Learn security by doing it

Read the wire.

Packet analysis in Wireshark: where to tap, how to filter, and how to pull a secret out of traffic — including three labs you solve by capturing your own machine.

Break the app, on paper first.

How web apps are attacked: access control, injection, client-side trust, and information disclosure. Theory, then labs where you read a real HTTP exchange and pull the secret out.

Everything between you and the origin lies a little.

Web cache poisoning, cache deception, key confusion, and cache-hit timing side channels. The bugs that live in the gap between what the cache keys on and what the origin actually uses.

An HTTP handshake, then a stream of frames.

How a WebSocket connection is built and framed, and how to read and tamper with one — in Wireshark from a capture, and live against your own browser.

The maths is fine. The wiring is not.

How real cryptosystems break: encoding mistaken for encryption, signatures that verify nothing, and keys reused until the plaintext falls out. Decoder-and-pencil labs, no heavy tooling.

The binary already knows the password.

Reading compiled code back into intent: static triage, finding the check, and defeating it. Starts with a disassembly you read by hand; live crackme binaries follow.

Turn a bug into a shell.

Memory-corruption from the ground up: the stack, overflowing it, and hijacking control flow. Theory and a stack-diagram lab now; live exploitable targets follow in a sandbox.

Nothing is ever really deleted.

Recovering the truth from files, images and dumps: magic bytes, carving, metadata, and timelines. A hexdump lab you solve by eye, then real disk and memory images.

One box. Foothold to root.

Full HackTheBox-style boxes: a tiny vulnerable machine you enumerate, get a shell on, and escalate to root — two flags per box. The methodology is here now; the live boxes need their sandbox.