Web Fundamentals

Understand the web before you hack it. HTTP, auth, APIs, DevTools, and the OWASP Top 10 — the foundation every attacker needs.

Recon & OSINT

Map the full attack surface before you fire a single request. Asset discovery, content enumeration, fingerprinting, secrets, and passive intel.

API Security

Attack the modern web. REST, GraphQL, JWT, OAuth, and mass assignment — the vulnerabilities that ship in every API.

Authentication Attacks

Break login systems end to end. Brute force, session hijacking, password reset abuse, 2FA bypass, and OAuth flaws — against real banking and social app targets.

Mastering XSS

Go beyond alert(1). Cover every XSS variant from reflected to blind, learn how attackers chain XSS into account takeovers, and understand why CSP often fails to stop it.

Injection Attacks

Every way user input becomes a weapon. SQL, NoSQL, command, template, XML, and file-upload injection — from login bypass to full server compromise.

Hacker Toolkit

Master the tools every hacker uses daily. sqlmap, ffuf, curl, and hashcat — learn them properly so they work for you, not against you.

Network & Systems Hacking

Go beyond web apps. Scan networks, escalate Linux privileges, crack passwords, enumerate services, exploit server misconfigurations, and analyse captured traffic.

LLM & AI Security

Attack AI-powered products. Prompt injection, jailbreaking, and indirect attacks — the vulnerabilities that ship in every LLM integration.

Business Logic & Race Conditions

Vulnerabilities that scanners never find. Abuse the application's own rules — price manipulation, workflow bypasses, race conditions, and parameter tampering.

Password & Hash Attacks

Crack hashes, bruteforce logins, and exploit weak credential policies. From hashcat modes to Hydra one-liners — learn how attackers break authentication at the credential layer.

Post-Exploitation & Pivoting

You're in — now what? Learn to loot a box, plant persistence, harvest credentials, and tunnel through networks to reach the next target.