🏫 Programming & Software Development

Digital Forensics and Ethical Hacking

Master the Red vs. Blue lifecycle: From Adversarial Attacks to Digital Forensic Investigation

Duration

12 Weeks

Weekly Hours

4 Hours

Course Incharge

Muzammil Bilwani

📋 Prerequisites

✓ Intermediate IT knowledge, Networking fundamentals (TCP/IP), and basic Linux/Windows CLI experience

📖 Course Description

Intensive track blends offensive security (Ethical Hacking) with defensive investigation (Digital Forensics). Students learn to think like an adversary to breach perimeters and escalate privileges, then switch roles to the Blue Team to acquire memory, recover deleted data, and perform malware analysis to build professional-grade forensic reports.

What You Will Learn

Execute advanced Red Team tactics: Reconnaissance, Exploitation, and Lateral Movement

Master Blue Team skills: Memory Forensics, Disk Imaging, and Network Post-mortems

Attack and defend Enterprise environments including Active Directory and Kerberos

Perform Static and Dynamic Malware Analysis using Ghidra and Sandboxes

Implement Incident Response playbooks and maintain the Chain of Custody

Utilize industry-standard tools: Metasploit, Burp Suite, Volatility 3, and Autopsy

Course Outline

Zero-Day Readiness & Lab Orchestration

→Introduction to Cyber-Ops: Ethics, Scope of Work (SoW), and Rules of Engagement
→Architecting the Lab: Virtualization with VirtualBox/VMware
→Deploying the Attack Stack: Kali Linux, Parrot Security, and Metasploitable
→Network Isolation: Setting up Host-Only networks and snapshots
→Hands-on: Build a multi-OS virtual attack environment with isolated snapshots

OS Internals & System Hardening

→Deep-dive into Windows (Registry, LSASS, SAM) vs. Linux (Kernel, Proc, Syslog) architecture
→Mastering the Command Line: Advanced Bash scripting for security professionals
→PowerShell for Security: Understanding execution policies and remote management
→Permissions and Access Control: Managing sudoers and ACLs
→Hands-on: Write a script to automate 'System Hardening' by closing ports and managing user permissions

Tactical Reconnaissance & Stealth Scanning

→The Art of Passive Recon: OSINT, Google Dorking, and Shodan intelligence
→Active Scanning: Stealthy Nmap techniques, NSE scripts, and Service Enumeration
→Vulnerability Research: Using Searchsploit and the CVE database
→Fingerprinting: Identifying CMS versions and OS flavors
→Hands-on: Perform an 'External Audit' of a target network without triggering an Intrusion Detection System (IDS)

Network Infiltration & Traffic Manipulation

→Man-in-the-Middle (MITM) attacks: ARP Poisoning and DNS Spoofing
→Packet Crafting: Using Scapy to build custom malicious network packets
→Wireshark for Attackers: Identifying clear-text credentials in the stream
→SSL Stripping and Certificate Analysis
→Hands-on: Use Wireshark to intercept and decrypt live traffic to harvest credentials

Web App Exploitation (The OWASP Top 10)

→Breaking Modern Web Architecture: SQL Injection (SQLi) and Cross-Site Scripting (XSS)
→Broken Access Control and IDOR vulnerabilities
→Intercepting the Flow: Mastering Burp Suite Professional features and Repeater/Intruder
→Session Hijacking and Cookie Manipulation
→Hands-on: Exploit a DVWA instance from 'Low' to 'Impossible' security levels

The Metasploit Engine & Payload Engineering

→Metasploit Framework: Modules, Exploits, Payloads, and Encoders
→Payload Engineering: Creating Undetectable (FUD) payloads with MSFVenom
→Evasion Techniques: Bypassing basic Antivirus (AV) and Windows Defender
→Post-Exploitation Modules and Meterpreter commands
→Hands-on: Deploy a Meterpreter shell on a remote target and establish persistent access

Post-Exploitation & Privilege Escalation

→Living off the Land: Using native OS tools to move laterally across a network
→Cracking the Vault: Mimikatz for memory-based credential harvesting
→Password Cracking: Using Hashcat and John the Ripper for brute-forcing
→Privilege Escalation: Exploiting SUID bits and misconfigured services
→Hands-on: Escalate a Guest user to 'System/Root' privileges on Windows and Linux targets

Enterprise Warfare (Active Directory Attacks)

→Active Directory (AD) Fundamentals: Kerberos, Domain Controllers, and Forests
→AD Recon: Using BloodHound to map and visualize attack paths
→Kerberoasting, AS-REP Roasting, and Golden Ticket creation
→Pass-the-Hash and Pass-the-Ticket attacks
→Hands-on: Execute an attack path from a standard user to Domain Admin using BloodHound and Impacket

The Forensics Lifecycle & Evidence Integrity

→Introduction to Digital Forensics: The 'Order of Volatility'
→Legal Foundations: Chain of Custody and evidence hashing (MD5/SHA256)
→First Responder Toolkit: Setting up a forensic workstation
→RAM Acquisition: Using FTK Imager and DumpIt
→Hands-on: Perform a 'Live Acquisition' of system memory and document the process

Memory Forensics (Volatility 3)

→Analyzing the RAM: Finding hidden processes, sockets, and DLLs
→Volatility 3 Plugins: psscan, netscan, and malfind
→Extracting passwords and browser history from a memory dump
→Identifying Code Injection and rootkit behavior
→Hands-on: Use Volatility 3 to uncover a hidden rootkit and C2 connections in a RAM image

Disk Imaging & File System Reconstruction

→Forensic Disk Imaging: Creating .E01 and Raw images
→File System Deep-Dive: NTFS Master File Table (MFT) and FAT32 artifacts
→Data Carving: Recovering 'permanently' deleted files using headers/footers
→Autopsy Forensics: Case management and keyword searching
→Hands-on: Use Autopsy to reconstruct a criminal case from a corrupted disk image

Network Forensics & PCAP Analysis

→Post-Mortem Traffic Analysis: Reconstructing the 'Initial Access' point
→Identifying Data Exfiltration patterns and Beaconing behavior
→Analyzing specialized protocols: SMB, RDP, and HTTP/2 forensics
→Automating analysis with Zeek and RITA
→Hands-on: Conduct a network investigation of a simulated Ransomware outbreak

Malware Analysis & Reverse Engineering

→Static Analysis: Hashing, String extraction, and PE header analysis
→Dynamic Analysis: Using Flare-VM to monitor registry and file changes
→Reverse Engineering: Introduction to Ghidra and decompilation
→Identifying Obfuscation and Packers
→Hands-on: Decompile a malicious .exe using Ghidra to find its hardcoded C2 server

Incident Response (IR) Playbooks

→The 6 Stages of Incident Response: Preparation to Lessons Learned
→Log Correlation: Using SIEM tools (Splunk/ELK) to find attack 'Breadcrumbs'
→Containment Strategies: Isolating infected hosts and revoking tokens
→Threat Hunting fundamentals
→Hands-on: Respond to a live 'SQL Injection' alert and block the attacker via Firewall/SIEM

The CTF Challenge (The Gauntlet)

→The Gauntlet: A 48-hour Capture The Flag (CTF) immersive event
→Multi-server environment featuring Web, Network, and AD vulnerabilities
→Red vs. Blue: Breach a server, then switch roles to investigate your own tracks
→Real-world scenario simulation: Data Breach and Ransomware deployment
→Hands-on: Successfully capture all flags and document the exploitation/forensic path

The Forensic Audit & Final Report

→Writing for the C-Suite: Translating technical hacks into business risk
→Developing Professional Forensic Reports for legal/corporate use
→Expert Witness Preparation: Presenting digital evidence in a formal setting
→Final Project: A full end-to-end audit of a compromised network
→Hands-on: Submit and present your Final Forensic Audit Report for graduation

📊 Grading Criteria

Component	Percentage
Quizzes	20%
Class Participation / Attendance	15%
Projects	25%
Final Projects	40%
Total	100%

Ready to Register in This Course?

Join thousands of students who have transformed their careers. Start your journey today!