Cyber Security — Program 03
Red Team — Beginner to Advanced
This is the course students ask for, and we will tell you plainly in the counselling call that junior offensive roles are fewer than junior defensive ones and the bar is higher. That is a reason to be serious about it, not to avoid it. Sixteen weeks from scoping and recon through web, privilege escalation and Active Directory, ending in an engagement delivered the way a client receives one.
( Who it is for )
You need
- Foundations, or pass its entry test. You need networking, Linux and Windows internals, scripting and a working lab.
It prepares you for
- Junior Penetration Tester, security consultant, bug bounty
- CompTIA PenTest+
- a credible on-ramp to OSCP
( Curriculum — 16 weeks )
Method, recon and the web
Nothing is touched before the first week is understood.
- Scoping, rules of engagement, authorisation
- Note-taking that becomes a report
- OSINT and attack surface mapping
- Nmap and service enumeration
- Burp Suite as a working environment
- OWASP Top 10, APIs and JWT attacks
Getting in and up
Exploitation, then the part that actually takes the time.
- Vetting public exploits
- Metasploit and manual exploitation
- Shells, payloads and stabilisation
- Linux privilege escalation
- Windows privilege escalation
- Credential theft
Active Directory
Where real internal engagements are won, and where most courses stop short.
- Domain enumeration and BloodHound
- Kerberoasting and AS-REP roasting
- Password spraying within lockout policy
- Pass-the-hash and pass-the-ticket
- ACL, delegation and GPO abuse
- Pivoting across subnets
Breadth and the engagement
The rest of the attack surface, then the deliverable.
- Phishing campaigns and pretexting
- Wireless attacks
- Cloud misconfiguration and IAM paths
- Evasion, to the depth a report needs
- Purple team with the Blue Team cohort
- Capstone engagement, report and debrief
The capstone.
A multi-host Active Directory environment with a written scope and a client brief. Two weeks to run it, then a professional report and a debrief to a non-technical client. The report is worth more than the compromise — reaching halfway and documenting it properly beats domain admin and four sloppy pages, which is also how the job works.
You finish with: Written walkthroughs for every machine you solved · A web assessment, an AD assessment and a full engagement report · A public profile — labs, a blog, or bug bounty reports · PenTest+ readiness and a realistic OSCP plan.
Next batch enrolling
Enroll ↗