team campaign plan** in a capstone scenario, demonstrating mastery in aligning adversary simulation with business risk, technical depth, and regulatory resilience.

Whether you're launching a red team, enhancing its strategic role, or aligning testing with executive and compliance priorities, this course provides the **governance, methodology, and tactical frameworks** to ensure success.

Disclaimer: **Much of the content was helped by an LLM**

Planning, Execution and Coordination of Offensive Operations with a Focus on Real Results

Introduction to Red Team Operation Management

# Malware Analysis Introduction v1

Master modern malware analysis through structured methodologies for static and dynamic inspection, memory forensics, operational integration, and threat intelligence, transforming suspicious binaries into actionable intelligence for incident response, detection engineering, and defensive security operations.

## What this course is

A complete introductory malware analysis course, structured in 5 modules and 48 lessons. Training covers malware fundamentals, analysis methodologies, secure laboratory environments, static inspection, dynamic behavioral analysis, memory forensics, operational integration, detection engineering, threat attribution, malware simulation, and threat intelligence contextualization across modern defensive security workflows.
Each lesson delivers concrete practice through structured analysis methodologies, guided demonstrations, laboratory exercises, realistic malware investigation scenarios, and professional workflows covering executable inspection, behavioral monitoring, memory analysis, IOC extraction, malware classification, operational integration, and threat intelligence enrichment using technologies and techniques presented throughout the curriculum.

## Objective

After completing this course you will be able to safely analyze malware using structured static and dynamic methodologies, investigate executable files and memory artifacts, identify behavioral indicators and indicators of compromise, interpret malware objectives and execution techniques, integrate analytical findings into SOC operations and detection engineering, contextualize malware through threat intelligence, and support defensive investigations using repeatable professional workflows.

## Who this is for

• SOC analysts who need to understand malware behavior beyond security alerts and transform suspicious binaries into actionable indicators that improve investigation quality, incident response, and defensive monitoring.
• DFIR professionals responsible for investigating compromised systems who want to incorporate malware analysis, behavioral inspection, memory analysis, and IOC extraction into forensic and incident response workflows.
• Threat hunters seeking to correlate malware behavior with process activity, registry changes, filesystem artifacts, network communications, persistence mechanisms, and command-and-control activity during proactive investigations.
• Malware analysts and aspiring reverse engineers who want to build a structured foundation in malware classification, executable analysis, behavioral inspection, memory forensics, and operational investigation methodologies.
• Detection engineers responsible for developing and improving detection logic through malware behavior analysis, IOC generation, threat contextualization, and integration with defensive security operations.
• Blue Team professionals who need practical knowledge of malware analysis to strengthen incident triage, detection engineering, threat hunting, operational investigations, and SOC collaboration.
• Security researchers and Red Team professionals interested in malware simulation, reverse engineering fundamentals, payload analysis, threat attribution, malware collections, and operational threat intelligence.

## What you will learn

1. Fundamentals of Malware and the Analysis Ecosystem — Malware threat landscape, malware categories, infection vectors, malware lifecycle, analysis methodologies, Blue Team and Red Team applications, malware objectives including persistence, evasion, command-and-control, and exfiltration, MITRE ATT&CK-based classification, legal and ethical considerations, and secure malware laboratory design using virtual machines, snapshots, and isolated environments.
2. Static Malware Analysis Fundamentals — Static analysis methodology, executable inspection principles, PE and ELF structures, binary metadata, header interpretation, timestamps, sections, structural anomalies, and the analytical workflow used to examine malware without execution.
3. Executable Structures and Binary Identification — PE file organization, ELF fundamentals, executable layout, binary characteristics, hashing techniques using MD5, SHA256, and SSDEEP, sample identification, integrity validation, and malware comparison during investigative workflows.
4. Strings, Imports, and API Analysis — String extraction, FLOSS-assisted analysis, IOC identification through embedded artifacts, import tables, function calls, Windows APIs, executable dependencies, and interpretation of binary characteristics that reveal malware capabilities before execution.
5. Packers, Obfuscation, and Static Investigation Techniques — Identification of packed and obfuscated malware, recognizing protected executables, understanding how packing affects analysis, and preparing suspicious samples for deeper investigation through structured static inspection.
6. Dynamic Malware Analysis Methodology — Safe malware execution practices, behavioral observation, controlled runtime analysis, execution monitoring, and the complementary role of dynamic analysis alongside static investigation during professional malware analysis.
7. Process and System Activity Monitoring — Monitoring malware execution with ProcMon and ProcExplorer, observing process creation, system activity, registry modifications, file operations, and runtime behavior to document malicious activity throughout execution.
8. Registry and File System Behavioral Analysis — Regshot, file comparison techniques, registry monitoring, filesystem inspection, persistence artifacts, execution traces, and behavioral evidence generated while malware interacts with the operating system.
9. Network Behavior and Command-and-Control Analysis — Monitoring network communications with Wireshark, simulating external services using INetSim, identifying command-and-control behavior, analyzing malware-generated traffic, and documenting network indicators during controlled execution.
10. Process Injection and Runtime Detection — Process Hacker, API monitoring, process injection detection, runtime observation, behavioral inspection, and identification of execution techniques commonly used by malware during compromise.
11. Malware Unpacking and Behavioral Inspection — Manual and automated unpacking techniques, behavioral validation, protected malware analysis, unpacked payload examination, and preparation of samples for deeper static and dynamic investigation.
12. Sandboxes and Indicator Extraction — Malware sandboxing, emulated execution environments, behavioral observation, IOC extraction, runtime evidence collection, and structured documentation of malicious artifacts for defensive investigations.
13. Introduction to Memory Forensics — Memory acquisition concepts, volatile evidence, memory-based malware analysis, forensic methodology, and the importance of memory inspection for identifying malicious activity beyond traditional executable analysis.
14. Memory Analysis and Malicious Process Investigation — Process injection analysis, executable reconstruction from memory dumps, packed malware identification, obfuscated payload analysis, process hollowing detection, and memory-resident malware investigation techniques.
15. Advanced Malware Memory Analysis with Volatility — Volatility fundamentals, plugin usage, advanced memory investigation, forensic artifact extraction, custom malware detection workflows, and automation using Python together with the Volatility API.
16. Memory-Based Malware Detection Case Studies — Practical analysis of memory-resident malware scenarios, investigation methodologies, reconstruction techniques, evidence interpretation, and application of memory analysis throughout realistic detection workflows.
17. Malware Analysis for SOC Operations — Integration of malware analysis into Blue Team operations, incident investigation support, operational workflows, analytical collaboration, and the contribution of malware analysis to modern security operations centers.
18. Detection Engineering and Threat Attribution — Leveraging malware analysis for detection engineering, generating actionable indicators, malware attribution, APT profiling, and transforming analytical findings into operational defensive intelligence.
19. Reverse Engineering and Red Team Applications — Reverse engineering as a Red Team capability, malware simulation, payload design, controlled offensive security exercises, and understanding how malware knowledge supports adversary simulation activities.
20. Private Malware Collections and Intelligence Pivoting — Building and maintaining a private malware zoo, organizing malware samples, pivoting from malware analysis to IOC generation, and extending investigations through threat intelligence feeds.
21. Threat Intelligence Contextualization — Using MISP, ThreatFox, and Malpedia to enrich malware investigations, contextualize malicious samples, correlate indicators, improve analytical confidence, and support intelligence-informed defensive decision-making.

## What you will be able to do by the end

• Conduct structured malware investigations using safe laboratory environments, static inspection, dynamic behavioral analysis, and memory analysis methodologies that produce repeatable, evidence-based technical findings suitable for defensive security operations.
• Analyze suspicious executables by interpreting PE and ELF structures, executable headers, hashes, strings, import tables, API calls, packers, and obfuscation techniques to understand malware characteristics before execution.
• Monitor malware behavior during controlled execution by observing processes, registry modifications, filesystem activity, network communications, command-and-control behavior, process injection, and indicators of compromise generated throughout runtime analysis.
• Investigate memory-resident malware using memory forensics methodologies, Volatility, process injection analysis, executable reconstruction, packed payload identification, process hollowing detection, and automated memory analysis workflows with Python and the Volatility API.
• Integrate malware analysis into SOC operations, incident response, threat hunting, and detection engineering by transforming analytical findings into operational indicators, defensive knowledge, and improved investigation workflows.
• Contextualize malware through attribution, APT profiling, malware simulation, private malware collections, IOC pivoting, and threat intelligence enrichment using MISP, ThreatFox, and Malpedia during professional investigative activities.
• Apply a complete malware analysis methodology spanning malware fundamentals, static analysis, dynamic inspection, memory forensics, operational integration, and threat intelligence to support professional malware investigations across Blue Team, DFIR, threat hunting, detection engineering, and security research environments.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

Foundations, Techniques, and Operational Relevance for Blue and Red Teams

Malware Analysis Introduction v1

## Offensive Development Introduction for Windows v1

Build a strong foundation in Windows offensive development through practical C++ programming, Windows API development, Red Team fundamentals, malware development concepts, software evasion techniques, x64 Assembly, and initial access methodologies. This course provides a structured introduction to the programming and operational knowledge required to understand and develop offensive tooling for authorized security engagements.

## What this course is

Offensive Development Introduction for Windows v1 is a comprehensive introductory training that combines programming, Windows development, and Red Team tradecraft into a structured learning path focused on offensive engineering. The course begins with C++ fundamentals, guiding students from basic language concepts to intermediate and advanced programming techniques before introducing Windows API programming and the practical use of C++ for offensive development. Hands-on laboratory exercises reinforce each stage of the learning process, allowing participants to apply programming concepts within controlled environments.
Building on these programming foundations, the course introduces the core principles that support professional Red Team operations. Students learn the fundamentals of Red Team methodology, common frameworks, Tactics, Techniques and Procedures (TTPs), adversary simulation and adversary emulation, operational security (OpSec), Rules of Engagement (ROE), and the design of Command and Control (C2) infrastructure. The curriculum also covers tiered C2 architecture, reverse proxy deployment with Nginx, and the components required to build a complete Red Team infrastructure for authorized offensive operations.
The second half of the course focuses on the fundamental techniques used during Windows offensive development. Students explore the differences between antivirus and endpoint detection technologies, detection mechanisms, AV and EDR bypass concepts, direct and indirect syscalls, shellcode runners, XOR shellcode encryption, in-memory execution, C++ droppers, vulnerable driver exploitation concepts, fileless PowerShell execution, VBA shellcode delivery, DLL hijacking, remote thread hijacking, hookchain concepts, ransomware fundamentals, LSASS dumping concepts, and Chrome credential extraction with Python. The curriculum concludes with software evasion fundamentals, AMSI, SmartScreen, Mark of the Web, anti-sandbox concepts, x64 Assembly programming, shellcode development, and introductory initial access techniques using weaponized LNK files, VBA macros, and shellcode execution, providing a cohesive introduction to the complete offensive development workflow.

## Objective

After completing this course, you will understand the fundamental programming, development, and operational concepts required to begin working with Windows offensive development. You will be able to write offensive-oriented C++ applications, interact with the Windows API, understand the components of Red Team infrastructure, recognize the principles behind common malware development techniques, develop and extract basic shellcode using x64 Assembly, and understand software evasion and initial access concepts within authorized laboratory environments. The course is designed to establish a practical foundation for offensive engineering by combining programming knowledge with the methodologies and techniques commonly encountered during Red Team operations.

## Who this is for

• Red Team Operators who want to develop a solid foundation in Windows offensive development and offensive programming.
• Offensive Security Engineers interested in learning C++, Windows API programming, shellcode development, and Red Team infrastructure fundamentals.
• Malware Analysts and Reverse Engineers seeking to understand the programming concepts and techniques commonly used during malware development.
• Security Researchers who want practical exposure to software evasion concepts, x64 Assembly, and Windows offensive development techniques.
• Detection Engineers and Blue Team Professionals looking to better understand offensive methodologies, malware execution concepts, and Red Team tradecraft to strengthen defensive capabilities.
• Cybersecurity Professionals and Students who want a structured introduction to Windows offensive development through practical laboratories covering programming, Red Team operations, malware development fundamentals, software evasion, Assembly, and initial access.

## What you will learn

1. C++ Foundations for Offensive Development — Build a solid programming foundation by learning C++ syntax, core language concepts, and practical coding techniques through beginner, intermediate, and advanced exercises. You will understand how these programming skills support the development of Windows offensive tooling and prepare you for subsequent modules focused on offensive engineering.
2. Windows Development Environments — Configure and work with development environments using Visual Studio for Windows and Linux-based compilation workflows. Learn how to create, build, and execute C++ projects while understanding the differences between development environments commonly used during offensive research.
3. Windows API Programming — Learn how Windows applications interact with the operating system through the Windows API. Explore the APIs commonly used in offensive development and understand how native Windows functionality can be leveraged when building security research and Red Team proof-of-concepts.
4. Advanced C++ Programming Concepts — Progress from fundamental programming concepts to intermediate and advanced C++ techniques that strengthen your ability to write structured, maintainable, and reusable code suitable for offensive development projects.
5. Red Team Methodology and Frameworks — Understand the purpose of Red Team engagements by exploring Red Team methodologies, widely adopted frameworks, and the role of structured offensive operations within authorized security assessments.
6. TTPs, Adversary Simulation, and Operational Security — Study Tactics, Techniques and Procedures (TTPs), distinguish between adversary simulation and adversary emulation, and understand how Operational Security (OpSec) and Rules of Engagement (ROE) contribute to safe, controlled, and professionally managed Red Team engagements.
7. Command and Control Infrastructure — Explore the components that support Command and Control (C2) operations, including C2 infrastructure design, tiered architectures, reverse proxy deployment with Nginx, and the principles involved in building a complete Red Team infrastructure.
8. Malware Development Fundamentals — Gain an introduction to malware development concepts by examining the differences between Antivirus and Endpoint Detection and Response (EDR) technologies, common detection mechanisms, and the foundational principles behind AV and EDR bypass concepts.
9. Syscalls and Shellcode Execution Concepts — Learn the purpose of direct and indirect syscalls, shellcode runners, XOR shellcode encryption, and in-memory execution techniques, understanding how these concepts are applied during offensive development and security research.
10. Offensive Payload Development Concepts — Explore the foundational concepts behind C++ droppers, vulnerable driver exploitation, fileless PowerShell execution, and VBA shellcode delivery to understand common approaches used when studying Windows offensive development techniques.
11. Windows Tradecraft Techniques — Examine introductory concepts behind DLL Hijacking, Remote Thread Hijacking, and Hookchain techniques, understanding their role within Windows offensive tradecraft and how they fit into broader offensive development workflows.
12. Credential Access and Malware Concepts — Study ransomware fundamentals together with LSASS dumping concepts and Chrome credential extraction using Python to understand common credential access and malware-related techniques within controlled learning environments.
13. Software Evasion Fundamentals — Develop an understanding of the principles behind software evasion by exploring how security mechanisms identify potentially malicious software and how evasion concepts are approached from an offensive security perspective.
14. Windows Security Mechanisms — Learn the purpose and operation of AMSI, SmartScreen, and Mark of the Web (MOTW), and understand why these Windows security features are important considerations during offensive development and security testing.
15. Anti-Sandbox Concepts — Explore the basic principles of anti-sandbox techniques and understand why software may behave differently when executed inside analysis or testing environments.
16. x64 Assembly Programming Fundamentals — Build a foundation in x64 Assembly by learning essential syntax, configuring the required toolchain, creating simple programs, and understanding basic input and output operations.
17. Practical Shellcode Development — Learn how shellcode is created, compiled, extracted, and executed within controlled laboratory environments while developing a practical understanding of low-level Windows code execution.
18. Initial Access Techniques — Examine introductory initial access concepts involving weaponized LNK files, VBA macros, and shellcode execution to understand how these techniques are studied during authorized offensive security engagements.
19. Integrated Offensive Development Laboratories — Reinforce every major topic through practical laboratory exercises that combine programming, Windows development, Red Team methodology, malware development concepts, software evasion, Assembly, and initial access into guided hands-on experience.
20. Offensive Development Workflow — Understand how the individual topics presented throughout the course fit together into a structured offensive development workflow, beginning with programming fundamentals and progressing through infrastructure, execution, evasion, and initial access concepts.
21. Practical Foundations for Windows Offensive Engineering — Consolidate the knowledge gained throughout the course into a practical understanding of Windows offensive development, combining C++, Windows API programming, Red Team fundamentals, malware development concepts, software evasion, Assembly programming, and initial access techniques into a cohesive introductory skill set.

## What you will be able to do by the end

• Develop foundational Windows offensive applications using C++ and interact with the Windows API through practical programming exercises.
• Configure development environments, compile projects in Visual Studio and Linux, and apply C++ programming techniques to offensive development scenarios.
• Understand the principles of Red Team methodology, TTPs, adversary simulation, adversary emulation, Operational Security (OpSec), Rules of Engagement (ROE), and Command and Control infrastructure.
• Explain the purpose and practical application of malware development concepts, shellcode execution, software evasion techniques, and Windows security mechanisms within authorized laboratory environments.
• Build, extract, and work with basic x64 Assembly shellcode while understanding the concepts behind low-level Windows code execution.
• Recognize the principles behind Windows offensive tradecraft, including DLL Hijacking, Remote Thread Hijacking, fileless execution, VBA delivery techniques, credential access concepts, and anti-sandbox mechanisms.
• Apply a structured offensive development workflow that integrates programming, Windows API development, Red Team infrastructure, malware development fundamentals, software evasion, Assembly programming, and introductory initial access techniques in controlled and authorized security testing environments.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

Learn the fundamentals of offensive development on Windows, including evasion techniques, API abuse, and shellcode execution. Designed for aspiring Red Teamers and security researchers

Offensive Development Introduction for Windows v1

This hands-on course teaches advanced Operational Security (OpSec) principles and digital anonymity strategies tailored specifically for Red Team operators, offensive security engineers, and threat simulation professionals. Through three structured modules—covering fundamentals, tools & techniques, and real-world case studies—students will learn how to build persona-isolated infrastructure, evade attribution, and execute stealthy engagements under realistic adversarial conditions.

Unlike theoretical OpSec training, this course delivers deeply technical content with practical labs, toolchain walkthroughs, and campaign simulation exercises. From network fingerprint obfuscation and C2 staging to anti-forensics and metadata hygiene, students will gain real-world capabilities for high-fidelity offensive operations while maintaining operational deniability.

Ideal for professionals who want to elevate their Red Team tradecraft, reduce exposure, and stay ahead of detection frameworks.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based.**

Advanced Operational Security and Digital Anonymity for Offensive Security Professionals



OpSec & Anonymity for Red Teams

# Purple Team - Active Directory and AzureAD v1

Modern enterprise identity spans both on-premises Active Directory and Microsoft Entra ID (Azure AD), creating complex hybrid environments that require continuous validation from both offensive and defensive perspectives. This course provides a practical Purple Team approach to assessing identity security, simulating realistic attacks, validating detections, and strengthening enterprise defenses across hybrid infrastructures.

---

# What this course is

Purple Team - Active Directory and AzureAD v1 is an advanced identity security course focused on understanding how attackers target enterprise identity infrastructures and how defenders can detect, validate, and mitigate those techniques. Rather than approaching offensive and defensive operations independently, the course demonstrates how Red Team tradecraft and Blue Team visibility work together to improve organizational resilience. Students explore core identity technologies including on-premises Active Directory, Microsoft Entra ID (Azure AD), Hybrid Identity, LDAP, Kerberos, NTLM, Microsoft Graph, PowerShell, Azure CLI, and modern enterprise authentication mechanisms.

Throughout the course, participants build realistic enterprise lab environments that closely resemble production infrastructures while performing identity reconnaissance, attack simulation, defensive validation, and detection engineering. Practical scenarios emphasize Purple Team methodology, enabling students to validate security controls, improve detection quality, strengthen identity security, and measure defensive effectiveness using enterprise-grade techniques across hybrid Active Directory and cloud environments.

---

# Objective

The objective of this course is to teach security professionals how to simulate realistic identity-focused attack scenarios while simultaneously validating defensive controls across hybrid Active Directory and Microsoft Entra ID environments. Students will learn to improve detection capabilities, harden enterprise identity infrastructures, evaluate incident response readiness, and continuously strengthen organizational security through collaborative Purple Team exercises that integrate offensive operations with defensive validation.

---

# Who this is for

- Purple Team professionals responsible for validating enterprise security controls.
- Red Team operators performing identity-focused attack simulations.
- Blue Team analysts and SOC professionals improving detection coverage.
- Detection Engineers developing enterprise detection logic and telemetry.
- Active Directory and Microsoft Entra ID administrators responsible for identity security.
- Cloud security engineers, incident responders, and security consultants working with hybrid enterprise environments.

---

# What you will learn

1. **Enterprise Identity Architecture**  
   Understand the security foundations of Active Directory, Microsoft Entra ID, and hybrid identity infrastructures.

2. **Identity Reconnaissance and Enumeration**  
   Discover users, systems, trusts, permissions, authentication paths, and identity relationships using enterprise reconnaissance techniques.

3. **Hybrid Identity Security Assessment**  
   Evaluate synchronization, authentication flows, and security boundaries between on-premises and cloud identities.

4. **Credential and Authentication Attacks**  
   Analyze common attack paths involving Kerberos, NTLM, password abuse, token-based authentication, and identity compromise.

5. **Microsoft Graph and Cloud Identity Operations**  
   Assess Microsoft Graph, Azure services, OAuth, PowerShell, and Azure CLI from both offensive and defensive perspectives.

6. **Privilege Escalation and Lateral Movement**  
   Identify privilege escalation opportunities, abuse identity misconfigurations, and evaluate lateral movement across hybrid environments.

7. **Enterprise Identity Persistence**  
   Examine persistence mechanisms involving Active Directory, Microsoft Entra ID, AD CS, LAPS, gMSA, Exchange, and related enterprise identity services.

8. **Detection Engineering and Defensive Validation**  
   Develop and validate detections using enterprise telemetry, Microsoft Sentinel, SIEM platforms, BloodHound, KQL, Sysmon, and Purple Team methodologies.

9. **Security Control Evasion and Validation**  
   Understand techniques involving AMSI, ETW, AppLocker, WDAC, and defensive control assessment while validating monitoring effectiveness.

10. **Identity Hardening and Incident Response**  
    Improve enterprise identity security through hardening strategies, continuous validation, incident response, and operational security best practices.

---

# What you will be able to do by the end

- Build enterprise-ready hybrid Active Directory and Microsoft Entra ID laboratory environments.
- Perform comprehensive identity reconnaissance across both on-premises and cloud infrastructures.
- Simulate credential attacks while validating defensive visibility and detection coverage.
- Assess privilege escalation opportunities and lateral movement paths across hybrid identity environments.
- Execute realistic Purple Team exercises that integrate attack simulation, detection engineering, and defensive validation.
- Develop and improve enterprise detections using Microsoft Sentinel, Sysmon, KQL, BloodHound, and SIEM technologies.
- Strengthen enterprise identity security through continuous hardening, validation, and incident response improvements.

---

> **This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**


Red Teaming and Blue Teaming Tactics

Purple Team - Active Directory and AzureAD v1

# Windows API for Red Team Introduction

### Build a practical foundation in Windows API programming, C++, Windows Internals, and introductory offensive development for modern Red Team operations.

---

# What this course is

Windows remains the primary operating system in enterprise environments, making a solid understanding of the Windows API one of the most valuable skills for offensive security professionals. This introductory course provides a practical foundation in Windows system programming by combining Windows Internals concepts, native API interaction, C++ development, and hands-on coding exercises. Rather than focusing solely on theory, the course emphasizes how Windows applications communicate with the operating system and how these mechanisms are leveraged by both legitimate software and offensive security tooling.

Throughout the course, students progressively build practical experience writing C++ applications that interact directly with Windows APIs for process management, memory operations, registry access, networking, authentication, and system enumeration. The curriculum also introduces fundamental offensive development concepts—including syscall usage, shellcode execution, API hashing, hook detection, and introductory EDR evasion techniques—providing the knowledge required to pursue more advanced topics such as malware development, Windows internals research, and custom Red Team tooling.

---

# Objective

The objective of this course is to provide students with a practical understanding of Windows API programming from both a systems programming and offensive security perspective. By the end of the course, students will be able to create native C++ applications that interact with documented and native Windows APIs, understand how Windows manages processes, memory, threads, services, networking, authentication, and registry operations, and implement foundational offensive development techniques that serve as the basis for more advanced Red Team, malware analysis, and Windows research.

---

# Who this is for

- Red Team professionals beginning their offensive development journey.
- Penetration testers interested in developing custom Windows tools.
- Malware analysts seeking a deeper understanding of Windows internals.
- Security researchers exploring native Windows APIs and system programming.
- Reverse engineers analyzing Windows executables and operating system behavior.
- Detection engineers wanting to better understand attacker tradecraft.
- Windows developers transitioning into cybersecurity.
- Students preparing for advanced malware development and offensive engineering courses.
- Anyone interested in learning practical Windows API programming through hands-on examples.

---

# What you will learn

### 1. Understanding the Windows API Architecture

Learn how Windows applications communicate with the operating system through the Windows API, including the relationship between user mode, kernel mode, native APIs, and the overall Windows execution model that underpins modern software.

---

### 2. Windows Internals Fundamentals

Build a foundational understanding of Windows Internals by exploring core operating system concepts that influence process execution, memory management, security boundaries, and system interactions essential for both software development and offensive security.

---

### 3. System Calls and Native API Execution

Understand how Windows system calls operate beneath the Windows API, explore the differences between documented APIs and native NT functions, and learn the concepts behind direct and indirect syscalls used in modern security research.

---

### 4. Practical C++ for Windows Development

Develop the C++ skills necessary for Windows programming, including language fundamentals, project creation with Visual Studio, code organization, compilation, debugging, and practical programming patterns used when interacting with native APIs.

---

### 5. Building Native Windows Applications

Learn how to create Windows applications that safely interact with operating system services using documented APIs while understanding common development workflows used by both software engineers and security professionals.

---

### 6. Process Creation and Process Management

Explore how Windows creates, manages, and monitors processes using APIs such as `CreateProcess`, `OpenProcess`, and related native functions while learning how processes interact within the operating system.

---

### 7. Memory Management and Process Memory Operations

Understand virtual memory concepts, memory allocation, memory protection, and process memory interaction using functions such as `VirtualAlloc`, `ReadProcessMemory`, `WriteProcessMemory`, and native memory management techniques.

---

### 8. Windows Enumeration Techniques

Learn how to enumerate system information programmatically, including running processes, windows, users, services, network sessions, adapters, authentication sessions, and other operating system resources frequently used in administration and security tooling.

---

### 9. Registry, Configuration, and System Information Access

Learn how to interact with the Windows Registry using native APIs to open registry keys, query configuration values, and retrieve system information. You'll also explore techniques for gathering user, authentication, networking, and operating system metadata that are commonly leveraged in enterprise software and security tools.

---

### 10. Dynamic API Resolution and DLL Management

Understand how Windows loads and resolves dynamic libraries at runtime using functions such as `LoadLibraryA`, `LoadLibraryW`, and related APIs. The course also introduces API ordinals, API hashing, and dynamic resolution techniques commonly found in security products, malware analysis, and custom tooling.

---

### 11. Threads, Sections, and Native Memory Techniques

Explore advanced Windows programming concepts involving thread context manipulation, native section mapping, and low-level process interaction through APIs such as `NtMapViewOfSection`, `NtUnmapViewOfSection`, `GetThreadContext`, and `SetThreadContext`, providing insight into how Windows manages execution internally.

---

### 12. Security, Anti-Debugging, and System Protection APIs

Gain an understanding of defensive and offensive techniques related to Windows security, including anti-debugging concepts, process inspection, Windows Data Protection API (DPAPI), logon session enumeration, and authentication-related APIs that expose valuable system information.

---

### 13. Introductory Offensive Development

Build a practical understanding of how Windows APIs are used during offensive development by implementing introductory techniques such as XOR shellcode encryption, in-memory shellcode execution, inline hook detection, restoring the NTDLL `.text` section, and understanding the principles behind EDR evasion without relying on black-box tools.

---

### 14. Practical API Development Through Hands-On Labs

Apply the concepts learned throughout the course by completing practical exercises that reinforce Windows API programming, native development, system interaction, and introductory offensive programming techniques in a controlled laboratory environment.

---

### 15. Building a Foundation for Advanced Windows Security

Consolidate the knowledge required to progress toward more advanced topics such as malware development, Red Team tooling, Windows Internals research, reverse engineering, detection engineering, and low-level Windows security development.

---

# What you will be able to do by the end

- Understand the Windows API architecture, execution model, and the relationship between user mode, kernel mode, and native Windows components.
- Develop native C++ applications that interact directly with documented and native Windows APIs.
- Create applications that work with processes, threads, memory, registry, services, networking, authentication, and system information.
- Understand Windows syscall mechanisms, including the concepts behind direct and indirect syscalls.
- Programmatically inspect Windows processes, retrieve operating system information, and enumerate system resources using practical APIs.
- Implement dynamic API loading, API hashing, ordinal-based resolution, and other techniques commonly used in Windows security research.
- Build introductory offensive utilities that demonstrate shellcode execution, process interaction, hook detection, memory manipulation, and native API usage.
- Understand the fundamentals of offensive Windows development while recognizing how these techniques relate to defensive monitoring, malware analysis, and detection engineering.
- Establish a strong technical foundation for continuing into advanced Windows Internals, malware development, Red Team tooling, reverse engineering, and offensive security research.

---

> **This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**



Windows API Fundamentals for Red Team Operations

Windows API for Red Team Introduction

# Physical PenTest Fundamentals

Modern organizations rely on layered physical security controls to protect people, facilities, information, and critical assets. This course provides a structured introduction to professional Physical Penetration Testing, combining physical security assessment methodologies, Red Team planning principles, reconnaissance techniques, and defensive validation practices to help security professionals evaluate real-world physical security programs within authorized engagements.

---

# What this course is

Physical PenTest Fundamentals is a professional training program focused on the methodologies, planning processes, and operational considerations involved in conducting authorized physical security assessments. Students explore how physical penetration testing complements traditional Red Team operations by validating the effectiveness of access controls, security policies, employee awareness, surveillance systems, and facility protections. Throughout the course, emphasis is placed on legal authorization, ethical conduct, operational planning, evidence preservation, and responsible execution within defined Rules of Engagement.

Physical PenTest Fundamentals is a professional training program focused on the methodologies, planning processes, and operational considerations involved in conducting authorized physical security assessments. Students explore how physical penetration testing complements traditional Red Team operations by validating the effectiveness of access controls, security policies, employee awareness, surveillance systems, and facility protections. Throughout the course, emphasis is placed on legal authorization, ethical conduct, operational planning, evidence preservation, and responsible execution within defined Rules of Engagement.

---

# Objective

Upon completing this course, students will understand how professional Physical Penetration Testing engagements are planned, executed, documented, and reported within enterprise environments. They will be able to assess physical security controls using recognized methodologies, perform structured reconnaissance activities, collect defensible evidence, analyze risks, and produce executive-ready assessment reports that support security validation and continuous improvement.

---

# Who this is for

- Red Team professionals seeking to expand assessments beyond traditional network and application security into physical security validation.
- Penetration testers interested in integrating physical security methodologies into authorized enterprise engagements.
- Physical security consultants responsible for evaluating facility protections, access control programs, and corporate security processes.
- Corporate security teams responsible for validating physical safeguards, operational procedures, and employee security awareness.
- Security researchers studying physical attack surfaces, access control technologies, and defensive assessment methodologies.
- Defensive cybersecurity professionals who support enterprise risk assessments, security assurance, and comprehensive organizational resilience.

---

# What you will learn

1. **Physical Penetration Testing Fundamentals** — Understand the purpose, scope, and methodology of professional physical security assessments.
2. **Red Team Physical Operations** — Learn how physical assessments integrate into broader adversary simulation and security validation programs.
3. **Legal Authorization and Compliance** — Apply engagement requirements, contractual boundaries, and legal considerations throughout authorized assessments.
4. **Ethics and Professional Conduct** — Perform security testing responsibly while protecting client assets, personnel, and organizational trust.
5. **Rules of Engagement** — Define operational boundaries, objectives, escalation procedures, and assessment limitations before execution.
6. **Physical Threat Modeling** — Identify likely physical attack surfaces, critical assets, and environmental risks affecting enterprise facilities.
7. **Operational Planning and OPSEC** — Prepare assessments while minimizing unnecessary operational exposure and maintaining professional discipline.
8. **Social Engineering Methodologies** — Understand how human factors influence physical security validation within authorized engagements.
9. **Pretext Development** — Design realistic and defensible engagement scenarios that align with assessment objectives and organizational context.
10. **OSINT for Physical Assessments** — Gather publicly available intelligence to support reconnaissance and engagement planning.
11. **GEOINT and Environmental Analysis** — Evaluate facility layouts, surrounding infrastructure, and geographic factors that influence physical security.
12. **Passive Reconnaissance and Observation** — Conduct structured environmental assessments through observation while respecting engagement constraints.
13. **Security Surveillance Evaluation** — Assess the effectiveness of monitoring technologies, visibility, and physical security coverage.
14. **Information Exposure Assessment** — Examine how discarded materials and publicly accessible information may contribute to organizational risk.
15. **Access Credential Technologies** — Understand RFID, NFC, proximity cards, and common enterprise identification systems from a defensive perspective.
16. **Physical Access Control Assessment** — Evaluate locks, controlled entry systems, turnstiles, elevators, sensors, and related security mechanisms.
17. **Corporate Facility Security** — Analyze layered building security strategies and identify opportunities for defensive improvement.
18. **Evidence Collection and Documentation** — Record assessment activities using structured, defensible, and professionally documented evidence.
19. **Risk Analysis and Findings Validation** — Prioritize identified weaknesses based on business impact, likelihood, and operational significance.
20. **Executive Reporting** — Communicate technical findings through concise reports tailored to management, security teams, and stakeholders.
21. **Assessment Best Practices** — Apply repeatable methodologies that support continuous physical security improvement and organizational resilience.

---

# What you will be able to do by the end

- Plan authorized physical security assessments using structured methodologies, clearly defined objectives, and professional Rules of Engagement.
- Perform reconnaissance activities through OSINT, GEOINT, and environmental observation to support physical security validation.
- Develop realistic social engineering scenarios that align with assessment objectives while respecting legal and ethical boundaries.
- Evaluate enterprise physical security controls, including access management processes, facility protections, and layered defensive measures.
- Document observations, preserve assessment evidence, and perform structured risk analysis to support remediation planning.
- Produce professional physical security assessment reports suitable for technical teams, management, and executive stakeholders.
- Contribute to enterprise Red Team and defensive security programs by validating physical security controls through responsible, authorized assessment practices.

---

> **This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**


Physical Pentest Fundamentals: Real-World Techniques in Social Engineering, Recon, and Facility Breach Operations

Physical PenTest Fundamentals

# Active Directory Certificate Services

## Subtitle

From zero to Domain Admin through Active Directory Certificate Services — hands-on ESC1–ESC16 on a live Enterprise CA.

## Description

A fully weaponized AD CS attack range where a single low-privileged user escalates to Domain Admin through every major certificate-abuse primitive. Built on a Windows Server 2019 Domain Controller running an Enterprise Root CA (`adescrtl.lab`), the lab pre-plants each misconfiguration — vulnerable templates, dangerous ACLs, CA policy flags, weak certificate mappings, and OID-to-group links — so you can walk each path end-to-end with Certipy and Impacket.

You'll learn how certificate identity binding actually works (SAN, UPN, and the SID security extension), why KB5014754 broke the classic attacks, and how a single careless CA setting (ESC16) brings them all back. Every technique is documented with concept, lab configuration, verified commands, real output, and the exact defensive control that stops it.

### Covers

- **ESC1** — enrollee-supplies-subject + Client Authentication
- **ESC2** — Any Purpose (or no) EKU
- **ESC3** — Enrollment Agent certificate chain
- **ESC4** — vulnerable template ACL (GenericAll)
- **ESC5** — vulnerable PKI object ACL
- **ESC6** — `EDITF_ATTRIBUTESUBJECTALTNAME2` on the CA
- **ESC7** — ManageCA / ManageCertificates rights
- **ESC8** — NTLM relay to Web Enrollment
- **ESC9** — no security extension + weak binding
- **ESC10** — weak certificate mappings
- **ESC11** — unencrypted ICPR relay
- **ESC13** — issuance policy OID-to-group link
- **ESC16** — SID security extension disabled (the enabler)

### You'll master

- Template and CA enumeration
- SAN / UPN spoofing and certificate identity binding
- PKINIT authentication and UnPAC-the-hash
- On-behalf-of enrollment (enrollment agents)
- NTLM relay to certificate endpoints (HTTP and RPC)
- The KB5014754 hardening model — attacking **and** defending it

### Prerequisites

Basic Active Directory and Kerberos familiarity; comfort with a Linux attack box (Certipy, Impacket).

---

### Alternative subtitles

- Attack and defend the full AD CS ESC1–ESC16 escalation family — hands-on.
- Certificate-based domain takeover, from foothold to Domain Admin.


From zero to Domain Admin through Active Directory Certificate Services - hands-on ESC1–ESC16 on a live Enterprise CA.

Active Directory ADCS - Labs

This hands-on lab focuses on **Windows Active Directory security** and demonstrates how real-world misconfigurations can lead to **initial domain compromise**.  
Participants will interact with a vulnerable Active Directory environment composed of a Domain Controller and a member server, simulating legacy enterprise setups commonly found in production networks.

Throughout the lab, students will practice offensive security techniques such as **NTLM abuse, Kerberos-based attacks, and network authentication weaknesses**, gaining a deep understanding of how attackers obtain their first valid domain credentials without exploiting software vulnerabilities.

The environment is intentionally misconfigured for educational purposes, allowing students to safely explore attack paths, observe authentication behavior, and understand the impact of poor Active Directory hardening.

### What you will learn

* How attackers gain initial access to Active Directory environments
* How legacy protocols and weak configurations expose credentials
* Practical interaction with real Windows servers and domain services
* Hands-on experience with realistic enterprise attack scenarios

### Lab Access & Credits

This lab includes **120 free credits** upon enrollment, allowing you to test and explore the environment at no additional cost.  
Once the credits are consumed, additional credits can be purchased to continue practicing and revisiting the lab.

This lab is designed for **Red Team operators, penetration testers, and security professionals** who want practical, real-world experience with Active Directory attack surfaces.

From Network Access to Valid Domain Credentials in a Misconfigured AD Environment

Active Directory Compromise - Laboratory

## Course Overview

Modern endpoint detection and response platforms have evolved into formidable adversaries for red team operators. The days of compiling a payload with a public framework and expecting it to survive on disk let alone in memory are over. Today's EDR solutions leverage kernel-mode telemetry, behavioral analysis, machine learning classifiers, and deep call-stack inspection to detect and neutralize threats at every stage of execution. This course exists because the gap between what most operators know and what modern defenses demand has never been wider.

100-technique masterclass designed for experienced red team operators, adversary simulation engineers, and security researchers who need to understand at the deepest technical level how modern AV/EDR products detect malicious activity and, critically, how those detections can be circumvented. This is not a tool-focused course. There are no pre-built frameworks to lean on. Every technique is taught from first principles: you will write the code, understand the underlying Windows internals, and learn exactly which telemetry sources your actions generate and how to minimize or eliminate that footprint.

  
The curriculum spans the full evasion lifecycle. You will begin with execution primitives and sandbox evasion, progress through application control bypass and in-memory loading, master process injection variants that evade modern call-stack analysis, learn to operate without triggering AMSI or script-block logging, abuse legitimate system binaries to blend into normal operations, defeat EDR behavioral heuristics through adaptive execution, leverage .NET managed code for stealth, and ultimately descend to the syscall level where you will interact directly with the Windows kernel to bypass user-mode hooks entirely. Each module builds on the last. By the end, you will not simply know 100 techniques you will understand the architectural principles that make them work and the engineering discipline required to combine them into resilient, detection-resistant toolchains.


## Prerequisites

Before beginning this course, students should have solid working knowledge in the following areas. This is advanced material and assumes a strong technical foundation.

| Area | Required Proficiency | Details |
|:-----|:---------------------|:--------|
| **C/C++ Programming** | Intermediate to Advanced | Comfortable with pointers, memory management, structs, Win32 API calls, and compiling with MSVC or MinGW |
| **C# / .NET** | Intermediate | Familiar with `System.Reflection`, P/Invoke, delegates, `Assembly.Load`, and the CLR execution model |
| **PowerShell** | Intermediate | Able to write and debug scripts, understand the PowerShell pipeline, runspaces, and script block logging |
| **Rust** | Basic to Intermediate | Familiarity with Cargo, unsafe blocks, FFI, and the Rust memory model (some modules use Rust for memory-safe evasion) |
| **x86/x64 Assembly** | Basic | Ability to read disassembly, understand calling conventions (stdcall, fastcall), syscall stubs, and stack frames |
| **Windows Internals** | Intermediate | Understanding of processes, threads, virtual memory, PEB/TEB structures, the Windows loader, and kernel-user transitions |
| **Offensive Security Fundamentals** | Intermediate | Experience with penetration testing or red team operations; familiarity with shellcode, loaders, and C2 concepts |
| **Debugging Tools** | Basic to Intermediate | Comfortable using WinDbg, x64dbg, or similar debuggers; ability to set breakpoints and inspect memory |

## Technology Stack

This course uses four primary languages, each chosen for specific strengths in the evasion domain.

| Language | Use Cases | Key Strengths |
|:---------|:----------|:--------------|
| **C++ (Win32 API)** | Low-level loaders, process injection, syscall stubs, PE manipulation, DLL development | Direct hardware/OS access, minimal runtime dependencies, full control over memory layout |
| **Rust** | Memory-safe evasion tooling, cross-compilation, loader development | Memory safety without garbage collection, minimal binary footprint, strong FFI with C, harder to reverse |
| **C# (.NET)** | Managed code tradecraft, Assembly.Load techniques, reflection-based execution, P/Invoke | Rich runtime library, dynamic compilation, access to .NET internals, CLR hosting |
| **PowerShell** | Script-based evasion, AMSI testing, rapid prototyping, runspace manipulation | Deep Windows integration, .NET access, ubiquitous on Windows, scriptblock flexibility |

### Build Tools and Frameworks

| Tool | Purpose |
|:-----|:--------|
| Visual Studio 2022 Build Tools | MSVC compiler for C/C++ projects |
| .NET SDK 6.0 / 8.0 | Building and publishing C# projects |
| Cargo (Rust) | Building Rust projects with `stable` and `nightly` toolchains |
| NASM / MASM | Assembling raw syscall stubs and shellcode |
| MinGW-w64 | Cross-compilation of Windows binaries from Linux |
| CMake | Build system for multi-file C/C++ projects |

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based.**

A Deep-Dive into 100 Techniques for Bypassing Modern Endpoint Security. From Memory Loaders to Kernel-Level Stealth.

Advanced AV/EDR Evasion Engineering

## Course Overview

This comprehensive course teaches you how to design, develop, and deploy a modern Command & Control (C2) framework from scratch using industry-standard technologies and security practices. You will build a fully functional C2 infrastructure that demonstrates core concepts used in professional penetration testing and red team operations.

The course follows the **OST-C2-Spec** (Open Source C2 Specification) and draws architectural patterns from modern frameworks like **Sliver**, **Covenant**, and **Havoc**.

### What You Will Build

By the end of this course, you will have developed:

1. **Team Server** - A robust C2 server managing multiple agent sessions
2. **Agent** - A cross-platform implant capable of command execution and communication
3. **Operator Console** - A professional GUI for managing operations
4. **Secure Communication Layer** - End-to-end encrypted messaging with integrity protection
5. **Advanced Features** - Session management, tasking, cryptography, and extensibility

---

## Target Audience

This course is designed for:

- **Security professionals** seeking to understand offensive infrastructure
- **Penetration testers** and **red teamers** wanting to develop custom tooling
- **Blue team defenders** learning attacker techniques and indicators
- **Security researchers** studying C2 architecture and detection
- **Software engineers** interested in secure distributed systems
- **Students** pursuing careers in offensive or defensive security

---

## Prerequisites

### Required Knowledge

- **Programming**: Strong proficiency in C# and .NET development
- **Networking**: Understanding of HTTP/HTTPS, WebSockets, TCP/IP
- **Security Fundamentals**: Basic cryptography concepts (symmetric/asymmetric encryption)
- **Software Architecture**: Familiarity with client-server patterns, APIs, and MVVM
- **Operating Systems**: Working knowledge of Windows and Linux environments

### Required Tools

- **.NET 8 SDK** - Primary development framework
- **Visual Studio 2022** or **JetBrains Rider** - Recommended IDEs
- **Git** - Version control
- **Postman** or **curl** - API testing
- **Wireshark** - Network traffic analysis
- **Virtual machines** - Isolated testing environment (VMware/VirtualBox/Hyper-V)

### Recommended Background

- Experience with RESTful API development
- Understanding of asynchronous programming (async/await)
- Familiarity with MVVM pattern for GUI development
- Basic knowledge of penetration testing concepts

---

## Technology Stack

### Core Technologies

| Component | Technology | Justification |
|-----------|-----------|---------------|
| **Language** | C# (.NET 8) | Cross-platform, high performance, excellent async support, strong typing |
| **GUI Framework** | .NET MAUI / WPF | Modern UI capabilities, MVVM architecture, cross-platform (MAUI) |
| **Communication** | HTTPS + WebSockets | Encrypted transport, real-time bidirectional communication, firewall-friendly |
| **Serialization** | JSON | Human-readable, widely supported, easy debugging |
| **Web Framework** | ASP.NET Core | High-performance web server, built-in middleware, excellent API support |
| **Encryption** | RSA-4096, AES-256-GCM, HMAC-SHA256 | Industry-standard cryptographic algorithms, authenticated encryption |

### Why This Stack?

**C# and .NET 8** provides:
- Native cross-platform support (Windows, Linux, macOS)
- High-performance async I/O for concurrent agent handling
- Strong standard library for cryptography and networking
- Mature tooling and debugging capabilities
- Easy deployment and single-file executables

**HTTPS + WebSockets** enables:
- Encrypted communications that blend with normal traffic
- Real-time bidirectional messaging for interactive sessions
- Support for proxy environments
- Firewall traversal using standard ports (443)

**AES-GCM + RSA** delivers:
- Authenticated encryption preventing tampering
- Secure key exchange without pre-shared secrets
- Protection against replay attacks
- Industry-vetted security guarantees

---

## Course Structure

The course is divided into **3 comprehensive modules** with **24+ lessons** total:

### 📘 Module 1: Team Server (C2 Server)
**8 lessons** covering server-side infrastructure

Build the central command server that manages agent sessions, dispatches tasks, and collects results.

**Topics:**
- C2 architecture and design patterns
- Session management and agent lifecycle
- OST-C2-Spec protocol implementation
- RESTful API development
- Task queue and dispatching
- Result collection and storage
- Logging and operational security
- Database design and persistence

### 📗 Module 2: Client/Agent + Operator GUI
**8 lessons** covering agent development and operator interface

Develop the field agent that runs on target systems and the GUI console for operators.

**Topics:**
- Agent architecture and execution flow
- Beaconing, sleep, and jitter mechanisms
- Command execution and output capture
- Secure communication with Team Server
- Operator GUI design (WPF/MAUI)
- MVVM pattern implementation
- Real-time session monitoring
- Interactive command interface

### 📙 Module 3: Advanced Features
**8 lessons** covering security and extensibility

Implement enterprise-grade security features and advanced capabilities.

**Topics:**
- Asymmetric cryptography (RSA key exchange)
- Symmetric encryption (AES-GCM)
- Message authentication (HMAC)
- Anti-replay protection
- Protocol versioning and extensibility
- Secure tunneling concepts (SOCKS proxy)
- Persistence mechanisms
- Advanced logging and audit trails

---

## Learning Outcomes

Upon completing this course, you will be able to:

1. **Design** scalable C2 architecture following industry best practices
2. **Implement** secure communication protocols with cryptographic protection
3. **Develop** cross-platform agents capable of remote command execution
4. **Build** professional operator interfaces using modern GUI frameworks
5. **Apply** advanced security techniques (encryption, integrity, anti-replay)
6. **Analyze** existing C2 frameworks and understand their design decisions
7. **Debug** complex distributed systems with multiple components
8. **Deploy** C2 infrastructure in controlled testing environments
9. **Recognize** C2 indicators from a defender's perspective
10. **Extend** the framework with custom features and modules

---

## Course Methodology

### Hands-On Approach

Every lesson includes:
- **Theoretical foundation** - Concepts and architectural decisions
- **Practical implementation** - Complete, functional code examples
- **Visual aids** - Architecture diagrams, sequence flows, data models
- **Security analysis** - Threat modeling and defense considerations

### Incremental Development

The course follows an incremental approach:
1. Start with minimal viable functionality
2. Add features layer by layer
3. Refactor and improve as complexity increases
4. Maintain working code at every stage

### Production-Quality Code

All code examples demonstrate:
- Clean architecture and SOLID principles
- Comprehensive error handling
- Async/await for non-blocking operations
- Logging and diagnostics
- Configuration management
- Unit testable design

---

## Code Repository Structure

```
c2-framework/
├── src/
│   ├── TeamServer/          # C2 Server implementation
│   ├── Agent/               # Field agent implementation
│   ├── OperatorGUI/         # Operator console (WPF/MAUI)
│   ├── Shared/              # Shared libraries and models
│   └── Tests/               # Unit and integration tests
├── docs/
│   ├── architecture/        # Architecture diagrams
│   ├── protocols/           # Protocol specifications
│   └── api/                 # API documentation
├── examples/                # Example configurations
└── labs/                    # Hands-on lab exercises
```

---

## Additional Resources

### References
- [OST-C2-Spec](https://github.com/rasta-mouse/OST-C2-Spec) - Open Source C2 Specification
- [Sliver C2](https://github.com/BishopFox/sliver) - Modern adversary emulation platform
- [Covenant](https://github.com/cobbr/Covenant) - .NET C2 framework
- [Havoc](https://github.com/HavocFramework/Havoc) - Modern post-exploitation framework

### Further Learning
- MITRE ATT&CK Framework - Command and Control Tactics
- .NET Security Documentation
- Applied Cryptography by Bruce Schneier
- Red Team Development and Operations by Joe Vest


**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based.**

Building Modern Command & Control Infrastructure

Advanced C2 Development

## Course Overview

A comprehensive, hands-on course designed to teach the theory and practice of modern exploit development. It focuses on understanding how software vulnerabilities occur at the lowest levels of a system and how they can be analyzed and exploited in controlled environments.

The course targets security researchers, penetration testers, reverse engineers, and software engineers who want to gain a deep technical understanding of vulnerability exploitation. Rather than focusing only on tools or automated techniques, DevExploit emphasizes **fundamental concepts**, including processor architecture, memory management, binary analysis, and exploit construction.

Throughout the course, students work with **real vulnerable programs and lab environments** that can be compiled and executed locally. Each module includes practical exercises where participants analyze the source code of vulnerable applications, identify the root cause of a vulnerability, and develop working exploits step by step.

The curriculum covers exploitation techniques across **multiple architectures and operating systems**, including **x86, x64, and ARM**, with practical examples on both **Windows and Linux** platforms. This allows learners to understand how exploitation techniques differ between environments and how modern operating systems implement defensive mechanisms.

Key topics covered in the course include:

* Processor architecture and virtual memory management
* Assembly programming for exploit development
* Writing and encoding custom shellcode
* Using C/C++ and Python for exploit scripting and automation
* Reverse engineering binaries with debugging and analysis tools
* Exploiting stack-based buffer overflows
* Advanced heap exploitation techniques
* Building Return-Oriented Programming (ROP) chains
* Bypassing modern mitigation mechanisms such as DEP, ASLR, and stack protections
* Exploiting vulnerabilities in kernel space on both Windows and Linux
* Introduction to exploitation techniques on ARM architectures

The course follows a **progressive learning structure**, starting with low-level system fundamentals and gradually moving toward advanced exploitation scenarios. By understanding how vulnerabilities interact with operating system internals and processor behavior, students develop the skills required to analyze complex security issues and build reliable exploits.

**All labs run locally** - every module includes buildable vulnerable applications, kernel modules, and exploit scripts you can compile and test on your own machines

### Vulnerable Applications for Practice

| Resource | URL | Focus |
|----------|-----|-------|
| VulnServer | https://github.com/stephenbradshaw/vulnserver | Windows stack overflows, SEH |
| HEVD | https://github.com/hacksysteam/HackSysExtremeVulnerableDriver | Windows kernel exploitation |
| Exploit Education - Phoenix | https://github.com/ExploitEducation/Phoenix | Stack, heap, format strings |
| Exploit Education - Protostar | https://exploit.education/protostar/ | Classic Linux exploitation |
| ROP Emporium | https://ropemporium.com/ | ROP chain practice |
| pwnable.kr | https://pwnable.kr/ | Linux pwn challenges |
| pwnable.tw | https://pwnable.tw/ | Advanced Linux pwn |
| how2heap | https://github.com/shellphish/how2heap | Heap exploitation techniques |
| Damn Vulnerable Windows XP/7 | https://github.com/yourbackdoor/dvwxp | Legacy Windows exploitation |
| OverTheWire - Narnia | https://overthewire.org/wargames/narnia/ | Binary exploitation basics |
| Kernel-Exploits collection | https://github.com/bcoles/kernel-exploits | Linux kernel CVE exploits |
| Linux Kernel Exploitation | https://github.com/xairy/linux-kernel-exploitation | Kernel exploit resources |
| Windows Kernel Exploits | https://github.com/SecWiki/windows-kernel-exploits | Windows kernel CVEs |
| pawnyable | https://github.com/ptr-yudai/pawnyable | Kernel exploitation training |


**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

A comprehensive exploit development course covering x86, x64, and ARM architectures

Advanced Exploit Development

### Course Overview

This is a comprehensive, advanced-level Open Source Intelligence (OSINT) course designed for security professionals, investigators, intelligence analysts, journalists, and researchers who want to master the art and science of gathering, analyzing, and operationalizing publicly available information.

The course covers **10 modules** with **110+ lessons**, progressing from foundational methodology and investigative mindset through advanced automation and reporting. Each module includes hands-on exercises, real-world case studies, and production-ready Python tools.

---

### Prerequisites

- Intermediate understanding of networking (TCP/IP, DNS, HTTP)
- Basic Python programming knowledge
- Familiarity with Linux/Unix command line
- Understanding of web technologies (HTML, APIs, databases)
- Ethical mindset and respect for legal boundaries

---

### Recommended Reading

- **Open Source Intelligence Techniques** - Michael Bazzell
- **Hunting Cyber Criminals** - Vinny Troia
- **The Art of Intrusion** - Kevin Mitnick
- **Social Engineering: The Science of Human Hacking** - Christopher Hadnagy
- **Intelligence-Driven Incident Response** - Scott Roberts & Rebekah Brown
- **Structured Analytic Techniques for Intelligence Analysis** - Richards Heuer & Randolph Pherson

---

### Community Resources

- [OSINT Framework](https://osintframework.com/)
- [Bellingcat's Online Investigation Toolkit](https://docs.google.com/spreadsheets/d/18rtqh8EG2q1xBo2cLNyhIDuK9jrPGwYr9DI2UncoqJQ/)
- [SANS OSINT Summit](https://www.sans.org/cyber-security-summit/)
- [Trace Labs](https://www.tracelabs.org/)
- [The OSINT Curious Project](https://osintcurio.us/)


**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

From Methodology to Actionable Intelligence

Advanced OSINT Mastery

## Course Overview

This comprehensive course covers every aspect of post-exploitation operations used by professional penetration testers and red team operators. From initial situational awareness through advanced tradecraft, each module builds upon the previous to develop complete post-exploitation capability.

All techniques are presented in the context of **authorized penetration testing and red team engagements**. Every tool, technique, and procedure (TTP) maps to the MITRE ATT&CK framework where applicable.

---

## Prerequisites

- Solid understanding of networking (TCP/IP, DNS, HTTP/S)
- Familiarity with Windows and Linux operating systems
- Basic penetration testing experience (initial access/exploitation)
- Kali Linux installed and configured
- Lab environment (recommended: Active Directory lab with multiple hosts)
- Legal authorization for any testing activities

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

Complete Red Team & Penetration Testing Post-Exploitation Training

Advanced Post-Exploitation Mastery Course

**Course Description – Aerospace & Satellite Hacking**

Aerospace & Satellite Hacking is an entry-level course designed to provide a strong technical foundation in space systems, satellite communications, software defined radio (SDR), and aerospace security. The program is structured to guide students from core concepts to controlled laboratory environments, ensuring a clear understanding of both how satellite systems operate and how they can be analyzed and secured.

Students begin by learning the fundamentals of orbital mechanics, satellite types, communication architectures, ground station operations, and the space environment. These concepts establish the engineering basis required to understand real-world aerospace systems.

The course then introduces Software Defined Radio (SDR), covering hardware selection, signal capture, antenna theory, GNU Radio flowgraph development, and advanced signal analysis tools. Students gain hands-on experience capturing and analyzing RF signals, building a practical understanding of radio frequency systems.

In the signal intelligence module, learners study telemetry, modulation, demodulation, and decoding techniques. Practical exercises include weather satellite decoding, ADS-B and AIS signal analysis, beacon interpretation, and signal recording for forensic purposes. This phase strengthens analytical skills applied to real satellite transmissions.

The aerospace security section explores CubeSat architectures, embedded systems, firmware security, cryptography in space systems, and common vulnerabilities. Students learn how weaknesses can emerge in satellite and ground infrastructure and how secure software development practices mitigate risk.

In a strictly controlled lab environment, the course introduces RF attack theory, protocol analysis, telemetry spoofing simulation, jamming concepts, and defensive countermeasures. The focus is educational and defensive, ensuring students understand threats in order to build resilient systems.

The program concludes with an overview of the aerospace threat landscape, GNSS interference, space espionage case studies, international space law, and defensive spectrum monitoring. Students are introduced to both red team and blue team perspectives within aerospace environments.

By the end of the course, students will have a solid foundational understanding of:

* How satellite systems are designed and operate
* How RF signals are captured, analyzed, and decoded
* How SDR tools are used in real-world scenarios
* How vulnerabilities can affect aerospace systems
* How defensive strategies protect space infrastructure

This course prepares students for further specialization in satellite communications, RF engineering, space cybersecurity, or aerospace defense operations, building a structured foundation for advanced study and practical application.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

Advanced Space Systems, SDR Signal Intelligence and Aerospace Cybersecurity

Aerospace & Satellite Hacking

## Course Description

**AI Security Lab** is a hands-on course for learning how to assess the security of LLM applications and AI agents. Through 50 interactive challenges, you will explore prompt injection, jailbreaks, data leakage, RAG poisoning, unsafe tool use, authorization failures, multi-agent attacks, and guardrail evasion.

The lab provides a controlled environment with a simulated LLM, document uploads, retrieval workflows, tool calls, hints, and solution walkthroughs. Each challenge helps you recognize an attack path, test its impact, and understand the controls that can prevent it. The course is designed for security professionals and developers who want practical experience securing AI-powered systems


Exploiting Vulnerabilities in LLMs 

AI Offensive Security Lab

# AI Security Risk — Complete Professional Course

> A comprehensive, expert-level course on AI Security Risk for security professionals, AI practitioners, risk managers, compliance officers, and technology leaders.

## About This Course

The **AI Security Risk** course delivers 50 lessons across 5 modules, covering every critical dimension of AI risk — from understanding how LLMs work to implementing enterprise-grade governance programs, securing AI identity and access, and operating AI systems safely in production.

Written at the level of an experienced professor and security researcher, each lesson provides deep technical insights, real-world examples, and actionable guidance grounded in current industry frameworks and regulatory requirements.

## Course Structure

| Module                                                                                                     | Title                                                 | Lessons |
| ---------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------- |
| [Module 1](https://file+.vscode-resource.vscode-cdn.net/opt/Labs/AISecurityRisk/modules/module-1-index.md) | AI Fundamentals, LLMs and Modern Architectures        | 10      |
| [Module 2](https://file+.vscode-resource.vscode-cdn.net/opt/Labs/AISecurityRisk/modules/module-2-index.md) | AI Risk Management and Risk Taxonomy                  | 10      |
| [Module 3](https://file+.vscode-resource.vscode-cdn.net/opt/Labs/AISecurityRisk/modules/module-3-index.md) | Governance, Compliance and AI Management System       | 10      |
| [Module 4](https://file+.vscode-resource.vscode-cdn.net/opt/Labs/AISecurityRisk/modules/module-4-index.md) | Identity, Access and Security in AI Systems           | 10      |
| [Module 5](https://file+.vscode-resource.vscode-cdn.net/opt/Labs/AISecurityRisk/modules/module-5-index.md) | Controls, Evaluation, Monitoring and Secure Operation | 10      |


## Target Audience

* **Security Engineers & CISOs** — Understand AI-specific threat landscape and controls
* **AI/ML Engineers & Data Scientists** — Build secure AI systems by design
* **Risk Managers & Compliance Officers** — Navigate AI regulatory requirements
* **Enterprise Architects** — Design secure, governed AI architectures
* **Technology Leaders & CTOs** — Make informed decisions on AI risk

## Prerequisites

* Basic understanding of software systems and cybersecurity concepts
* Familiarity with enterprise IT environments
* No prior AI/ML experience required (Module 1 covers foundations)

## Frameworks and Standards Covered

* **NIST AI Risk Management Framework (AI RMF)**
* **ISO/IEC 42001** — AI Management System
* **ISO/IEC 23894** — AI Risk Management
* **EU AI Act** — Compliance and risk classification
* **OWASP LLM Top 10**
* **MITRE ATLAS** — Adversarial Threat Landscape for AI Systems
* **NIST SP 800-207** — Zero Trust Architecture
* **ISO 31000** — Risk Management
* **GDPR** — Privacy and accountability for AI

## Key Topics

* LLM architecture, transformers, RAG, fine-tuning, and agentic AI
* Hallucination, bias, toxicity, adversarial attacks, prompt injection
* Data poisoning, model theft, model inversion, membership inference
* AI governance program design, model inventory, AI impact assessment
* NIST AI RMF, ISO 42001, EU AI Act compliance
* Human and non-human identity, Zero Trust for AI, RBAC/ABAC
* Agent identity, secrets management, behavioral monitoring
* Guardrails, input/output filtering, AI evals, red teaming
* Model cards, system cards, risk registers, incident playbooks
* Secure LLM/RAG/agent production operations
  

A Complete Guide to Risk, Governance, Identity, and Secure Operations for LLMs, Agents, and Copilots

AI Security Risk: From Foundations to Secure Operations

# Security Champions Training Platform

## Transform Your Developers Into Security Champions

A hands-on training platform that teaches secure coding through real vulnerability exploitation and remediation — with gamification, team competition, and enterprise-grade tracking.

---

### What It Does

Security Champions provides interactive labs where developers:
- **Exploit** real vulnerabilities to understand attacker techniques
- **Remediate** insecure code using industry best practices
- **Earn points**, climb leaderboards, and unlock achievements
- **Compete** in CTF challenges and daily missions

### Key Features

- **55 Security Labs** across 8 categories — Web, API, LLM, Mobile, Cloud, Crypto, Server Hardening, and WAF
- **Multi-Language Support** — Practice fixes in Python, JavaScript, Go, PHP, Java, and C#
- **5 Difficulty Tiers** — From Beginner to Master, with scoring multipliers
- **Hybrid Validation** — Static analysis + AST parsing + LLM-powered code review with A–F security grading
- **Learning Paths & Tutorials** — Structured progression with progressive hints and quizzes
- **Teams & Organizations** — Group competition, role-based access, and assignment tracking
- **Enterprise Ready** — Audit logging, compliance reports, API keys, and multi-tenant orgs
- **Self-Hosted** — Single VM deployment via Docker Compose

### Vulnerability Coverage

| Category | Labs | Topics |
|----------|------|--------|
| Web | 13 | SQL Injection, XSS, XXE, SSTI, CSRF, Command Injection, File Upload, Path Traversal |
| API | 8 | BOLA, JWT Manipulation, Mass Assignment, SSRF, GraphQL, Insecure Deserialization |
| LLM | 7 | Prompt Injection, Output Handling, Data Exfiltration, Model DoS, Tool Abuse |
| Mobile | 6 | Insecure Storage, Code Tampering, Reverse Engineering, Insecure Auth & Communication |
| Cloud | 7 | S3 Misconfiguration, IAM Escalation, Container Escape, SSRF Metadata, Exposed Secrets |
| Crypto | 5 | Weak Hashing, ECB Mode, Padding Oracle, Broken RNG, Hardcoded Keys |
| Hardening | 6 | Nginx, Apache, TLS, CORS, Security Headers, Rate Limiting |
| WAF | 3 | SQLi Rules, XSS Rules, Advanced WAF Tuning |

### Gamification

- **7 Levels** — Script Kiddie, Apprentice, Journeyman, Specialist, Expert, Elite, Shadow Broker
- **Achievements & Badges** — Milestones, streak rewards, and hidden challenges
- **Daily Challenges** — Time-limited labs with 2x bonus multipliers
- **CTF Mode** — Time-boxed competitions with up to 1.5x scoring
- **Category Skills** — Specialized progression per vulnerability domain

### Enterprise Features

- **Organizations** — Multi-tenant support with scoped API keys (read/write/admin)
- **Assignments** — Assign labs and paths with deadlines and status tracking
- **Compliance Reports** — Track team coverage and training completion
- **Audit Logging** — Comprehensive action trails for security and compliance
- **Role-Based Access** — User, Manager, and Admin roles

### Why Security Champions?

- Learn by doing, not reading
- Safe environment to practice real attacks
- Instant AI-powered feedback with line-by-line code annotations
- Track individual and team progress across all categories
- From onboarding to advanced — one platform for every skill level


Train your team and develop a culture of safe development

Application Security Labs

## What This Course Is

This course is a systematic, technical guide to reverse engineering artificial intelligence models. You will learn
to take a machine learning system—whether accessed only through an API or available as a full open-source
checkpoint—and extract meaningful information about its architecture, training data fingerprints, decision
logic, failure modes, and internal representations.

Reverse engineering AI is not about breaking things. It is about understanding systems deeply enough to audit
them for safety, compliance, bias, and security vulnerabilities. It is about asking the question: "What is this
model actually doing?" and answering it rigorously.

---

## Who This Course Is For

- **Security Researchers** who need to audit AI systems for vulnerabilities, adversarial susceptibility, and
  unexpected behaviors before deployment.
- **ML Engineers** who want to understand models they did not build, reproduce results, or diagnose production
  failures.
- **AI Auditors and Compliance Officers** operating under GDPR, EU AI Act, or internal governance frameworks
  that require explainability and auditability.
- **Academic Researchers** studying model behavior, emergent capabilities, alignment, and interpretability.
- **Competitive Intelligence Analysts** (working within legal and ethical boundaries) who need to understand
  what capabilities competitor systems have.
- **Red Team Practitioners** testing AI-augmented products for adversarial robustness.

---

## Prerequisites

Before starting this course, you should have:

### Required Knowledge
- **Python**: Comfortable writing scripts, using classes, working with libraries. You don't need to be an
  expert, but you should be able to read and modify Python code confidently.
- **Basic Machine Learning**: You should understand what training and inference are, what a neural network is at
  a conceptual level, and have worked with at least one ML framework.
- **Linear Algebra Fundamentals**: Vectors, matrices, dot products. We will go deeper, but you need the basics.
- **Statistics**: Mean, variance, distributions, hypothesis testing at an introductory level.
- **Command Line**: Comfortable with bash, running scripts, managing virtual environments.

### Helpful But Not Required
- Prior experience with PyTorch or TensorFlow
- Familiarity with HuggingFace Transformers
- Background in traditional software reverse engineering
- Experience with Jupyter notebooks

---

## Course Structure: Five Modules

### Module 1: Foundations of AI Reverse Engineering
The first module establishes the conceptual and technical groundwork. You will learn what AI reverse engineering
is, why it matters, the legal and ethical frameworks that govern it, and the mathematical foundations needed to
understand what you are measuring. You will set up your lab environment and run your first reverse engineering
experiment on a real sentiment classification model.

Key skills gained: Environment setup, mental model of RE process, first black-box experiment, understanding
transformer and classical ML taxonomy, mathematical intuition for weights and representations.

### Module 2: Architecture Discovery and Model Fingerprinting
The second module focuses on the art and science of figuring out what kind of model you are dealing with when
you only have API access. You will learn timing analysis, output shape analysis, vocabulary probing, and
behavioral fingerprinting. You will be able to classify an unknown model as a transformer, RNN, tree-based
model, or other architecture with high confidence from behavioral signatures alone.

Key skills gained: Timing-based architecture inference, output distribution analysis, tokenization boundary
detection, vocabulary size estimation, architecture hypothesis generation.

### Module 3: Training Data Reconstruction and Privacy Analysis
The third module dives into one of the most consequential areas of AI RE: understanding what data a model was
trained on. You will learn membership inference attacks, data extraction techniques, training distribution
analysis, and how to detect personally identifiable information (PII) memorization in language models.

Key skills gained: Membership inference, verbatim memorization detection, training distribution estimation,
PII extraction analysis, copyright content detection.

### Module 4: Behavioral Analysis and Adversarial Testing
The fourth module covers systematic behavioral analysis, including boundary detection, adversarial example
generation, and failure mode mapping. You will learn how to create comprehensive test suites that reveal model
capabilities and limitations, how to craft adversarial inputs that cause systematic failures, and how to build
behavioral profiles that characterize what a model does and does not do.

Key skills gained: Systematic probing design, adversarial example generation, decision boundary mapping, bias
detection, robustness quantification.

### Module 5: Advanced Topics and Specialized Techniques
The fifth module covers cutting-edge and specialized topics: model stealing (replication), gradient-based
analysis of open-weight models, mechanistic interpretability, circuit analysis in transformers, and practical
RE of multimodal models. This module also covers how to write professional RE reports and how to coordinate
responsible disclosure.

Key skills gained: Model stealing attacks, mechanistic interpretability, circuit discovery, multimodal RE,
professional reporting, responsible disclosure process.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

A Comprehensive Hands-On Course for Security Researchers, ML Engineers, and AI Auditors

Artifical Intelligence Model Reverse Engineering

# Artificial Intelligence Architecture and Security - Introduction

## Course Overview

This course provides a comprehensive, hands-on journey through the architecture and security of modern AI systems — from foundational machine learning concepts to production-grade defensive controls. Designed for security professionals, architects, and engineers, it bridges the gap between understanding how AI works internally and knowing how to secure it at every layer.

## What You Will Learn

### Foundations of AI Engineering
- **Neural Networks & The Training Loop** — Understand how models learn through forward propagation, loss calculation, backpropagation, and gradient descent. Grasp the mechanics that power every modern AI system.
- **Embeddings & Vector Representations** — Learn how meaning is encoded as high-dimensional vectors, enabling semantic search, similarity matching, and the backbone of modern NLP pipelines.
- **Retrieval-Augmented Generation (RAG)** — Master the architecture pattern that grounds LLM outputs in real, retrievable data — reducing hallucinations and enabling domain-specific AI applications.

### AI Security Architecture
- **Model Alignment** — Explore RLHF, Constitutional AI, red-teaming, and guardrails that teach models how to behave — and where those controls can fail.
- **Reference Architecture for Secure Cloud AI** — Study production-grade blueprints for deploying AI systems securely in cloud environments, covering data pipelines, model serving, API gateways, identity, and network segmentation.
- **Defense in Depth** — Apply layered security controls across the full AI stack: input validation, prompt injection defenses, output filtering, model isolation, monitoring, and incident response.

### Practical Application
- **CAISA Exam Lab** — Solve a realistic AI architecture scenario end-to-end, applying every concept from the course to design and defend a production AI system.

## Who This Course Is For

- Security professionals expanding into AI/ML security
- Cloud and solution architects designing AI-powered systems
- Engineers building or operating LLM-based applications
- Anyone preparing for the CAISA (Certified AI Security Architect) certification


Master AI architecture, neural networks, embeddings, RAG, model alignment, and defense-in-depth security controls for cloud AI systems.

Artificial Intelligence Architecture and Security - Introduction

A comprehensive, hands-on curriculum covering the full spectrum of modern Artificial Intelligence — from mathematical foundations to production-grade agent systems and frontier research methods.

---

## Overview

This course was designed for engineers, researchers, and advanced practitioners who want to **deeply understand AI from first principles**, **build and train their own models**, and **develop production-ready AI systems**. It covers both the theoretical foundations and the practical engineering required to work at the frontier of AI.

---

## Who This Course Is For

| Profile | Starting Point | Value |
|---|---|---|
| **ML Engineer** moving into AI research | Module 2 or 3 | Research methodology, frontier techniques |
| **Software Engineer** entering AI | Module 1 | Full foundation from math to production |
| **Data Scientist** leveling up to LLMs | Module 3 | Fine-tuning, RAG, deployment, agents |
| **AI Researcher** broadening skills | Module 4 or 5 | Agent systems, algorithm improvement |
| **Technical Lead** designing AI systems | Module 4 | Architecture patterns, production engineering |

---

## Prerequisites

- **Python**: Proficiency with Python 3.10+ (NumPy, basic scripting)
- **Mathematics**: Comfort with linear algebra and probability (Module 1 provides a deep refresher)
- **Environment**: Access to a GPU (local or cloud) for training-focused modules
- **Curiosity**: A genuine interest in understanding how AI works, not just using it

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

From First Principles to Production: A Complete Guide to Modern AI Research and Engineering

Artificial Intelligence Research

**Course Description**

This course provides a deep and practical introduction to assembly language across modern architectures, with a strong focus on x86 and x64\. Students will learn how CPUs execute instructions, how registers, memory, and the stack work, and how high-level code translates into real machine behavior. The course emphasizes reading and reasoning about assembly rather than memorization, preparing students for reverse engineering, low-level security analysis, exploit understanding, and performance-aware debugging. By the end of the course, students will confidently analyze compiled binaries and understand software execution at the CPU level.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based. Paid content is to support the platform subscription and other operational costs.**

Learn assembly language in different architectures

Assembly Language x86/x64

🟡 CORE

## Description

The Certified Application Security Professional (CASP) exam is a rigorous 4-hour assessment designed to evaluate advanced knowledge and practical skills in modern application security. Candidates must achieve a minimum score of 80% to pass.

The exam combines Multiple Choice Questions (MCQ) covering secure SDLC, OWASP Top 10, cryptography, authentication, DevSecOps, cloud security, containers, and secure coding principles, along with a practical lab environment consisting of 10 real-world challenges.

The hands-on lab simulates vulnerable web applications where candidates must identify, exploit, and demonstrate understanding of vulnerabilities such as SQL Injection, XSS, SSRF, IDOR, JWT manipulation, command injection, path traversal, insecure deserialization, broken authentication, and broken access control 


Before starting the exam, all candidates must ensure that their full name is correctly updated in their profile at:  
<https://courses.redteamleaders.com/profile>

Failure to update profile information prior to the exam may affect certification issuance.

## **What the student should study before taking the exam:**

1. OWASP Top 10 (2021) and common web vulnerabilities
2. Secure SDLC concepts and threat modeling (STRIDE, DREAD)
3. Authentication, authorization, JWT and session security
4. Injection vulnerabilities (SQLi, Command Injection, Deserialization)
5. XSS (Stored, Reflected, DOM-based) and CSRF protections
6. SSRF, IDOR and Broken Access Control
7. Secure password storage (bcrypt, Argon2, salting)
8. HTTP security headers (CSP, HSTS, SameSite, X-Frame-Options)
9. Docker security basics and container hardening
10. DevSecOps fundamentals and Software Composition Analysis (SCA)

Comprehensive Application Security Skills Assessment

Certified Application Security Professional (CASP)

🟡 CORE

**CAIPJ – Certified AI Pentest Junior** is an entry-level, hands-on certification focused on **offensive security for LLM-powered applications**.

Instead of testing generic web hacking or traditional infrastructure, CAIPJ places you directly in front of a realistic **customer support platform powered by an LLM agent (“Nova”)**, wired into real backend tools: ticket search, shell diagnostics, refunds, database queries and runtime configuration.

Your mission is to think like a junior red teamer and:

* Abuse **LLM behavior** (prompt injection, jailbreaks, policy bypass).
* Misuse **LLM tools and actions** (ticket search, shell, SQL, refunds, KYC).
* Expose **business logic flaws** specific to AI-driven workflows (KYC, refunds, incident handling).
* Understand how **OWASP Top 10 for LLM Applications** applies in practice.

The lab environment is intentionally vulnerable, but looks and feels like a real SaaS customer support chat from a startup, not a traditional “CTF box”. There is no debugger, no step-by-step hints in the UI, and no obvious “solve” buttons. You are expected to:

* Discover and exploit **10 practical challenges** inspired by OWASP Top 10 for LLMs.
* Capture **10 static flags** in the format `RTL{MD5}`.
* Prove you understand how modern LLM applications can be attacked and how to reason about their attack surface.

The focus is **applied AI security**, not general AI theory: if you can think like an attacker around prompts, tools, and business workflows, you’re in the right place.

---

## Exam Format

* **Exam Mode:** Fully hands-on, remote, scenario-based.
* **Environment:**  
   * Web chat interface with a startup-style UI (OrbitSupport).  
   * LLM assistant “Nova” connected to backend tools.  
   * Backend intentionally mis-configured to expose realistic attack paths.
* **Challenges:** 10 labs mapped to common LLM risks (prompt injection, tool abuse, data poisoning, model DoS, etc.).
* **Flags:** 1 flag per lab (`RTL{32_HEX_MD5}`), static and verifiable.
* **Duration:** Up to **24 hours** from the moment you start the exam.
* **Style:** “Real product” behavior, not toy examples. You must explore, experiment and chain ideas.
* **Score:** 60%

---

## Self-Study Materials – Pentesting LLM Applications

The CAIPJ exam assumes you have basic understanding of web security and are now moving into **LLM-centric pentesting**. Below is a suggested self-study path and reference list.

### 1\. Core Concepts to Understand

Before you attempt CAIPJ, you should be comfortable with:

* **LLM fundamentals (just enough to hack):**  
   * How prompts are structured (system / user / tools).  
   * Temperature, context window, and why they matter for attacks.  
   * The concept of **tool calling / function calling / actions**.
* **LLM-specific attack surface:**  
   * **Prompt injection** (direct & indirect).  
   * **Jailbreaks / guardrail evasion**.  
   * **Data exfiltration via the model** (getting it to reveal secrets/system prompts).  
   * **Tool abuse**: convincing the model to misuse powerful backend functions.  
   * **Training / retrieval poisoning**: manipulating what the model will later “believe”.  
   * **Model-driven business logic abuse**: KYC decisions, refunds, ticket triage, etc.  
   * **LLM DoS patterns**: huge prompts, recursive instructions, adversarial content.

---

### 2\. Recommended Reading and References

You don’t need to read everything exhaustively, but these will give you a strong foundation:

#### LLM & AI Security

* OWASP: **Top 10 for LLM Applications**  
Understand the categories and typical examples. Focus on:  
   * Prompt Injection  
   * Insecure Output Handling  
   * Excessive Agency  
   * Data Exfiltration  
   * Supply Chain / Training Data Issues  
   * Overreliance on LLMs for critical decisions (e.g. KYC/refunds).
* Blog posts / papers on:  
   * **Prompt injection and jailbreaks** in real products.  
   * **Tool-calling vulnerabilities** (when LLMs can run code, call APIs, execute shell commands).  
   * **Retrieval-augmented generation (RAG)** and how poisoning the knowledge base affects outputs.
---

### 3\. Practical Self-Study Exercises

To prepare for CAIPJ, try the following exercises on your own labs or safe environments:

1. **Prompt Injection Playground:**  
   * Take any simple LLM chat system.  
   * Try to override its instructions (“ignore previous instructions”, “switch to debug mode”, etc.).  
   * See if you can get it to reveal system prompts or internal rules.
2. **Tool Abuse Simulation:**  
   * Build or use a demo that lets the LLM call:  
         * a fake “file read” tool,  
         * a fake “payment/refund” tool,  
         * a fake “SQL query” tool.  
   * Practice crafting prompts that make the model:  
         * read sensitive files,  
         * issue a refund without proper checks,  
         * run arbitrary SQL queries.
3. **Data Poisoning Experiment:**  
   * Create a “FAQ” or “knowledge base” that your LLM uses.  
   * Insert a malicious or misleading entry (e.g. “internal test code is X”).  
   * Ask a question that should trigger that specific entry and observe behavior.
4. **KYC / Business Logic Scenarios:**  
   * Model a very simple KYC process where the LLM writes a decision token.  
   * Try to convince the model to mark verification as “PASSED” without proper evidence.  
   * Think: what if the backend trusted that token blindly?
5. **DoS-Style Prompts:**  
   * Experiment with prompts that:  
         * are extremely long,  
         * contain many repeated tokens or recursive instructions.  
   * Observe how the system behaves (timeouts, rate limits, special error messages).

---

### 4\. How to Study Specifically for CAIPJ

To align your study directly with the CAIPJ environment:

* Practice:  
   * Asking the model to act as:  
         * internal security engineer,  
         * SRE on call,  
         * fraud / risk analyst,  
         * developer debugging production.  
   * Using that persona to justify access to tools or sensitive data.
* Think about:  
   * **“What tools might this bot have behind the scenes?”**  
   * **“How can I get it to call those tools on my behalf?”**  
   * **“What happens if the backend trusts the model too much?”**
* Keep notes for each scenario:  
   * Prompts you used.  
   * Tool calls you triggered.  
   * What worked / what failed.  
   * Where you see flags or internal identifiers.

Hands-on LLM Exploitation

Certified Artificial Intelligence PenTest Junior (CAIPJ)

🟢 ENTRY

## **Exam Description**

The **CAISR** certification validates that a professional can **design, assess, secure, monitor, and govern Artificial Intelligence systems** across their entire lifecycle — from data and model development to deployment, agent/tool interaction, logging, compliance, and operational defense.

Unlike traditional security certifications that focus only on infrastructure or application layers, CAISR focuses on the **unique security, privacy, and risk challenges introduced by AI, LLMs, RAG architectures, AI agents, and MLOps pipelines**.

This exam measures the candidate’s ability to:

* Understand AI-specific threat models and attack surfaces
* Design secure AI architectures with proper authorization and isolation
* Implement guardrails and monitoring for LLM and GenAI applications
* Secure RAG, vector databases, and AI agent tooling (MCP security)
* Protect AI pipelines from supply chain and data poisoning risks
* Apply international frameworks, standards, and regulations to AI systems
* Perform AI Red Team and AI Blue Team defensive activities
* Establish logging, auditability, and compliance practices for AI
* Implement secure MLOps and AI governance programs

CAISR validates **real-world, defensive, architectural, and governance competence in AI Security**.

## **Recommended Self-Study for Candidates**

Candidates are expected to study and be familiar with the following:

### Frameworks & Standards

* NIST AI Risk Management Framework (AI RMF)
* ISO/IEC 42001 (AI Management System)
* ISO/IEC 23894 (AI Risk Management)
* EU AI Act
* GDPR Article 22 and AI implications

### Security Guidance

* OWASP LLM Top 10
* OWASP GenAI Security
* OWASP AIMA (AI Model Attacks)
* MITRE ATLAS (Adversarial ML TTPs)

### Technical Topics

* RAG security and vector database risks
* Guardrails and input/output filtering
* Secure AI agent and MCP tool usage
* Model extraction, inversion, poisoning, evasion
* AI logging, auditability, and monitoring
* Secure MLOps and AI supply chain controls
* Differential privacy and membership inference
* AI threat modeling and defense-in-depth

Candidates are encouraged to complement theory with **hands-on experimentation** using AI applications, RAG setups, and agent-based systems to understand the practical security implications.

---

## **Exam Format**

* **Language:** English
* **Duration:** 4 hours
* **Total Questions:** 75  
   * 60 Multiple Choice (A–D)  
   * 15 Single-word Written Responses
* **Question Style:** Scenario-based, case-driven, security and risk oriented
* **Passing Score:** **75%**
* **Focus:** Defensive architecture, governance, and AI security maturity

Assessment of Security Architecture, Governance, Risk Management, and Defensive Practices Across the AI System Lifecycle


Certified Artificial Intelligence Security & Risk (CAISR)

# Certified Artificial Intelligence Security Architect (CAISA)

**Self-study certification. 8-hour practical exam.**

CAISA certifies engineers who can design AI systems that survive real attacks — prompt injection, tool abuse, privilege escalation and data exfiltration. It is a self-study track: you prepare at your own pace, then sit the exam when you are ready.

## The exam

The exam runs for **8 hours** and is built around a **practical architecture workspace**, not a multiple-choice form. You are given real production scenarios — enterprise chatbots, banking and fintech assistants, healthcare retrieval systems, autonomous agents, MCP integrations, multi-agent security operations, zero-trust AI platforms — and you have to architect the defenses for each one.

Every scenario carries a business brief: what the system does, which assets are sensitive, which threats apply, what constraints you are working under, and what your architecture must achieve.

## The practical part

You build each architecture yourself and submit it for evaluation.

The evaluator does not read prose. It analyzes your architecture as a graph: it checks required services, directed relationships, security configurations and policy ordering, and it actively hunts for **bypasses** — removing each mandatory barrier and testing whether traffic still reaches the protected asset. A defense that can be routed around does not count as a defense.

- **15 progressively complex labs**, Foundation through Advanced.
- **1,500 validation points per lab**, distributed across **16 security categories**.
- **22,500 points** maximum practical score.
- Full validation on a lab unlocks its **flag** and the next challenge.
- Hints are available at a permanent cost of **25**, **50** and **100** awarded points.
- A final report gives per-competency scores, every earned flag, and prints to PDF.

The workspace runs entirely on **localhost** — a single binary, offline, no external API, no model subscription, no build step. Your progress is stored locally.

## Scope

Threat evaluation is an **offline, deterministic analysis of architecture controls**. No model is invoked and no tool code executes. The exam measures whether you designed the correct defenses — it is not a penetration test of a deployed system, and it does not certify that any production system is secure.

## Preparation

Recommended self-study material before sitting the exam:

- [AI Security Risk: From Foundations to Secure Operations](https://courses.redteamleaders.com/courses/c9482773-c70f-44a3-8a3a-ad295c3dfde2)
- [Certified LLM Security Professional and Expert — Course Preparation](https://courses.redteamleaders.com/courses/76172b63-32cd-4e3b-aaf9-6d3bf005348a)


From Foundation to Advanced: prove you can architect AI systems that survive prompt injection, tool abuse and data exfiltration.

Certified Artificial Intelligence Security Architect (CAISA)

🟢 ENTRY

### Certification description

The **Certified C++ Practitioner Certification (CCPC)** is a **6-hour, multiple-choice exam** that validates a professional’s ability to design, implement and maintain software in **modern C++ (C++11 and later)**.

The exam focuses on **real-world C++ practice**, including RAII, smart pointers, standard containers and algorithms, error handling, concurrency, time utilities and filesystem usage. Instead of testing obscure corner cases or trivia, CCPC emphasizes **practical decision-making**: choosing the right abstractions, avoiding undefined behavior and applying the standard library correctly in typical development scenarios.

---

### Purpose

CCPC aims to certify that the candidate can:

* Use **modern C++ idioms**:  
   * RAII, `std::unique_ptr` / `std::shared_ptr`, `std::array`, `std::vector`, `std::string`, etc.  
   * Safer types such as `std::optional`, `std::string_view`, `std::span`, `std::byte`.
* Apply **good coding practices**:  
   * Avoid buffer overflows, dangling pointers, data races, resource leaks and other forms of undefined behavior.  
   * Prefer standard facilities (`std::chrono`, `std::filesystem`, `std::thread`, standard algorithms) over ad-hoc or unsafe solutions.
* Read and reason about **existing C++ code**, identifying issues and knowing how to improve it with modern patterns.
* Write code that is **readable, maintainable and aligned with industry expectations** for professional C++ developers.

---

### Exam format

* **Total duration:** up to **6 hours**
* **Question type:** **multiple-choice questions only**
* **Scope:** conceptual understanding + practical reasoning on realistic code snippets

### Score

70% minimum


Professional certification in modern C++ programming, focused on robust, maintainable code and practical industry skills.

Certified C++ Practitioner Professional (CCPP)

### About the Certification

The **Certified Client/Browser Exploitation Analyst (CCBE)** is a hands-on, performance-based security certification that validates a practitioner's ability to analyze, instrument, and exploit vulnerabilities in modern client-side web applications using browser-native tooling.

Unlike traditional web security certifications that rely on server-side exploitation and proxy-based interception tools (Burp Suite, ZAP), the CCBE demands that candidates demonstrate deep understanding of **browser internals, JavaScript runtime behavior, and client-server trust boundaries** — all through the construction of a **purpose-built Manifest V3 browser extension**.

The CCBE is the first and only certification that bridges the gap between offensive security and browser engineering, requiring candidates not just to find vulnerabilities, but to **build the tools that prove them**.

---

### What the Exam Covers

The CCBE exam is built around **NexusBoard**, a realistic corporate management portal — a single-page React application with interconnected features, intentionally designed with 10 client-side vulnerabilities spanning 6 security domains:

| Domain | Weight | Challenges |
|--------|--------|------------|
| **Authentication & Authorization** | 20% | Client-state auth bypass, privilege escalation via claims manipulation |
| **Client-Side Cryptography & Integrity** | 20% | Pre-encryption data interception, parameter tampering before signature |
| **Browser API Security** | 20% | Service Worker request rewriting abuse, WebSocket message manipulation |
| **Client-Side Protection Mechanisms** | 10% | Anti-debug / anti-tamper control bypass |
| **Client-Side Business Logic** | 10% | Feature flag discovery, business logic abuse |
| **Information Disclosure & Code Analysis** | 10% | Operational secret exposure in client code |
| **Extension Engineering** | — | Assessed holistically across all challenges |
| **Technical Reporting** | — | Assessed holistically across all findings |

**The 10 Technical Challenges:**

| # | Challenge | Core Skill Tested |
|---|-----------|-------------------|
| C1 | Client-State Authentication Bypass | JavaScript state manipulation and auth boundary analysis |
| C2 | Privilege Escalation via Claims Manipulation | Browser storage instrumentation and authorization flow analysis |
| C3 | Pre-Encryption Data Interception | WebCrypto API hooking and memory-level data observation |
| C4 | Parameter Tampering Before Signature | Fetch/XHR interception and integrity mechanism reverse engineering |
| C5 | Service Worker Request Rewriting Abuse | Service Worker lifecycle analysis and cache manipulation |
| C6 | Anti-Debug / Anti-Tamper Control Bypass | Minified code analysis and runtime detection neutralization |
| C7 | Hidden Feature Discovery via Feature Flags | Bundle static analysis and feature enumeration |
| C8 | Client-Side Business Logic Abuse | Business rule analysis and workflow parameter correlation |
| C9 | WebSocket / Event Stream Manipulation | Real-time protocol analysis and message crafting |
| C10 | Operational Secret Exposure in Client Code | Frontend code reverse engineering and secret detection |

Challenges are **interconnected** — discoveries in one challenge may provide shortcuts or prerequisites for others. This reflects real-world application security assessment, not isolated CTF puzzles.

---

### Exam Format

| Attribute | Specification |
|-----------|---------------|
| **Type** | Hands-on, practical, individual |
| **Duration** | **24 hours** (continuous single session) |
| **Delivery** | Remote proctored or on-site at authorized testing centers |
| **Environment** | Isolated lab instance running NexusBoard (provided via Docker or cloud VM) |
| **Tooling Allowed** | Clean Chromium-based browser, text editor, terminal |
| **Internet Access** | Documentation only (MDN, Chrome Extension docs, language references) |
| **Prohibited Tools** | Burp Suite, ZAP, Nikto, pre-built exploitation frameworks, AI assistants |

### What Makes CCBE Different

| Dimension | Traditional Certs | CCBE |
|-----------|-------------------|------|
| **Focus** | Server-side vulnerabilities | Client-side browser security |
| **Tooling** | Use existing tools (Burp, ZAP) | Build your own extension |
| **JavaScript Analysis** | Minimal to none | Core requirement (minified bundles) |
| **Browser APIs** | Not tested | WebCrypto, Service Workers, WebSockets, MV3 |
| **Modern SPA Testing** | Limited | Deep (React, Zustand, feature flags) |
| **Evaluation Model** | Find + Report | Find + Build + Prove + Explain + Remediate |
| **Deliverables** | Report only | Extension + Report + Evidence |


## Course

Web Browser Hacking:
https://courses.redteamleaders.com/courses/e79d5f5c-181d-4a90-bedd-58d3320eabf3

Create your own vulnerability exploitation extension

Certified Client Browser Exploitation (CCBE)

# CCSJP — Certified Cybersecurity Junior Professional

## Certification Overview

The **Certified Cybersecurity Junior Professional (CCSJP)** is a vendor-neutral, entry-level cybersecurity certification designed to validate the foundational knowledge and hands-on skills required to operate effectively in a modern Security Operations Center (SOC), incident response team, or junior blue/red team role.

Unlike theory-heavy entry-level certifications, CCSJP combines rigorous conceptual testing with **real-world practical challenges** that mirror the day-to-day tasks of a junior security analyst — log triage, SIEM investigation, EDR telemetry analysis, IAM auditing, network forensics, incident response, cloud misconfiguration hunting, malware triage, threat intelligence correlation, and reconnaissance analysis.

---

## Exam Details

| Property | Value |
|----------|-------|
| **Exam Code** | CCSJP-001 |
| **Format** | Online |
| **Total Questions** | 250 |
| **Theoretical Questions** | 150 (multiple-choice + short free-text) |
| **Practical Challenges** | 100 (hands-on with downloadable artifacts) |
| **Duration** | **8 hours** (480 minutes) |
| **Passing Score** | **75%** (188 of 250) |
| **Language** | English |
| **Prerequisites** | None (experience recommended) |
| **Delivery** | Browser-based with local Go artifact binaries |

---

## Who Should Take This Exam

This certification is intended for:

- **SOC Analyst (Tier 1/2) candidates** seeking to validate foundational skills
- **Junior Incident Responders** joining a CSIRT or IR consulting team
- **IT Professionals transitioning** into a cybersecurity role
- **Computer Science / Information Security students** preparing for their first security job
- **Junior Blue Team members** (threat hunters, detection engineers, SIEM analysts)
- **Entry-level Red Team / Pentest** professionals needing baseline blue-team context
- **Cloud engineers** adding security posture assessment to their skill set
- **Help Desk / System Admins** pivoting to cybersecurity

**Recommended background:** 6 months of hands-on IT student or experience OR completion of a foundational cybersecurity training program.

---

## Exam Objectives — Domains &amp; Weights

The CCSJP exam tests 15 knowledge domains derived from real-world junior analyst competencies:

| Domain | Weight | Topics |
|--------|--------|--------|
| **Networking Fundamentals** | 12% | TCP/IP, DNS, DHCP, ARP, routing, common protocols/ports, packet analysis, network attacks |
| **SIEM Operations** | 11% | Splunk (SPL), Microsoft Sentinel (KQL), QRadar (AQL), correlation rules, alert triage, log normalization |
| **Windows &amp; Linux CLI** | 10% | PowerShell, cmd, bash, system administration, process/service management, forensic commands |
| **Incident Response** | 9% | NIST SP 800-61, IR lifecycle, evidence handling, chain of custody, memory forensics, disk imaging |
| **Firewalls / IDS / IPS** | 9% | Stateful firewalls, NGFW, Snort/Suricata rules, evasion techniques, WAF, network segmentation |
| **Log Analysis** | 8% | Apache/Nginx, Windows Event Logs, syslog, CEF/LEEF, attack pattern recognition, log tampering |
| **Cloud Security** | 8% | AWS/Azure/GCP shared responsibility, IAM policies, S3/Storage, CloudTrail, misconfigurations |
| **Vulnerability Assessment** | 7% | CVSS, CVE analysis, scan prioritization, credentialed vs. uncredentialed scans, remediation |
| **Security Frameworks** | 6% | NIST CSF, ISO 27001, NIST SP 800-53/171, CIS Controls, PDCA, ISMS |
| **Scripting** | 5% | Python, Bash, PowerShell — parsing logs, automating tasks, common security libraries (scapy, etc.) |
| **Active Directory / IAM** | 5% | Kerberos, NTLM, Golden/Silver Ticket, DCSync, Pass-the-Hash, Azure AD/Entra ID, conditional access |
| **EDR / Endpoint Security** | 4% | Process telemetry, behavioral detection, LSASS protection, process injection, masquerading |
| **MITRE ATT&amp;CK** | 3% | Tactics, techniques, sub-techniques, Navigator, threat emulation mapping |
| **Threat Intelligence / IOCs** | 2% | TLP, STIX/TAXII, Diamond Model, strategic/tactical/operational intel, IOC quality |
| **Cryptography** | 1% | Symmetric/asymmetric encryption, TLS, certificates, hash algorithms, PFS, common weaknesses |

---

## Recommended Study Path

### Primary Training — Red Team Leaders

We strongly recommend preparing for the CCSJP exam by completing the training courses available at:

**https://courses.redteamleaders.com/**

The Red Team Leaders platform offers structured, hands-on courses that directly map to the CCSJP exam domains. Candidates who complete the recommended learning path typically achieve a **significantly higher first-attempt pass rate**.

**Recommended courses for CCSJP preparation:**

1. **Blue Team Fundamentals** — SOC operations, log analysis, SIEM basics, incident detection
2. **Incident Response Essentials** — IR lifecycle, evidence handling, timeline reconstruction, containment strategies
3. **Network Security &amp; Packet Analysis** — TCP/IP deep dive, Wireshark, intrusion detection, firewall configuration
4. **Windows &amp; Linux Forensics** — Event logs, registry analysis, memory forensics, Linux artifacts
5. **Cloud Security Foundations** — AWS/Azure/GCP security posture, IAM, CloudTrail, common misconfigurations
6. **Active Directory Security** — Kerberos, NTLM, attack paths, Mimikatz defense
7. **Introduction to Penetration Testing** — Reconnaissance, Nmap, vulnerability scanning, CVE analysis
8. **Malware Analysis Basics** — Static analysis, sandbox interpretation, IOC extraction
9. **Threat Intelligence &amp; MITRE ATT&amp;CK** — TTP mapping, IOC feeds, threat actor profiling
10. **Cryptography for Security Professionals** — TLS, PKI, hashing, common weaknesses

Each course at Red Team Leaders includes **lab exercises, real-world scenarios, and mentorship** that reinforce the practical skills measured by the CCSJP practical section.

### Additional Study Resources

- **NIST Special Publications:** SP 800-61 (Incident Handling), SP 800-53 (Security Controls), SP 800-171 (CUI)
- **MITRE ATT&amp;CK Framework:** https://attack.mitre.org/ — study tactics, techniques, and Navigator
- **CIS Controls v8:** Implementation Groups and prioritized controls
- **Vendor Documentation:** Splunk SPL reference, Microsoft KQL reference, Snort/Suricata rule syntax
- **Hands-on labs:** Build a home lab with Windows AD, Linux servers, and a SIEM (Splunk Free, Elastic, or Wazuh)
- **Capture The Flag (CTF):** Practice log analysis and forensic challenges on TryHackMe, HackTheBox, CyberDefenders

---

## Technical Requirements for Exam Day

- **Workstation:** Modern laptop or desktop (Windows 10+, macOS 11+, Ubuntu 20.04+, or equivalent)
- **Architecture:** x86 (32-bit) or x64 (64-bit) supported
- **Browser:** Chrome, Firefox, Edge, or Safari (latest stable version)
- **Permissions:** Ability to execute local binaries (artifacts are unsigned Go executables)


The Practical Entry Point to a Career in Cyber Security

Certified Cyber Security Junior Practitioner (CCSJP)

# **FREE 1 ATTEMPT: USE COUPON CCEP100OFF

🟢 ENTRY

The **Certified Cybersecurity Educator Professional (CCEP)** certification validates both the **technical expertise** and **instructional capability** of cybersecurity professionals who train, mentor, and lead others in the field.

This exam demonstrates mastery across the core domains of cybersecurity, including **Fundamentals & Network Security, Information Security Architecture, Identity and Access Management (IAM), Offensive Security, Cloud Security, Security Operations, Application Security,** and **Incident Response**.

The **CCEP** exam consists of **80 questions** rigorous style of industry-recognized certifications. Each question is structured to test deep understanding rather than memorization, with carefully randomized and balanced answer options.

**Who should take this exam:**  
Cybersecurity educators, technical leaders, analysts, architects, Red/Blue Team professionals, and corporate trainers who need to both **apply and teach** complex cybersecurity concepts effectively.

**What certification holders demonstrate:**

* Proficiency in designing secure architectures and implementing effective controls (on-premises and cloud).
* Capability to lead security operations and incident response.
* Skill in evaluating risk, mitigating threats, and aligning technical findings with business impact.
* Strong communication and teaching abilities to translate advanced cybersecurity topics into actionable knowledge.

**Pass Score**

* Required Grade 80% 

**Duration**

* 2 Hours

The Global Standard for Cybersecurity Education and Expertise

Certified Cybersecurity Educator Professional (CCEP)

🟢 ENTRY

# Certified Encryption and Cryptography Beginners (CECB)

This is a simple, beginner-friendly exam designed to check your understanding of basic encryption and cryptography concepts. You’ll answer 40 multiple-choice questions. Only one option is correct per question. And answer 10 practical questions with challenges involving cryptography and encryption.

The exam will take approximately 10 hours to complete the challenges.

Use the programming language you feel most comfortable with and be sure to use capital and lowercase letters correctly.

If you encounter any problems during the exam, please send a screenshot through support.

You need to get 80% to pass the exam!

***Does the exam have a course to help? Not at the moment, but it's under development!***

## Self Study

<https://github.com/sobolevn/awesome-cryptography>
<https://crypto101.io/>  
<https://www.crypto101.io/Crypto101.pdf>  
<https://www.coursera.org/learn/crypto>  
<https://crypto.stanford.edu/~dabo/courses/OnlineCrypto/>  
<https://toc.cryptobook.us/>   
<https://joyofcryptography.com/pdf/book.pdf>  
<https://cryptobook.nakov.com/>  
<https://www.khanacademy.org/computing/computer-science/cryptography>  
<https://cryptopals.com/>  
<https://cryptohack.org/challenges/>  
<https://overthewire.org/wargames/krypton/>  
<https://tryhackme.com/module/cryptography>  
<https://tryhackme.com/room/cryptographybasics>  
<https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-authentication-bypass-via-encryption-oracle>  
<https://picoctf.org/resources.html>  
<https://picoctf.org/learning%5Fguides/Book-2-Cryptography.pdf>

Beginner-friendly assessment of foundational encryption and cryptography concepts

Certified Encryption and Cryptography Beginners (CECB)

🟡 CORE

### What CEDS is

The **Certified Exploit Development Specialist (CEDS)** is a hands-on, lab-driven certification that validates your ability to go from **binary analysis** to **reliable code execution** on hardened Windows user-mode targets. 

### What you’ll be able to do after CEDS

CEDS focuses on advanced, real-world exploit development behaviors, including:

* **Reverse engineering** a service to understand data flow, trust boundaries, and vulnerable logic
* Converting crashes into **controlled execution** (proof of instruction pointer control and stability)
* Writing **custom assembly shellcode** under constraints (bad chars, size limits, staging)
* Building **ROP chains** to bypass common mitigations (DEP/NX, ASLR realities, “no easy stack execution”)
* Producing a professional-grade **exploit report**: reproducible steps, evidence, and clean Python PoCs

### Who it’s for

* Security engineers moving from pentesting into **vulnerability research/exploit development**
* Red teamers who want deeper understanding of mitigations and exploit reliability
* Professionals preparing for exploit-focused certifications such as **OSED** and **CORELAN** 

### Exam model (high level, no spoilers)

* You receive **4 Windows user-mode service targets**.
* 96 Hours Duration
* You must fully solve **any 2 targets** to pass.
* Each solved target requires:  
   * Root-cause analysis (RE evidence)  
   * Mitigation analysis and bypass strategy  
   * Working, reproducible **Python PoC**  
   * Your **custom shellcode** performing a benign “proof” action (file write with your unique token)
* Final deliverable is a **full English report** with step-by-step reproduction and source code.

## How to prepare for CEDS

A practical prep path that won’t rely on “recipe exploitation”:

1. **Windows debugging fluency** (WinDbg/x64dbg): breakpoints, stack/register inspection, memory maps
2. **Reverse engineering reps**: identify parsing, copy operations, unsafe formatting, and control-flow decisions
3. **Memory corruption fundamentals**: offsets, bad-char strategy, reliable triggering
4. **Mitigation mindset**: always ask “what stops execution?” then design the bypass
5. **Shellcode discipline**: small, position-independent, constraint-aware proof payloads
6. **Write your report as you go**: screenshots, addresses, reasoning, and failure modes

---

## Recommended training

1. **OffSec EXP-301 (OSED track) – Paid**  
The closest “industry benchmark” for Windows user-mode exploit dev: RE, shellcode, and modern mitigation bypass. [OffSec](https://www.offsec.com/courses/exp-301)
2. **Corelan Exploit Development Training – Paid**  
Highly practical training path around Windows exploitation concepts and real mitigations (Corelan is a long-standing reference in the space). [corelan-training.com](https://www.corelan-training.com)
3. **RPISEC – Modern Binary Exploitation (MBE) – Free (GitHub course materials)**  
Excellent structured foundations for exploitation thinking and debugging workflows; great for building problem-solving muscle. [GitHub](https://github.com/RPISEC/MBE)
4. **OpenSecurityTraining2 – Free courses (Debugging/Exploitation tracks)**  
Strong for stepping up your debugging depth and exploitation methodology through rigorous course-style material. [p.ost2.fyi](https://p.ost2.fyi/courses)
5. **FuzzySecurity – Windows Exploit Development Tutorial Series – Free**  
Classic, stepwise learning path across Windows exploit development topics (great as supplementary practice and reference). [fuzzysecurity.com](https://fuzzysecurity.com/tutorials.html)

Advanced Windows User-Mode Exploit Engineering & Mitigation Bypass

Certified Exploit Development Specialist (CEDS)

🟡 CORE

## Certification Description

### **Certified Game Hacking Engineer (CGHE) v1**

The **Certified Game Hacking Engineer (CGHE) v1** is a **120-hour, hands-on practical certification exam** designed to validate advanced skills in **game hacking, reverse engineering, and offensive memory analysis** using an open-source first-person shooter.

This certification challenges candidates to analyze real game binaries, identify memory structures, reverse internal logic, and develop fully functional offensive tooling in a **controlled, offline, and ethical environment**. All practical tasks are performed against **AssaultCube in offline mode with bots**, ensuring legality and academic integrity.

---

## What CGHE v1 Validates

During the exam, candidates are expected to demonstrate hands-on proficiency in:

* Memory scanning and pointer analysis using Cheat Engine
* Reverse engineering game logic with debuggers and disassemblers
* Understanding player entities, physics, and weapon systems
* Developing cheats such as aimbots, wallhacks, speed hacks, and trainers
* Building a complete mod menu or trainer using C/C++ and GUI libraries
* Translating reverse engineering findings into reliable offensive tools

CGHE v1 focuses on **how cheats are engineered**, not on their misuse, providing deep insight into **offensive development techniques and game security weaknesses**.

---

## Exam Format

* **Total workload:** 120 hours
* **Exam type:** 100% practical, hands-on
* **Target game:** AssaultCube
* **Mode:** Offline (bots only)
* **Platform:** Windows or Linux
* **Passing requirement:** Successfully complete **at least 3 out of 5 technical challenges** and deliver a working trainer or mod menu

Candidates must submit a detailed technical report documenting methodology, findings, and implementation decisions.

---

## Skills Demonstrated

By earning the **CGHE v1**, candidates prove their ability to:

* Perform professional-grade memory analysis
* Reverse engineer real-world software targets
* Identify and exploit logical weaknesses in game engines
* Develop custom offensive tooling from scratch
* Understand modern cheat architecture and design
* Apply ethical hacking principles to non-traditional attack surfaces

---

## Target Audience

CGHE v1 is intended for:

* Reverse engineers
* Offensive security professionals
* Red Team operators
* Malware analysts
* Low-level software developers
* Security researchers studying game security and anti-cheat systems

Solid knowledge of **C/C++**, **assembly fundamentals**, and **debugging techniques** is strongly recommended.

---

## Ethical Scope

All activities are conducted in an **offline, open-source, and educational environment**.  
The techniques covered in this certification **must not be applied to online or competitive games**.

## Courses

Fundamentals of Game Hacking Development - https://courses.redteamleaders.com/courses/c0f369dc-356d-4362-8942-b5446e02164b

Practical Game Hacking, Reverse Engineering and Trainer Development

Certified Game Hacking Engineer (CGHE)

## Overview

The **Certified GRC Professional (CGRCP)** is a professional certification designed to validate foundational to intermediate knowledge in **Governance, Risk, and Compliance (GRC)**. This certification demonstrates that a candidate possesses the competencies required to support and contribute to an organization's integrated GRC program.

The CGRCA bridges the gap between theoretical frameworks and practical application, ensuring certified professionals can identify risks, support compliance initiatives, contribute to governance structures, and leverage technology to enhance GRC operations.

---

## Exam Details

| Parameter | Details |
|---|---|
| **Number of Questions** | 100 |
| **Question Types** | Multiple-choice (75) and Free-text short answer (25) |
| **Time Limit** | 4 hours (240 minutes) |
| **Passing Score** | 70% (70 out of 100 questions) |
| **Language** | English |
| **Delivery Format** | Online proctored or authorized testing center |
| **Prerequisites** | None required; 1–2 years of GRC-related experience recommended |
| **Exam Fee** | Refer to the official certification portal |
| **Results** | Provided immediately upon completion |

---

## Exam Objectives & Domains

The CGRCA exam is organized into **seven domains**, each representing a critical area of GRC knowledge. Questions are distributed across these domains according to the weights below.

### Domain Weights Summary

| Domain | Weight | Questions (approx.) |
|---|---|---|
| 1. GRC Foundations & Frameworks | 15% | 15 |
| 2. Governance & Corporate Oversight | 12% | 12 |
| 3. Risk Management | 18% | 18 |
| 4. Compliance Management | 15% | 15 |
| 5. Information Security & Privacy GRC | 15% | 15 |
| 6. Audit & Assurance | 12% | 12 |
| 7. Technology & GRC Tools | 13% | 13 |
| **Total** | **100%** | **100** |

### Recommended Resources

- COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017)
- ISO 31000:2018 — Risk Management Guidelines
- NIST Cybersecurity Framework (CSF) 2.0
- IIA Standards and Practice Advisories
- OCEG GRC Capability Model (Red Book)
- Relevant regulatory texts (GDPR, SOX Section 302/404, HIPAA Privacy Rule)
- Industry publications from ISACA, IIA, and OCEG

Governance, Risk, and Compliance Foundations for Modern Organizations

Certified GRC Professional (CGRCP)

🟡 CORE

## Description

The **Certified Human Risk Management Practitioner (CHRMP)** is an advanced professional certification designed for security leaders, risk professionals, awareness managers, and governance specialists who are responsible for transforming human behavior into a measurable, manageable component of organizational cybersecurity.

Unlike traditional security certifications that focus on tools, technologies, or compliance frameworks, CHRMP focuses on the **human layer of security** — where phishing, credential misuse, shadow IT, policy bypass, and cultural gaps create the largest and most underestimated attack surface in modern enterprises.

This certification validates your ability to design, implement, and measure a **complete Human Risk Management program** using practical governance structures, KPI dashboards, risk registers, incident reporting flows, RACI ownership models, role-based training maps, control adoption strategies, maturity assessments, and stakeholder communication plans.

---

### What CHRMP Proves You Can Do

A certified CHRMP practitioner demonstrates the ability to:

* Build and maintain a **Human Risk Register**
* Design meaningful **security KPIs** that measure behavior, not compliance
* Create and execute a **90-Day Human Risk Roadmap**
* Implement an effective **Incident Reporting Flow**
* Develop and operationalize **Response Playbooks**
* Apply **RACI and ownership governance** to security initiatives
* Create **role-based training maps** that change behavior
* Lead **control adoption plans** that balance usability and security
* Conduct **maturity assessments** for security culture and processes
* Communicate human risk posture to executives and stakeholders in business terms

---

### Exam Format

* **Duration:** 8 hours
* **Total Questions:** 60 scenario-based questions + 10 practical validation flags
* **Question Types:**  
   * Multiple choice (governance, decision-making, KPIs, risk evaluation)  
   * Free-text conceptual questions (RACI, incident response terms, risk concepts)  
   * Practical validation questions requiring completion of platform modules
* **Passing Criteria:**  80%

---

### Who This Certification Is For

* Security Awareness Leaders
* GRC Professionals
* CISOs and Security Managers
* Risk Analysts
* Security Culture and Behavior Specialists
* Incident Response and Governance Teams

Mastering the Measurement, Governance, and Reduction of Human-Centric Cyber Risk in Modern Organizations

Certified Human Risk Management Practitioner (CHRMP)

# ALERT: Before taking the exam, update your name so that your certificate is generated correctly. Access the link below.

https://courses.redteamleaders.com/profile

# FREE EXAM USE COUPON: STOPHUMANTRAFFICKING

## **Certified Human Trafficking Awareness Professional (CHTAP)**  
_Empowering Awareness, Strengthening Prevention, Protecting Communities._

The Certified Human Trafficking Awareness Professional (CHTAP) is a comprehensive awareness-based certification designed to equip professionals, organizations, and community leaders with the knowledge necessary to recognize, prevent, and respond to human trafficking.

This certification goes beyond traditional testing formats. The CHTAP exam is structured as an awareness-guided assessment, combining educational content with scenario-based questions that reinforce critical thinking and ethical responsibility. Participants develop a deep understanding of human trafficking definitions under international law, global statistics, recruitment tactics, vulnerability factors, online exploitation risks, and key differences between trafficking and smuggling.

The program also emphasizes practical awareness skills, including identifying behavioral and environmental red flags, understanding subtle victim signaling, applying trauma-informed response principles, and knowing how to report concerns safely and responsibly. Candidates will also explore the role of businesses, healthcare providers, educators, and community organizations in prevention and long-term impact reduction.

Designed for corporate environments, NGOs, educational institutions, compliance teams, and community advocates, CHTAP promotes a survivor-centered, ethical, and prevention-focused approach.

By earning the CHTAP credential, professionals demonstrate their commitment to awareness, social responsibility, and proactive community protection.

You don't need to study anything; the exam contains all the necessary material to help you answer the questions.

## About Exam

Required Pass: 60%

Duration: 2 Hours

Building Awareness. Strengthening Prevention. Protecting Lives.

Certified Human Trafficking Awareness Professional (CHTAP)

🟢 ENTRY

# Exam Description

The **Certified Linux Fundamentals Practitioner (CLFP)** exam is designed to validate a candidate’s understanding of essential Linux concepts and practical command-line skills. This exam combines theoretical knowledge with hands-on tasks, allowing students to demonstrate that they can understand, navigate, and operate within a Linux environment.

The exam contains **100 questions** divided into multiple sections covering the most important Linux fundamentals. Students will be tested on the Linux filesystem hierarchy, file permissions, essential commands, operating system and kernel concepts, Linux networking, Linux security, and practical terminal-based challenges.

The practical portion of the exam uses a simulated Linux terminal environment. Students will complete hands-on challenges, execute commands, inspect files, solve tasks, and submit flags in the required format. This allows students to prove real operational ability without needing to install Linux on their own machine.

## What the Exam Covers

The **CLFP** exam includes the following areas:

- Linux filesystem structure and important directories
- File and directory permissions
- Ownership, groups, and permission modes
- Essential Linux commands
- Text processing and file manipulation
- Linux kernel and operating system concepts
- Processes, shells, and system information
- Basic Linux networking
- SSH, DNS, IP addressing, and connectivity tools
- Linux security fundamentals
- Practical command-line challenges

## Exam Format

| Item | Details |
|---|---|
| **Total questions** | 100 |
| **Question types** | Multiple choice, free text, and hands-on practical challenges |
| **Practical environment** | Simulated Linux terminal |
| **Practical answers** | Flag submission format |
| **Linux installation required** | No |
| **Internet required after download** | No |
| **Recommended for** | Beginners, students, junior IT professionals, cybersecurity learners, help desk technicians, and anyone starting with Linux |

Validate your hands-on Linux fundamentals through practical command-line challenges and core system knowledge

Certified Linux Fundamentals Practitioner (CLFP)

# Certified LLM Security Expert (CLLMSE)

## 100% OFF Coupons: AIEXPERTSECURITY

**Prove you can secure AI before someone proves you can't.**

---

## The problem

Every company is shipping LLM features and AI agents right now. Almost
none of the people building them have ever been tested on whether they
can actually secure one. Certifications built for traditional AppSec
don't cover prompt injection, agent supply-chain attacks, or MCP trust
boundaries. CLLMSE does.

## What makes it different

Most AI security "certifications" are a multiple-choice quiz you can
pass by memorizing a blog post. CLLMSE isn't. You don't just answer
questions about prompt injection — you exploit it yourself in a live
lab, then prove your fix actually blocks the attack, and only then get
credit. If you can't defend it hands-on, you don't pass.

---

## What you're tested on

- **LLM Attacks & Adversarial Techniques** — prompt injection, jailbreak families (DAN, Crescendo, Skeleton Key, many-shot, PAIR, adversarial suffixes, token smuggling), model extraction, membership inference, model inversion, sponge/DoS.
- **OWASP Top 10 for LLM Applications (2025) & Red Teaming** — every LLM01-LLM10 category against a real incident scenario, plus how to run an AI red-team program with MITRE ATLAS and the OWASP AI Exchange.
- **Risk Management & Threat Modeling** — NIST AI RMF, MITRE ATLAS, AI-adapted STRIDE, risk registers, red-team cadence.
- **AI Governance & Compliance** — EU AI Act, ISO/IEC 42001, GDPR Article 22, CCPA, HIPAA in LLM contexts.
- **Blue Team Defense & Monitoring** — guardrail pipelines, behavioral baselining, canary/honeytokens, PII redaction, DLP, incident response.
- **Identity & Access Management for AI** — RBAC/ABAC/Zero Trust, capability tokens, secrets vaulting, vector-DB access control.
- **Secure Agent Architecture & Design** — sandboxing, circuit breakers, tool allow-listing, MCP security, secure RAG pipelines.
- **Agent Lifecycle & Operations** — drift monitoring, regression testing, canary rollouts, continuous red teaming, vibe-coding risk.
- **AI/LLM Supply Chain & Third-Party Risk** — model provenance, unsafe deserialization, AI-BOM, plugin/MCP marketplace vetting, rug-pull attacks.

## The practical lab: attack it, then defend it

The final 10 questions require `cllmse-lab` — a self-contained binary
(macOS, Linux, Windows) with 5 live attack scenarios: indirect prompt
injection, RAG poisoning, SSRF via an unvalidated LLM-generated URL,
excessive agency in a tool-calling agent, and an MCP supply-chain rug
pull. You write the actual exploit payload — no button to click, no
gimmes. Trigger the vulnerability, enable the real guardrail, then
prove it holds. No internet required.

---

## Exam details

| | |
|---|---|
| **Questions** | 150 (110 multiple-choice + 40 free-text) |
| **Duration** | 6 hours |
| **Passing score** | 75% |
| **Domains** | 9 knowledge domains + a hands-on practical lab |
| **Language** | English |
| **Format** | Offline, self-contained exam package |
| **Covers** | OWASP GenAI / LLM Top 10, OWASP AI Exchange, NIST AI RMF, MITRE ATLAS, EU AI Act, ISO/IEC 42001, MCP |

---

## Who this is for

- **Security Engineers & Architects** shipping AI products and need to prove they can secure them
- **AI/ML Engineers** building agents who are tired of security being someone else's problem
- **Red Teamers & Pentesters** who want a credential that maps directly to real AI attack surface
- **GRC Professionals** who need to speak the technical language of AI risk, not just the policy language
- **Blue Team / SOC Analysts** defending AI-powered products in production
- **CISOs & Security Leaders** who need a bar to hold their AI teams to

## Extra Materials

Download Handbook: https://drive.google.com/file/d/1fLN1ZHq5HED2GtWp6LKFALaD9Hbk0tnG/view?usp=sharing

Lab: https://github.com/Red-Team-Leaders/RTL-Labs/blob/main/cllmse-practice-lab.zip


Prove you can secure AI before someone proves you can't

Certified LLM Security Expert (CLLMSE)

## Course Description

**ATM Penetration Testing & Security Assessment** is a comprehensive technical course focused on understanding, attacking, and securing Automated Teller Machine (ATM) environments. The course provides a deep dive into ATM hardware architecture, operating systems, middleware, communication protocols, and real-world attack vectors used by adversaries.

Students will learn how ATMs are built from the ground up, including core components such as the main computer system, card readers, PIN pads, cash dispensers, sensors, and network infrastructure. The course then progresses into common and advanced attack techniques, covering physical attacks, logical attacks, malware, skimming, black box attacks, and protocol abuse.

In addition to offensive techniques, the course emphasizes security assessment and risk analysis. Students will learn how to identify security weaknesses, assess hardware and software controls, understand vendor-specific implementations, and document findings in a structured and professional manner suitable for audits, red team engagements, and security assessments.

This course is designed for penetration testers, red team operators, security consultants, and defenders who want a practical and realistic understanding of ATM security in modern banking environments.

**This content was generated by AI, validated by our instructors, and includes additional content. Please note that there are no video lessons; the courses are entirely text-based.**

From ATM Architecture to Real-World Attacks and Defensive Controls

ATM Penetration Testing & Security Assessment

# Certified LLM Security Professional (CLLMSP) - Coupon (AISECURITYFORALL)

---

## Why CLLMSP?

Large Language Models are transforming every industry — but they introduce an entirely new class of security risks that traditional certifications don't cover. Prompt injection, jailbreaks, tool poisoning, agent manipulation, data exfiltration through RAG pipelines, and shadow AI are real threats happening today. The CLLMSP was built to close this gap.

This is not a theoretical certification. It was designed for professionals who build, deploy, operate, and defend LLM-powered systems — and need to do it securely.

---

## What You'll Master

- **LLM Architecture & Security Fundamentals** — Understand how Transformers, attention mechanisms, tokenization, and inference parameters create the attack surface you need to defend.

- **OWASP Top 10 for LLMs** — Go deep on every category: prompt injection (direct & indirect), insecure output handling, training data poisoning, model denial of service, supply chain risks, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft.

- **Jailbreak Attacks & Defenses** — Study real-world techniques (DAN, Crescendo, Skeleton Key, Many-Shot, PAIR, adversarial suffixes, token smuggling) and build multi-layered guardrail architectures that actually stop them.

- **AI Governance & Risk Management** — Apply NIST AI RMF, ISO/IEC 42001, and EU AI Act requirements. Build AI risk registers, model cards, red teaming programs, and acceptable use policies.

- **Data Privacy & Compliance** — Navigate GDPR, CCPA, and HIPAA in LLM contexts. Implement differential privacy, federated learning, redaction pipelines, and consent management for AI systems.

- **MCP (Model Context Protocol) Security** — Secure tool integrations end-to-end. Defend against tool poisoning, rug pull attacks, cross-server data exfiltration, and command injection through MCP servers.

- **AI Agents & Orchestration** — Secure autonomous agents with sandboxing, circuit breakers, human-in-the-loop controls, and capability tokens. Understand multi-agent injection risks and orchestration boundary validation.

- **Vibe Coding & Secure AI-Assisted Development** — Identify and mitigate the risks of AI-generated code (Copilot, Claude, ChatGPT) reaching production without proper security review.

- **Application Security for AI Products** — Bridge traditional AppSec (SSRF, XSS, SQLi) with AI-specific attack surfaces. Implement DevSecOps pipelines with prompt injection testing, model behavior regression, and streaming content filtering.

- **Identity, Access & Incident Response** — Design RBAC/ABAC/Zero Trust architectures for LLM platforms. Secure vector databases. Execute AI-specific incident response with model forensics and behavioral baseline monitoring.

---

## Exam Details

| | |
|---|---|
| **Questions** | 200 (154 multiple-choice + 46 short-answer) |
| **Domains** | 9 |
| **Languages** | English |
| **Format** | Online, no-proctored |
| **Passing Score** | 80% |
| **Covers** | GPT-4, Claude, Gemini, Ollama, Copilot, MCP, LangChain, OWASP, NIST, EU AI Act |

---

## Who Should Take This Exam?

- **Security Engineers & Architects** protecting AI-powered products and infrastructure
- **AI/ML Engineers** building and deploying LLM applications in production
- **Red Teamers & Pentesters** testing LLM systems for vulnerabilities
- **GRC Professionals** managing AI risk, compliance, and responsible use policies
- **DevSecOps Engineers** integrating AI security into CI/CD pipelines
- **CISOs & Security Leaders** making strategic decisions about AI adoption and governance

---

## What Makes CLLMSP Different

- **Offensive + Defensive** — You learn how attacks work AND how to stop them
- **Current** — Covers MCP, vibe coding, AI agents, and 2024-2026 jailbreak research
- **Challenging** — 200 questions across 9 domains with non-predictable answer distribution

---

## Handbook

Reference book to aid in studies.

Link: https://drive.google.com/file/d/1E55P1i41CGA_YEsOAFyQ_BHocOMoreHE/view?usp=sharing

Master LLM Risk, Governance & Defense

Certified LLM Security Professional (CLLMSP)

🟢 ENTRY

### **Certified Malware Analysis Beginners (CMAB)**

Whether you're starting in malware analysis, aiming to understand how modern threats behave, or want to build a foundation before jumping into reverse engineering, this certification is your entry point into the world of malware dissection.

---

### **Why CMAB?**

This certification focuses on **hands-on analysis of real-world malware samples**. It’s designed to teach you how malicious software operates from static inspection to behavioral analysis using professional tools and safe lab environments.

You'll learn how to uncover hidden payloads, detect persistence, monitor malicious behavior, and reverse engineer simple malware families all from scratch.

---

### **Challenges**

* How to analyze malware in PDF.
* How to analyze Windows malware in EXE.
* How to reverse APK files and detect malicious behaviors in Android malware.
* How to safely detonate malware and monitor filesystem, registry, and network changes.
* How to identify indicators of compromise (IOCs).

**Time**: 48 Hours

**Pass Score:** 70%

---

### **Requirements**

To fully participate and complete the challenges, you’ll need:

* **Virtualization Platform**  
Either VirtualBox or VMware Workstation Player
* **Lab Machines**  
   * **Windows 10 VM (x64 preferred)**  
   * **REMnux or Ubuntu Linux VM**  
   * (Optional) **Android Emulator** or Genymotion for mobile analysis
* **Essential Tools**  
   * `Procmon`, `Process Hacker`, `Autoruns`, `Regshot`, `x64dbg`, `PE-bear`, `PDF-Parser`  
   * `APKTool`, `JADX`, `MobSF`, `Frida`, `ADB`, `Volatility`, `BinText`, `FLOSS`
* **Basic Skills Required**  
   * Familiarity with Windows OS structure and processes  
   * Comfortable with command line (Linux and Windows)  
   * Basic understanding of malware categories and threat behaviors

---

Are you ready to dissect real malware and build the skills to become a threat analysis expert?

**Get CMAB Certified and start your journey in malware analysis.**

---

**All these exams are Self-Study**

Fundamentals of Static, Dynamic and Behavioral Malware Analysis



Certified Malware Analysis Beginners (CMAB)

🟡 CORE

## Certified Mobile Android Penetration Tester Junior

The Certified Mobile Android Penetration Tester Junior is designed for professionals who want to master, in practice, the most relevant pentesting techniques for mobile applications, exploring a vulnerable application built to simulate real-world challenges. Throughout the exam, the candidate is guided to identify, analyze, and exploit flaws in different layers of the Android ecosystem, combining reverse engineering, static analysis, dynamic instrumentation, and manual exploitation.

More than validating theoretical knowledge, this certification proves your ability to act as an offensive analyst capable of evaluating the security of Android apps with technical depth. Among the skills tested are APK decompilation, Android component analysis, exploitation of Content Providers, cryptographic flaws, abuse of Deep Links, insecure WebView, Intent manipulation, backup extraction, local storage analysis, bypassing anti-root and anti-Frida protections, as well as information leaks via logs and insecure network configurations.

---

### Skills Assessed

- APK Decompilation & Static Analysis
- Android Component Security (Activities, Content Providers, Services, Broadcast Receivers)
- SQL Injection & Path Traversal in Content Providers
- Cryptographic Analysis (AES/ECB, MD5, hardcoded keys)
- SharedPreferences & Local Storage Exploitation
- WebView Security (JavaScript Bridge, File Access)
- Deep Link Abuse & Intent Manipulation
- Application Backup Extraction
- Network Security Configuration Analysis
- Root/Frida Detection Bypass with Runtime Instrumentation
- Logcat & Debug Information Leakage

### Prerequisites

- Basic understanding of Android architecture
- Familiarity with ADB (Android Debug Bridge)
- Experience with at least one decompilation tool (jadx, apktool)
- Knowledge of Frida or similar instrumentation frameworks
- A rooted Android device or emulator

### Exam Format

| Detail | Value |
|--------|-------|
| Total Questions | 30 |
| Free-Text (Flag Submission) | 19 |
| Multiple Choice | 11 |
| Flag Format | `RTL{...}` |
| Methodology | OWASP MSTG / MASVS |
| Difficulty | Intermediate to Advanced |

### Duration

- 24 Hours 
- Required Grade: 80%

Master the art of Android application security through hands-on exploitation of a real-world vulnerable application

Certified Mobile Android PenTest Junior (CMAPJ)

# Certified Network Security Fundamentals

## What this exam is

This exam certifies foundational knowledge of network security, how networks work, the protocols attackers abuse, and the controls that defend them. Aimed at security professionals at a beginner level.

## Exam details

- **Questions:** 80 total — 60 multiple-choice + 20 free-text
- **Time limit:** 2 hours
- **Passing score:** 75%
- **Format:** Online, timed | Difficulty: Beginners | Audience: Security professionals | Language: English

## Study Resources

* **Networking fundamentals:** OSI model, TCP/IP, subnetting, routing, switching, VLANs, NAT, DNS, DHCP, ARP, ICMP, TCP, UDP, HTTP/HTTPS.
* **Network security basics:** firewalls, IDS/IPS, VPNs, segmentation, access control lists, zero trust concepts, secure network design.
* **Common attacks:** ARP spoofing, DNS spoofing, port scanning, brute force attacks, packet sniffing, man-in-the-middle attacks, denial-of-service, rogue DHCP, credential interception.
* **Defensive controls:** network monitoring, logging, hardening, patching, least privilege, MFA, secure configuration, encryption, incident response basics.
* **Hands-on tools:** Wireshark, Nmap, Netcat, tcpdump, traceroute, ping, nslookup/dig, basic firewall rules.
* **Recommended practice:** analyze packet captures, identify protocols, interpret Nmap scan results, recognize suspicious traffic, and explain mitigation steps.
* **Suggested references:**  
   * Cisco Networking Basics  
   * CompTIA Network+ study material  
   * CompTIA Security+ network security sections  
   * Wireshark official documentation  
   * Nmap Network Scanning guide  
   * OWASP testing concepts for web/network exposure  
   * MITRE ATT&CK Enterprise: Network-based techniques  
   * CISA cybersecurity fundamentals guidance

Fundamentals of Network Protocol and Security

Certified Network Security Fundamentals (CNSF)

🟢 ENTRY

### **Certified Offensive Windows API (COWA)**

Whether you're a Red Teamer, malware analyst, exploit developer, or security researcher, this course gives you the foundation to build advanced tools and understand what really happens under the hood.

---

### **Why COWA?**

This certification bridges the gap between Red Teaming and native Windows development. It’s not about writing payloads it’s about **understanding how Windows works from an attacker’s perspective** and writing tools that use the system’s own capabilities to your advantage.

---

### **Challenges**

* How to use `EnumWindows`, `EnumChildWindows`, `GetWindowText`, `SendMessage`, etc.
* How to reveal hidden GUI data (e.g., extracting masked passwords from edit fields).
* How to make system calls directly via ordinal numbers and syscall tables.
* How to interact with Windows internals like handles, processes, and memory.
* How to build tools that interact with real-world Windows applications at a low level.

Pass Score: 75%

---

### **Requirements**

To participate and build the required exercises, you’ll need:

* **Visual Studio 2022 (Community Edition)**  
Download: <https://visualstudio.microsoft.com/pt-br/downloads/>  
Be sure to install the **"Desktop Development with C++"** workload.
* **Windows 10 or 11 x64**  
A native Windows environment is required. WSL is **not** supported for GUI interaction.
* **Basic C/C++ Knowledge**  
You should be comfortable writing and compiling C++ programs.

---

Are you ready to challenge your skills and prove your mastery over the Windows API?

**Get COWA Certified and unlock the hidden layers of Windows.**

---

**All these exams are Self-Study**

Master Low-Level Windows API with Hands-On Offensive Development

Certified Offensive Windows API (COWA)

🟢 ENTRY

## Exam Description – Certified OSINT Research Analyst (CORA)

This exam evaluates both theoretical knowledge and practical skills in Open Source Intelligence (OSINT) and digital investigations. It is based on realistic scenarios commonly encountered in cybersecurity operations, threat intelligence, corporate investigations, and incident response activities.

Candidates are required to identify, analyze, correlate, and validate information obtained exclusively from publicly available sources, while strictly adhering to legal, ethical, operational security (OPSEC), and data protection principles.

---

### Exam Objectives

The exam is designed to validate the candidate’s ability to:

* Conduct structured, methodical, and reproducible OSINT investigations
* Correlate intelligence gathered from multiple open-source platforms
* Identify publicly exposed credentials, secrets, and sensitive data
* Analyze domain registrations, DNS records, and internet infrastructure
* Perform cryptocurrency wallet identification and transaction analysis
* Extract and interpret metadata from documents, images, and email headers
* Conduct image and video geolocation and chronolocation analysis
* Identify exposed services and devices using search engines such as Shodan
* Apply proper OPSEC practices during investigative activities
* Assess source credibility and reduce analytical bias through corroboration

---

### Score and Time

8 Hours of Exam

75% Score Pass

### Exam Structure

The exam consists of a combination of hands-on practical challenges and theoretical questions covering the following domains:

#### Practical Assessment Areas

* Credential leak discovery using open-source platforms and paste sites
* Blockchain analysis and cryptocurrency attribution
* Image geolocation and EXIF metadata analysis
* Document and PDF metadata forensics
* Email header analysis for phishing and business email compromise detection
* GitHub secret exposure investigation
* Domain, DNS, and infrastructure reconnaissance
* Social media username correlation and digital footprint analysis
* IoT and exposed service discovery using Shodan

#### Knowledge Areas Evaluated

* OSINT fundamentals, including passive versus active intelligence gathering
* Advanced search engine techniques and Google Dorking
* DNS, WHOIS, ASN, and network infrastructure concepts
* OSINT tools such as Maltego, SpiderFoot, theHarvester, and username enumeration frameworks
* OPSEC, ethics, and privacy considerations
* Legal and regulatory frameworks including GDPR
* Source validation, corroboration, and bias mitigation techniques
* Threat intelligence concepts and the MITRE ATT&CK framework

---

### Tools and Techniques

Candidates may use commonly accepted OSINT tools and methodologies, including but not limited to:

* Search engines and advanced search operators
* Google Dorks
* Shodan
* Maltego
* SpiderFoot
* theHarvester
* Sherlock, Maigret, and similar username enumeration tools
* ExifTool
* Blockchain explorers
* Wayback Machine
* WHOIS and DNS analysis tools
* Paste-sharing platforms

Professional Certification in Open Source Intelligence and Digital Investigation

Certified OSINT Research Analyst (CORA)

🟡 CORE

## Exam Overview 

The **Certified Red Team Engineer Development v1** is a hands-on, development-focused certification.  
The candidate must design, implement and document offensive security artifacts typically used in red team operations, while demonstrating secure development practices, anti-analysis awareness and clear technical reporting.

* **Exam type:** Remote, No-protectored, Openbook, Individual, Practical
* **Primary focus:** Windows offensive development, shellcode runners, basic malware techniques, evasive behavior and infrastructure (Nginx redirector)
* **Deliverables:**  
   * One **technical report (PDF)** documenting all artifacts  
   * **Source code** for each challenge  
   * **PoC execution videos** embedded or linked in the report
* **Authentication marker:**  
Every artifact must contain the string  
`RTL{StudentName}`  
where `StudentName` is replaced with the candidate’s real name (or registered exam name). This is used to validate authorship and prevent tampering.


This exam is intended for professionals who:

* Have solid knowledge of **C/C++**, C#, or similar low-level / systems languages
* Understand **Windows internals** at a basic level (processes, threads, memory, LSASS, etc.)
* Have basic familiarity with:  
   * **Shellcode execution** concepts  
   * **Nginx** reverse proxy / redirection  
   * **Anti-analysis techniques** (anti-VM, anti-sandbox, anti-debugging)  
   * Basic **malware development** concepts

Recommended experience:

* 1–2 years working with **offensive security**, malware development, or red teaming; **or** equivalent home-lab and learning experience.

## Exam Rules & Format

* **Duration:** 7 calendar days (1 week) from the moment the exam package is received.
* **Open book:**  
You may use documentation, books and public references. However: 
   * All **code must be written and understood by you**.  
   * Direct copy-paste of existing public PoCs without modification, understanding or credit is forbidden.
* **Individual work:**  
   * No collaboration, pair programming or sharing of code with others.  
   * No posting your tasks online requesting solutions.
* **Authenticity requirement:**  
   * The string `RTL{StudentName}` must appear in:  
         * All shellcode runners (Challenge 1)  
         * The Nginx configuration or response body (Challenge 2)  
         * The malware code (Challenge 3)  
         * The LSASS dumping utility (Challenge 4)  
         * The custom shellcode of Challenge 5 (as output)  
   * This string is used to cross-check the binaries, videos and source code.

## Lab Environment Requirements

### Mandatory

* **Windows 10 (x64)** machine or VM with:  
   * Visual Studio (or another C/C++ / C# toolchain)  
   * Administrator privileges (for LSASS-related tests and some anti-analysis checks)  
   * Ability to compile and run your artifacts locally

### Recommended

* **Ubuntu Linux (e.g., Ubuntu Server 22.04 LTS)** or equivalent

### Recommended courses and materials:

1) https://courses.redteamleaders.com/courses/62c9b0f6-6a0a-488c-870b-4ca0ac754378

2) https://courses.redteamleaders.com/courses/3e9e0212-81dc-49ed-9233-ec9ca894fc6a

3) https://maldevacademy.com/

4) https://cocomelonc.github.io

5) https://www.alteredsecurity.com/evasionlab

6) https://redsiege.com/training-red-team-tactics/

7) https://github.com/CyberSecurityUP/Red-Team-Exercises

8) https://training.whiteknightlabs.com/live-training/offensive-development-practitioner-certification/

9) https://cyberwarfare.live/

Develop your practical tools for Red Team operations.

Certified Red Team Engineer Development (CRTED)

🟢 ENTRY

# About Exam

Certified Red Team Operations Management (CRTOM) is an advanced, scenario-driven assessment focused on designing, governing, and executing modern red team programs. The exam evaluates your ability to build threat-led operations (TLPT/TIBER-EU), define and enforce Rules of Engagement, manage safety and deconfliction, measure effectiveness with rigorous KPIs (MTTD/MTTC and control-hypothesis outcomes), and align technical emulation with business risk. Coverage includes adversary emulation planning, C2 architecture and governance (including commercial frameworks), cloud red teaming, detection validation, compliance constraints across regions, evidence handling, and remediation verification practices expected in mature enterprise programs.

# Duration

4 Hours

# Format

Questions and answer

# Score

Required Grade 75%

# Self Study

- Red Team Guide
- SEC565
- Introdução ao Red Team Operations 1.0 - Portuguese Version
- Red Team Development and Operations
- Red Team Field Manual

# Course

Link: https://courses.redteamleaders.com/courses/1390aba4-3ad7-4ae2-8e2a-4575a821b0f7

Advanced Red Team Operations & Governance 


Certified Red Team Operations Management (CRTOM)

# AV/EDR Evasion Practical Techniques 2.0

**Windows Internals, Syscalls, EDR Bypass, Process Injection & AI-Powered Adversarial Testing — 60 Hands-On Labs**

---

## What You Will Learn

This course is one of the most complete AV and EDR evasion training programs available. It includes **60 practical lessons** covering everything from Windows internals fundamentals to advanced injection, syscalls, unhooking, and AI-powered adversarial testing techniques, all with compilable source code in C++, x86-64 Assembly, and Python.

You will not only study theory. Each lesson includes **real code**, **technical diagrams**, and **hands-on labs** that simulate real-world red team scenarios.

---

## Who Is This Course For?

- Pentesters who want to go beyond automated tools
- Red teamers building custom implants and loaders
- Malware researchers analyzing modern evasion techniques
- Security engineers who need to understand offensive techniques to improve defense

**Prerequisites:** Basic knowledge of Windows, C/C++, and offensive security concepts.

---

## Modules & Lessons — 60 Total

### Module 01 — Windows Internals & Foundation — 11 Lessons

| # | Lesson |
|---|--------|
| 01 | Windows Architecture Deep Dive |
| 02 | PEB/TEB Internals & Dynamic Module Resolution |
| 03 | API Hashing Techniques: djb2, CRC32, compile-time |
| 04 | No-IAT Binaries — Zero Static Imports |
| 05 | Alternative & Rarely Hooked Windows APIs |
| 06 | Memory Management — RW↔RX Toggling |
| 07 | Junk Code Generation & Control Flow Obfuscation |
| 08 | Anti-Debugging: Advanced Multi-Layer Protections |
| 09 | Anti-VM & Anti-Sandbox Robust Techniques |
| 10 | Windowless & Console-less Execution |
| 11 | **Debugging Evasive Loaders with x64dbg** |

### Module 02 — Syscalls: Direct, Indirect & Proxying — 11 Lessons

| # | Lesson |
|---|--------|
| 01 | Windows Syscall Mechanism & Architecture |
| 02 | NTDLL Syscall Stubs & SSN Resolution |
| 03 | Direct Syscalls — Manual Implementation |
| 04 | Indirect Syscalls — Trampolining Through NTDLL |
| 05 | Hell's Gate, Halo's Gate, Tartarus' Gate |
| 06 | Syscall Proxying via ROP Gadgets |
| 07 | Call Stack Spoofing & Stack Frame Manipulation |
| 08 | Timing & Behavioral Normalization |
| 09 | Assembly Shellcode Development |
| 10 | Building a Complete Syscall-Only Loader |
| 11 | **SysWhispers4: Advanced Syscall Stub Generation** |

### Module 03 — EDR Internals, Hooking & Unhooking — 13 Lessons

| # | Lesson |
|---|--------|
| 01 | EDR Architecture Internals |
| 02 | Userland Hooking Mechanisms |
| 03 | Hook Detection & Classification |
| 04 | Manual Unhooking from Disk |
| 05 | Perun's Fart — Full DLL Unhooking |
| 06 | ETW Bypass via Hardware Breakpoints |
| 07 | AMSI Bypass Techniques |
| 08 | Multi-Layer Unhooking Strategies |
| 09 | DLL Hollowing & Module Stomping |
| 10 | Building an Adaptive Unhooking Engine |
| 11 | Custom EDR Hook Agent Lab |
| 12 | Kernel-Level Detection: ObRegisterCallbacks & ETW-Ti |
| 13 | **Advanced AMSI & ETW: Patching & Patchless Bypass** |

### Module 04 — Advanced Injection, Execution & Stealth — 15 Lessons

| # | Lesson |
|---|--------|
| 01 | Process Injection Landscape |
| 02 | Section-Based Injection & Mapping Techniques |
| 03 | Thread Hijacking & Execution Primitives |
| 04 | Process Hollowing, Ghosting & Herpaderping |
| 05 | In-Memory Payload Execution & Reflective Loading |
| 06 | Sleep Obfuscation & Encryption |
| 07 | Payload Encryption & Obfuscation |
| 08 | C2 Communication & Stealth Channels |
| 09 | Anti-Forensics & Trace Elimination |
| 10 | Complete Stealth Loader Architecture |
| 11 | Named Pipe Injection & IPC-Based Execution |
| 12 | Process Parameter Poisoning: PEB Masquerade |
| 13 | **Fiber-Based Shellcode Execution** |
| 14 | **Callback-Based Execution Techniques** |
| 15 | **Multi-Layer Encryption & Staged Decryption** |

### Module 05 — AI-Powered Adversarial Testing — 10 Lessons

| # | Lesson |
|---|--------|
| 01 | AI for Security Testing Fundamentals |
| 02 | Automating Evasion with Machine Learning |
| 03 | Adversarial PE Generation |
| 04 | Polymorphic & Metamorphic Code Generation |
| 05 | AI-Powered C2 Traffic Generation |
| 06 | Automated Vulnerability & Attack Surface Discovery |
| 07 | AI-Assisted Social Engineering & Phishing |
| 08 | Building Custom Security AI Pipelines |
| 09 | AI-Assisted Loader Development |
| 10 | Reinforcement Learning & LoRA for Evasion Code Generation |

---

## Covered Techniques — Highlights

### Syscalls & Hook Evasion

- Direct & Indirect Syscalls using manual ASM
- Hell's Gate, Halo's Gate, Tartarus' Gate, RecycledGate
- SysWhispers4 — 8 resolution methods, 5 invocation methods, 9 evasion features
- Call Stack Spoofing & ROP Gadgets
- ntdll Unhooking: KnownDlls, Perun's Fart, section remapping

### Injection & Execution

- Process Hollowing, Ghosting, Herpaderping, Doppelgänging
- DLL Hollowing & Module Stomping
- Fiber-Based Execution without kernel callbacks
- Callback-Based Execution: EnumWindows, TimerQueue, CertEnum, ThreadPool, LdrDllNotification
- Named Pipe & IPC Injection
- Thread Hijacking & APC Injection

### Cryptography & Stealth

- Multi-Layer Encryption: XOR + AES-256-CBC + RC4
- Environment-Keyed Decryption: hostname + domain + volume serial
- Staged Decryption with Self-Erase
- Sleep Obfuscation: Ekko, Foliage, fiber-based
- Entropy Normalization via UUID Encoding

### Anti-Analysis

- Multi-Layer Anti-Debugging: PEB, timing, DR registers, NtQueryInformationProcess
- Anti-VM & Anti-Sandbox: CPUID, WMI, registry, behavioral checks
- ETW Bypass & Telemetry Starvation
- AMSI Bypass: patching & patchless
- PEB Masquerade & PPID Spoofing

### AI & Automation

- ML for signature analysis and payload mutation
- Adversarial PE generation with neural networks
- Automated polymorphic and metamorphic code generation
- RL + LoRA for fine-tuning evasion code generation models
- CI/CD pipelines for continuous validation against EDRs

---

## What Is Included

- **60 detailed lessons** with step-by-step explanations
- **60+ compilable source code files** in C++, ASM, and Python
- **Technical SVG diagrams** in every lesson
- **Zip bundles** with ready-to-compile code
- Coverage of **x64, x86, WoW64, and ARM64**
- Support for **MSVC, MinGW, and Clang**

---

## Recommended Environment

- Windows 10/11 x64 in an isolated VM
- Visual Studio 2022 with C++ Desktop Development
- Python 3.10+ with PyTorch for Module 05
- NASM/MASM for assembly
- VMware or Hyper-V with an EDR product for testing

Windows Internals, Syscalls, EDR Bypass, Process Injection & AI-Powered Adversarial Testing

AV/EDR Evasion Practical Techniques 2.0

# CRTOP - Certified Red Team Operations Planning

## Exam description and learning objectives

> **Audience.** Red Team Leads, senior offensive operators stepping into engagement-management roles, offensive-security programme managers, and threat-led-testing coordinators in regulated sectors (finance, energy, telco, government).
>
> **Outcome.** A holder of CRTOP can plan, run, govern, and report a Red Team operation end-to-end against a defended environment - covering scope, RoE, threat-informed adversary emulation, team and infrastructure planning, operational control, deconfliction, reporting, and post-engagement governance.

---

## Why this exam exists

The offensive industry is saturated with practitioner-level certifications that prove an operator can *break in*. Far fewer validate the upstream discipline that decides:

- whether the right adversary is being emulated,
- whether the right business risk is being demonstrated,
- whether the right people are aware of the engagement at the right time,
- whether the right artefacts are produced so the Blue Team can improve.

CRTOP fills that gap. It tests **planning, control and reporting** at the level a Red Team Lead is held to during a regulated TIBER / DORA / BCB-4.893 engagement, not the keystroke craft of a single operator.

---

## 2. Format

| Item | Detail |
|---|---|
| Level | **Advanced -> Expert** |
| Focus | Strategic, operational and tactical planning of Red Team operations |
| Format | **150 questions**: 77 multiple-choice + 63 free-text + 10 practical RTL{sha256} flags |
| Practical | **CRTOP lab artefact** - Go-built web platform, 10 drag-and-drop challenges across 5 planning documents |
| Duration | **4 hours** |
| Pass mark | **80%** |
| Delivery | Self-study, on-demand, open-book within the candidate's local environment |

---

## Domain blueprint

| Domain | Questions |
|---|---|
| **D1 - Fundamentals of Red Team Operations** | 15 |
| **D2 - Engagement Planning** | 38 |
| **D3 - Threat Intelligence & Adversary Emulation** | 22 |
| **D4 - Team & Resource Management** | 22 |
| **D5 - Operations & Execution Control** | 22 |
| **D6 - Documentation, Reporting & Deliverables** | 18 |
| **D7 - Ethics, Legal Aspects & Governance** | 13 |
| **Total** | **150** |

## Detailed learning objectives

### D1 - Fundamentals of Red Team Operations

- Distinguish Red Team from Pentest, Purple Team and TIBER engagements.
- Apply maturity models (CMMI) to Red Team programmes.
- Map operations against reference frameworks: MITRE ATT&CK, PTES, OSSTMM, OWASP.
- Choose the appropriate engagement type: Full-Scope, Assumed-Breach, Physical, Hybrid.
- Apply the principles of adversary simulation and threat emulation.
- Position the engagement within the regulatory context: BACEN (BCB-4.893), PCI-DSS v4.0, ISO 27001, LGPD.

### D2 - Engagement Planning

- Define scope and objectives using **Crown Jewels Analysis**.
- Elicit requirements with stakeholders (CISO, Board, IT).
- Build a **Rules of Engagement (RoE)** that includes Engagement Authority, In/Out-of-Scope, Operating Window, Kill Switch, Out-of-Band channel, Permitted Techniques and Data Handling.
- Threat-model the customer and select an adversary profile **driven by CTI**.
- Define Success Criteria and KPIs (MTTD, MTTC, Time-to-Objective).
- Plan **Lines of Operation (LOO)**: access, persistence, lateral movement, exfiltration.
- Build an operations schedule with phases, milestones and blackout windows.
- Build a communication plan: escalation matrix, out-of-band channels, decision authorities.

### D3 - Threat Intelligence & Adversary Emulation

- Use CTI at all four levels (strategic, operational, tactical, technical) during planning.
- Classify intelligence with TLP 2.0 and respect sharing limits.
- Profile and customise an adversary (APT29, FIN7, regional actors).
- Map TTPs in the **MITRE ATT&CK Navigator** with layered coverage and gap analysis.
- Build a structured **Adversary Emulation Plan**.
- Use Threat Intel Platforms (MISP, OpenCTI), and emulation tooling (Caldera, Atomic Red Team).
- Apply **threat-informed defense** to adapt the plan based on defender intelligence.

### D4 - Team & Resource Management

- Stand up a Red Team: Lead, Operator, Researcher, Support.
- Assign roles and responsibilities during the engagement.
- Manage resources: tooling, infrastructure, budget.
- Design C2 infrastructure (redirectors, long-haul vs short-haul, categorised domains, OPSEC).
- Justify tooling selection (commercial vs open-source vs custom).
- Control operations: Op Log, operator assignments, intra-team deconfliction.
- Manage operational risk: accidental damage, exposure, premature detection.

### D5 - Operations & Execution Control

- Define the canonical **Op Log** schema (mandatory fields, chain-of-custody integrity).
- Manage IOCs produced during the operation.
- Run a **deconfliction process** to avoid conflict with parallel real incidents or other assessments.
- Apply OPSEC: information compartmentalisation, operator identity management.
- Define **Decision Gates**: criteria for advance, pause, abort.
- Handle in-engagement incidents (detection, response, continuity).
- Establish secure communications (channels, encryption, procedures).

### D6 - Documentation, Reporting & Deliverables

- Structure a technical and executive Red Team report.
- Capture and organise evidence with chain of custody.
- Measure performance: TTD, MTTC, objective-attainment rate.
- Prioritise findings via **Impact x Likelihood** in business context.
- Tailor presentation to different audiences (technical vs executive).
- Run **Lessons Learned** sessions and drive continuous improvement.
- Deliver: Executive Summary, Technical Report, Remediation Roadmap.

### D7 - Ethics, Legal Aspects & Governance

- Formal authorisation: Letter of Authorisation, NDA, SoW / MSA.
- Operator and provider legal responsibility.
- Data protection during engagement (LGPD / GDPR application).
- Ethics: limits, proportionality, minimum harm.
- Red Team programme governance: policy, maturity, cadence.
- Integration with Purple Team and Blue Team for continuous improvement.


Strategic Adversary Emulation & Red Team Mission Planning

Certified Red Team Operations Planning (CRTOP)

🟢 ENTRY

## Exam Description

This is a **hands-on exam with manual grading**. You will receive **five independent binaries**; to pass, you must **successfully solve any 3 out of 5**. Each solution must be reproducible and accompanied by a short write-up with evidence (e.g., debugger screenshots, relevant offsets/bytes, or a small decoding script). The emphasis is on understanding control flow, checks, and data transformations—not blind brute force. Submissions are validated by an examiner on Windows (bare metal or VM).

7 Days of exam and fully open book

## Results

Write a complete report showing how you resolved each challenge

Results may take up to 20-30 days to arrive, depending on the evaluators' needs.

Therefore, we ask for your understanding and please wait to receive your results.

## Necessary knowledge

* **x64 assembly basics** — registers, flags, common arithmetic/logic, calls/returns, conditional jumps.
* **Microsoft x64 calling convention** — RCX/RDX/R8/R9 for args, stack frames, prologue/epilogue.
* **Windows PE essentials** — sections (`.text/.rdata/.data`), RVA/VA, Import Table vs. runtime resolution.
* **Debugger workflow (x64dbg)** — breakpoints (software/hardware), run/step controls, “follow in dump,” inline assemble, save patches.
* **Disassembler navigation (Ghidra/IDA Free)** — xrefs, referenced strings, RIP-relative loads, function/var renaming, CFG view.
* **Control-flow reasoning** — locate decision branches, trace validation chains, distinguish signal from noise/decoys.
* **Input-validation patterns** — length/format checks, character classes, simple checksums/mods.
* **Bit-manipulation** — XOR with fixed/repeating keys, ROL/ROR, index-based masks; write a tiny script to transform data.
* **Lightweight hashing/mixing awareness** — recognize accumulator/mix patterns and compare gates at a high level.
* **Memory inspection for decoded data** — identify stack/heap buffers and capture values before comparison.
* **Dynamic imports recognition** — trace `LoadLibrary*/GetProcAddress`\-style flows and indirect calls.
* **Anti-debug fundamentals** — common checks and clean, minimal neutralization strategies.
* **Timing gates awareness** — detect time-based rejects and choose safe ways to measure or bypass without stepping.
* **Control-flow flattening cues** — spot dispatchers/state machines and rebuild the logical sequence.
* **Minimal, safe patching** — invert a conditional, replace with a jump, or short-circuit cleanly; document bytes and offsets.
* **Reproducible reporting** — clear screenshots, key addresses/offsets, scripts/commands, and concise reasoning.

## Self-Study

* Ghidra: [https://ghidra-sre.org](https://ghidra-sre.org/)
* x64dbg (docs & hotkeys): [https://x64dbg.com](https://x64dbg.com/) • [https://help.x64dbg.com](https://help.x64dbg.com/)
* IDA Free: <https://hex-rays.com/ida-free/>
* PE-bear: <https://github.com/hasherezade/pe-bear-releases>
* Detect It Easy (DiE): <https://github.com/horsicq/DIE-engine>
* Windows PE format (Microsoft Docs): <https://learn.microsoft.com/windows/win32/debug/pe-format>
* LoadLibrary / GetProcAddress (Microsoft Docs): <https://learn.microsoft.com/windows/win32/api/libloaderapi/>
* OpenSecurityTraining / OST2: <https://opensecuritytraining.info/> • <https://ost2.fyi/>
* INE Reverse Engineering paths: <https://ine.com/>
* OffSec EXP-301 (OSED track): <https://www.offsec.com/courses/exp-301/>
* Pluralsight “Getting Started with Reverse Engineering”: <https://www.pluralsight.com/>
* AlmondForce — x64dbg intro (<https://www.youtube.com/watch?v=NC5FedMuAwo&ab%5Fchannel=AlmondForce>)
* Guided Hacking — Reverse Engineering playlist (<https://www.youtube.com/watch?v=fgMl0Uqiey8&list=PLt9cUwGw6CYFXtAElzDLob2aOaSfZqHJc&ab%5Fchannel=GuidedHacking>)
* IronByte — Win RE playlist (<https://www.youtube.com/watch?v=ws7FZNEMVmI&list=PL-A03qCBcinTiuCUtfhWGy1HMpnr0rOdh&ab%5Fchannel=IronByte>)
* LowLevel — reversing session (<https://www.youtube.com/watch?v=gh2RXE9BIN8&ab%5Fchannel=LowLevel>)
* David Bombal — malware/RE fundamentals (<https://www.youtube.com/watch?v=5FXrCHLAJZM&ab%5Fchannel=DavidBombal>)
* CTF101 — Reverse Engineering overview (<https://ctf101.org/reverse-engineering/overview/>)
* Reverse\_Engineering\_CTFs (curated repo) (<https://github.com/InfectedCapstone/Reverse%5FEngineering%5FCTFs>)

Reverse Engineering Practical Exam — Windows PE, Debugging & Runtime Analysis

Certified Reverse Engineering Beginners v1 (CREB)

🔴 Advanced

# Certified Reverse Engineering Professional (CREP)

## Overview
The CREP exam certifies the ability to analyze Windows and Linux executables,
reconstruct algorithms, understand commercial protections, document internal
architectures, neutralize anti-analysis mechanisms, and investigate behaviors
associated with modern threats. Every artifact
is synthetic and self-contained; all sensitive behavior (persistence, telemetry,
EDR, process transfer, destruction) is simulated inside the lab sandbox.

Challenges are **not** solved by flipping a single conditional. Each artifact
demands technical evidence, logical reconstruction, and the production of
supporting tooling.

## Format
- **6 challenges** per sitting: **4 mandatory** (LicenseForge, BlackBox Packer,
  Sentinel Desktop, Chimera Nexus) + **2 variable** (from FerrumVault,
  PolyCalc VM-RS, VaultSync Relay, IronDaemon, Specter Telemetry, Mirage Updater).
- **Artifacts:** Windows PE x64 and Linux ELF x64.
- **Languages:** C, C++, and Rust.
- Each lab ships as a **password-protected `.zip`** (final binaries only); the
  password is on the lab's page.
- Run everything in a **disposable VM/container with snapshots**. Windows PE in a
  Windows VM; IronDaemon (Lab 07) is Linux ELF (Linux/WSL/VM).

## Duration
- **144 hours** of hands-on work + **24 hours** to finalize the report.
- The environment is available only during the practical window. Evidence,
  scripts and dumps are submitted with the report.

## Scoring (1000 points, category-based)
| Category | Points |
|---|---:|
| Static analysis | 150 |
| Dynamic analysis | 150 |
| Structure & algorithm reconstruction | 180 |
| Protection neutralization | 130 |
| Tool development | 160 |
| Cross-artifact correlation | 80 |
| Evidence quality | 70 |
| Professional report | 80 |
| **Total** | **1000** |

Suggested per-lab weights (100–200 pts) guide effort; the final grade is assigned
by the categories above from the delivered evidence. A flag by itself earns no
points — it only proves you reached the objective.

## Passing grade
- **≥ 75% overall** (≥ 750 / 1000), **and**
- **≥ 60%** of the Chimera Nexus (Lab 10) points,
- **≥ 70%** of the report grade,
- **≥ 1 working tool** delivered (keygen / unpacker / emulator / parser / extractor),
- **no lab-rule violation.**

## What each challenge requires (objectives)
- **01 LicenseForge (PE, C++, 100):** reconstruct the license format and class
  hierarchy, separate real checks from decoys, recover the key/auth generation,
  neutralize anti-debug, and build a **license generator**.
- **02 BlackBox Packer (PE, C/C++, 130):** identify the two packer stages, find
  the OEP, extract the real payload vs. the decoy, and write an **unpacker** that
  rebuilds a working executable.
- **03 FerrumVault (PE+ELF, Rust, 110):** confirm Rust, reconstruct
  structs/enums/traits and the key derivation, recover the synthetic records and
  the simulated persistence, and build a standalone **extractor**.
- **04 PolyCalc VM-RS (ELF/PE, C, 160):** identify the custom VM, reconstruct the
  opcode table, decrypt/extract the bytecode, build a **disassembler + emulator**,
  and recover the virtualized algorithm (patching the return earns nothing).
- **05 Sentinel Desktop (PE, C++, 100):** catalog every detection technique
  (real vs. decoy), reconstruct the multithreaded state machine, neutralize the
  protections, and demonstrate the true flow.
- **06 VaultSync Relay (PE+ELF, C, 110):** reconstruct the proprietary protocol,
  identify the **cryptographic flaw**, build a parser + compatible client, and
  recover the requested message.
- **07 IronDaemon (ELF, C, 110):** reconstruct the socket protocol, analyze the
  process supervision and seccomp, find the hidden routine, identify the
  **authorization flaw**, and produce a **compatible client**.
- **08 Specter Telemetry Lab (PE set, C/C++, 150):** reconstruct the execution
  chain, identify EDR detection and provider interference, locate the transferred
  module, **restore telemetry**, and write detection rules.
- **09 Mirage Updater (PE+ELF, C, 100):** reconstruct the signed-package format,
  locate the **trust-chain flaw**, identify the tampered module, prevent canary
  removal, and build a **package inspector**.
- **10 Chimera Nexus (PE+ELF+Rust, 200):** unpack the PE, analyze the ELF, isolate
  the Rust library, analyze the **virtualized critical function**, and build a
  **standalone tool** that reproduces the operation by **correlating both
  binaries** (patching alone earns nothing).

## Rules (summary)
Isolated/snapshot environment; do not attack the exam infrastructure or host (no
arbitrary shell, external-binary upload, or host access); synthetic data only;
destruction confined to canary directories; persistence/telemetry/EDR are
simulated. **Every technical claim needs evidence** (offset, pseudocode,
debugger capture, dump, reconstructed structure, script output, decoded traffic,
or before/after patch). Patching is allowed but must be explained and does not
replace analysis.

## Deliverables
Per lab: the required tool, reconstructed structures/specs, evidence, and the
lab write-up. Plus **one consolidated report in PDF** (`CPRE_<your_id>_report.pdf`)
with an executive summary, per-artifact technical sections, cross-artifact
correlation, execution timeline, detection indicators, and defensive fixes.

## What the certification measures
PE & ELF internals · x86-64 assembly & calling conventions · compiled C/C++ and
Rust (classes, vtables, RTTI, templates/STL, traits, enums, monomorphization) ·
packer analysis, dump & reconstruction · anti-debugging & anti-disassembly ·
control-flow flattening & opaque predicates · custom virtual machines · applied
cryptography & binary protocols · concurrency & synchronization · behavioral
analysis without real malware · tool development · and professional reporting.


Practical RE certification: PE & ELF, packers, VMs, crypto protocols, cross-binary correlation.

Certified Reverse Engineering Professional (CREP)

🟡 CORE

## Description

The Certified RTL Digital Forensic Analyst (CRDFA) is an exam  designed to develop practical and investigative expertise in Digital Forensics, Incident Response, and OSINT.

* Digital forensic fundamentals and forensic imaging
* Disk and file system analysis (NTFS, deleted data, slack space, MFT artifacts)
* Memory forensics using industry-standard frameworks
* Network forensic analysis including DNS tunneling and beacon detection
* Windows and Linux artifact investigation
* Browser forensics and user activity reconstruction
* Mobile device forensics (Android and iOS)
* Anti-forensics techniques such as timestomping, encryption, and secure deletion
* OSINT methodology, metadata analysis, and intelligence workflows

The CRDFA course is intended for incident responders, SOC analysts, forensic investigators, red and blue team professionals, and security practitioners seeking to strengthen their investigative capabilities and technical depth in digital evidence analysis.

## Exam Details

Required Grade 75%

Duration 4 Hours

**Format:** MCQ

From Evidence to Intelligence: Mastering Digital Forensics, Incident Response & OSINT in Real-World Investigations

Certified RTL Digital Forensic Analyst (CRDFA)

🟡 CORE

## CSAIP – Certified Security Artificial Intelligence Programming (Practical Exam)

The **CSAIP practical exam** challenges you to secure **10 vulnerable LLM-powered applications** against real-world attack vectors mapped to the **OWASP Top 10 for Large Language Models (2025)**.

Each challenge presents a working **Python application** with a critical security flaw — from prompt injection and XSS to supply chain attacks and excessive AI agency.

Your mission:  
Implement defensive controls that pass a comprehensive automated test suite including:

* Functional tests
* Attack simulations
* Anti-cheat validation

No multiple choice.  
No theory questions.  
Just vulnerable code, a test suite, and a flag to capture.

---

## What You’ll Work On

You will gain hands-on experience with:

* Prompt injection defense using multi-layer input/output filtering
* HTML sanitization and XSS prevention on LLM-generated content
* PII detection and redaction using regex pattern matching
* Rate limiting and input validation against denial-of-service attacks
* Supply chain integrity verification using checksums and allowlists
* Credential leak prevention through sensitive data filtering
* Plugin and tool hardening with:  
   * RBAC (Role-Based Access Control)  
   * Path traversal protection  
   * SQL injection prevention
* RAG document poisoning detection and filtering
* LLM output verification and hallucination scoring
* Excessive AI agency control using:  
   * Role-based permissions  
   * Approval workflows

---

## Required Skills

* Python
* Regular Expressions (Regex)
* Secure coding principles
* Practical understanding of how LLM applications can be exploited and defended

## Information

Pass Score 70%

16 Hours of Duration

Defend LLM-powered applications against the OWASP Top 10 for Large Language Models             


Certified Security Artificial Intelligence Programming (CSAIP)

🟢 ENTRY

## Certified Security Code Review Beginners (CSCRB)

The **Certified Security Code Review – Beginners (CSCRB)** is a professional certification exam that validates foundational skills in identifying and mitigating security flaws through code review. Aimed at beginners in software development and cybersecurity, the assessment challenges candidates to analyze real-world insecure code samples, detect common vulnerabilities such as injection flaws, insecure authentication, and sensitive data exposure, and propose effective remediation strategies. Passing the CSCRB demonstrates the ability to apply secure coding principles and contributes to building more resilient software throughout the development lifecycle (SDLC).

## **Duration**

**24 hours** (60% Practical, 40% Theory)

**Pass Score** 75%

## **Requirements**

Understanding application security fundamentals, web and android exploitation, reading and interpreting source code, identifying common vulnerabilities (auth, input validation, file handling, SQLi, XSS, CSRF, race conditions), applying secure programming practices.

---

Are you ready to improve your code analysis skills?

---

**All these exams are Self-Study**


Practical Secure Coding and Code Review for Beginners

Certified Security Code Review Beginners (CSCRB)

🟡 CORE

## Description

The **CSLA** exam validates a candidate’s ability to analyze, correlate, and investigate security events using real log data inside a SIEM. This is a hands-on, investigation-driven assessment where candidates must extract precise answers directly from diverse datasets such as Active Directory, Windows Security, PowerShell, Linux authentication, EDR telemetry, web logs, and network traffic.

Rather than testing theory, CSLA measures practical capability. Candidates are placed in a realistic environment and must identify indicators of compromise, trace attacker behavior across multiple hosts, recognize suspicious patterns, and determine the exact evidence contained in logs. Success requires strong knowledge of event types, log fields, authentication flows, process activity, service creation, lateral movement, web probing, and defensive controls such as WAF and endpoint alerts.

The exam focuses on:

* Interpreting raw logs from multiple platforms
* Correlating events across systems and timelines
* Identifying attacker actions and affected assets
* Recognizing common attack techniques through log artifacts
* Using SIEM queries effectively to extract evidence
* Providing concise, evidence-based answers

CSLA is designed for SOC analysts, blue teamers, incident responders, threat hunters, and security professionals who want to prove their ability to turn raw log data into actionable security intelligence.

**Course**: https://courses.redteamleaders.com/courses/5ba830c2-0137-431a-8619-4370fc325b22

**Tool**: Elastic SIEM

## Duration

15 Hours

## Required Grade

70% Pass Score

## Evaluation format

Manual

## Format

36 questions

Hands-On Detection and Investigation with SIEM Logs

Certified SIEM Log Analysis (CSLA)

## Certified SOC Analyst Fundamentals

#### This is a self-study certification, but you can check out some materials on our website to help with your studies.

CSOCF is a 200-question, hands-on SOC analyst certification that mirrors the day-to-day reality of a modern Security Operations Center, alert triage, threat hunting, detection engineering, credential-access investigations, lateral-movement reconstruction, exfiltration tracking and full kill-chain analysis. Half the exam is multiple-choice knowledge. The other half is **inside a simulated SIEM** you spin up locally and query yourself.

---

## Who this certification is for

- **Aspiring SOC analysts** preparing for their first Tier-1 role and the recruiter loop.
- **Junior analysts** who want a credential that proves practical investigation skills, not just terminology.
- **Mid-level analysts** ready to formalize their detection engineering, threat hunting and CTI fluency.
- **Senior analysts and team leads** looking for a credential that covers leadership, purple team, advanced cloud/K8s, AMSI bypass, AMP, memory forensics and detection-at-scale topics.
- **Career switchers** from IT, software, networking or compliance who need a clear, complete roadmap of what SOC fundamentals actually look like.
- **Training providers, bootcamps and university programs** seeking a turnkey, lab-backed assessment for their cybersecurity tracks.

---

## How the exam is structured

Two halves, six blocks, 200 questions. Theory first, then a hands-on practical block for each tier.

### Part A — Theory (100 questions)

| Block | Tier | Audience | Questions |
|---|---|---|---|
| 1 | TIER 1 | Junior SOC Analyst | 33 |
| 2 | TIER 2 | Mid-Level SOC Analyst | 33 |
| 3 | TIER 3 | Senior SOC Analyst | 34 |

### Part B — Practical (100 questions)

| Block | Tier | Lab artifact | Questions |
|---|---|---|---|
| 4 | TIER 1 | `tier1.zip` — SSH brute-force + commodity loader + C2 | 33 |
| 5 | TIER 2 | `tier2.zip` — spear-phish → Sliver C2 → LSASS dump → SMB lateral | 33 |
| 6 | TIER 3 | `tier3.zip` — full APT (PHOENIX-44) across 12 kill-chain phases | 34 |

Practical questions are **free-text, one-word answers** (an IP, a hostname, a CVE, a MITRE T-ID, a process name, a registry key). You find them by querying. Case-insensitive grading. Each question ships with a non-spoiling **hint** so you always know where to start looking.

The fundamentals certification for SOC Analyst

Certified SOC Analyst Fundamentals (CSOCF)

🟢 ENTRY

## **Description**  

Certified Threat Hunting and Incident Response I (CTHRI-I) validates your ability to investigate real-world security incidents end-to-end. This practical exam focuses on hypothesis-driven hunting, log analysis, endpoint telemetry triage, network signal interpretation, MITRE ATT&CK mapping, and clear, actionable reporting. Candidates work through interactive, time-boxed scenarios that simulate enterprise conditions—pivoting across host and network data, correlating events, and documenting containment, eradication and recovery.

## **Passing score** 
75% overall, based on an objective rubric that rewards accuracy, reasoning, and reporting quality.

48 Hours of Exam

## **Preparation** 
Designed for self-study. You should be comfortable with Windows security events and Sysmon, PowerShell auditing concepts, basic Kerberos/authentication flows, EDR process/command-line telemetry, and common network behaviors (DNS/HTTP/HTTPS/ICMP). Familiarity with MITRE ATT&CK, timeline building, and evidence-backed recommendations is expected.

## **What’s assessed** 
Crafting effective queries/filters, distinguishing malicious from benign patterns, correlating multi-source telemetry, articulating impact and scope, and delivering a concise incident report with justified response actions.

--- 

**All these exams are Self-Study**

A hands-on, vendor-neutral blue-team certification for modern defenders

Certified Threat Hunting and Incident Response I (CTHIRI)

🟢 ENTRY

## Description


The **Certified Threat Intelligence & Governance Analyst (CTIGA)** certification validates a professional’s ability to design, manage, and operationalize Threat Intelligence programs aligned with organizational governance, risk management, and strategic security objectives.

This exam focuses on transforming raw threat data into **actionable intelligence** that supports executive decision-making, regulatory compliance, and security operations. Candidates are assessed on their understanding of intelligence lifecycle management, intelligence governance, ethical and legal considerations, intelligence-driven security operations, and the integration of threat intelligence across SOC, incident response, risk management, and executive leadership.

CTIGA emphasizes **methodologies, frameworks, and best practices** rather than tools alone. It evaluates the candidate’s ability to establish intelligence requirements, manage intelligence programs, assess intelligence maturity, and ensure intelligence outputs are aligned with business priorities, compliance obligations, and strategic risk tolerance.

The exam is designed for professionals who operate at the intersection of **technology, governance, and security strategy**, ensuring that Threat Intelligence is not only collected, but properly governed, contextualized, and effectively consumed across the organization.

## Duration

5 Hours

## Score

Required Grade 70% 

## Materials

Self-Study

[Awesome Threat Intelligence](https://github.com/hslatman/awesome-threat-intelligence)

Bridging Cyber Threat Intelligence, Governance and Strategic Decision-Making

Certified Threat Intelligence & Governance Analyst (CTIGA)

🟡 CORE

The **Certified Web API PenTest Junior (CWAPJ)** is a fully hands-on, lab-based exam designed to validate your ability to find and exploit real-world vulnerabilities in modern web APIs.

You will be dropped into a realistic e-commerce environment (**Wazzy**, a pet shop platform) and given up to **24 hours** to map the attack surface, exploit flaws, and capture **10 unique flags** hidden across the API. There are no multiple-choice questions, no theory-only sections – just you, your tools, and a vulnerable API.

During the exam you will:

* Enumerate and attack REST endpoints in a real application workflow 
* Exploit vulnerabilities aligned with the **OWASP API Security Top 10**, including:  
   * Broken Object Level Authorization (BOLA)  
   * Broken Authentication
   * Broken Object Property Level Authorization / Mass Assignment  
   * Broken Function Level Authorization & HTTP Verb Tampering  
   * Business logic flaws in payment and checkout flows  
   * Security misconfiguration and exposed config endpoints  
   * Improper inventory management
   * SQL Injection
   * SSRF via backend HTTP client functionality
* Use your preferred tooling (Burp Suite, Postman, curl, custom scripts, etc.) exactly as in a real engagement.

**Key details**

* **Difficulty:** Junior / Entry-Level API Pentest
* **Format:** 100% practical, lab-based, remote
* **Time limit:** 48 hours continuous access to the lab
* **Passing criteria:** Successfully identify and submit the correct flags in the required format `RTL{…}`
* **Retake policy:** If any lab-side technical issue prevents progress, a free retake will be granted after validation by support.

This exam is ideal for:

* Junior pentesters and bug bounty hunters who want a **formal, practical validation** of their API hacking skills.
* Web security enthusiasts transitioning from web app testing to **API-focused** assessments.
* Blue teamers and developers who want to understand how attackers really break API layers in production-like scenarios.

Prove that you can handle real-world API testing, not just memorize theory.

**Self Study**

APISec University Course: https://www.apisecuniversity.com/

Portswigger Labs: https://portswigger.net/web-security/all-labs

PentesterLab: https://pentesterlab.com/

PentestingExams (SecOps Group): https://pentestingexams.com/product/certified-api-pentester/


Hands-on API Hacking Exam for Junior Pentesters

Certified Web API PenTest Junior (CWAPJ)

🟡 CORE

# CWAPP - Certified Web API Penetration Testing Professional

## Exam Overview

The **CWAPP (Certified Web API Penetration Testing Professional)** is an advanced, hands-on certification designed to validate real-world expertise in API security testing. Candidates are placed in a fully functional e-commerce environment and must identify, analyze, and exploit vulnerabilities across a modern REST API infrastructure — just as they would during a professional engagement.

## Exam Details

| | |
|---|---|
| **Exam Name** | CWAPP - Certified Web API Penetration Testing Professional |
| **Duration** | 48 hours |
| **Format** | 100% Hands-On / Practical |
| **Total Challenges** | 25 |
| **Passing Grade** | 70% (minimum 18 out of 25 flags) |
| **Proctored** | No |
| **Retake Policy** | Available after 15-day cooling period |
| **Prerequisites** | Strong understanding of HTTP, REST APIs, and web application security fundamentals |
| **Recommended Experience** | 2+ years in penetration testing or application security |

## Knowledge Domains

The exam covers the following areas, aligned with industry-standard frameworks:

### OWASP API Security Top 10 (2023)
- **API1:2023** — Broken Object Level Authorization (BOLA)
- **API2:2023** — Broken Authentication
- **API3:2023** — Broken Object Property Level Authorization
- **API4:2023** — Unrestricted Resource Consumption
- **API5:2023** — Broken Function Level Authorization (BFLA)
- **API7:2023** — Server-Side Request Forgery (SSRF)
- **API8:2023** — Security Misconfiguration
- **API9:2023** — Improper Inventory Management

### Injection & Data Handling
- SQL Injection (Union-Based & Time-Based Blind)
- NoSQL Injection (MongoDB Operator Injection)
- Server-Side Template Injection (SSTI)
- XML External Entity Injection (XXE)
- OS Command Injection
- Insecure Deserialization

### Access Control & Authentication
- JWT Authentication Bypass via Weak Signing Key
- Mass Assignment / Privilege Escalation
- HTTP Verb Tampering
- Insecure Direct Object Reference (IDOR)
- CORS Misconfiguration

### Business Logic & Advanced
- Race Condition Exploitation
- Server-Side Request Forgery (SSRF) Chaining
- HTTP Parameter Pollution
- Path Traversal / Directory Traversal
- Rate Limiting Bypass
- Excessive Data Exposure
- API Version Data Leakage

## Who Is This Certification For?

The CWAPP is designed for experienced security professionals who want to validate their API penetration testing skills at an advanced level:

- **Penetration Testers** looking to specialize in API security
- **Red Team Operators** who need to assess modern API-driven applications
- **Application Security Engineers** validating their offensive testing abilities
- **Bug Bounty Hunters** focused on API-centric targets
- **Security Consultants** who perform API security assessments for clients
- **DevSecOps Engineers** who want to understand real API attack vectors

Hands-on API Hacking Exam for Professional Pentesters

Certified Web API PenTest Professional (CWAPP)

🟡 CORE

# Certified Windows Drivers Exploitation v1 CWDE — Exam Description

**Passing score:** **60%**  
**Exam Time:** **7 days**

**Audience:** Security engineers, reverse-engineers, kernel devs, red/blue teamers seeking validation of Windows driver reversing and user↔kernel I/O skills.

You need to submit a report, which may take up to 20 business days to review.

## Overview

WDEv1 evaluates your ability to reverse-engineer Windows kernel drivers, identify device interfaces and IOCTL contracts, reconstruct user↔kernel data structures, and craft small user-mode PoCs

## Skills Measured

* Windows kernel driver model basics (KMDF control device, queues, `EvtIoDeviceControl`)
* Device & symbolic link discovery (`\\.\DeviceName`)
* IOCTL enumeration (function codes, methods, access)
* Buffer handling and struct reconstruction (sizes, order, “magic” constants)
* User-mode PoC creation (`CreateFile`/`DeviceIoControl`)
* Clean reporting with evidence, screenshots, and reproducibility

## Prerequisites

* Comfort with C/C++ on Windows and basic Win32 APIs
* Familiarity with IDA/Ghidra and WinDbg/DbgView
* Ability to work in a Windows 10/11 x64 **virtual machine** with Test Signing

## Format & Materials

* **Provided:** Compiled, test-signed driver packages (no source/symbols), challenge briefs
* **You provide:** Windows 10/11 x64 VM, reversing/debugging tools, compiler
* **Artifacts to submit:** Report (**.md** or **.pdf**) + PoC source

Use your own virtual machine and tools:

* WDK - https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk

* WinDBG - https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/

* Configuration 1 Tutorial - https://www.youtube.com/watch?v=bNhrOmoa1MI

* Configuration 2 Tutorial - https://www.youtube.com/watch?v=V7DJ_ptkOpM

* Course Windows Kernel Exploitation - https://redteamleaders.coursestack.com/courses/69e7984c-a1ce-48e5-b7fc-bd2a2aa6f189

## Integrity & Collaboration

* **Individual work.** Do not share PoCs or binaries with other candidates.
* Cite references when used; do **not** copy PoC code verbatim from public sources.
* The proctor may request a short **live verification** (screen-share) to confirm authorship.

## Scoring & Passing

**Minimum to pass:** **60 points (60%)**  
**Maximum base score:** 100 points

| Component                                      | Points  |
| ---------------------------------------------- | ------- |
| Challenge 1 — Memory Disclosure (simulation)   | 50      |
| Challenge 2 — Process Control / viragt64 (sim) | 20      |
| Challenge 3 — NT Authority (SYSTEM sim)        | 30      |
| **Subtotal (base)**                            | **100** |

**Bonus (optional): up to +15 points** for exceptional PoC quality, report clarity, and reproducibility (clean code, robust error handling, exemplary screenshots).

Bundles

Courses (113)

Exams (37)