Hack Theory Academy banner with a secure network and Linux terminal design

~/academy/catalog

From first command to defensible systems.

Every core course is free. Work through the modules, complete the listed labs only in systems you own or purpose-built training environments, then use quizzes and path screens to check your understanding.

BEGINNER

Cybersecurity Foundations

Build a precise mental model of risk, identity, data, and incident handling.

  1. Threats and risk: assets, actors, attack surface, likelihood, and impact.
  2. Identity: MFA, sessions, least privilege, secrets, and recovery.
  3. Host and data defense: patching, backups, encryption, logging, and EDR.
  4. Incident workflow: preparation, detection, containment, eradication, recovery, lessons learned.

Lab: create a threat model for a small web service. Assessment: identify three controls and the detection evidence each should produce.

BEGINNER → INTERMEDIATE

Networking and Packet Analysis

Understand what crosses the wire and how defenders reason from it.

  1. Models and addressing: Ethernet, IP, TCP/UDP, ports, subnetting, and routing.
  2. Core services: ARP, DNS, DHCP, HTTP, TLS, and NAT.
  3. Packet workflow: filters, flows, handshakes, timing, retransmission, and baselines.
  4. Detection: scans, beacons, unusual DNS, lateral movement, and encrypted-traffic metadata.

Lab: capture traffic from your own test client resolving and loading a local service. Assessment: annotate the DNS and TCP/TLS sequence.

BEGINNER → ADVANCED

Linux Command Line and Automation

Operate safely, make changes observable, and automate repeatable work.

  1. Shell fundamentals: paths, quoting, pipes, redirection, exit codes, and help pages.
  2. Files and processes: ownership, permissions, services, signals, logs, and resource use.
  3. Text and network tools: grep-style searching, structured output, SSH, curl, DNS, and sockets.
  4. Safe scripting: strict modes, input validation, temporary files, logging, testing, and rollback.

Lab: write a Bash health check for a local service that never prints secrets. Assessment: explain failure modes and safe retry behavior.

INTERMEDIATE

Secure Web and Software Engineering

Design frontend, backend, and delivery systems that fail safely.

  1. Trust boundaries: validation, encoding, authentication, authorization, and sessions.
  2. Data layer: parameterized queries, migration safety, encryption, and least-privilege service accounts.
  3. Browser security: CSP, cookies, CORS, CSRF, XSS, dependencies, and supply chain.
  4. Delivery: reviews, tests, secret scanning, SBOMs, staged deployment, telemetry, and rollback.

Lab: harden a deliberately vulnerable local demo app. Assessment: pair each fix with a regression test and observable alert.

INTERMEDIATE → ADVANCED

Blue, Red, and Purple Team Operations

Practice authorized testing and detection improvement as one feedback loop.

  1. Blue: telemetry design, triage, timelines, containment, and detection engineering.
  2. Red: rules of engagement, safe emulation, evidence handling, stop conditions, and reporting.
  3. Purple: map tests to measurable objectives, compare evidence, tune, and retest.
  4. Communication: severity, uncertainty, mitigation owners, validation, and executive summaries.

Lab: run a benign authentication-failure simulation in a local lab. Assessment: produce a detection query, response checklist, and retest result.

Progression: start with /study-tip, answer scheduled quizzes, complete both /ctf-start labs, and use /path-screen. A passing screen creates a staff recommendation; it never grants trust or permissions automatically.