MODULE TREE — Complete Course Archive

← HOME CRASH COURSE PRACTICAL LABS RESOURCES DEFENSIVE RECON PHASE 1 PHASE 2 PHASE 3 PHASE 4 PHASE 5

How to use this page: Each module links to its HTML file. Status shows if navigation (next/prev) works and whether the module has been fact-checked against live research.

✓ VALIDATED = Fact-checked + evidence added ✓ LIVE = Complete with navigation ○ PENDING = Exists but needs work ✗ MISSING = Not found

// PHASE 1 — FOUNDATION

WEEKS 1-4: THE BASICS NETWORKING → RECON → POWERSHELL → CODING

00

READER GUIDE

How to use this course. Lab setup. Study methodology. Expectation setting.

VIEW →

✓ LIVE
01

NETWORKING FUNDAMENTALS

TCP/IP, sockets, ports, protocols, Wireshark, tunneling. "Eventually all comes to networking." — mentor

VIEW →

✓ LIVE
02

RECON & OSINT

Active/passive recon, network mapping, service enumeration, OSINT targeting. "You cannot attack what you cannot see." — mentor

VIEW →

✓ LIVE
03

POWERSHELL WARFARE

Cmdlets, pipeline, remoting, WMI, AMSI bypass basics, LOLBAS. "PowerShell is the Windows attacker's native language." — mentor

VIEW →

✓ LIVE
04

CODING BASICS

C, Python, Windows API fundamentals for security tooling. No prior coding required.

VIEW →

✓ LIVE

// PHASE 2 — WEAPONIZATION

WEEKS 5-8: BUILDING THE CHAIN SHELLCODE → MEMORY → REGISTRY → PRIVESC

05

SHELLCODE DEVELOPMENT

Assembly, registers, PIC, PEB walking, encoding. Build payloads from scratch.

VIEW →

✓ LIVE
06

MEMORY ARCHITECTURE

Virtual memory, paging, heap vs stack, protection flags, EPROCESS. The battlefield.

VIEW →

✓ LIVE
07

REGISTRY ANALYSIS

Windows registry deep-dive. Persistence locations, forensic artifacts, offline analysis.

VIEW →

✓ LIVE
08

PRIVILEGE ESCALATION

Token abuse, service misconfig, unquoted paths, UAC bypass. "Privilege escalation is easy." — mentor

VIEW →

✓ LIVE

// PHASE 3 — EVASION

WEEKS 9-12: STAYING ALIVE MALWARE → INJECTION → ROOTKITS → DEFENSE → EDR

09

MALWARE DEVELOPMENT

Shellcode construction, XOR obfuscation, dynamic API resolution, anti-sandbox.

VIEW →

✓ LIVE
10

CODE INJECTION

DLL injection, process hollowing, APC, thread hijacking, atom bombing, reflective DLL.

VIEW →

✓ LIVE
11

ROOTKITS & PERSISTENCE

Userland/kernel rootkits, persistence mechanisms, tri-vector persistence. "Save every rung." — mentor

VIEW → AMSI BONUS →

✓ LIVE
12

DEFENSIVE VERIFICATION

Memory scanning, behavioral analysis, EDR testing, parent/child relationships.

VIEW → ETW BONUS →

✓ LIVE
13

EDR EVASION

Direct syscalls, syscall proxying, HWBP bypass, unhooking, AMSI/ETW bypass.

VIEW → KAV BONUS →

✓ LIVE

// PHASE 4 — OPERATIONS

WEEKS 13-16: MOVING THROUGH THE NETWORK EXFIL → LATERAL → C2 → SOCIAL ENGINEERING

14

CLOUD FILES & EXFIL

AWS S3, Azure Blob, GCS, dead drops, pre-signed URLs, covert channels.

VIEW →

✓ LIVE
15

LATERAL MOVEMENT

Pass-the-Hash, Kerberoasting, WMI, PSExec, RDP hijacking, DCOM.

VIEW →

✓ LIVE
16

C2 FRAMEWORKS

Beacon vs interactive, jitter, encryption, Discord bridge. "Reverse shell is basic." — mentor

VIEW →

✓ VALIDATED
17

SOCIAL ENGINEERING

Phishing, pretexting, OSINT targeting, payload delivery. "Real attacks are carried remotely." — mentor

VIEW →

✓ VALIDATED

// PHASE 5 — ADVANCED

WEEKS 17-22: THE REAL WEAPON ANDROID → AD → KILL CHAIN → CAPSTONE

18

ANDROID RAT

APK structure, smali, JADX, Frida, SSL pinning bypass, StarKiller RAT.

VIEW →

✓ LIVE
19

ACTIVE DIRECTORY

Kerberos, TGT/TGS, SPN, delegation, BloodHound, DCSync, Golden Ticket.

VIEW →

✓ LIVE
20

FULL KILL CHAIN

MITRE ATT&CK, TTP mapping, purple teaming, full chain walkthrough.

VIEW →

✓ LIVE
21

CAPSTONE: GEODEFEND

Full kill chain walkthrough, blue team detection, GeoDefend scenario.

VIEW → MOBILE BONUS →

✓ LIVE
22

WEB APPLICATION HACKING

Recon, authentication, SQLi, IDOR, API signature breaking. Integrates TAFE pentest course and diudream.com findings.

VIEW →

✓ LIVE
23

INFOSTEALERS — HOW THEY WORK

Builder, victim, C2. Process injection, browser credential theft, crypto wallets, Discord tokens, detection rules, incident response.

VIEW →

✓ LIVE
24

MALWARE ANALYSIS & BACKDOOR AUDITING

Static analysis methodology, Fernet payload decryption, IOC extraction, and the crypto-wallet hijacking backdoor discovered in the original infostealer dropper.

VIEW →

✓ VALIDATED
BONUS

CEO TRANSLATION

Dollar impact of every technique. Board-ready language. Risk quantification.

VIEW →

✓ LIVE
UTILITY

DEFENSIVE RECON CHEAT SHEET

Blue team field manual. Network, process, persistence, AV, file system hunting. Live evidence from RADON C2 discovery.

VIEW →

✓ VALIDATED

VALIDATION STATUS: Modules marked ✓ VALIDATED have been fact-checked against live research and include evidence boxes with real command output. All other modules are complete with navigation and quizzes but await full lab validation.

Validation log: scripts/lab_evidence_2026-06-29.log

MODULE TREE // COMPLETE ARCHIVE