Cyber Security: Offense and Defense

1. Injection: SQL and command

Injection happens whenever data a user typed is treated as code. It has been near the top of the OWASP Top Ten for twenty years because it is easy to write by accident and devastating when found. This lesson shows exactly how SQL injection and command injection work, how to find them, and the one habit that eliminates them: never build code out of strings.

2. XSS, CSRF and the browser's defences

The browser is where web attacks land. Cross-site scripting runs the attacker's JavaScript in your user's session; cross-site request forgery makes the user's browser act without their knowledge. This lesson explains both precisely, demonstrates them against a practice app, and covers the modern defences: output encoding, Content Security Policy, SameSite cookies and the tokens that frameworks add for you.

3. Authentication, sessions and access control

Broken access control is now the number one web vulnerability. It is not clever; it is a server that forgets to check who is asking. This lesson covers how to store passwords, how sessions and JWTs work and fail, multi-factor authentication, and the systematic way to test every endpoint for the question 'but am I allowed?'.

1. Rules of engagement and reconnaissance

What separates a penetration tester from an intruder is not skill but permission and method. This lesson sets out the legal and contractual frame that makes testing lawful, the phases of a structured engagement, and the first phase in depth. Reconnaissance is where most of the real insight comes from: what an organisation has exposed on the internet, which of its names and addresses it has forgotten, and what its staff have revealed without meaning to. You will learn to gather that information passively, record it properly, and turn it into an attack-surface map.

2. Exploitation and privilege escalation

Once you know what is running, you ask whether it can be abused and, if it can, how far the access goes. This lesson covers how vulnerabilities are named and scored (CVE and CVSS), how to match a service version to published weaknesses, what a shell is and how exploitation usually ends with one, and the Linux checks that turn a low-privilege foothold into full control. Every technique is practised on purpose-built vulnerable machines, and every lesson ends with the fix a defender would apply.

1. Logging, detection and the SIEM

An attack that leaves no trace has not been detected; it has simply not been looked for. This lesson explains how defenders decide what to record, how to collect logs from many systems into one place, how detection rules are written and tested, and how a security information and event management (SIEM) platform turns a flood of events into a short list of things worth a human's attention. It closes with the failure modes that make monitoring useless: silence, noise and rules nobody maintains.

2. Hardening, patching and incident response

Detection tells you something is wrong; hardening reduces how often it happens, and response decides how much it costs. This lesson sets out how to prioritise hardening and patching when there is always more to do than time, how to protect data with backups that have actually been restored, and how the incident-response lifecycle structures what to do in the first hours of a breach. The examples are drawn from the attacks in the previous lessons, so the response is grounded in a concrete timeline.