security
FTK Imager Tutorial: Create and Verify a Forensic Disk Image
Create a forensic disk image with Exterro FTK Imager, choose E01 settings, record evidence metadata, verify MD5 and SHA1 hashes, mount the image read-only, and keep acquisition logs.
security
Test Web Login Brute-Force Protection with Hydra and Burp Suite
Test DVWA web login brute-force protection on Kali with a small password list, Hydra http-get-form, Burp Intruder, CSRF and rate-limit caveats, and false-positive checks.
security
Browser-in-the-Browser (BITB) Phishing Attack Explained
Learn how Browser-in-the-Browser (BITB) phishing fakes an SSO login window inside a real page, how to spot painted address bars, and how passkeys and awareness limit the attack.
security
Analyze Phishing Emails with ThePhish, TheHive, Cortex and MISP
Build an authorized ThePhish lab on Kali with TheHive 4 and Cortex, submit a sanitized .eml sample, review observables and analyzer verdicts, and see where MISP fits.
security
Andriller Android Forensics Tutorial: ADB Extraction and Artifact Analysis
Install Andriller CE 3.6.3 on Kali, create known Genymotion artifacts, run an ADB acquisition, and verify SMS, call logs, and SQLite data in the HTML report.
security
Apktool Tutorial: Decompile, Modify, Rebuild and Sign APKs
Install Apktool 3.0.3 on Kali, decode InsecureShop into resources and Smali, make a harmless label change, rebuild with apktool b, sign with apksigner, and install on Genymotion while explaining signature mismatch on …
security
Android Insecure Data Storage Testing: SharedPreferences, SQLite & Files
Find InsecureShop cleartext SharedPreferences credentials on rooted Genymotion, then practice SQLite and file inspection with clearly labeled training data and scoped-storage caveats.
security
Android Deep Link Security Testing with ADB
Enumerate InsecureShop deep-link intent filters, trigger custom schemes with adb, attack weak URL validation, and check App Links verification state.
security
Drozer Android Pentesting Tutorial
Install Drozer 3.1.0 and the matching Agent on Kali and Genymotion, enumerate InsecureShop components, start an exported activity, and inspect a permission-gated content provider with careful result wording.
security
Android Exported Components Security Testing
Find android:exported activities, services, and receivers in InsecureShop, prove reachability with adb and Drozer, and show why export alone is not a vulnerability.
security
Objection Android Pentesting Tutorial
Install Objection 1.12.5 on Kali, attach to InsecureShop through frida-server on rooted Genymotion, enumerate components and storage paths, and try built-in Android jobs for SSL pinning and root detection before writing …
security
Frida Android Tutorial: frida-server, ADB and Runtime Hooking
Pin Frida 17.17.0 on Kali, install a matching frida-server on rooted Genymotion, enumerate InsecureShop, and hook Java methods to observe and modify runtime values over ADB.
security
Android SSL Pinning Bypass with Frida and Burp Suite
Prove Burp CA trust first, identify Android certificate pinning, then bypass Network Security Config and OkHttp pins with Objection and targeted Frida scripts on an authorized training APK so HTTPS appears in Burp.
security
How to Intercept Android App HTTPS Traffic with Burp Suite
Route an Android emulator or device through Burp Suite on Kali, install the Burp CA for your Android version, verify HTTPS in a browser first, then diagnose proxy and trust issues before testing apps.
security
Genymotion Android Pentest Lab: Install, Root & Connect ADB
Install Genymotion Desktop Pro on the physical host, create a rooted Android 10 device, fix VirtualBox host-only networking, and connect from Kali with adb for MobSF dynamic analysis.
security
Penetration Testing Lab Requirements: RAM, Disk, and Server Options
Plan a CompTIA PenTest+ lab as four groups instead of one giant build: start with a local VirtualBox lab, add GOAD-Light for Active Directory lessons, then cloud-native and hosted targets only when those topics appear. …
security
MobSF Tutorial: Static and Dynamic Android App Security Testing
Run MobSF 4.5.2 in Docker on Kali, scan the InsecureShop APK, triage static findings against MASVS, and validate an exported activity on Genymotion with the Dynamic Analyzer.
security
APKHunt Tutorial: Static Android APK Security Analysis
Install APKHunt on Kali, scan InsecureShop, and manually validate MASVS-style static findings including an exported-activity false negative.
security
Pentest Lab Setup: Kali Linux and Metasploitable 2 on VirtualBox
Build a penetration testing lab on VirtualBox: host-only network, Kali Linux attacker VM, and a Metasploitable 2 target, with DVWA running inside Kali for authorized ethical hacking practice.
security
Set Up an Android Pentesting Lab with Android Studio Emulator (AVD)
Build a free Android pentesting lab on Kali with Android Studio AVD, pick a Google APIs image without Play Store, verify adb, and sideload a vulnerable APK for authorized mobile testing.
security
OT/ICS Security Testing: Modbus, PLCs and Industrial Networks
Learn OT/ICS security testing with a different risk model from IT pentests: ICS architecture, Modbus TCP vs Modbus Security, local Modbus and virtual CAN labs on Kali, plus safety and controls.
security
LLM Prompt Injection Attacks: Direct, Indirect, RAG, and Agent Risks
Test LLM prompt injection as application security: direct and indirect attacks, malicious instructions in retrieved RAG content, agent tool abuse, system-prompt leakage, and a deterministic app-security simulator mapped …
security
Scapy Tutorial: Craft, Send, Sniff, and Analyze Network Packets
Learn Scapy packet crafting in Python: build IP/TCP/UDP/ICMP layers, inspect with show() and show2(), send and receive on localhost, sniff loopback traffic, and read or write PCAP files.
security
How Do People Dox Someone? Methods, Sources & How to Protect Yourself
Learn how doxxing works through usernames, social profiles, public records, data brokers and other exposed clues, what an IP can reveal, and how to audit and reduce your own online footprint.
security
How to Install GOAD-Light on Proxmox (Active Directory Hacking Lab)
Install GOAD-Light on Proxmox VE with Packer, Terraform, and Ansible, then verify the three-node Active Directory lab from Kali Linux.
security
How to Prioritize Vulnerabilities for Penetration Testing
Prioritize pentest findings using CVSS, EPSS, CISA KEV, reachability, exploit availability, and attack-path value to decide which vulnerabilities to validate first.
security
Establish Persistence on Linux and Windows After Initial Access
Learn Linux and Windows persistence techniques after initial access — cron, SSH keys, systemd, scheduled tasks, Run keys, services, local accounts, and web shells with tested lab examples and cleanup.
security
Lateral Movement on Windows with PsExec, WMI, and WinRM
Learn Windows lateral movement with PsExec, WMI, WinRM, NetExec, and Evil-WinRM — find admin-capable hosts and open remote shells from Kali in an authorized AD lab.
security
Pass-the-Hash and Pass-the-Ticket Attacks on Active Directory
Compare pass-the-hash vs pass-the-ticket in Active Directory from Kali — replay NT hashes with NetExec and Impacket, use overpass-the-hash for a Kerberos TGT, and reuse .ccache tickets on GOAD-Light.
security
Kerberoasting and AS-REP Roasting on Active Directory
Learn Kerberoasting vs AS-REP roasting with Impacket on Kali. Use GetUserSPNs and GetNPUsers, crack Kerberos tickets with hashcat or John, and verify recovered AD credentials on GOAD-Light.