Learning Roadmap

Explore the roadmap.
Start with the right track.

A structured path across the full library. Pick a track, see the sequence, and open the exact course or lesson you want next.

6 tracks21 courses250 lessons

Selected Track

Advanced Hacking

This track contains 4 courses and 46 lessons. Follow the order if you want the clearest progression.

Open First Course
1

Course 1

Hacking Windows & Active Directory: Pass-the-Hash, Mimikatz, and Pivoting

6 chapters14 lessons
Open CourseStart First Lesson

Chapters

1

Understanding Active Directory

3 lessons
01Active Directory Structure — Domains, Forests, and ControllersFree02AD Protocols: LDAP, Kerberos and SMB03Setting Up the Windows Active Directory Lab
2

Active Directory Enumeration

2 lessons
04Active Directory Enumeration: enum4linux, ldapdomaindump, and CrackMapExec05BloodHound and SharpHound: Mapping Attack Paths
3

Credential Attacks

3 lessons
06Pass-the-Hash: Reusing an NTLM Hash07Kerberoasting: Attacking Service Accounts08AS-REP Roasting: Attacking Accounts Without Pre-authentication
4

Lateral Movement

2 lessons
09Lateral Movement: PSExec and SMB10Lateral Movement: WMI and WinRM
5

Windows Privilege Escalation

2 lessons
11Mimikatz: Extracting Credentials from LSASS12Token Impersonation: Windows Privilege Escalation
6

Active Directory Persistence

2 lessons
13Golden Ticket: Ultimate Kerberos Persistence14DCSync: Dumping All Domain Hashes
2

Course 2

C2 & Post-Exploitation

5 chapters12 lessons
Open CourseStart First Lesson

Chapters

1

Understanding C2

2 lessons
01What is a C2?Free02Listener / Agent / Teamserver Architecture
2

Advanced Metasploit

3 lessons
03Advanced Meterpreter04Metasploit Post-Exploitation Modules05Pivoting with Metasploit
3

Cobalt Strike concepts

2 lessons
06Beacon and Listeners — C2 Concepts07Malleable C2 Profiles
4

Persistence

2 lessons
08Windows Persistence09Linux Persistence
5

Pivoting & Tunneling

3 lessons
10SSH Port Forwarding11Proxychains and SOCKS12Chisel and ligolo-ng
3

Course 3

Privilege Escalation Linux

5 chapters10 lessons
Open CourseStart First Lesson

Chapters

1

Fundamentals

2 lessons
01Linux Post-Exploitation EnumerationFree02SUID & SGID
2

Sudo Abuse

2 lessons
03Sudo Abuse04Sudoers Misconfigurations
3

Scheduled Tasks & Services

2 lessons
05Cron Jobs06Vulnerable Services
4

Advanced Techniques

3 lessons
07Linux Capabilities06Path Hijacking08Weak File Permissions
5

Kernel & Wrap-up

1 lessons
09Kernel Exploits
4

Course 4

Privilege Escalation Windows

5 chapters10 lessons
Open CourseStart First Lesson

Chapters

1

Fundamentals

2 lessons
01Windows Post-Exploitation EnumerationFree02Unquoted Service Paths
2

Registry & Installers

2 lessons
03AlwaysInstallElevated04Registry Misconfigurations
3

DLL & Services

2 lessons
05DLL Hijacking06Weak Service Permissions
4

Token Abuse

2 lessons
07SeImpersonatePrivilege08Token Impersonation
5

Advanced Techniques

2 lessons
09Autorun & Startup Abuse10Credential Dumping Windows

Next Step

Want the guided version instead?

The roadmap shows the structure of the library. The bootcamp gives you the same idea as a guided path with a fixed starting point.

Open Bootcamp