Cybersecurity for Beginners: From Zero to Practical Security Skills

About Course

Cybersecurity is no longer just an IT skill. It is an essential life skill for students, professionals, business owners, developers, freelancers, and anyone who uses the internet.

Every day, cybercriminals launch thousands of phishing campaigns, ransomware attacks, website hacks, identity theft attempts, and online scams. Understanding how these attacks work is the first step toward protecting yourself, your business, and your future career.

This comprehensive beginner-friendly course has been carefully designed to help you build a strong foundation in cybersecurity without assuming any prior technical knowledge.

Unlike many courses that only scratch the surface, this course provides detailed written lessons, practical examples, real-world case studies, downloadable resources, quizzes, hands-on activities, and step-by-step explanations that make even complex cybersecurity concepts easy to understand.

Whether your goal is to protect your personal data, secure your business, prepare for industry certifications, or begin a career in cybersecurity, this course provides a structured learning path from beginner to confident learner.

What You’ll Learn

Understand the core principles of cybersecurity
Learn how hackers think and how cyber attacks happen
Protect computers, websites, networks, and online accounts
Understand malware, ransomware, phishing, and social engineering attacks
Learn networking fundamentals essential for cybersecurity
Build your own cybersecurity practice lab safely
Understand ethical hacking concepts and penetration testing fundamentals
Learn website and web application security
Explore cloud security fundamentals
Understand digital privacy and online anonymity
Learn incident response and business security practices
Discover cybersecurity career paths and industry certifications
Gain practical skills using beginner-friendly security tools

Course Features

Beginner-friendly explanations
Practical hands-on exercises
Real-world cybersecurity case studies
Downloadable cheat sheets and checklists
Security templates and worksheets
End-of-module quizzes
Practice assignments
Resource libraries for further learning
Lifetime updates

Who This Course Is For

Complete beginners
University students
IT professionals
Developers
Website owners
Freelancers
Entrepreneurs
Small business owners
Digital marketers
Anyone interested in cybersecurity

Prerequisites

No previous cybersecurity knowledge is required.

Basic computer skills and an eagerness to learn are all you need.

Course Content

Module 1: The Cybersecurity Landscape & Foundation

Module 1 Assignment: Foundation Verification & Lab Environment Proof Assignment Overview Before we can move on to Module 2 and start using hacking tools like Wireshark and Nmap, we must verify two things: first, that you genuinely understand the core concepts of cybersecurity and networking; and second, that you have successfully built a safe, isolated virtual laboratory. In the professional world, you will often be asked to document your environment and explain technical concepts to non-technical management. This assignment simulates that process. Objective Prove your understanding of the CIA Triad and basic networking mechanics. Demonstrate the successful and safe construction of your VirtualBox lab. Practice communicating technical concepts for business/monetization purposes. Part 1: Conceptual Application (40 Points) Scenario: The Corner Coffee Shop Imagine you are consulting for a small, local coffee shop called “The Daily Grind.” They offer free Wi-Fi to customers and use a point-of-sale (POS) system to process credit cards. Over the past month, three strange things have happened: The owner’s laptop was hit by ransomware, locking all of their accounting spreadsheets until a ransom is paid. A customer complained that when they typed in www.dailygrind.com on their phone, it redirected to a weird website that looked exactly like the coffee shop’s site, but stole their email password. The manager noticed that the price of a large coffee was changed from $4.00 to $0.04 in the POS system database, and a customer was charged the wrong amount. Your Task: Write a short paragraph (100-150 words) addressing the owner. You must: Identify exactly which pillar of the CIA Triad was broken in each of the three scenarios (Scenario 1, Scenario 2, Scenario 3). Explain how the DNS system was involved in Scenario 2 using simple, non-technical language that the coffee shop owner can understand. Part 2: Practical Lab Verification (40 Points) Do not skip this section. You cannot proceed to Module 2 without a functioning lab. You will submit visual proof of your work. Task 1: The Virtual Machine Setup Take a screenshot of your VirtualBox Manager window. The screenshot must clearly show: Your Kali Linux VM. Your Metasploitable 2 VM. Note: Both machines do not need to be powered on at the exact same time for the screenshot, but their icons/names must be visible in the left-hand sidebar of VirtualBox. Task 2: Network Safety Proof As stated in Lesson 1.3, running a vulnerable machine on a standard network connection is dangerous. Take a screenshot of the Network Settings for your Metasploitable 2 VM. This screenshot must clearly show that the adapter is attached to Host-Only Adapter (not NAT). Pro-tip: In VirtualBox, go to your Metasploitable VM -> Settings -> Network -> Adapter 1. Take a screenshot of this exact window. Task 3: The Safety Net Take a screenshot proving that you have taken a “Snapshot” of your Kali Linux VM (or your Metasploitable VM) before you start doing any hacking in future modules. Pro-tip: The screenshot should show the Snaphots pane on the right side of the VirtualBox window with your saved snapshot visible. Part 3: The Consultant’s Pitch (20 Points) One of the easiest ways to make money with foundational IT knowledge (as discussed in Lesson 1.2) is by offering basic network troubleshooting to small businesses. Your Task: Write a 3-4 sentence “Elevator Pitch” that you could post on a local Facebook community group or Craigslist. Goal: Offer your services to fix slow networks, set up secure Wi-Fi, or map local devices. Requirement: You must naturally use at least two of the following terms in a way that makes you sound professional, but not confusing: IP Address, DNS, Router, DHCP, Ports. Example of bad phrasing: “I will fix your DHCP IP address on Port 80.” (Makes no sense). Example of good phrasing: “Is your internet dropping constantly? It might be a conflict with how your router is assigning IP addresses (DHCP). I can troubleshoot your network and get your devices communicating smoothly again.” Submission Checklist (Before you submit, ensure you have:) A written response identifying the CIA Triad breaches for the 3 coffee shop scenarios. A simple explanation of the DNS hack for the coffee shop owner. Screenshot 1: VirtualBox Manager showing both VMs. Screenshot 2: Metasploitable Network Settings showing “Host-Only Adapter”. Screenshot 3: Proof of a VirtualBox Snapshot. A 3-4 sentence professional pitch using two networking terms. Instructor Evaluation Rubric (How you will be graded) Conceptual Accuracy (40%): Did the student correctly map the three scenarios to Confidentiality, Integrity, and Availability? Did they accurately describe DNS spoofing/poisoning in plain English? Lab Execution (40%): Are the screenshots clear and unedited? Is Metasploitable definitively set to Host-Only? (If Metasploitable is set to NAT, the student will receive a 0 for this section and be asked to fix it before proceeding, as this is a critical safety protocol). Professional Communication (20%): Does the elevator pitch sound professional? Were the technical terms used correctly and contextually? (Note for LMS Admin: Set this up as a “File Upload” or “Text Entry” assignment where students can type their paragraphs and upload their 3 screenshots as a single PDF or Word document).
Lesson 1.1: The CIA Triad & The Modern Threat Landscape
Lesson 1.2: Demystifying the Tech: Networks, IPs, and DNS
Lesson 1.3: Building Your First Secure Lab (No Hardware Needed)

Module 2: Network Security & Reconnaissance

Module 2 Assignment: The Junior Analyst Assessment Assignment Overview Congratulations on making it through the technical core of network security. In the real world, a junior Security Operations Center (SOC) analyst or penetration tester is judged not by what they say they know, but by the data they can extract and present. In this assignment, you will act as a junior analyst hired to investigate a target network. You will be required to capture live traffic, enumerate a target using industry-standard tools, and build an Open Source Intelligence (OSINT) profile. This assignment pulls directly from the hands-on tutorials in Lessons 2.1, 2.2, and 2.3. Objective Prove your ability to capture and filter network traffic using Wireshark. Demonstrate proficiency with Nmap scanning flags and output interpretation. Apply Passive Reconnaissance techniques (Google Dorking, Shodan) and articulate the difference between passive and active recon. Part 1: Network Forensics with Wireshark (30 Points) Prerequisite: Your Kali Linux and Metasploitable 2 VMs must be running on your VirtualBox Host-Only network. The Scenario: You suspect an unauthorized SSH connection was made to the Metasploitable 2 server. You need to capture the traffic and prove the connection occurred. Your Tasks: Open Wireshark on Kali Linux and start a capture on your eth0 interface. Open a terminal and SSH into your Metasploitable 2 machine (Username: msfadmin, Password: msfadmin). Once logged in, run the command ls -la, then type exit to log out. Stop the Wireshark capture. Deliverables for Part 1 (Provide Screenshots and Text): Screenshot 1: Apply the display filter tcp.port == 22. Take a screenshot showing the filtered list of SSH packets. Screenshot 2: Right-click one of the SSH packets, select “Follow TCP Stream”. Take a screenshot of the pop-up window showing the conversation. Question: Look at the middle pane (Packet Details) of the very first SSH packet in your filtered list. Expand the “Transmission Control Protocol” section. What are the exact Flags set to for this first packet? (e.g., SYN, ACK, PSH, etc.) Part 2: Target Enumeration with Nmap (35 Points) Prerequisite: Ensure you can ping Metasploitable 2 from Kali. The Scenario: Management has asked you for a complete inventory of all open doors and software versions running on the Metasploitable 2 server (IP: Use your specific Metasploitable IP address). Your Tasks: Execute the necessary Nmap commands against your Metasploitable 2 VM to answer the following questions. Do not guess; your answers must come directly from Nmap output. Deliverables for Part 2 (Provide Screenshots and Text): Screenshot 3: Run an Nmap SYN scan against all 65,535 ports. Take a screenshot of the final output showing the list of open ports. (Note: Ensure the command you used is visible in the terminal screenshot). Question 1: Based on your full port scan, exactly how many ports are listed as “open” on this machine? Question 2: Run a version detection scan. Look at the output for Port 21. What is the exact name and version of the FTP software running? Question 3: Look at the output for Port 445. What is the name of the service running on this port? Question 4: In 2-3 sentences, explain why you chose the specific Nmap flags you used for this task, and why you didn’t just use a default nmap [IP] command. Part 3: The OSINT Dossier (Passive Reconnaissance) (25 Points) Prerequisite: You only need a standard web browser for this section. The Scenario: Before you are allowed to actively scan a client’s network (like you did in Part 2), you must first build a profile using only Passive Reconnaissance. Your client is a large state university (e.g., any .edu website). Your Tasks: Use Google Dorking and Shodan to gather intelligence. Deliverables for Part 3 (Provide Text Responses): Question 1: Construct a Google Dork to find Microsoft Excel spreadsheet files (.xls) containing the word “budget” on university websites. Write down the exact search query you used. Question 2: Go to Shodan.io and search for: port:23 country:US (This searches for Telnet servers in the US). Briefly describe (2-3 sentences) why finding an open Telnet port on a modern network is a massive security failure. Question 3: Compare the Nmap scan you did in Part 2 to the Shodan search you just did. If a system administrator at a company looks at their firewall logs tomorrow, will they see your IP address from the Nmap scan? Will they see your IP address from the Shodan search? Explain why. Part 4: The Consultant’s Pitch (10 Points) As discussed in Lesson 2.3, one of the easiest ways to monetize beginner cybersecurity skills is by selling “Passive Recon Audits” (also known as External Footprinting or Attack Surface Management) to local businesses that have no idea what they have exposed to the internet. Your Task: Write a short, 4-5 sentence “Cold Email” pitch that you could send to the owner of a local accounting firm. Goal: Convince them to pay you $150 to perform a Passive Recon audit of their company. Requirement: You must mention at least one specific thing you will look for (e.g., exposed databases, leaked credentials, unpatched devices) using non-technical language that a business owner would understand and fear. Submission Checklist (Before you submit, ensure you have:) Screenshot 1: Wireshark filtered for Port 22. Screenshot 2: Wireshark Follow TCP Stream window. Text answer identifying the TCP Flags of the first packet. Screenshot 3: Nmap full port scan (-p-) showing the command and open ports. Text answer stating the total number of open ports. Text answer identifying the exact FTP software version on Port 21. Text answer identifying the service on Port 445. Text answer justifying your Nmap flag choices. Text answer providing the exact Google Dork query used. Text answer explaining the danger of open Telnet ports. Text answer comparing Nmap logging vs. Shodan logging. A 4-5 sentence cold email pitching a Passive Recon audit. Instructor Evaluation Rubric (How you will be graded) Technical Execution (40%): Are the Wireshark and Nmap screenshots clear, unedited, and demonstrating the correct commands/filters? Did the student successfully map their virtual lab network? Analytical Accuracy (35%): Are the answers regarding port counts, software versions, and TCP flags correct based on the standard Metasploitable 2 configuration? Did the student accurately explain the difference in traceability between active and passive recon? Methodology Understanding (15%): Does the student’s justification for Nmap flags show an understanding of stealth vs. noise, and comprehensive scanning vs. default scanning? Business Communication (10%): Is the cold email professional, persuasive, and does it accurately translate a technical passive recon concept into a business risk? (Note for LMS Admin: Set this up as a “File Upload” assignment where students compile their screenshots and text answers into a single PDF or Word Document, or use an “Online Text” assignment with a file upload addon for the images).
Lesson 2.1: Packet Sniffing & Traffic Analysis
Lesson 2.2: Mastering Nmap (Network Mapping)
Lesson 2.3: Passive vs. Active Reconnaissance

Module 3: Operating System & Endpoint Security

Module 3 Assignment: The Endpoint Security Analyst Assessment Assignment Overview In Modules 1 and 2, you looked at the network from the outside. In Module 3, you went inside the machine. As a cybersecurity professional, you will spend a massive portion of your career investigating the operating systems of endpoints—checking for misconfigurations, hunting for malicious processes, and ensuring that access controls are tight. In this assignment, you will act as a Junior Endpoint Security Analyst. You will be tasked with auditing a Linux system’s file permissions, enumerating a Windows system’s local security posture, and identifying a malicious file using cryptographic hashing and threat intelligence platforms. Objective Demonstrate practical competence in navigating the Linux filesystem and modifying file permissions using chmod. Prove the ability to enumerate Windows local users, groups, and shares using built-in command-line tools. Understand the mechanics of modern malware identification by calculating cryptographic hashes and utilizing VirusTotal. Articulate the conceptual differences between legacy Antivirus and modern EDR. Part 1: Linux Filesystem & Permission Auditing (30 Points) Prerequisite: Your Kali Linux virtual machine must be running. The Scenario: A junior developer left a sensitive configuration snippet in the /tmp directory with insecure permissions. Your job is to locate it, identify the insecurity, and fix it using the Principle of Least Privilege. Your Tasks: Open your Kali terminal. Navigate to the /tmp directory. Create a new file named db_config.txt by running this exact command: echo “DB_PASSWORD=S3cur3P@ss!” > db_config.txt Check the current permissions of the file. Alter the permissions so that ONLY the owner (you) can read and write to the file. Remove all permissions for the Group and Others. Ensure the file is not executable. Deliverables for Part 1 (Provide Screenshots and Text): Screenshot 1: A clear screenshot of your terminal showing: The command you used to view the permissions of db_config.txt before you changed them. The exact chmod command you used to fix the permissions. The command you used to view the permissions after the change, proving the permissions now look like -rw——-. Question 1: In 1-2 sentences, explain why storing a file containing a plaintext password in the /tmp directory is a security risk, even if the permissions are locked down. Part 2: Windows Security Enumeration (30 Points) Prerequisite: You need access to a Windows 10/11 machine (a personal PC or a Windows VM). The Scenario: You are performing a routine security audit on a Windows workstation. You need to document exactly who has administrative access and what resources are being shared on the local network. Your Tasks: Open the Command Prompt as an Administrator (Start -> type cmd -> Right-click -> Run as Administrator). Execute the necessary commands to discover your current username and its group memberships. Execute the necessary command to list all accounts that have God-mode (Administrator) access to this specific machine. Deliverables for Part 2 (Provide Screenshots and Text): Screenshot 2: A screenshot of your Windows Command Prompt showing the output of the command used to list the members of the local Administrators group. Question 2: According to the module, what is the specific difference between a Pass-the-Hash attack (associated with NTLM) and a Golden Ticket attack (associated with Kerberos)? Which piece of Active Directory infrastructure must be compromised to execute a Golden Ticket attack? Part 3: Malware Fingerprinting & Threat Intelligence (25 Points) Prerequisite: A web browser and a terminal (Kali Linux, Mac Terminal, or Windows PowerShell). The Scenario: A suspicious file was found on an endpoint. Before you attempt to open it, you must identify it safely using hashing and OSINT (Open Source Intelligence). Your Tasks: The Avalanche Effect: In your terminal, create a file named original.txt containing the text CompanyFinances2023. Calculate its SHA-256 hash. Now, change the text to CompanyFinances2024 and calculate the hash again. The EICAR Test: Recreate the safe, industry-standard EICAR test file in your terminal using the echo command provided in the lesson: echo ‘X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*’ > eicar.txt Calculate the SHA-256 hash of the eicar.txt file. Take that SHA-256 hash and search for it on VirusTotal.com. Deliverables for Part 3 (Provide Text Responses): Question 3: Paste the two different SHA-256 hashes for original.txt and original.txt (with the changed year). Does this demonstrate the Avalanche Effect? (Yes/No). Question 4: What is the exact SHA-256 hash of the eicar.txt file you generated? Question 5: When you look up the EICAR hash on VirusTotal, how many of the vendors flagged it as malicious (e.g., what was the Detection ratio like 60/70)? Question 6: If a hacker uses a polymorphic engine to scramble the code of a virus so its hash changes every time it spreads, why will traditional Signature-Based Antivirus fail to catch it, and how does EDR (Endpoint Detection and Response) successfully catch it instead? Part 4: The Consultant’s Pitch (15 Points) In Lesson 3.1, we discussed the epidemic of cloud data breaches caused by Linux permission misconfigurations (like leaving AWS S3 buckets publicly readable). In Lesson 3.3, we learned that traditional Antivirus is mostly useless against modern attacks. Your Task: Write a short, 4-5 sentence “Cold Email” pitch to the owner of a mid-sized local business (e.g., a regional accounting firm that stores client tax records in the cloud). Goal: Convince them to hire you for a $200 “Endpoint & Cloud Storage Security Audit.” Requirement: You must explicitly mention the danger of relying solely on traditional Antivirus, AND mention the risk of improper file permissions exposing their data to the internet. Translate these technical concepts into business risks (fines, leaked client data, reputational damage) that a non-technical business owner would understand. Submission Checklist (Before you submit, ensure you have:) Screenshot 1: Linux terminal showing the db_config.txt permissions before and after the chmod fix. Text answer explaining the risk of /tmp. Screenshot 2: Windows CMD showing the local Administrators group membership. Text answer explaining Pass-the-Hash vs. Golden Ticket. Text answer with the two hashes demonstrating the Avalanche Effect. Text answer with the exact SHA-256 hash of the EICAR file. Text answer with the VirusTotal detection ratio for EICAR. Text answer explaining why AV fails against polymorphic malware and how EDR catches it. A 4-5 sentence cold email pitching an Endpoint/Cloud audit. Instructor Evaluation Rubric (How you will be graded) Technical Execution (35%): Did the student successfully navigate the Linux filesystem? Did they use the correct chmod syntax to achieve the exact -rw——- permission state? Did they successfully use the correct Windows commands (net localgroup administrators)? Analytical Accuracy (35%): Does the student accurately describe the difference between NTLM and Kerberos attacks? Do they correctly explain the mechanics of the Avalanche Effect and the operational differences between Signature-Based AV and EDR? Threat Intelligence Application (15%): Did the student successfully generate the EICAR hash and accurately report the VirusTotal findings? Business Communication (15%): Does the cold email professionally translate technical flaws (AV limitations, permission misconfigurations) into compelling business risks that would motivate a client to purchase an audit? (Note for LMS Admin: Set this up as a “File Upload” assignment where students compile their screenshots and text answers into a single PDF or Word Document).
Lesson 3.1: Linux Fundamentals for Security Pros
Lesson 3.2: Windows Security Architecture & Active Directory
Lesson 3.3: Malware Analysis Basics & Endpoint Protection

Module 4: Web Application Security (The Money Maker)

Module 4 Practical Assignment: The Junior Bug Hunter’s First Report Assignment Overview In the cybersecurity industry, no one cares about what you know; they care about what you can prove. Finding a vulnerability is only half the job; if you cannot clearly document it and communicate the risk, you will not get paid, and you will not pass professional certifications. This assignment bridges the gap between theory and real-world application. You will use your Kali Linux lab, your knowledge of the OWASP Top 10, and your new Burp Suite skills to hunt for a flaw on a legally safe practice site. You will then compile your findings into a professional Bug Bounty Report. Objective Demonstrate the ability to configure and use Burp Suite’s Intercept and Repeater features. Successfully identify a web application vulnerability (specifically Broken Access Control / IDOR or Information Disclosure). Write a flawless, professional vulnerability report using the industry-standard template. ⚠️ Critical Rule DO NOT test any website that is not explicitly listed in the instructions below. Only use the provided practice URLs. Testing unauthorized sites is illegal and will result in immediate failure of this course module. The Target Environment For this assignment, you will be targeting the Acunetix Test PHP Site. This is a deliberately vulnerable website hosted by a legitimate security company specifically for professionals to practice on. Target URL: http://testphp.vulnweb.com Part 1: Technical Execution & Evidence Gathering (40 Points) You must complete the following technical steps and capture visual/textual evidence of your work. You will paste this evidence into your final submission document. Task 1: The Intercept Ensure Burp Suite is running and your Firefox browser is properly configured with the proxy (Port 8080) and the CA Certificate installed (as taught in Lesson 4.2). Navigate to the target site’s login page: http://testphp.vulnweb.com/login.php Turn on Burp Intercept. Enter any random username and password (e.g., test/test) and click Login. Deliverable 1: Copy and paste the raw HTTP POST request that Burp intercepted into your assignment document. (Highlight the exact line that contains the username and password you typed). Task 2: The Hunt & The Repeater Turn OFF Burp Intercept (let traffic flow normally). Browse the website. Look for pages that display information based on a number or ID in the URL (e.g., ?id=1, ?pid=2). Hint: Look at the product pages or the “View Details” links. Once you find a URL with a numeric parameter, right-click the request in Burp’s HTTP History (or intercept it) and send it to Repeater. Deliverable 2: Take a clear screenshot of the Burp Suite Repeater tab showing your original captured request on the left, and the normal server response on the right. Task 3: The Exploitation Still in the Repeater tab, manipulate the numeric parameter in the URL. Change it from 1 to 2, then 3, etc. Find an instance where changing the number reveals information that should likely belong to a different user or a different context (e.g., seeing a different user’s order details, viewing a different product that you weren’t supposed to access via that specific navigation flow, or viewing comments meant for a different page). Deliverable 3: Copy and paste the raw HTTP Response from Burp Repeater that proves you successfully accessed the unauthorized/alternative data. Highlight the specific text in the response payload that proves the access. Part 2: The Professional Deliverable (50 Points) Now that you have found the flaw and gathered the raw data, you must write the report as if you were submitting it to HackerOne for a $500 bounty. Create a section in your assignment document titled “Vulnerability Report” and format it exactly as follows using the template from Lesson 4.3: Vulnerability Title: [Fill in a professional title, e.g., “Insecure Direct Object Reference (IDOR) in product details allows viewing of unauthorized items”] Severity: [Low / Medium / High / Critical] – Defend your choice based on the data you saw. Description: [2-3 sentences explaining what the flaw is and why it happened (hint: the application trusts the user-supplied ID without verifying authorization).] Steps to Reproduce: [Write a numbered, 1-2-3 list of exact instructions. Include the exact starting URL, the exact parameter you changed in Burp Repeater, and what you changed it to.] Proof of Concept (PoC): [Reference the screenshots and raw text you gathered in Part 1. Explicitly state “See Task 2 Screenshot” and “See Task 3 Raw Response”.] Impact: [Explain the business impact. If this were an e-commerce site, what could an attacker do with this flaw?] Part 3: Conceptual Application (10 Points) The OWASP Mapping Review the OWASP Top 10 list provided in Lesson 4.1. State exactly which ONE of the OWASP Top 10 categories the vulnerability you found in Part 2 falls under. Write a short paragraph (3-4 sentences) explaining why it fits into that specific category. Submission Checklist (Before you submit, ensure you have:) Raw HTTP POST request from the login intercept. Screenshot of Burp Repeater showing the original request/response. Raw HTTP Response showing the manipulated data access. A fully completed, professionally formatted Vulnerability Report. Correct OWASP Top 10 classification with justification. Zero mention of testing any live, unauthorized websites. Instructor Evaluation Rubric (How you will be graded) Technical Accuracy (40%): Did the student successfully intercept traffic? Did they successfully use Repeater to manipulate a parameter? Is the raw HTTP data accurate? Report Quality (40%): Is the report free of spelling/grammar errors? Is the tone professional and objective? Are the Steps to Reproduce perfectly clear and easy to follow without guessing? Did they accurately describe the Impact? Conceptual Understanding (10%): Did they correctly map the bug to the proper OWASP Top 10 category with a sound logical justification? Rule Adherence (10%): Did the student follow all instructions and safety rules? (Any submission showing traffic intercepted from a real-world, out-of-scope site will receive an automatic zero). Note for LMS Admin: You can set this up as a “File Upload” or “Text Entry” assignment in your LMS, allowing students to paste text and upload their Burp Suite screenshots as a PDF or Word Doc.
Lesson 4.1: How Web Apps Work & The OWASP Top 10
Lesson 4.2: Mastering Burp Suite & Manual Testing
Lesson 4.3: Bug Bounty Hunting 101 (Earning Real Money)

Module 5: Cryptography & Identity Access Management

Module 5 Assignment: Cryptography, Certificates, and Zero Trust Instructions: This assignment is designed to test your practical understanding of the concepts covered in Module 5. Complete the three parts below. When you are finished, compile your answers and screenshots into a single PDF document and upload it to the LMS. Part 1: The Avalanche Effect (Hands-On) Objective: Prove that hashing is highly sensitive to input changes, a critical concept for data integrity and password security. Go to the CyberChef website (linked in your Resource Vault) or use the command line in your Kali Linux VM. Hash the phrase: CyberShield2024 using the SHA-256 algorithm. Change exactly one character (e.g., make the “C” lowercase, or change “2024” to “2025”). Hash the new phrase using SHA-256. Deliverable: Provide the two resulting 64-character hashes. In one short sentence, explain why this “Avalanche Effect” makes it impossible for a hacker to guess a password by looking at its hash. Part 2: The SSL Consultant (Hands-On) Objective: Practice auditing web server configurations using industry-standard tools. Go to Qualys SSL Labs (ssllabs.com/ssltest). Find a small, local business website in your area (e.g., a local restaurant, a small accounting firm, or a local boutique). Do not scan major sites like Google or Amazon. Run the SSL Server Test on that website. Deliverable: Provide a screenshot of the final “Grade” (e.g., A, B, F) the website received. Write a 3-to-4 sentence “pitch” to the business owner explaining what the grade means in plain English, why it is a problem (mentioning Google penalties or customer trust), and offering to fix it for them. (Hint: Use the monetization angle from Lesson 5.2!) Part 3: Securing the Perimeter (Action & Reflection) Objective: Apply Zero Trust and IAM principles to your own digital life. Log into your primary personal email account (Google, Microsoft, etc.) and navigate to the Security settings. Check the “Two-Step Verification” or “MFA” settings. Deliverable: Take a screenshot showing that you have MFA enabled (blur out any sensitive personal info like your phone number). Answer in 2-3 sentences: What specific method of MFA are you currently using (SMS, Authenticator App, Hardware Key)? Based on Lesson 5.3, if you are using SMS, what is the specific security risk (attack name) you are vulnerable to, and what should you upgrade to? Grading Criteria: Part 1: Correct hashes provided and accurate explanation of the avalanche effect. (33%) Part 2: Screenshot of a real scan provided and a professional, easy-to-understand pitch written. (34%) Part 3: Screenshot of active MFA provided and accurate identification of MFA methods and SMS vulnerabilities. (33%)
Lesson 5.1: The Mathematics of Secrets (Explained Simply)
Lesson 5.2: PKI, SSL/TLS, and Secure Communications
Lesson 5.3: Zero Trust Architecture & IAM

Module 6: Offensive Security & Penetration Testing

Module 6 Assignment: The Mini-Pentest & Report Assignment Overview In this module, you learned that a penetration test is only as good as the report documenting it. For this assignment, you will execute a small, structured attack in your isolated virtual lab and then write a professional, mini-penetration test report based on your findings. Objective: Demonstrate your understanding of the 5 phases of pentesting, successfully execute an exploit using Metasploit, and format the results into a professional report deliverable. Important Warning: You must perform this assignment strictly inside your VirtualBox lab (Kali Linux attacking Metasploitable 2). Do not point Metasploit at any external IP address. Part 1: The Rules of Engagement (10 Points) Before touching any tools, a professional defines the boundaries. Task: Create a brief, 3-bullet-point “Rules of Engagement” snippet for the following scenario: Scenario: You have been hired by a local accounting firm to test their main external web server. Requirements: Define the exact Scope (IP/URL), one Out-of-Scope rule, and the Time Window for the test. Part 2: The Exploitation (40 Points) Put your hands on the keyboard. Task: Boot your Kali Linux and Metasploitable 2 VMs. Follow the exact steps from Lesson 6.2 to exploit the UnrealIRCd backdoor and gain a Meterpreter session. Deliverable for Part 2: Provide two clear screenshots: A screenshot showing the msfconsole prompt right after you successfully run the exploit and receive the meterpreter > prompt. (Ensure your IP settings are visible if possible). A screenshot showing the output of the sysinfo command executed inside your Meterpreter session. Part 3: The Professional Report (50 Points) This is the most critical part of the assignment. Open a Word document or Google Doc. You are going to write a condensed, professional report based only on the UnrealIRCd exploit you just performed in Part 2. Document Structure Required: 1. Executive Summary (Approx. 3-4 sentences): Write a summary for the “CEO” of Metasploitable Corp. Explain what you did, what you gained access to, and the ultimate business risk (in plain English—no technical jargon like “TCP payloads” or “Metasploit”). 2. Technical Finding: Format your finding exactly like this: Title: [Create a professional title] Severity: [Critical, High, Medium, or Low?] Description: (2 sentences explaining what the UnrealIRCd backdoor is). Business Impact: (2 sentences explaining what an attacker could do with root access on this specific machine). Proof of Concept: (A simple 3-step list of how you exploited it, referencing the screenshots you took in Part 2). Remediation: (1 highly specific sentence telling the IT team exactly how to fix this specific issue). Submission Instructions Save your Part 1 text, Part 2 screenshots, and Part 3 report into a single PDF document. Name the file: Module6_Assignment_YourName.pdf Upload the PDF to the LMS. Grading Rubric Part 1 (10 pts): Demonstrates a clear understanding of scope and legal boundaries. Part 2 (40 pts): Screenshots prove successful navigation of the Metasploit framework and a live Meterpreter session. Part 3 – Executive Summary (15 pts): Written for a non-technical audience, focusing on business risk rather than technical steps. Part 3 – Technical Finding (25 pts): Follows the exact requested structure. Impact and Remediation are specific and actionable, not vague.
Lesson 6.1: The 5 Phases of a Penetration Test
Lesson 6.2: Exploitation with Metasploit
Lesson 6.3: Writing Professional Pentest Reports

Module 7: Building a Career & Monetizing Your Skills

Assignment Overview: You have spent this module learning how to transition from a student of cybersecurity to a paid professional. Reading about these strategies is useless without execution. This assignment is designed to force you out of “learning mode” and into “building mode.” You will create three critical assets that you will actually use in the real world: a personalized certification study plan, your live professional portfolio, and your first monetization asset. Total Points Possible: 100 Points Submission Format: A single PDF document containing links, written text, and structured plans. (Or a Word Document). Part 1: The Certification Roadmap (15 Points) You cannot boil the ocean. Trying to study for three certifications at once will result in failing all three. In this section, you will map out your immediate next step. Task: Choose ONE certification from Lesson 7.1 (CompTIA Security+, eJPT, or OSCP) that aligns with your current skill level. Create a realistic, week-by-week study schedule. Deliverable: Create a table or structured list that includes: Chosen Certification: (State the exam code if applicable, e.g., SY0-701). Target Exam Date: (A realistic date 2 to 6 months from now). Budget Breakdown: The exact cost of the exam voucher, practice tests, and any books you plan to buy. Weekly Schedule (Minimum 4 weeks): For each week, list: Passive Learning: (e.g., “Watch Professor Messer Videos 1.1 – 1.5”) Active Learning: (e.g., “Complete 50 Dion Practice Questions”) Hands-on Lab: (e.g., “Configure UFW firewall in Kali Linux to match PBQ requirements”) Grading Criteria: 15 points for a realistic, detailed, and logically paced plan that utilizes the specific study methodologies taught in the lesson (not just “read a book”). Part 2: The “Learn in Public” Portfolio Build (40 Points) This is the most important part of the assignment. A resume is a claim; a portfolio is proof. You are going to build your digital storefront right now. Task A: Deploy Your GitHub Pages Site (15 Points) Follow the Step-by-Step Tutorial from Lesson 7.2 to create a free GitHub Pages portfolio. Deliverable for Task A: Provide the live URL to your GitHub Pages website (e.g., https://yourusername.github.io). I will click this link. Ensure the site includes: A professional “About Me” section (3 sentences as outlined in the lesson). A “Certifications” or “Current Studies” section. A “Projects & Write-Ups” section (even if it just says “Coming Soon” for now). A “Contact” section with a professional email and LinkedIn profile. Task B: Write Your First Lab Write-Up (25 Points) Using the knowledge and labs from Modules 1 through 6, write a formal Lab Write-Up to be posted on your new website. Deliverable for Task B: Paste the text of your Lab Write-Up into your PDF submission. It must follow the exact 5-step structure taught in Lesson 7.2: The Hook and Objective: What are you doing and why? The Tools Used: List tools with brief definitions. The Methodology: Step-by-step commands you typed and what they did. (e.g., I ran nmap -sV to…) The Mitigation: How does a defender fix the vulnerability or misconfiguration you found? (Optional but highly recommended) A placeholder where a screenshot would go, described in brackets, e.g., [Screenshot of Nmap output showing port 445 open here]. Grading Criteria: 15 pts for a live, functioning, clean website. 25 pts for a write-up that strictly follows the requested structure, uses correct terminology, and provides a logical mitigation strategy. Spelling and grammar matter—this is a test of your communication skills. Part 3: The Monetization Asset (35 Points) Choose ONE of the three pathways from Lesson 7.3 (Platform Freelancing, Direct Consulting, or Passive Income) and build the exact copy/assets you would use to get paid. Option A: The Fiverr/Upwork Gig (Freelancing) Write the exact copy for your gig profile. Include: Gig Title: (SEO optimized) Pricing Tiers: (Basic, Standard, Premium) with exact prices and specific deliverables for each. Gig Description: The sales copy (minimum 100 words) addressing the client’s pain points. Requirements: The mandatory questions you ask the buyer upon purchase. Option B: The Cold Email Pitch (Direct Consulting) Use Google Maps to find a real local small business (dentist, law firm, etc.). Write out: The Target: Name and type of business. The Decision Maker: The name of the owner/manager you found. The Email: The exact cold email you would send, customizing the template provided in Lesson 7.3. Option C: The Digital Product Pitch (Passive Income) Design a digital product you could sell on Gumroad. Include: Product Name: Catchy and clear. Platform: Where you will sell it. Price: And why you chose that price point. Sales Copy: A 150-word description selling the product, highlighting the pain point it solves for the buyer. Grading Criteria: 35 points for choosing one option and executing it with high professionalism, persuasive copywriting, and strict adherence to the frameworks taught in the lesson. Part 4: The Legal Shield Check (10 Points) Understanding the legal boundaries of cybersecurity consulting is what separates an amateur from a professional. Answer the following two scenario-based questions in 3-4 sentences each: Scenario 1: A small business owner finds you on LinkedIn. He says: “My network is running really slow and I think I have a virus. Can you just remote in real quick and take a look? I’ll pay you $100 cash via Venmo, we don’t need a contract for something this small.” Question: How do you respond, and why? Cite a specific legal concept from Lesson 7.3. Scenario 2: You are hired to perform a $300 External Vulnerability Assessment (scanning) on a company’s 5 public IP addresses. While writing the report, you notice that one of their web applications has a severe SQL injection flaw. The client emails you: “Since you’re already looking at it, can you just exploit the SQL injection to prove it’s real, and then show us how to patch it?” Question: What is the danger here regarding your original contract, and how do you handle this request? Grading Criteria: 5 points per question. Full points awarded only if the student correctly identifies the risks (working without a contract/scope creep) and articulates a professional, legally sound response. 📝 Submission Checklist (Before you upload, ensure you have:) Chosen a certification and provided a detailed, budgeted 4+ week study plan. Provided a clickable, live link to a deployed GitHub Pages portfolio containing an About Me and Contact section. Written a formal Lab Write-Up following the 5-step methodology (Hook, Tools, Method, Mitigation). Completed ONE monetization option (Fiverr Gig, Cold Email, or Digital Product Pitch) with professional copywriting. Answered the two legal scenario questions correctly. Saved everything into a single PDF/Word document and uploaded it to the LMS.
Lesson 7.1: Certifications That Actually Matter
Lesson 7.2: Building an Unbeatable Portfolio
Lesson 7.3: Freelancing, Consulting & Passive Income

About Course

What You’ll Learn

Course Features

Who This Course Is For

Prerequisites

Course Content

Module 1: The Cybersecurity Landscape & Foundation

Lesson 1.1: The CIA Triad & The Modern Threat Landscape

Lesson 1.2: Demystifying the Tech: Networks, IPs, and DNS

Lesson 1.3: Building Your First Secure Lab (No Hardware Needed)

Module 2: Network Security & Reconnaissance

Lesson 2.1: Packet Sniffing & Traffic Analysis

Lesson 2.2: Mastering Nmap (Network Mapping)

Lesson 2.3: Passive vs. Active Reconnaissance

Module 3: Operating System & Endpoint Security

Lesson 3.1: Linux Fundamentals for Security Pros

Lesson 3.2: Windows Security Architecture & Active Directory

Lesson 3.3: Malware Analysis Basics & Endpoint Protection

Module 4: Web Application Security (The Money Maker)

Lesson 4.1: How Web Apps Work & The OWASP Top 10

Lesson 4.2: Mastering Burp Suite & Manual Testing

Lesson 4.3: Bug Bounty Hunting 101 (Earning Real Money)

Module 5: Cryptography & Identity Access Management

Lesson 5.1: The Mathematics of Secrets (Explained Simply)

Lesson 5.2: PKI, SSL/TLS, and Secure Communications

Lesson 5.3: Zero Trust Architecture & IAM

Module 6: Offensive Security & Penetration Testing

Lesson 6.1: The 5 Phases of a Penetration Test

Lesson 6.2: Exploitation with Metasploit

Lesson 6.3: Writing Professional Pentest Reports

Module 7: Building a Career & Monetizing Your Skills

Lesson 7.1: Certifications That Actually Matter

Lesson 7.2: Building an Unbeatable Portfolio

Lesson 7.3: Freelancing, Consulting & Passive Income

Partner with us to develop something extraordinary

Company

Useful Links

Navigation Links

Subscribe to The Acinge Newsletter

Partner with us to develop
something extraordinary