What is Cybersecurity and Ethical Hacking: Fundamentals?

Learn how attacks work and how to defend against them, using a practice lab you build and own. You will understand how common attacks work and how to defend against them. You will practise only on a safe lab that you build on your own computer and fully own. You will finish with a written security assessment of that lab: what you found, how you proved it, how you fixed it and how you checked the fix.

Open the Cybersecurity and Ethical Hacking: Fundamentals course page

Complete beginners who are curious about security: office workers, students, small-business owners, career changers and anyone who wants to understand how attackers think so they can defend better. You need no security or programming background. You only need to copy and run short scripts, and every one is explained.

These are the prerequisites the course lists:

• You can install a program, save a text file and open a browser on your own computer
• You can type a short command into a terminal window (Command Prompt, PowerShell, Terminal). Module 1 shows you where to find it
• No security, networking or programming experience is needed
• A computer that you own or fully control. Never use a work or school computer for the lab without written permission from its owner

These are the tools and materials the course lists:

• A Windows, Mac or Linux computer that you own, with permission to install software
• Python 3, which is free from python.org. Any recent Python 3 should work; the lab code in this course was checked on Python 3.11. Nothing else needs to be installed, because the lab uses only tools that ship with Python
• A plain text editor (Notepad, TextEdit in plain-text mode, or the free Visual Studio Code) and a web browser
• About seven hours in total, spread over as many sittings as you like
• Nothing in the core lessons costs money. Free extras for practice after the course, such as OWASP Juice Shop, need extra free software (Node.js or Docker), so check each project's current instructions and licences before you install anything

A Written Security Assessment of Your Practice Lab. A report of about four to eight pages that you could hand to the owner of a small web app. It states what you were allowed to test, what you found, how bad each problem is, how you proved it, how you fixed it and how you checked the fix. You build one part in every module, so the last lesson is assembly and checking, not a surprise. The finished deliverables are:

• A charter with your scope, your rules and a description of the lab (Module 1)
• A system map: listening ports, web requests, an attack surface table and a note on encryption (Module 2)
• Threat notes: an attack-stage map, a phishing rule, a password storage review and a file check routine (Module 3)
• A findings log with at least seven findings, each with where it is, how to reproduce it, evidence and impact (Modules 3 and 4)
• A fix and retest log showing the original attack and the result after each fix, plus a working log-watching script (Module 5)
• A personal security baseline checklist for your own computer, with each item marked done or not done (Module 6)
• The final report: a plain-language executive summary, a ranked findings table, a fix plan and the retest results (Module 6)

Cybersecurity and Ethical Hacking: Fundamentals has 24 lessons in 6 modules, a workbook of 10 items and a capstone project. It is planned at about 7 hours in total. The lesson text runs to roughly 16,400 words.

Cybersecurity and Ethical Hacking: Fundamentals has 6 modules:

• Module 1: Ground Rules and Your Practice Lab. Learn the three goals of security, the one rule that separates ethical hacking from crime, how to build a lab on your own computer, and the plain words used to talk about risk.
• Module 2: What an Attacker Can See: Networks and the Web. Understand ports and services, read a web request and response, list everything your lab exposes, and see what encryption does and does not protect.
• Module 3: How Attacks Start. Follow the stages of an attack, learn to spot phishing, see how passwords are stored and guessed, and use file fingerprints to check that a download has not been changed.
• Module 4: Testing Your Own Lab. Use the OWASP Top 10 as a checklist, then find and prove four weaknesses in your own lab: SQL injection, cross-site scripting, broken access control and a forgeable cookie. Log each one as a finding with evidence.
• Module 5: Fix It, Then Prove It Is Fixed. Repair each weakness the right way, retest with the same attack that worked before, add a slow password hash and a guess limit, and turn on logs that let you see attacks as they happen.
• Module 6: Defend, Rate and Report. Harden your own computer with a personal security baseline, rate and rank your findings, write a report that people act on, and finish the capstone assessment.

All 24 lesson titles, module by module:

• Module 1: Ground Rules and Your Practice Lab. 1.1 What Security Protects: The Three Goals; 1.2 Permission First: Scope and Rules of Engagement; 1.3 Build Your Practice Lab; 1.4 Risk in Plain Words.
• Module 2: What an Attacker Can See: Networks and the Web. 2.1 Addresses, Ports and Services; 2.2 How the Web Talks: Requests and Responses; 2.3 Your Attack Surface; 2.4 Encryption in Transit: What HTTPS Does and Does Not Protect.
• Module 3: How Attacks Start. 3.1 The Stages of an Attack; 3.2 Phishing and Social Engineering; 3.3 Passwords: How They Are Stored and Guessed; 3.4 Malware and File Fingerprints.
• Module 4: Testing Your Own Lab. 4.1 The OWASP Top 10 as Your Checklist; 4.2 SQL Injection: When Input Becomes a Command; 4.3 Cross-Site Scripting: When Text Becomes Code in the Browser; 4.4 Broken Access Control: Never Trust the Browser.
• Module 5: Fix It, Then Prove It Is Fixed. 5.1 Fix Injection and Script Injection; 5.2 Fix Access Control and Sessions; 5.3 Fix Passwords: Slow Hashes and Guess Limits; 5.4 Logs and Safe Errors: See Attacks as They Happen.
• Module 6: Defend, Rate and Report. 6.1 Defense in Depth: Your Personal Security Baseline; 6.2 Rate and Rank Your Findings; 6.3 Write the Report So People Act on It; 6.4 Capstone: Assemble, Retest and Hand Over Your Assessment.

The course is listed at beginner level and planned at about 7 hours in total. It has 24 lessons, each with objectives you can check yourself against.

Lesson 1 is "What Security Protects: The Three Goals" (Module 1, Ground Rules and Your Practice Lab). By the end of it the course says you will be able to:

• Name the three goals of security: confidentiality, integrity and availability
• Explain in one sentence what an ethical hacker does
• Describe what you will build in this course and how each lesson is laid out

Cybersecurity and Ethical Hacking: Fundamentals defines 25 terms in plain words: Asset, Threat, Vulnerability, Exploit, Risk, Attack surface, Scope, Rules of engagement, Penetration test, Port, Localhost, HTTP and HTTPS, Encryption, Hash, Salt, Phishing, SQL injection, Cross-site scripting (XSS), Authentication and authorization, Session, Multi-factor authentication (MFA), Log, Patch, Least privilege and Ransomware.

AssetThreatVulnerabilityExploitRiskAttack surfaceScopeRules of engagementPenetration testPortLocalhostHTTP and HTTPSEncryptionHashSaltPhishingSQL injectionCross-site scripting (XSS)Authentication and authorizationSessionMulti-factor authentication (MFA)LogPatchLeast privilegeRansomware

Cybersecurity and Ethical Hacking: Fundamentals lists 18 official sources that were opened and checked while it was written, from 11 websites.

• top10.owasp.org
• cheatsheetseries.owasp.org
• attack.mitre.org
• pages.nist.gov
• cisa.gov
• first.org
• github.com
• docs.python.org
• developer.mozilla.org
• rfc-editor.org
• justice.gov

Cybersecurity and Ethical Hacking: Fundamentals costs $39 (USD) as The Codex, the full written course with its workbook and templates. Studio (narrated video lessons) and the Full Operator path are not on sale yet.

How much do courses cost?

Cybersecurity and Ethical Hacking: Fundamentals was prepared by Apex Flow Labs with AI assistance and checked before it was published. Every code sample, formula and command the course includes was run before it went in, the course records 20 verification checks, and it lists 18 official sources it checked. Do not take the label on trust: open the sources and run the examples yourself.

How Apex Flow Academy checks its courses

Yes for the core lessons, according to the course's own requirements list: "Nothing in the core lessons costs money." The list also names optional extras or costs outside the core lessons, so read it in full. Tool plans and prices change, so check each tool's current terms before you sign up.

Yes. The course lists this prerequisite: "No security, networking or programming experience is needed." It is listed at beginner level. It also asks for:

• You can install a program, save a text file and open a browser on your own computer
• You can type a short command into a terminal window (Command Prompt, PowerShell, Terminal). Module 1 shows you where to find it
• A computer that you own or fully control. Never use a work or school computer for the lab without written permission from its owner

No. Cybersecurity and Ethical Hacking: Fundamentals teaches and checks a skill, but it cannot promise an outcome. The course's own disclosure reads: "Created by Apex Flow Academy with AI assistance. For education only; not legal, tax, financial or medical advice. Results depend on your effort and circumstances."

Yes. Cybersecurity and Ethical Hacking: Fundamentals includes a verifiable Certificate of Completion, issued by Apex Flow Academy when you finish every lesson, resolve every quiz question with at least 50% right on the first try, and tick the capstone checklist. It has a unique ID and a public verification page. It is a completion certificate, not a degree, licence, accreditation or exam result. The Full Operator path, with a final exam and capstone review, opens later with its own separate, stronger credential.

Is there a certificate?