Cyber Security Course Syllabus

Outcome: Map an application and its APIs completely, and plan a test that covers every role, endpoint and risk category.

Topics

• HTTP and HTTPS, TLS, cookies, headers, the same-origin policy and CORS basics
• Burp Suite set-up: proxy, scope, site map, Repeater and Intruder
• Content discovery with ffuf, and reading client-side JavaScript
• REST, SOAP and GraphQL; OpenAPI and schemas; building an API inventory
• Standards: OWASP Top 10:2025, OWASP API Security Top 10:2023, WSTG and ASVS
• Engagement scope, rules of engagement and the endpoint-and-role coverage matrix

Hands-on labs

• Map a multi-role web application and its API
• Build the coverage matrix you will use all course

Deliverable

Application map and coverage matrix

Job skills covered

• Burp Suite
• OWASP Top 10
• API testing
• Test planning

Outcome: Break login, session and permission controls, including the object, property and function-level flaws most common in APIs.

Topics

• Authentication, MFA and password-reset flows; session handling and logout
• JWT handling, OAuth 2.0 and OpenID Connect
• Horizontal and vertical access control; IDOR and BOLA
• Mass assignment and property-level authorization (BOPLA); function-level authorization (BFLA)
• Multi-role and multi-tenant testing
• CSRF, CORS misconfiguration and clickjacking

Hands-on labs

• Two-account access-control testing across the coverage matrix
• Forge and tamper with JWTs in a vulnerable API

Deliverable

Access-control findings with evidence

Job skills covered

• Authentication testing
• Access control (IDOR, BOLA)
• JWT and OAuth

Outcome: Find, confirm and explain injection and server-side flaws, and show developers exactly how to fix them.

Topics

• SQL injection, including careful use of SQLmap; NoSQL injection
• OS command injection, server-side template injection and insecure deserialization
• Cross-site scripting (reflected, stored and DOM-based) and Content Security Policy
• File upload, path traversal and file inclusion
• XXE, and SSRF including cloud metadata services

Hands-on labs

• Exploit each class in authorized labs, then write the fix
• Chain SSRF to reach an internal service

Deliverable

Injection findings with reproduction steps and fixes

Job skills covered

• SQL injection
• XSS
• SSRF
• Server-side vulnerabilities

Outcome: Test what scanners cannot: business workflows, race conditions, request-level attacks and GraphQL APIs.

Topics

• Business logic and sensitive workflows; limits, quotas and resource consumption
• Race conditions and state transitions
• Host-header attacks, request smuggling, cache poisoning and cache deception
• WebSockets and client-side prototype pollution
• GraphQL: introspection, resolver-level authorization, batching and query depth

Hands-on labs

• Exploit a race condition in a checkout flow
• Test a GraphQL API

Deliverable

Business-logic and GraphQL findings

Job skills covered

• Business-logic testing
• GraphQL
• Advanced web attacks

Outcome: Test an Android app end to end: unpack and read it, find insecure storage and components, bypass client-side controls and test its back-end API.

Topics

• Android architecture, the APK format, permissions and the app sandbox
• Lab set-up: Android emulator, ADB and a rooted test device image
• OWASP Mobile Top 10 (2024), MASVS and MASTG
• Static analysis with jadx, apktool and MobSF: hardcoded secrets, insecure configuration and weak cryptography
• Insecure data storage: shared preferences, databases, logs and backups
• Exported activities, services, content providers, intents, deep links and WebViews
• Intercepting app traffic with Burp; certificate pinning and root-detection bypass with Frida and objection
• Testing the mobile back-end API

Hands-on labs

• Assess intentionally vulnerable Android apps in an emulator
• Bypass certificate pinning and test the app's API

Deliverable

Android application penetration test findings

Job skills covered

• Android application security
• OWASP MASVS
• Frida
• Mobile API testing

Outcome: Assess a desktop application and its server: traffic, local storage, binaries and the Windows environment it runs in.

Topics

• Two-tier and three-tier thick-client architectures; .NET and Java desktop applications
• Information gathering with Sysinternals tools such as Process Monitor
• Intercepting HTTP and non-HTTP traffic between the client and its server
• Insecure local storage: configuration files, the registry, hardcoded credentials and database connection strings
• Decompiling .NET applications with dnSpyEx or ILSpy, and patching client-side checks
• DLL hijacking and insecure file and service permissions
• Direct database access and injection through the client
• OWASP Desktop App Security Top 10

Hands-on labs

• Assess an intentionally vulnerable thick-client application end to end

Deliverable

Thick-client assessment findings

Job skills covered

• Thick-client testing
• Binary analysis basics
• .NET decompilation

Outcome: Read code for security flaws, use SAST and DAST tools with judgment, and test AI features for prompt injection and data leaks.

Topics

• Threat modeling with STRIDE
• Secure code review basics: spotting injection and authorization flaws in code
• SAST with Semgrep and DAST with OWASP ZAP and Burp's scanner; dependency and secrets scanning
• How chat assistants, RAG and agents sit behind web and API endpoints
• OWASP Top 10 for LLM Applications 2025: prompt injection, improper output handling, sensitive information disclosure and excessive agency
• AI-assisted testing: payload ideas and report drafting, verified by hand

Hands-on labs

• Review a vulnerable code base and confirm the flaws in the running app
• Attack an intentionally vulnerable chat assistant with a knowledge base and tools

Deliverable

Code-review notes and AI feature test notes

Job skills covered

• SAST and DAST
• Secure code review
• AI and LLM security

Outcome: Assess unseen targets against the clock, report them professionally and verify the fixes in a formal retest.

Topics

• Assess an unseen web application and its API, plus an Android app or a thick-client application
• CTF challenges on web, API and mobile flaws
• Complete coverage matrix and an explanation of false positives
• Fix representative flaws, report and run a formal retest
• Technical oral exam on your findings

Hands-on labs

• Timed practical assessment and retest

Deliverable

Web, API, Android and thick-client reports (R-01 to R-04)

Job skills covered

• End-to-end application security testing
• Report writing

Outcome: Run an engagement the professional way, and build a segmented lab with a multi-domain Active Directory forest to test it in.

Topics

• Lab: segmented subnets, Linux and Windows hosts and a multi-domain Active Directory forest in VirtualBox
• Law and ethics: the IT Act, written authorization, scope and rules of engagement
• Why clients commission VAPT: ISO 27001, PCI DSS, CERT-In, RBI and SEBI requirements
• Methodology: PTES and NIST SP 800-115; internal, external and assumed-breach tests
• CVE, CWE and CVSS v4; evidence handling and note-taking

Hands-on labs

• Build and snapshot the advanced lab
• Draft the rules of engagement for a sample client

Deliverable

Lab diagram and a rules-of-engagement document

Job skills covered

• Engagement management
• Compliance-driven VAPT

Outcome: Map an organization's external and internal attack surface and enumerate every live host and service in scope.

Topics

• Passive OSINT: DNS, certificate transparency, search engines, code repositories and leaked credentials
• Internet-wide search engines (Shodan, Censys) and checking results against scope
• Nmap in depth: discovery, TCP and UDP scans, timing, version detection and the scripting engine
• Service enumeration: SMB, SNMP, LDAP, NFS, SMTP, SSH, RDP, HTTP and databases
• Scripting for testers: writing and adapting Bash, Python and PowerShell to automate enumeration

Hands-on labs

• External attack-surface map of a fictional company
• Full enumeration of a segmented lab
• Write a Python script that parses Nmap output

Deliverable

Attack-surface inventory

Job skills covered

• Reconnaissance
• Nmap
• Scripting (Python, Bash, PowerShell)

Outcome: Run credentialed and uncredentialed scans, validate and prioritize the results, review configurations against benchmarks and assess wireless security.

Topics

• Nessus: scan policies, credentialed and uncredentialed scans
• Triage: false positives, manual validation and business context
• Prioritization with CVSS v4, EPSS and CISA's Known Exploited Vulnerabilities catalog
• Configuration review against CIS Benchmarks for Windows, Linux and network devices
• Wireshark: protocol analysis and clear-text credentials
• Wireless assessment: WPA2 and WPA3, handshake capture and cracking, rogue access points (lab demonstration)

Hands-on labs

• Credentialed scan with manual validation of the top findings
• CIS benchmark review of a Windows server

Deliverable

Validated vulnerability assessment summary

Job skills covered

• Vulnerability assessment
• Nessus
• Configuration review
• Wireless security

Outcome: Exploit confirmed weaknesses safely, by framework and by hand, and attack passwords within agreed limits.

Topics

• Metasploit: modules, payloads, sessions and the database
• Manual exploitation: finding, reading and adapting public exploit code
• Common service misconfigurations and default credentials
• Password attacks: spraying and brute force within agreed limits, and hash cracking with Hashcat rules and masks and John the Ripper
• Pass-the-hash and credential reuse

Hands-on labs

• Exploit Linux and Windows targets with and without Metasploit
• Crack captured hashes with rules and masks

Deliverable

Exploitation evidence log

Job skills covered

• Exploitation
• Password attacks
• Metasploit

Outcome: Escalate to administrator on Linux and Windows, pivot through segmented networks and move laterally the way real attackers do.

Topics

• Linux privilege escalation: sudo, SUID, cron, capabilities and kernel issues
• Windows privilege escalation: services, scheduled tasks, stored credentials and token privileges
• Tunneling and pivoting: SSH, SOCKS proxies, Chisel and Ligolo-ng, including double pivots
• Lateral movement: WinRM, PsExec-style execution, WMI and RDP
• Persistence concepts, cleaning up after a test, and how defenders see your activity in Sysmon

Hands-on labs

• Escalate on Linux and Windows targets
• Pivot through two subnets to reach an isolated host

Deliverable

Attack-path evidence across the segmented network

Job skills covered

• Privilege escalation
• Pivoting
• Lateral movement

Outcome: Take a multi-domain forest from a low-privilege user to domain and forest admin, and recommend the fixes that break each path.

Topics

• Domains, forests, trusts, GPOs and ACLs
• Enumeration with NetExec (nxc), LDAP queries and BloodHound attack-path analysis
• Kerberoasting, AS-REP roasting, NTLM relay and authentication coercion
• ACL abuse with bloodyAD
• Delegation attacks: unconstrained, constrained and resource-based constrained delegation
• Active Directory Certificate Services (AD CS) attacks with Certipy
• DCSync, golden and silver ticket concepts, and attacks across forest trusts
• Hybrid identity with Entra ID (introduction); hardening: tiered administration, Windows LAPS, gMSA, SMB and LDAP signing

Hands-on labs

• Attack the lab forest from a low-privilege user to forest admin
• Exploit a misconfigured certificate template

Deliverable

Attack-path diagram and hardening plan

Job skills covered

• Active Directory
• Kerberos and NTLM
• AD CS
• BloodHound and Impacket

Outcome: Use an AI assistant safely to speed up analysis and writing, and turn findings into a report managers and engineers can act on.

Topics

• Using an LLM assistant to summarize scan output, suggest next steps and draft commands, then verifying every answer in the lab
• Client data and confidentiality: what never goes into a public AI service
• Report structure: executive summary, scope, methodology, findings and remediation
• Writing a finding: impact, evidence, reproduction steps, CVSS v4 rationale and a specific fix
• Peer review, and presenting findings to a client

Hands-on labs

• Rewrite a weak finding into a reviewed one
• Summarize a large scan export with AI, then check it against the evidence

Deliverable

Peer-reviewed report sections

Job skills covered

• Report writing
• Client communication
• Responsible AI use

Outcome: Show you can do the job: compromise an unseen segmented network and forest against the clock, then defend your report.

Topics

• Assess an unseen segmented network and Active Directory forest end to end
• CTF challenges across the course's tools and techniques
• Technical and management report with an attack-path diagram
• Technical oral exam on your findings

Hands-on labs

• Timed practical assessment

Deliverable

Network and Active Directory penetration test reports (R-05, R-06)

Job skills covered

• End-to-end network and AD penetration testing

Outcome: Explain how attacks work and how networks and systems are defended, in the terms every security team uses.

Topics

• Threats, vulnerabilities, attacks and controls; confidentiality, integrity and availability
• Networking for analysts: TCP/IP, DNS, DHCP, HTTP, SMTP and VPN
• Network defense: firewalls, IDS/IPS, proxies, segmentation and what each one logs
• Windows and Linux essentials and hardening
• Identity and access management, cryptography and PKI basics
• Wireless, cloud and IoT security basics

Hands-on labs

• Capture and read traffic in Wireshark
• Harden a Windows and a Linux machine against a checklist

Deliverable

Network defense notes and a hardening checklist

Job skills covered

• Networking
• Network security
• Windows and Linux
• CCT core concepts

Outcome: Work inside a SOC and read the logs it depends on: know which source answers which question.

Topics

• L1, L2 and L3 roles, shifts, ticketing, SLAs, escalation and shift handover
• Frameworks: Cyber Kill Chain, MITRE ATT&CK, IOCs vs IOAs and the Pyramid of Pain
• Windows Security events, PowerShell logging and Sysmon
• Active Directory and Kerberos events; Linux authentication, syslog and auditd
• Firewall, proxy, DNS and web server logs; Entra ID sign-in and AWS CloudTrail logs (introduction)
• Parsing, normalization, time zones and ingestion health

Hands-on labs

• Triage a queue of sample alerts and write ticket notes
• Trace one attack across Windows, Sysmon, firewall and DNS logs

Deliverable

Ticket notes, a shift handover and a log-source reference sheet

Job skills covered

• SOC operations
• Log analysis
• MITRE ATT&CK
• CSA core concepts

Outcome: Investigate alerts in Splunk, build searches, dashboards and alerts, and read the same investigation in Sentinel's KQL.

Topics

• Splunk search language (SPL): searching, fields, stats, lookups and knowledge objects
• Dashboards, reports and scheduled alerts
• Investigating authentication, endpoint and network events
• Correlation searches and use cases
• Microsoft Sentinel and KQL: the same investigation in Microsoft's SIEM (orientation and trainer demonstration)

Hands-on labs

• Investigate a brute-force-to-compromise case in Splunk
• Build a dashboard and a scheduled alert

Deliverable

Splunk investigation notes

Job skills covered

• SIEM
• Splunk
• Microsoft Sentinel and KQL (orientation)

Outcome: Monitor endpoints with Wazuh and Sysmon, investigate an endpoint alert the way EDR analysts do, and enrich it with threat intelligence.

Topics

• Wazuh manager, agents, decoders and rules; file integrity monitoring and vulnerability detection
• EDR concepts: process trees, isolation and response, as in tools such as Microsoft Defender and CrowdStrike
• Active response and alert tuning
• Threat intelligence: feeds, reputation services, MISP concepts and enrichment

Hands-on labs

• Deploy agents, generate activity, investigate the alerts and tune a noisy rule
• Enrich indicators from an alert

Deliverable

Endpoint investigation and tuning notes

Job skills covered

• Wazuh
• EDR investigation
• Threat intelligence

Outcome: Work the common L1 alert types with playbooks, write detections mapped to ATT&CK, and hunt for what the detections miss.

Topics

• Triage playbooks: phishing email analysis (headers, SPF, DKIM, DMARC, links and attachments), brute force and password spraying, malware and ransomware alerts, suspicious PowerShell and account compromise
• Sigma rules mapped to MITRE ATT&CK
• Baselines and false-positive reduction
• Hypothesis-driven threat hunting on replayed network and Active Directory attacks
• SOAR and automation concepts

Hands-on labs

• Analyze real-world-style phishing emails
• Write and test Sigma detections
• Run a hypothesis-driven hunt

Deliverable

Detection rules and a hunt report

Job skills covered

• Phishing investigation
• Detection engineering
• Threat hunting
• CSA core concepts

Outcome: Handle an incident from detection to recovery, and communicate it clearly to management and to authorities where required.

Topics

• The incident handling and response process: preparation, detection and analysis, containment, eradication, recovery and lessons learned
• Playbooks for malware, email, web application, network, insider and cloud incidents
• First response, evidence preservation and escalation
• CERT-In six-hour reporting and data breach duties under India's DPDP Act
• Incident communication and the incident report

Hands-on labs

• Run a tabletop exercise
• Contain and eradicate a simulated malware incident

Deliverable

Incident handling report

Job skills covered

• Incident response
• NIST incident response lifecycle
• ECIH core concepts

Outcome: Prove what happened: acquire and analyze disk, memory, network and email evidence, examine suspicious files, and build a defensible timeline.

Topics

• The forensic investigation process, chain of custody and order of volatility
• Disk acquisition and analysis with Autopsy; Windows file systems and artifacts
• Memory forensics with Volatility
• Network and email forensics
• Linux forensics basics
• Malware analysis basics: static and dynamic analysis in a sandbox, and extracting indicators of compromise
• Anti-forensics awareness, timelines and the forensic report

Hands-on labs

• Investigate a disk image and a memory image from a simulated breach
• Analyze a suspicious file in a sandbox

Deliverable

DFIR investigation report

Job skills covered

• Digital forensics
• Malware analysis
• Root cause analysis
• CHFI core concepts

Outcome: Use an AI assistant to work faster on alerts and notes, without letting it make the decision.

Topics

• Summarizing alerts, explaining log events and drafting incident notes with an LLM assistant
• Drafting search queries and Sigma rules with AI, then testing them against real events
• Limits: hallucinations, privacy of log data and a human decision on every escalation
• Watching AI applications for prompt injection and misuse

Hands-on labs

• Draft and verify a detection with AI help

Deliverable

Verified AI-assisted detection

Job skills covered

• Responsible AI use in the SOC

Outcome: Handle a live, timed multi-alert shift, from first alert to forensic findings, escalation and handover.

Topics

• A timed multi-alert simulation with written investigations
• CTF challenges on detection, investigation and forensics
• An incident case with evidence, a timeline, a shift handover and an escalation
• Technical oral exam on your investigation

Hands-on labs

• Timed simulation

Deliverable

SOC monitoring and detection report, and DFIR report

Job skills covered

• End-to-end SOC and DFIR investigation