All learning paths
Every path in the free KashSec cybersecurity course — 26 paths and 485 lessons, from complete beginner to advanced offensive and defensive security.
Path 00: Computer Basics & Security Mindset
For complete beginners — what a computer is, how the internet works, and staying safe online before anything else. (Absolute fresher · 12 lessons)
- What is a computer really?
- How the internet works
- Using your web browser safely
- Wi-Fi & connecting safely
- Files, folders & organizing yourself
- Updates & backups: the boring habits that save you
- Email basics & safety
- Passwords & accounts basics
- Common tech scams for beginners
- Staying safe online
- Building good digital habits
- How to learn tech effectively
Path 01: Introduction to Cybersecurity
What security is, why it matters, hacker types, the law, how to learn well. (Absolute beginner · 12 lessons)
- What is cybersecurity?
- Why it matters to you
- The CIA Triad: the three things security actually protects
- Types of hackers & careers
- A tour of common cyberattacks
- The golden rule: permission
- Cybersecurity laws & ethics, beyond the golden rule
- Security frameworks: a beginner's map
- How to actually learn this
- Building your first home lab
- Joining the security community
- Security Mindset Lab
Path 02: Networking Fundamentals
Networks, IP, ports, packets, TCP/UDP, DNS, HTTP/HTTPS — the bedrock. (Beginner · 20 lessons)
- What is a network?
- Routing basics
- IP addresses
- Subnetting & CIDR notation
- NAT & Port Forwarding
- Ports: the doors
- Packets & the OSI layers
- Switches & VLANs
- What is a protocol?
- TCP vs UDP
- Wireless networking basics
- DNS: the phonebook
- HTTP & HTTPS
- Firewalls: the basics
- Common Network Attacks: An Overview
- Network Troubleshooting Tools
- DNS Lab
- Cloud & Modern Networking
- Network Security Careers & Certifications
- Practical Packet Analysis Intro
Path 03: Operating Systems & Linux
Install Kali in VirtualBox, then a full tour of the Linux command line. (Beginner · 26 lessons)
- What is an operating system?
- Windows vs Linux vs macOS
- Why hackers love Linux
- Choosing a Linux distro for security work
- What is virtualization?
- Install VirtualBox
- Install Kali Linux
- Snapshots & safety
- Meet the terminal
- The Linux Filesystem Hierarchy
- Files & folders
- Text Processing Tools: Beyond grep
- Users, permissions & sudo
- Linux Package Management
- Linux Process Management
- Linux Networking Commands
- SSH & Remote Access
- Linux Cron & Scheduling
- Linux Logging Basics
- Linux Firewall Basics
- Your first bash script
- Shell Scripting Security Pitfalls
- A Practical Linux Hardening Checklist
- Linux Careers & Certifications
- Advanced Terminal Lab
- Linux Forensics Basics Lab
Path 04: Programming & Python
Programming from zero, then Python — build a real password-strength tool. (Beginner · 22 lessons)
- What is programming?
- Variables & data types
- Dictionaries & sets
- Decisions with if/else
- Loops: repeat things
- Error handling & exceptions
- Why Python for security
- Your first Python program
- String manipulation & regex
- Lists & functions
- Working with files in Python
- Python modules & packages
- Build a password checker
- Object-oriented Python basics
- Writing Secure Python Code
- Where to go next
- Python, requests & APIs
- Python for network scripting
- Python Security Libraries: An Overview
- Automation for Security
- Python Careers & Next Steps
- Security Scripting Lab
Path 05: How the Web Works
Requests, HTML/CSS/JS, client/server, cookies, APIs, DevTools. (Beginner · 18 lessons)
- The page-load journey
- How browsers render pages
- HTML, CSS & JavaScript
- Client vs server
- HTTP methods & status codes
- Cookies, sessions, logins
- Browser storage basics
- Same-Origin Policy & CORS
- APIs & JSON
- WebSockets & the real-time web
- Browser DevTools
- Web forms & input handling
- Content Security Policy basics
- Anatomy of a web app
- Web caching basics
- Web frameworks: an overview
- Cookies & Sessions Lab
- Browser DevTools Lab
Path 06: Cryptography Fundamentals
Crypto concepts get used everywhere in this course — this path teaches them from zero: encoding vs encryption vs hashing, AES, RSA, certificates, and the mistakes that keep breaking real systems. (Beginner · 14 lessons)
- What is cryptography?
- Symmetric Encryption
- Asymmetric Encryption
- Key Exchange & Diffie-Hellman
- Elliptic Curve Cryptography
- Hashing Explained
- Digital Signatures & Certificates
- The TLS Handshake, Step by Step
- Common Cryptographic Attacks
- Common Crypto Mistakes
- Applied Cryptography: Choosing and Using It Correctly
- Blockchain & Cryptocurrency Cryptography
- Post-Quantum Cryptography
- Crypto Hands-On Lab
Path 07: Windows Security Basics
Path 03 went deep on Linux — this path does the same for Windows: architecture, the Registry, Event Viewer, PowerShell, and a full hardening checklist. (Beginner · 14 lessons)
- Windows Fundamentals for Security
- Windows Security Settings
- RDP & Remote Access Security
- Windows Event Viewer
- Recognizing a Compromised Windows Machine
- Windows User Accounts & UAC
- Windows Active Directory: The Basics
- Windows Group Policy Basics
- Windows Command Line Basics
- Windows Services & Task Manager, for Security
- Securing a Windows Machine
- Windows Backup & Recovery
- Windows Privilege Escalation: An Introduction
- Windows Security Lab
Path 08: Cloud Computing Basics
Path 16 jumps straight into cloud security — this path builds the foundation first: what cloud computing is, storage, networking, IAM, and the shared responsibility model. (Beginner · 14 lessons)
- What is Cloud Computing?
- Cloud Providers Overview
- Cloud Compute Basics
- Cloud Serverless Basics
- Cloud Storage Basics
- Cloud Databases Basics
- Cloud Networking Basics
- Cloud Logging & Monitoring Basics
- Cloud Cost & Billing Security
- Cloud Identity & Access Management
- Cloud Multi-Account Governance
- The Shared Responsibility Model
- Cloud Security Careers & Certifications
- Cloud Basics Hands-On Lab
Path 09: Digital Privacy & Personal Security
A full path on protecting yourself, not just systems — your digital footprint, VPNs, browser tracking, secure messaging, identity theft, and a complete personal security audit. (Beginner · 14 lessons)
- Your Digital Footprint
- Social Media Privacy & Oversharing
- VPNs Explained
- Browser Privacy
- Privacy-Focused Tools & Alternatives
- Secure Communications
- Device & Location Privacy
- Data Broker Opt-Outs
- Identity Theft Protection
- Privacy Laws & Your Rights
- Privacy Settings Audit
- Protecting Family & Children's Privacy
- Deleting Your Digital Footprint
- Personal Security Capstone Lab
Path 10: Cybersecurity Fundamentals
CIA triad, risk, malware, hashing, phishing, MFA, frameworks. (Beginner→Intermediate · 20 lessons)
- The CIA triad
- Defense in depth
- Threats, vulns & risk
- Types of security controls
- Vulnerability Management Basics
- Attackers & the kill chain
- Insider Threats
- Malware families
- Supply Chain Security Basics
- Passwords & hashing
- Phishing & social eng.
- Security Policies & Awareness Training
- MFA, updates, backups
- Incident Response Basics
- Business Continuity & Disaster Recovery
- Physical Security Basics
- Frameworks & compliance
- Security Metrics & KPIs
- Risk Assessment Lab
- Social Engineering Lab
Path 11: Web Security & Hacking
OWASP Top 10, Burp, IDOR, XSS, SQLi, command injection, SSRF, JWT. (Intermediate · 26 lessons)
- The OWASP Top 10
- Burp Suite & PortSwigger
- Web recon
- Path Traversal Basics
- Broken access & IDOR
- CSRF — Cross-Site Request Forgery
- Clickjacking
- Cross-Site Scripting
- Web Security Headers: A Deep Dive
- SQL Injection
- Business Logic Vulnerabilities
- Race Conditions in Web Applications
- Command inj. & uploads
- XXE — XML External Entity Injection
- Local & Remote File Inclusion (LFI/RFI)
- Insecure Deserialization
- SSRF & auth attacks
- API Security Fundamentals
- GraphQL Security Basics
- Web Application Firewalls (WAFs)
- Secure Coding for Web Developers
- Your 90-day roadmap
- Advanced Burp Suite Lab
- Advanced JWT Lab
- SSRF & JWT Lab
- XSS Practical Lab
Path 12: Network Security
Nmap, Wireshark, firewalls, VPNs, IDS/IPS, Wi-Fi attacks, MITM. (Intermediate · 20 lessons)
- Why network security matters
- Scan networks with Nmap
- See traffic with Wireshark
- Network Forensics Basics
- ARP Spoofing, Hands-On
- Firewalls, VPNs, proxies
- VPN Protocols: A Deep Dive
- Network Segmentation in Practice
- IDS, IPS & SIEM
- Network Security Monitoring Tools
- Network Access Control (NAC)
- Wi-Fi security & attacks
- Bluetooth & IoT Network Security
- DNS Attacks, Hands-On
- Man-in-the-Middle
- DDoS Attacks & Mitigation
- Cloud Network Security
- Your network-security path
- Advanced Nmap Lab
- Advanced Wireshark Lab
Path 13: Mobile App Security
Android & iOS security from the ground up — APK analysis, insecure storage, traffic interception, certificate pinning bypass, and exported component vulnerabilities. (Intermediate→Advanced · 18 lessons)
- Mobile Security Fundamentals
- Android Permissions Deep Dive
- Setting Up a Mobile Testing Lab
- OWASP Mobile Top 10
- Android APK Analysis
- Reverse Engineering Mobile Apps
- Insecure Data Storage
- Mobile Authentication & Biometrics
- Intercepting Mobile Traffic
- Mobile API Security
- iOS App Security Basics
- Cross-Platform Mobile Security
- Mobile Privilege Escalation & Root Detection
- Mobile App Hardening
- Mobile Malware & App Store Security
- Mobile Device Management (MDM)
- Mobile Security Careers & Certifications
- Mobile Security Capstone Lab
Path 14: Ethical Hacking
The 5-phase methodology, from reconnaissance through reporting. (Intermediate→Advanced · 24 lessons)
- What ethical hacking really is
- Rules of Engagement, Deep Dive
- The 5 phases
- Pentest Methodologies & Standards
- Phase 1: Reconnaissance
- OSINT Tools, Deep Dive
- Phase 2: Scan & enumerate
- Vulnerability Scanning Tools
- Phase 3: Exploitation
- Exploit Development Basics
- Phase 4: Post-exploitation
- Privilege Escalation Methodology
- Lateral Movement Techniques
- Pivoting & Tunneling
- Phase 5: Reporting
- Red Team vs. Penetration Testing
- Social Engineering in Pentests
- Wireless Pentesting Basics
- Purple Teaming Basics
- Your ethical-hacking path
- Advanced Exploitation Lab
- Metasploit Practical Lab
- Practical Reconnaissance Lab
- Reporting Lab
Path 15: Bug Bounty
Programs, recon pipelines, hunting IDOR & logic bugs, reports that pay. (Intermediate→Advanced · 18 lessons)
- What is a bug bounty?
- Bug bounty platforms, deep dive
- Choosing programs
- Scope and legal boundaries
- The recon pipeline
- Burp Suite for bug bounty workflow
- Reports that get paid
- Hunting IDOR
- Hunting XSS & injection bugs
- Business logic & chains
- Race conditions, deep dive
- Automation & nuclei
- Mobile & API bug bounty
- The bug-bounty career
- Duplicates & triage realities
- Bug Bounty Hunting Challenges
- Logic Bug Hunting Lab
- Recon Pipeline Lab
Path 16: Advanced Cyber Topics
Linux/Windows privesc, Active Directory, cloud, containers, malware, DFIR. (Advanced · 26 lessons)
- Linux privilege escalation
- Linux privesc tools, deep dive
- Windows privilege escalation
- Windows privesc tools, deep dive
- Active Directory attacks
- Kerberos attacks, deep dive
- AD persistence & detection
- Cloud security
- IAM, deep dive
- Containers & Kubernetes
- Kubernetes attack paths
- Malware analysis basics
- Malware persistence mechanisms
- Digital forensics & IR
- Threat hunting fundamentals
- Advanced career paths
- Cloud Security Lab
- Containers & Kubernetes Lab
- DevSecOps Lab
- Digital Forensics & IR Lab
- Malware Analysis Lab
- Practical Linux Privilege Escalation Lab
- Purple Teaming Lab
- Threat Hunting Lab
- Threat Modeling Lab
- Windows Privilege Escalation Lab
Path 17: Malware & Reverse Engineering
A deep dive into reverse engineering and malware analysis — PE internals, Ghidra disassembly, dynamic analysis, unpacking, and writing YARA detection rules. (Advanced · 17 lessons)
- Reverse Engineering Fundamentals
- x86 vs. ARM Architectures
- Malware Families Deep Dive
- C2 Frameworks and Infrastructure
- Static Analysis Deep Dive
- ELF Format & Linux Malware
- Disassembly with Ghidra
- Ghidra Scripting Basics
- Dynamic Analysis & Sandboxing
- API Hooking & Monitoring
- Unpacking & Obfuscation
- Control Flow Obfuscation, Deep Dive
- YARA Rules & Detection
- Sigma Rules & Detection Engineering
- Anti-Analysis Techniques
- Malware Triage Methodology
- Malware & RE Capstone Lab
Path 18: AI & AI Security
How LLMs work, prompt injection, OWASP LLM Top 10, AI red teaming. (Advanced · 23 lessons)
- How LLMs actually work
- Transformer Architecture, Deep Dive
- Why AI security is new
- AI Threat Modeling
- Prompt injection
- Indirect Prompt Injection, Deep Dive
- Jailbreaks & bypasses
- Jailbreak Defenses & Guardrails
- OWASP LLM Top 10
- RAG Security Risks
- Poisoning & adversarial ML
- Multimodal Attack Vectors
- AI red teaming
- AI Safety Evaluation & Benchmarking
- Your AI-security career
- Defensive Prompt Engineering
- Agentic AI Risks
- LLM Attack Taxonomy
- LLM Governance & Compliance
- LLM Red Teaming Playbooks
- LLM Supply Chain Attacks
- Practical AI Red Teaming Labs
- Securing LLM Applications
Path 19: CTF Challenges
A standalone Capture The Flag zone — self-contained hands-on puzzles across Web, API, Crypto, Forensics, AI, Misc, and Linux privesc. No new material, just applying what you've learned under pressure. (All levels · 24 lessons)
- Welcome to the CTF Zone
- Web — The IDOR Hunt
- Crypto — The Layered Cipher
- Forensics — The Log Hunt
- Web — Forge the Token
- Misc — Hidden in Plain Sight
- Crypto — Break the XOR Cipher
- Linux — The Privesc Puzzle
- API — The Order Number That Wasn't Yours
- API — The Profile Update That Went Too Far
- API — Locked Out, Sort Of
- Web — Crack the Secret
- Web — The Wrong Kind of Trust
- Web — A Key of Your Choosing
- Web — Name Your Own Price
- Web — The Coupon That Wouldn't Quit
- Web — Two Steps Forward, Zero Back
- AI — Leak the System Prompt
- AI — The Ambush in the Article
- AI — Jailbreak the Judge
- Crypto — Small Primes, Big Problem
- Forensics — The EXIF Trail
- Linux — The Binary That Betrayed Root
- Solution Write-ups: The Template Every Good CTF Player Uses
Path 20: Career Prep
Resume, portfolio, interviews, and the job search — turn your skills into an offer. (All levels · 14 lessons)
- Building your security resume
- LinkedIn Optimization for Security Roles
- Certifications that actually help
- Entry-Level vs. Experienced Career Paths
- Building projects & GitHub portfolio
- Writing Technical Blog Posts
- Job search strategy
- Navigating Recruiters & Referrals
- Interview preparation
- Salary Negotiation
- Networking & community
- Mentorship & Imposter Syndrome
- Your first 90 days in a security job
- Career Growth After Year One
Path 21: API Security
APIs are the real backend of almost every modern app — the OWASP API Top 10, BOLA/BFLA, JWT attacks, GraphQL security, and a hands-on capstone lab against a real vulnerable API. (Advanced · 24 lessons)
- Why API Security Matters
- Real-World API Breach Case Studies
- What are APIs and why do they matter for security?
- API Versioning & Shadow APIs
- OWASP API Top 10 (2023)
- API Security Standards & Frameworks
- Authentication & Authorization in APIs
- OAuth2 & OIDC, Deep Dive
- Broken Authentication & JWT Attacks
- API Key & Secret Management
- BOLA & BFLA — the two most common API authorization failures
- Webhook Security
- Mass Assignment & Excessive Data Exposure
- API Gateway Security
- Rate Limiting, Injection & Resource Abuse
- WebSocket Security
- REST vs GraphQL — security differences that matter
- gRPC & Protobuf Security
- GraphQL Security
- GraphQL Authorization Patterns
- How to actually test APIs
- API Documentation & Postman Workflows
- API Security Capstone Lab
- Your API Security Roadmap
Path 22: DevSecOps & AppSec Program
Move from finding individual bugs to building the program that prevents them at scale — SAST/DAST/SCA, CI/CD security, secrets & supply chain, threat modeling, and the metrics that earn leadership buy-in. (Advanced · 15 lessons)
- What is DevSecOps?
- Shift Left vs. Shift Right
- SAST, DAST & SCA — The Core Scanning Trio
- Infrastructure as Code (IaC) Security Scanning
- Securing the CI/CD Pipeline
- Container Image & Registry Security
- Secrets Management & Software Supply Chain
- SBOM & Software Bill of Materials
- Threat Modeling in the SDLC
- Security Champions Programs
- Metrics That Matter
- Vulnerability Management & Prioritization
- Building an AppSec Program from Scratch
- AppSec Tooling & Orchestration
- AppSec Program Capstone Lab
Path 23: GRC & Compliance
Governance, Risk, and Compliance — the non-coding path into security. ISO 27001, NIST CSF, SOC 2, vendor risk, and how to actually break into a GRC career. (All levels · 18 lessons)
- What is GRC?
- GRC Career Economics & Demand
- Security Governance Basics
- RACI & Security Committees
- Risk Management Fundamentals
- Quantitative Risk Analysis & FAIR
- ISO 27001 Overview
- ISMS Documentation & Internal Audit
- NIST Cybersecurity Framework Overview
- NIST 800-53 & Control Families
- SOC 2 and Audits
- Other Compliance Frameworks: PCI-DSS, HIPAA & Beyond
- Writing Policies People Actually Follow
- Security Awareness Training Programs
- Third-Party & Vendor Risk
- Breach Notification & Disclosure Law
- GRC Tools, Certifications & Careers
- GRC Automation Platforms, Deep Dive
Path 24: Zero Trust Architecture
Never trust, always verify — identity, device trust, micro-segmentation, ZTNA, continuous verification, and how to actually roll this out. (Advanced · 18 lessons)
- What is Zero Trust?
- Identity as the New Perimeter
- Device Trust & Posture Verification
- Micro-Segmentation & Network Design
- Continuous Verification & Adaptive Access
- Zero Trust Network Access (ZTNA) vs. Traditional VPN
- Zero Trust in Cloud-Native Environments
- Implementing Zero Trust: A Practical Roadmap
- Data-Centric Zero Trust
- Zero Trust for APIs & Microservices
- Privileged Access Management Under Zero Trust
- Zero Trust for Third Parties & Vendor Access
- Zero Trust Maturity Models
- Analytics & Monitoring for Zero Trust
- Common Zero Trust Pitfalls
- Zero Trust for Remote & Hybrid Work
- Zero Trust Careers & Certifications
- Case Studies & Capstone: Assess a Zero Trust Maturity
Path 25: OT/ICS & Critical Infrastructure Security
A different world from IT: SCADA, industrial protocols, the Purdue Model, real-world ICS attacks (Stuxnet, Ukraine grid), and practical controls that respect physical safety constraints. (Advanced · 14 lessons)
- What is OT/ICS Security?
- SCADA & ICS Architecture Fundamentals
- Industrial Protocols: Modbus, DNP3, and Why Their Design Causes Security Problems
- The Purdue Model: Segmenting IT from OT
- Real-World ICS Attacks: What They Actually Teach Us
- Practical OT Security Controls
- OT Asset Inventory & Visibility
- ICS Vulnerability Management
- Safety Instrumented Systems
- ICS Incident Response
- ICS Supply Chain Risk
- IIoT & Cloud Convergence
- OT/ICS Careers & Certifications
- Capstone: Secure a Realistic Industrial Network