Free Online Course · Self-paced · Hands-on

Ethical Hacking & Penetration Testing Tutorial (Hands-On)

Free, hands-on ethical hacking course on Kali Linux covering lab setup, recon, password cracking, phishing, web, wireless, and mobile attacks.

  • 10 chapters
  • 94 lessons
  • ~30h
  • Beginner to Advanced
  • Tested with Kali Linux Rolling 2026.2
  • Updated Sep 2026
Start the course View syllabus
Ethical Hacking & Penetration Testing Tutorial (Hands-On)
By Last updated

About this course

This is a free, hands-on course in offensive security, built around a real lab and the tools practitioners actually use. It walks the full kill chain: lab setup with multiple Kali variants and vulnerable targets, then reconnaissance and OSINT, password cracking, phishing, web, wireless, and mobile attacks, exploitation frameworks, and finishing on the defensive side with digital forensics.

Every technique here is meant for authorized testing on systems you own or have explicit written permission to test. The whole lab runs on isolated VMs on your own machine for exactly that reason, so you can break things freely without touching anything that is not yours. Unauthorized access is a criminal offense in most jurisdictions regardless of intent, so keep your practice inside the lab.

If you are new, the order matters: build the lab first, then move through recon, attacks, and forensics. If you already know your way around Kali, each lesson stands on its own, so jump to password cracking, Burp Suite, or mobile pentesting as you need them.

What you'll learn

  • Set up a fully-isolated penetration testing lab on any host OS
  • Run reconnaissance and OSINT using industry-standard tools
  • Crack passwords, run brute-force attacks, and generate custom wordlists
  • Launch and analyze phishing campaigns ethically (red-team training)
  • Pentest web applications, mobile apps, and wireless networks
  • Use Metasploit, BeEF, Burp Suite, and other major exploitation frameworks
  • Perform digital forensics on disk images and memory dumps

Who this course is for

  • Beginners who want to learn offensive security the way it is actually practiced
  • Security students and CTF players building a hands-on tool set
  • Sysadmins and developers who want to see how their systems get attacked
  • Aspiring red teamers working toward a pentest role or certification

Prerequisites

  • Solid Linux command-line skills (cd, grep, ssh, package management)
  • Basic networking knowledge (TCP/IP, ports, DNS, HTTP)
  • A workstation that can run virtual machines (8 GB RAM minimum)
  • Legal warning: only run these techniques against systems you own or have explicit written permission to test

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Kali Linux Rolling 2026.2 Attacker OS for every tool lesson (kali-rolling)
Metasploit Framework 6.4.x Exploitation and payload generation, paired with Nmap 7.99
Metasploitable 2 2.0.0 Intentionally vulnerable Linux target
Oracle VirtualBox 7.x Host-only network for the isolated lab
Burp Suite 2026.8 (Community) Web application proxy and request tampering

Syllabus

10 chapters · 94 lessons · ~30h of reading

  1. 1 Set Up Your Lab 18 lessons · ~2h 45m
    1. Part 1 Create a Kali Linux bootable USB 6 min read
    2. Part 2 Install Kali Linux in VirtualBox 9 min read
    3. Part 3 Install Kali Linux on Apple M1 with UTM 8 min read
    4. Part 4 Install Kali Linux on Android 8 min read
    5. Part 5 Install Kali Linux on Raspberry Pi 5 min read
    6. Part 6 Dual boot Ubuntu and Kali Linux 10 min read
    7. Part 7 Dual boot Windows 10 and Linux 8 min read
    8. Part 8 Install Kali Linux apps on Ubuntu 15 min read
    9. Part 9 Manage Kali Linux repositories 11 min read
    10. Part 10 Pentest lab setup (Kali, Metasploitable, DVWA) 14 min read
    11. Part 11 Learn hacking using Metasploitable 2 17 min read
    12. Part 12 Install the CAINE forensics VM 6 min read
    13. Part 13 Install airmon-ng on Kali Linux 8 min read
    14. Part 14 Install Pyrit on Kali Linux 8 min read
    15. Part 15 Install Gobuster on Ubuntu 8 min read
    16. Part 16 Set up ProxyChains on Kali Linux 10 min read
    17. Part 17 Install Tor Browser on Linux 8 min read
    18. Part 18 Install Tor Browser on Rocky Linux 6 min read
  2. 2 Reconnaissance and OSINT 16 lessons · ~3h 26m
    1. Part 19 Complete Shodan tutorial 15 min read
    2. Part 20 OSINT with the Mitaka browser extension 5 min read
    3. Part 21 OSINT automation with SpiderFoot 13 min read
    4. Part 22 OSINT with the InfoOze tool 10 min read
    5. Part 23 Automated pentesting with Nettacker 11 min read
    6. Part 24 Banner grabbing techniques 16 min read
    7. Part 25 DNS enumeration 17 min read
    8. Part 26 Subdomain enumeration tools 13 min read
    9. Part 27 Find hidden endpoints with fuzzing 15 min read
    10. Part 28 SMTP and SMB enumeration 14 min read
    11. Part 29 Secrets enumeration with TruffleHog 12 min read
    12. Part 30 Network sniffing with Wireshark and tcpdump 14 min read
    13. Part 31 Recon scripting with Bash and Python 15 min read
    14. Part 32 How doxing works (and how to defend against it) 14 min read
    15. Part 33 Track an IP address using an image 5 min read
    16. Part 34 Use canary tokens for breach detection 17 min read
  3. 3 Password Cracking and Brute Force 8 lessons · ~1h 42m
    1. Part 35 Crack password hashes 17 min read
    2. Part 36 John the Ripper password cracker 14 min read
    3. Part 37 Generate custom wordlists 13 min read
    4. Part 38 SSH brute-force attack 12 min read
    5. Part 39 Brute-force web forms 14 min read
    6. Part 40 Postgres brute-force attack 11 min read
    7. Part 41 VNC brute-force attack 5 min read
    8. Part 42 Bypass an Android lock screen 16 min read
  4. 4 Phishing and Social Engineering 12 lessons · ~2h 19m
    1. Part 43 Social engineering attack types explained 13 min read
    2. Part 44 Social Engineering Toolkit (SET) phishing 13 min read
    3. Part 45 Install the Gophish phishing framework 9 min read
    4. Part 46 Create a phishing campaign with Gophish 11 min read
    5. Part 47 FiercePhish legacy campaign lab 13 min read
    6. Part 48 Snapchat phishing simulation 5 min read
    7. Part 49 Zphisher phishing awareness lab 11 min read
    8. Part 50 Phishing simulations with SocialFish 5 min read
    9. Part 51 Lockphish v2 PIN phishing attack 5 min read
    10. Part 52 Browser-in-the-browser (BitB) phishing 14 min read
    11. Part 53 Analyze phishing emails with ThePhish 20 min read
    12. Part 54 Analyze malicious PDF payloads 20 min read
  5. 5 Web Application Pentesting 13 lessons · ~2h 34m
    1. Part 55 DVWA - Damn Vulnerable Web Application 11 min read
    2. Part 56 Install DVWA on Kali Linux 14 min read
    3. Part 57 SQL injection on DVWA 15 min read
    4. Part 58 Install OWASP Juice Shop 14 min read
    5. Part 59 Burp Suite proxy tutorial 12 min read
    6. Part 60 ffuf web fuzzing tutorial 14 min read
    7. Part 61 Cross-site request forgery (CSRF) 9 min read
    8. Part 62 Bypass CSRF protection 14 min read
    9. Part 63 Server-side request forgery (SSRF) 9 min read
    10. Part 64 Local File Inclusion (LFI) attack 9 min read
    11. Part 65 Web cache deception attack 5 min read
    12. Part 66 WordPress vulnerability scanning with WPScan 22 min read
    13. Part 67 Set up a WordPress reverse shell 6 min read
  6. 6 Network Attacks (WiFi, MITM, DoS) 7 lessons · ~1h 16m
    1. Part 68 WiFi password attack techniques (WPA/WPA2) 15 min read
    2. Part 69 WPA2 WiFi honeypot tutorial 11 min read
    3. Part 70 Evil twin WiFi attack 12 min read
    4. Part 71 Man-in-the-middle via ARP spoofing 16 min read
    5. Part 72 MITM attacks with Xerosploit 6 min read
    6. Part 73 Change your MAC address on Linux 8 min read
    7. Part 74 DDoS attack example (in your own lab) 8 min read
  7. 7 Exploitation Frameworks 6 lessons · ~1h 8m
    1. Part 75 Metasploit tutorial 18 min read
    2. Part 76 BeEF browser exploitation framework 13 min read
    3. Part 77 Reverse shell cheat sheet 10 min read
    4. Part 78 Encode payloads with Shellter 11 min read
    5. Part 79 Undetectable Windows payload with TechnoLogger 5 min read
    6. Part 80 Windows remote access trojan (RAT) walkthrough 11 min read
  8. 8 Mobile Pentesting 7 lessons · ~1h 28m
    1. Part 81 Android Studio AVD pentest lab (free) 12 min read
    2. Part 82 APKHunt - Android app pentesting 17 min read
    3. Part 83 Mobile Security Framework (MobSF) walkthrough 15 min read
    4. Part 84 Embed a payload in an APK file 7 min read
    5. Part 85 Obfuscate Android payloads with APKBleach 5 min read
    6. Part 86 Ghost Framework Android ADB lab 13 min read
    7. Part 87 L3MON Android RAT panel lab 19 min read
  9. 9 Digital Forensics and Defense 6 lessons · ~1h 5m
    1. Part 88 Create a forensic disk image with FTK Imager 16 min read
    2. Part 89 Analyze memory dumps with Volatility 9 min read
    3. Part 90 Android forensics with Andriller 16 min read
    4. Part 91 Detect rootkits and malware with rkhunter 7 min read
    5. Part 92 Steganography - hide messages in images 10 min read
    6. Part 93 Encrypt a USB drive with VeraCrypt 7 min read
  10. 10 Project Management 1 lesson · ~11 min
    1. Part 94 Manage pentest projects with Cervantes 11 min read

Hands-on labs

6 guided builds you run yourself

  1. Build the Kali, Metasploitable, and DVWA lab

    Stand up an isolated host-only network with an attacker box and vulnerable targets before you run anything.

  2. Exploit Metasploitable 2 end to end

    Scan services with Nmap, map them to Metasploit modules, and land shells through known backdoors.

  3. Crack password hashes with hashcat

    Identify hash types and run dictionary, rule, mask, and hybrid attacks with sessions and restore.

  4. Run a phishing campaign with Gophish

    Build a sending profile, template, and landing page, launch a lab campaign, and read the results.

  5. Intercept and tamper web requests with Burp

    Proxy DVWA through Burp, edit requests in Repeater, and automate them with Intruder.

  6. Analyze a memory dump with Volatility

    Pull processes, network connections, and command lines out of a captured image on the defensive side.

Where to go after this course

  • CompTIA PenTest+ courseThe structured, exam-aligned version of this material if you want a certification path.
  • Wireshark courseRead the traffic your attacks generate and sharpen your recon skills.
  • Rules of engagementThe legal and scoping groundwork you need before testing anything you do not own.

Frequently Asked Questions

Only against systems you own or have written authorization to test. This course keeps everything on isolated lab VMs so nothing you do reaches a real network. Running these tools against machines, websites, or accounts you do not control is illegal in most countries, and intent does not change that, so build the lab and stay inside it.

Do I need programming or deep Linux skills first?

You need comfort on the Linux command line (moving around, editing files, installing packages) and a basic grasp of TCP/IP, ports, DNS, and HTTP. You do not need to be a developer, but some Bash and Python help a lot once you reach recon scripting and exploitation, and the course introduces what you need as you go.

Do I have to use Kali Linux?

Kali is recommended because the tools these lessons use ship preinstalled and stay updated together, which removes a lot of setup friction. You can run many of the same CLI tools on Ubuntu with apt when you keep Ubuntu as the host—see install Kali Linux tools on Ubuntu safely—but the walkthroughs assume Kali Rolling, so you will spend less time troubleshooting versions if you match the lab attacker OS.

What hardware do I need for the lab?

A workstation that can run virtual machines, with 8 GB of RAM as a realistic minimum. You run Kali as the attacker plus one or more vulnerable targets like Metasploitable and DVWA on a host-only network, so more RAM helps once you add Windows or Active Directory targets.

Should I take this or the CompTIA PenTest+ course?

Take this course if you want a broad, tool-first tour of offensive security with no exam attached. Move to the CompTIA PenTest+ course when you want the same skills organized against a certification blueprint, with scoping, reporting, and Active Directory labs mapped to exam domains. Many readers do this one first, then the cert course.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)