Track

Red Team Level 1

The complete offensive-security foundation: an integrated CEH, eJPT and OSCP+ preparation path, from cybersecurity fundamentals to OSCP-level practical pentesting.

26 Courses

165 Lessons

194 Hours

24 Weeks

Beginner Level

Ethical Hacking
Penetration Testing
CEH
eJPT
OSCP+
Active Directory
Linux
Windows

Choose How to Attend See the Curriculum

Ways to Attend

Recorded E£6,000

Watch at your own pace, with lifetime access to every lesson.

Live Online E£10,000

Live sessions with the instructor, from anywhere.

In Person E£10,000

Learn in the studio, face to face with your group.

Apply for This Track

Includes a certificate of completion on finishing every course.

About This Track

What You Are Signing Up For

This is the first level of the Red Team route, and it is built to move you through three stages that the industry treats as separate certifications but which are really one continuous skill. You begin with cybersecurity fundamentals, then the breadth of ethical hacking that CEH covers, then the hands-on penetration testing that eJPT measures, and finally the deep, practical, network-and-Active-Directory work that OSCP+ demands. It is thirty to forty percent theory and sixty to seventy percent lab work: you do not just learn what an attack is, you carry it out in an authorised training environment, escalate, pivot, and write it up. The level ends with a full corporate penetration test against a lab network, documented the way a professional report is written.

One continuous route across CEH, eJPT and OSCP+ — not three disconnected courses.
Sixty to seventy percent hands-on labs, in authorised training environments only.
Real depth where OSCP+ demands it: Active Directory, privilege escalation, pivoting and reporting.
Ends with a full corporate pentest and a professional written report.

What You Will Be Able to Do

Perform reconnaissance: information gathering and attack-surface discovery.
Scan and enumerate a network, and analyse its services.
Understand and test the most common web vulnerabilities in a training environment.
Analyse and exploit vulnerabilities appropriate to the lab.
Gain initial access on Linux and Windows, then find privilege-escalation paths.
Enumerate, analyse and attack an Active Directory domain inside a lab.
Work across segmented networks with tunnelling and pivoting.
Write a professional penetration-testing report.

Requirements

IT and networking fundamentals.
Comfort with Linux and Windows at a basic level, or the willingness to build it early.
No prior offensive-security experience required.
A machine that can run virtual labs.

Who It Is For

Beginners in cyber security with some IT and networking basics.
Computer Science and IT students moving toward offensive security.
Network and system administrators crossing into penetration testing.
Developers interested in web and application security.
SOC and blue-team analysts who want to learn the offensive side.
Anyone building a foundation before specialising in Red Team.
Anyone preparing, in time, for CEH, eJPT and OSCP+.

This is a preparation and training track. It builds the knowledge and practical skills the CEH, eJPT and OSCP+ paths are built on, but it does not award those certifications: their official exams and requirements are separate. All practical work is carried out in authorised, isolated lab environments only — never against systems you do not own or have explicit permission to test.

Skills

What You Will Learn

Reconnaissance & Scanning

Passive and active information gathering
OSINT and attack-surface discovery
DNS, WHOIS and subdomain enumeration
Network scanning with Nmap and NSE
Host, port, service and OS discovery

Enumeration & Analysis

Service enumeration: SMB, SNMP, LDAP, NFS, DNS, SMTP, RPC, FTP
Vulnerability classification: CVE, CVSS and databases
Vulnerability scanning and verification
Reading and prioritising findings

Exploitation

Web application testing and the OWASP Top 10
SQL injection: error-based, union-based and blind
Public exploit identification, analysis and modification
The Metasploit Framework, and manual exploitation without it
Password attacks, hashing and cracking

Privilege Escalation & AD

Linux privilege escalation: SUID, sudo, cron, capabilities, kernel
Windows privilege escalation: services, DLL hijacking, scheduled tasks
Active Directory enumeration with BloodHound and SharpHound
Kerberoasting, lateral movement and credential abuse

Post-Exploitation & Reporting

Pivoting and tunnelling across segmented networks
Client-side attack concepts
Antivirus and security-evasion fundamentals
Evidence collection and note taking
Professional penetration-test reporting

Hands On

What You Will Build

Every project below is yours to keep and to show. By the end you have a portfolio, not a certificate alone.

Integrated Labs

Lab 01 — Reconnaissance: OSINT to attack surface
Lab 02 — Network pentest: scan to initial access
Lab 03 — Web pentest: enumeration to shell
Lab 04 — Linux: initial access to root
Lab 05 — Windows: initial access to administrator
Lab 06 — Active Directory: initial access to domain compromise

Final Assessment

A full corporate lab: web server, internal network, Linux, Windows and Active Directory
Eleven phases from reconnaissance through to reporting
A professional pentest report that lets a reader reproduce every step

Graduation Project

You finish with a full corporate penetration test against a lab network that mirrors a real environment: an internet-facing web server, an internal network, Linux and Windows hosts, and an Active Directory domain behind a domain controller. You work eleven phases — reconnaissance, scanning, enumeration, vulnerability analysis, initial access, privilege escalation, pivoting, Active Directory, lateral movement, evidence and reporting — and hand in a professional report written so a technical reader can reproduce your work step by step.

The Roadmap

Your Path Through This Track

The Route

Course by Course

26 modules · 165 lessons. Open any module to see what is inside it.

01 CEH Foundation Cybersecurity and Ethical Hacking Fundamentals Beginner 9 lessons 8 hours
Before any tool, the vocabulary and the mental model. What information security actually protects, how an attacker thinks about a target, and the frameworks — the Cyber Kill Chain, MITRE ATT&CK — that turn a scattered set of techniques into a method.
- CEH
- Fundamentals
- MITRE ATT&CK
- Cyber Kill Chain
- Information security and the CIA triad
- Threats, vulnerabilities, exploits and threat actors
- Attack surface, attack vectors and risk
- Ethical hacking, pentesting and red teaming compared
- The Cyber Kill Chain
- MITRE ATT&CK and threat intelligence
- and 3 more
Open course
02 CEH · eJPT · OSCP+ Networking for Penetration Testers Beginner 7 lessons 8 hours
You cannot attack what you do not understand. The network stack from the OSI model down to the packets on the wire, the protocols you will meet on every engagement, and the tools to watch them. This is the module that stops the later ones being magic
- Networking
- TCP/IP
- Wireshark
- Nmap
- The OSI model and the TCP/IP stack
- IPv4, IPv6 and subnetting
- TCP, UDP, ports and services
- ARP, DNS, DHCP and ICMP
- Application protocols: HTTP, FTP, SSH, SMB, SMTP, LDAP, SNMP
- Packet analysis with Wireshark and tcpdump
- and 1 more
Open course
03 Systems Foundation Linux and Windows Fundamentals Beginner 8 lessons 8 hours
The two operating systems you will spend the rest of the track inside. Not as an administrator, but as someone who understands the system well enough to find where it is weak — the filesystem, users and permissions, services and processes, and the sh
- Linux
- Windows
- Bash
- PowerShell
- The Linux filesystem, users, groups and permissions
- Linux processes, services and networking
- Bash, environment variables and cron
- Linux package management
- Windows architecture, users, groups and services
- The Windows registry and file system
- and 2 more
Open course
04 CEH · eJPT · OSCP+ Penetration Testing Methodology Beginner 6 lessons 6 hours
The difference between poking at a box and running a penetration test is method. The nine stages from planning to reporting, the paperwork that keeps it legal — scope, rules of engagement — and the discipline of evidence, so that everything you claim
- Methodology
- Scope
- Rules of Engagement
- CEH
- eJPT
- OSCP+
- The nine stages: planning to reporting
- Scope and rules of engagement
- Target identification and attack-surface mapping
- Evidence, risk and impact
- Remediation and documentation
- Lab: scoping and planning a mock engagement
Open course
05 CEH · eJPT · OSCP+ Footprinting and Reconnaissance Beginner 9 lessons 10 hours
The quiet first phase, where a good tester learns more than a loud one. Passive and active information gathering, OSINT, DNS and WHOIS, and the discipline of building a picture of the attack surface before sending a single aggressive packet.
- OSINT
- Recon
- DNS
- CEH
- Passive versus active reconnaissance
- WHOIS, DNS footprinting and traceroute
- Google hacking and search operators
- Email and social-networking footprinting
- Subdomain discovery: Amass, Subfinder
- OSINT with theHarvester and public sources
- and 3 more
Open course
06 CEH · OSCP+ Network Scanning Beginner 7 lessons 8 hours
Turning an IP range into a map. Host discovery, port and service scanning, version and OS detection, and Nmap deep enough that you can tune a scan rather than run one blindly — plus the NSE scripts that begin the shift from scanning to enumeration.
- Nmap
- NSE
- Scanning
- CEH
- OSCP+
- Host discovery and scan types
- TCP and UDP port scanning
- Service and version detection
- OS detection and banner grabbing
- The Nmap Scripting Engine
- Scan optimisation and timing
- and 1 more
Open course
07 CEH · OSCP+ Service Enumeration Intermediate 6 lessons 8 hours
The phase where a port number becomes an opportunity. Deep enumeration of the services that matter — SMB, SNMP, LDAP, NFS, DNS, SMTP, RPC, FTP — pulling out the usernames, shares and misconfigurations that the next phase will use.
- Enumeration
- SMB
- SNMP
- LDAP
- CEH
- OSCP+
- SMB and NetBIOS enumeration
- SNMP and LDAP enumeration
- NFS, RPC and FTP enumeration
- DNS and SMTP enumeration
- Tooling: Enum4linux, NetExec, SMBClient
- From enumeration to attack path
Open course
08 CEH · OSCP+ Vulnerability Analysis Intermediate 6 lessons 6 hours
A scanner produces a list; a tester produces a judgement. How vulnerabilities are classified and scored, how to research them, and — the part that matters — how to verify a finding is real before you stake an exploit on it.
- CVE
- CVSS
- Nessus
- CEH
- OSCP+
- Vulnerability classification: CVE and CVSS
- Vulnerability databases and research
- Scanning with Nessus and Nmap NSE
- SearchSploit and Nikto
- Verification: proving a finding is real
- Writing the assessment findings
Open course
09 CEH · eJPT · OSCP+ Web Application Security Intermediate 12 lessons 14 hours
The largest module in the level, because the web is where most real access begins. A full web-assessment methodology with Burp Suite: enumeration, the OWASP Top 10, directory traversal, file inclusion and upload, command injection, and the client-sid
- Web
- OWASP
- Burp Suite
- CEH
- eJPT
- OSCP+
- Web assessment methodology and Burp Suite
- Web recon and directory enumeration: Gobuster, Nikto
- CMS security and WordPress testing
- The OWASP Top 10
- Cross-site scripting (XSS)
- Directory traversal and LFI/RFI
- and 6 more
Open course
10 CEH · OSCP+ SQL Injection Intermediate 6 lessons 6 hours
One of the oldest and most rewarding classes of bug, taught end to end: detect, verify, exploit in a lab, then document and remediate. Error-based, union-based and blind injection by hand, and the point where SQLmap earns its place.
- SQLi
- SQLmap
- CEH
- OSCP+
- SQL theory and database types
- Detecting and verifying injection
- Error-based and union-based SQLi
- Blind SQL injection
- MSSQL and xp_cmdshell
- SQLmap, and detect-verify-exploit-remediate
Open course
11 CEH · eJPT · OSCP+ System Hacking and Exploitation Intermediate 8 lessons 10 hours
Turning a known vulnerability into access. Finding, reading and — where the lab needs it — modifying public exploits, the fundamentals of memory corruption, and the post-exploitation and persistence concepts that follow a successful shell.
- Exploitation
- SearchSploit
- CEH
- eJPT
- OSCP+
- Finding public exploits: SearchSploit and Nmap NSE
- Analysing and understanding an exploit
- Modifying and fixing exploits
- Buffer-overflow and memory-corruption concepts
- Password attacks and brute forcing
- Hash cracking
- and 2 more
Open course
12 eJPT · OSCP+ The Metasploit Framework Intermediate 6 lessons 6 hours
The framework, learned properly — and its limits. Architecture, modules, payloads and Meterpreter, staged versus non-staged, post-exploitation and pivoting. And a clear-eyed note on why you must also exploit by hand: OSCP+ restricts Metasploit to a s
- Metasploit
- Meterpreter
- eJPT
- OSCP+
- Metasploit architecture and module types
- Auxiliary, exploit, payload and post modules
- Staged versus non-staged payloads
- Meterpreter and sessions
- Resource scripts and automation
- Why you must also exploit manually
Open course
13 OSCP+ Password Attacks and Credential Security Intermediate 6 lessons 6 hours
Credentials are the currency of a real engagement. Dictionary attacks, brute force and password spraying against services; hash identification and cracking; and the credential hunting that turns one foothold into many.
- Passwords
- Hashcat
- Hydra
- NTLM
- OSCP+
- Password policies and attack types
- Dictionary, brute force and spraying
- Hash identification and cracking
- NTLM, Net-NTLMv2 and SSH keys
- Credential hunting
- Tooling: Hydra, John, Hashcat, NetExec
Open course
14 OSCP+ Linux Privilege Escalation Advanced 7 lessons 8 hours
A low-privilege shell is a beginning, not an end. The enumeration that finds the weakness — SUID and SGID binaries, sudo rules, cron jobs, writable files, capabilities and kernel flaws — and the judgement to pick the path that works without breaking
- Linux
- PrivEsc
- SUID
- GTFOBins
- OSCP+
- Manual and automated Linux enumeration: LinPEAS
- Sudo, SUID, SGID and GTFOBins
- Cron jobs and writable files
- Capabilities and service misconfigurations
- Kernel vulnerabilities
- Credential discovery on the host
- and 1 more
Open course
15 OSCP+ Windows Privilege Escalation Advanced 7 lessons 8 hours
The same problem on the other operating system, where the weaknesses are different: service and DLL hijacking, unquoted service paths, scheduled tasks, dangerous privileges and the sensitive information Windows leaves lying around.
- Windows
- PrivEsc
- WinPEAS
- DLL Hijacking
- OSCP+
- Windows enumeration: WinPEAS and Seatbelt
- Windows privileges and permissions
- Service binary and DLL hijacking
- Unquoted service paths
- Scheduled tasks and sensitive information
- PowerShell artefacts
- and 1 more
Open course
16 OSCP+ Active Directory Advanced 8 lessons 12 hours
The heart of the OSCP+ exam and of most corporate networks. How a domain is built, and how to enumerate it: users, groups, computers, shares, SPNs and object permissions — mapped with BloodHound until the path to Domain Admin is a graph you can read.
- Active Directory
- BloodHound
- Kerberos
- LDAP
- OSCP+
- Domain architecture: DC, OUs, GPO, LDAP
- Kerberos, NTLM and SMB in a domain
- Enumerating users, groups and computers
- SPNs, shares and object permissions
- BloodHound and SharpHound
- PowerShell and .NET enumeration
- and 2 more
Open course
17 OSCP+ Active Directory Authentication and Attacks Advanced 6 lessons 8 hours
Turning the map into compromise. How AD authentication works and where it bends: Kerberoasting, credential abuse, and the lateral movement — Pass-the-Hash, Overpass-the-Hash, PsExec, WinRM — that walks a single credential across a domain.
- Kerberoasting
- Lateral Movement
- Pass-the-Hash
- OSCP+
- NTLM and Kerberos authentication in depth
- Kerberoasting and service-ticket abuse
- Credential abuse and domain credential access
- Lateral movement: PsExec, WinRM, WMI
- Pass-the-Hash and Overpass-the-Hash
- Persistence concepts: Golden Tickets, Shadow Copies
Open course
18 eJPT · OSCP+ Pivoting and Tunnelling Advanced 6 lessons 8 hours
Real networks are segmented; the interesting machines are never the one you land on. Port forwarding and every kind of tunnelling — local, remote, dynamic, SSH, Chisel, DNS — to reach an internal server through a compromised host.
- Pivoting
- Tunneling
- Chisel
- SSH
- eJPT
- OSCP+
- Pivoting concepts and adding routes
- Port forwarding: local, remote, dynamic
- SSH tunnelling
- Chisel, Socat, Plink and Netsh
- DNS tunnelling
- Lab: attacker to internal AD through a pivot
Open course
19 OSCP+ Client-Side Attacks Advanced 4 lessons 4 hours
When the perimeter holds, the way in is a person. Client reconnaissance and fingerprinting, and the delivery concepts OSCP+ tests — Office macros, Windows library files and shortcuts — studied as attack techniques inside a lab.
- Client-Side
- Phishing
- Macros
- OSCP+
- Client reconnaissance and fingerprinting
- Microsoft Office and Word macro concepts
- Windows library files and shortcuts
- Reasoning about delivery in an authorised test
Open course
20 CEH · OSCP+ Antivirus and Security Evasion Fundamentals Advanced 4 lessons 4 hours
How defences see an attack, so you can test whether they see yours. AV architecture and detection engines, IDS/IPS, firewalls and honeypots — studied to test defences in an authorised lab, never to bypass protection on a live system.
- AV Evasion
- IDS/IPS
- Firewalls
- CEH
- OSCP+
- IDS, IPS, firewalls and honeypots
- AV architecture and detection engines
- Known versus unknown threats
- Testing defences in an authorised lab
Open course
21 CEH CEH Specialised Security Domains Intermediate 5 lessons 8 hours
The breadth CEH covers that the practical certifications do not: wireless, mobile, IoT and OT, cloud, and cryptography. Each is a field of its own; here you get the working understanding a rounded ethical hacker is expected to hold.
- Wireless
- Mobile
- IoT
- Cloud
- Cryptography
- CEH
- Wireless security: WPA/WPA2, recon and attack concepts
- Mobile security: Android, iOS and OWASP Mobile
- IoT and OT fundamentals and vulnerabilities
- Cloud security: AWS, Azure, GCP, IAM, containers
- Cryptography: encryption, hashing, PKI, certificates
Open course
22 CEH Malware and Social Engineering Awareness Intermediate 4 lessons 4 hours
Two attacker capabilities every tester must understand to assess and to defend against them: the malware taxonomy and the APT lifecycle, and the social-engineering techniques — phishing, impersonation — that remain the most reliable way in.
- Malware
- Social Engineering
- Phishing
- CEH
- Malware types and the APT lifecycle
- Static and dynamic analysis concepts
- Social engineering, phishing and impersonation
- Detection and countermeasures
Open course
23 CEH Sniffing, Session Hijacking and DoS Concepts Intermediate 4 lessons 4 hours
The network-layer attacks that CEH expects you to understand: packet capture and ARP-based man-in-the-middle, session management and hijacking, and the denial-of-service and botnet concepts you must be able to recognise and defend against.
- Sniffing
- MITM
- Session Hijacking
- DoS
- CEH
- Packet capture and ARP-based MITM
- Session management, IDs and hijacking
- DoS, DDoS and botnet concepts
- Detection and protection
Open course
24 OSCP+ Professional Pentest Reporting Advanced 4 lessons 4 hours
The deliverable a client actually pays for, and the part OSCP+ marks as heavily as the exploitation. Note taking and evidence during the test, then a report — executive summary, technical findings, risk, impact and remediation — written so a technica
- Reporting
- Documentation
- OSCP+
- Note taking and evidence collection
- Executive and technical summaries
- Findings: risk, impact and recommendations
- Reproducible documentation and appendices
Open course
25 CEH · eJPT · OSCP+ Integrated Penetration Testing Labs Advanced 6 lessons 10 hours
Where the separate skills become one workflow. Six chained labs — reconnaissance, network, web, Linux, Windows and Active Directory — each taking you from nothing to a documented compromise, so the method becomes muscle memory before the final assess
- Labs
- Recon
- Web
- Linux
- Windows
- AD
- Lab 01 — Recon: OSINT to attack surface
- Lab 02 — Network pentest: scan to initial access
- Lab 03 — Web pentest: enumeration to shell
- Lab 04 — Linux: initial access to root
- Lab 05 — Windows: initial access to administrator
- Lab 06 — AD: initial access to domain compromise
Open course
26 Capstone Final Penetration Testing Assessment Advanced 4 lessons 8 hours
The whole level in one engagement. A corporate lab — internet-facing web server, internal network, Linux and Windows hosts, and an Active Directory domain behind a domain controller — taken through eleven phases from reconnaissance to a professional
- Capstone
- Corporate Lab
- Reporting
- OSCP+
- Phases 1-3: recon, scanning and enumeration
- Phases 4-6: vulnerability analysis, initial access, privesc
- Phases 7-9: pivoting, Active Directory, lateral movement
- Phases 10-11: evidence and reporting
Open course

Apply for This Track

After the Track

Roles This Track Prepares You For

Junior Penetration Tester
Ethical Hacker
Vulnerability Assessment Analyst
Security Tester
Junior Offensive Security Analyst
Junior Red Team Operator
Web Security Tester
Internal Pentest Junior
Security Consultant — Junior

Same Diploma

Other Tracks in This Diploma

Red Team Level 2 Track Advanced

Red Team Level 2

The jump from penetration tester to red team operator: an integrated CRTP, PNPT and CRTO preparation path across enterprise Active Directory, professional network engagements, Command & Control and OPSEC.

Red Team
Active Directory
Cobalt Strike
C2
CRTP
PNPT
CRTO
Adversary Simulation

One continuous route across CRTP, PNPT and CRTO — enterprise AD, professional engagements and C2.
Seventy percent hands-on in enterprise AD, internal network and C2 labs.
Real red team tradecraft: Cobalt Strike, C2 infrastructure, OPSEC and detection awareness.
Ends with a full enterprise adversary simulation across a multi-domain forest.

Red Team Level 3 Track Advanced

Red Team Level 3

The expert tier: an integrated OSEP, OSWE and OSED preparation path across advanced evasion, white-box web exploitation and Windows user-mode exploit development — the three specialisations that together map to OSCE3.

Advanced Evasion
Exploit Development
Web Exploitation
Reverse Engineering
OSEP
OSWE
OSED
OSCE3

Three real specialisations, not three variations: advanced evasion, web exploit development and binary exploit development.
Seventy-five percent hands-on across Windows internals, source-code review and exploit-development labs.
White-box web work: read the source, find the bug, write the exploit, reach RCE.
Windows user-mode exploit development: reverse engineering, DEP and ASLR bypass, custom shellcode.
Ends with three separate expert assessments, one for each of OSEP, OSWE and OSED.

Blue Team Level 1 Track Beginner

Blue Team Level 1

The defensive foundation: an integrated Security+, BTL1 and SC-200 preparation path, from cybersecurity fundamentals to working a SOC on the Microsoft security stack.

Security+
BTL1
SC-200
SOC
SIEM
Microsoft Sentinel
Defender
Incident Response

One continuous route across Security+, BTL1 and SC-200 — fundamentals to a working SOC analyst.
Built around the tools a SOC actually uses: a SIEM, Microsoft Sentinel and Defender, and KQL.
Fourteen practical labs, from packet analysis to a full incident investigation.
Ends with a complete SOC investigation, triaged, hunted and reported.

Certified

Certificates You Can Earn

Finish your course and receive an accredited MotiGraph certificate you can add to your CV and share with employers.