Learn from the team doing the work.

Install VirtualBox and configure a Kali Linux virtual machine as your personal, isolated lab — the same environment used throughout the rest of the bootcamp.

Get comfortable at the terminal: filesystem navigation, file permissions, process management, and the core commands every security tool in this course assumes you already know.

Practice open-source intelligence gathering with Whois lookups, Google dorking, and theHarvester to map a target’s public footprint before any technical testing begins.

Build a fake login page using GoPhish or the Social-Engineering Toolkit in a controlled lab, then walk through the technical and behavioral red flags that reveal a phishing attempt in the wild.

Run Hydra against sample login forms and John the Ripper against sample password hashes to understand exactly why weak and reused passwords fail so quickly under attack.

Using a dedicated test account, see how weak passwords and phishing links can compromise a social account — then harden that same account with two-factor authentication and lock down the gaps.

Use the Metasploit Framework against the intentionally vulnerable Metasploitable virtual machine to see the full path from open service to shell access, step by step.

Attack the Damn Vulnerable Web Application (DVWA) to extract data through SQL injection, then review exactly what parameterized queries and input validation would have stopped.

Inject and execute script in a deliberately vulnerable web app to see how stored and reflected XSS actually work, and what output-encoding fixes close the hole.

On your own router only, capture a WPA2 handshake and attempt to crack it with Aircrack-ng — then apply the same technique in reverse to audit and harden your own network.

Explore app permissions, basic APK analysis, and mobile malware awareness on a test or emulated device, building the instincts to spot a risky app before installing it.

Close the loop by configuring firewall rules and standing up intrusion detection with Snort or Suricata — turning everything learned on offense into a working defensive setup.