13 Hacking Domains · 151 Labs
Pick your domain — from Web · AD · Cloud · Mobile all the way to AI/ML Security · Hardware · Blockchain. Climb 4 levels per domain — Beginner → Expert. Every level lists the tools you'll learn, the real-world certifications it prepares you for, and a mixed-format curriculum of labs · CTFs · quizzes. Quizzes are blocking — pass to unlock the next module.
Web App Pentest
OWASP top-10 → modern SaaS attack surface. From reflected XSS to chained SSRF + IAM privesc.
Internal / AD Pentest
Enumerate, kerberoast, harvest hashes, pivot DC → DA. The bread-and-butter of internal engagements.
Cloud Pentest
AWS/Azure/GCP attack surface. IMDS SSRF, IAM privesc, S3 misconfigs, K8s RBAC, CI/CD secrets.
Mobile Pentest
iOS + Android attack surface. Static & dynamic analysis, deep-link abuse, OAuth flows.
Network / Infra Pentest
External + internal network attack surface. Port-scan to RCE, VPN abuse, MITM, IoT.
Cryptography
Symmetric, asymmetric, AEAD, hash. Padding oracles, length-extension, weak RNGs, ECDSA reuse.
Forensics & IR
Disk + memory + network forensics. Timeline reconstruction, malware triage, incident response.
OSINT / Recon
Open-source intelligence. Find people, infrastructure, leaked data without ever touching the target.
Reverse Engineering & Malware
Binaries, packers, anti-debug, malware families. Static + dynamic + emulation.
DevSecOps / AppSec
Build secure pipelines. SAST, DAST, IaC scanning, secret hygiene, secure SDLC.
AI / ML Security
Adversarial ML, prompt injection, model theft, data poisoning, RAG defense, and red-teaming LLMs.
Hardware & Embedded
PCB analysis, side-channel attacks, fault injection, firmware reverse-engineering, RF security.
Blockchain & Smart-Contract Security
Solidity audits, DeFi flash-loans, bridge attacks, MEV, ZK circuit bugs, key management.