Practical learning · 8 projects
Ethical Hacking and Penetration Testing (legal labs): projects and labs
Learn by doing: labs for each module, a project for each level, a capstone and a project exam. Every step is checked, and your work stays on this device.
Beginner
- Lab1 h · 3 stepsLab: permission before you touch anythingBefore any legal test there is paperwork: written permission, a clear scope and rules of engagement. You write a one-page authorisation and scope document for a practice engagement, then build a small Python guard that refuses any target outside the authorised range so you can never stray by accident.Not started
- Lab2 h · 4 stepsLab: build your isolated hacking labSet up a safe place to practise: a Kali attacker VM and a deliberately vulnerable target (Metasploitable 2 or DVWA), both on a VirtualBox host-only network. You prove the two machines can reach each other, prove the target cannot reach the internet, and take a snapshot so you can always roll back.Not started
- Lab1.5 h · 4 stepsLab: reconnaissance, the right wayRecon is gathering information before any attack. You practise passive recon (public DNS, with no packet sent to the target) and active recon against your own authorised lab target (a ping to check it is up, and HTTP headers to fingerprint the web server). For each finding you also write the defender's fix.Not started
- Project2.5 h · 5 stepsProject: map the attack surfaceFor your authorised lab target you confirm it is in scope, check it is up, grab a service banner, then rank the services by how much they are worth a closer look. The output is a short attack-surface report with a fix for the riskiest finding.Not started
Expert
- Project5 h · 6 stepsProject: web attacks and their fixesAgainst DVWA and OWASP Juice Shop in your lab you demonstrate SQL injection, reflected XSS and an insecure direct object reference (IDOR). For each one you write the defensive code that stops it (parameterised queries, output encoding, object-level authorisation), then re-test to prove the fix works.Not started
- Capstone10 h · 11 stepsCapstone: a full penetration test and reportRun a complete, legal penetration test of your lab (Metasploitable 2 and DVWA) from authorisation to retest, and write the professional report that is the real deliverable: scope, methodology, findings with CVSS and evidence, a lab exploitation, remediation and an executive summary. Every attack is paired with its fix.Not started
- Project exam1.25 h · 6 tasksProject exam: ethical hacking practicalA timed practical. In 75 minutes you write five checks a tester reaches for every day (scope, parsing a scan, CVSS banding, ordering findings, spotting safe SQL) and give one piece of real lab evidence. Every task is checked when you hand in; no hints or answers are shown.Not taken