Welcome to Offensive Security.
A hands-on dive into how Red Teams think, operate, and break things — professionally. Today you stop being a user. Today you start being an attacker.
Offensive security specialists breaking enterprise web apps, APIs, and cloud infra. Red & Blue Team engagements that go beyond compliance.
The Business of Breaking In.
Pentesting is not a hobby — it's a regulated, multi-billion dollar industry. Click each card to expand.
Web apps, APIs, mobile, cloud, internal networks, IoT, OT/SCADA.
The reason most pentests get funded in the first place.
Goal-oriented adversary simulation. No checklist — just objectives.
How the Web Actually Works.
Before we hack anything, we need to understand it. When you type a URL and hit enter, a chain of ~7 systems collaborates in under 300ms. Every single link in that chain is a potential attack surface.
The browser, mobile app, or CLI tool. It asks for things. We attackers control the client completely — that's the whole game.
The wire. TCP/IP, TLS, proxies, CDNs, WAFs. Data travels in packets. If unencrypted, anyone in the middle reads it.
The back-end. Runs code, talks to databases, returns responses. Never trusts the client — or shouldn't, anyway.
// Click "Press Enter" to begin the trace.
TCP (Transmission Control Protocol) is what makes the internet reliable. Before any data is exchanged, the client and server must agree they're both alive and ready. That agreement is the 3-way handshake — three packets, less than a roundtrip apart.
- • Reliability: sequence numbers track every byte — lost packets are retransmitted.
- • Ordering: packets that arrive out of order are reassembled correctly.
- • Flow control: the receiver advertises a window size so it isn't overwhelmed.
- • Spoof resistance: the initial sequence number is randomized — an attacker has to guess it to inject data.
CLIENT SERVER | | | ──── SYN seq=4291 ────► | ① | | | ◄── SYN-ACK seq=8821 ── | ② | ack=4292 | | | | ──── ACK ack=8822 ────► | ③ | | | ════ ESTABLISHED ═════ | | ready to send data |
- • SYN Flood — send millions of SYNs, never ACK. Server runs out of half-open slots → DoS.
- • TCP RST Injection — forge an RST packet to tear down someone's connection (great firewalls do this).
- • Sequence Prediction — old bug: if ISNs were predictable, you could spoof an entire session.
- • Port Scanning — Nmap maps networks by sending SYNs and watching what comes back (SYN-ACK = open, RST = closed).
TCP gives you a reliable pipe — but it's plaintext. Anyone on the path can read it. TLS (Transport Layer Security) wraps that pipe in encryption. TLS 1.3 is the modern standard and is what protects every HTTPS site you visit.
Asymmetric crypto (RSA/ECDHE) is slow but solves key exchange. Symmetric crypto (AES) is fast but needs a shared key. TLS uses asymmetric just long enough to agree on a symmetric key — then switches to symmetric for the actual data. Best of both worlds.
CLIENT SERVER | | | ── ClientHello ──────► | | ciphers, key_share, | | SNI=rbtsec.com | | | | ◄── ServerHello ──────── | | cipher_choice, | | key_share, Cert, | | CertVerify, Finished | | | | ── Finished ─────────► | | [APPLICATION DATA 🔒] | | AES-256-GCM encrypted |
- • SSL Strip — downgrade HTTPS to HTTP if HSTS isn't enforced.
- • Weak Ciphers — RC4, 3DES, export-grade keys (BEAST, POODLE, FREAK).
- • Heartbleed (2014) — OpenSSL bug leaked private keys from server memory.
- • Rogue/Mis-issued Certs — compromised CA → attacker mints a cert for your domain.
- • Burp's MITM — Burp installs its own CA in your browser to legally decrypt your own traffic for testing.
Computers route by IP, humans remember names. DNS bridges the two. A single lookup can hit up to 4 servers:
- 01
Recursive Resolver — your ISP or 1.1.1.1. Caches answers.
- 02
Root Servers — 13 root clusters worldwide. "Ask the .com folks."
- 03
TLD Servers — .com, .org, .pk authorities.
- 04
Authoritative NS — the actual answer: rbtsec.com → 203.0.113.10
Port 80. Data travels in clear. Anyone on the same Wi-Fi can read your cookies with Wireshark.
- • Vulnerable to MITM, sniffing, session hijack
- • No integrity guarantee — pages can be modified in flight
- • Modern browsers flag it as "Not Secure"
Port 443. TLS provides confidentiality, integrity, and authenticity.
- • Uses asymmetric crypto for handshake, symmetric for data
- • Server proves identity via X.509 certificate
- • Still attackable: weak ciphers, expired certs, mis-issued CAs
Pick a verb, watch the packet travel, and read the raw HTTP that crosses the wire.
GET / HTTP/1.1 Host: rbtsec.com User-Agent: Mozilla/5.0 (RBT-LAB) Accept: text/html,application/xhtml+xml Accept-Language: en-US,en;q=0.9 Connection: keep-alive
// Send a request to populate this panel.
💡 Bug-bounty pearl: try PUT /admin/user/1 on endpoints that "only" allow GET. Method-based access control bypasses are everywhere.
💡 The difference between 401 and 403 tells you whether the username exists. The difference between 200 and 500 tells you whether your payload broke parsing.
HTTP is stateless — every request stands alone. To remember you're logged in, servers issue a cookie the browser sends back on every subsequent request.
💡 If a session cookie is missing HttpOnly and the app has reflected XSS, an attacker can call document.cookie from injected JS and exfiltrate the session in one line.
Burp Suite — The Hacker's Microscope.
Burp Suite by PortSwigger is the de-facto standard for web pentesting. It's an intercepting proxy that sits between your browser and the target — letting you read, edit, replay, fuzz, and weaponize every request.
A proxy is a man-in-the-middle that you put there on purpose. Your browser is configured to send traffic to Burp (127.0.0.1:8080) instead of directly to the internet. Burp forwards it — but along the way you get to inspect and modify everything.
For HTTPS, Burp generates its own CA certificate that you install in the browser. That way Burp can decrypt, show you plaintext, and re-encrypt before forwarding. Same trick a corporate firewall uses.
Captures every request between browser and server. Two sub-tabs you'll live in:
- • Intercept — pause requests live, edit, then forward or drop.
- • HTTP History — chronological log of every request that passed through.
- • Match & Replace — auto-rewrite headers/body on the fly.
A tree view of every URL Burp has seen. Define your Scope here so you only attack what you're paid to.
- • Site Map — full hierarchy of host/path.
- • Scope — include/exclude regex rules. Critical for ethics + sanity.
- • Issue Definitions — Burp's own bug encyclopedia.
Take any request, modify it manually, send it again. Tweak one byte, hit Send, see the diff in the response.
- • Test SQLi, XSS, IDOR payloads one at a time.
- • Verify a vulnerability without re-doing the whole flow.
- • Shortcut: Ctrl+R from any request → "Send to Repeater".
Mark positions in a request as §payload§ and Burp fires hundreds of variations. 4 attack types:
- • Sniper — one payload set, one position at a time.
- • Battering Ram — same payload in all positions.
- • Pitchfork — parallel lists (user[i] + pass[i]).
- • Cluster Bomb — every combination (brute force).
Convert between URL, Base64, HTML, Hex, ASCII, Gzip. Chain decodes to peel back layers.
- • Decode JWTs, session tokens, encoded payloads.
- • Quick hashing: MD5, SHA-1, SHA-256.
- • Smart "Auto" mode guesses the encoding.
Visual diff between two requests or two responses. Spot a 1-byte change that flips behavior.
- • Identify which header triggered a different reply.
- • Find blind injection points by length/content delta.
- • Compare valid vs invalid auth responses for user enumeration.
Statistically analyse the randomness of session tokens, CSRF tokens, password-reset codes.
- • Captures hundreds of tokens, runs FIPS-style entropy tests.
- • Predictable token = session hijack or reset-link guessing.
Active + passive scanning for OWASP-class bugs. Crawls, audits, reports — but never replaces a human.
- • Passive: watches your traffic, flags low-hanging issues.
- • Active: injects payloads — get authorization first.
PortSwigger-hosted server with a unique subdomain per session. Detects blind vulns where the response doesn't echo your payload.
- • Blind SSRF, blind XXE, blind SQLi, OOB exfil.
- • If your payload triggers a DNS/HTTP callback → confirmed.
Free marketplace of community extensions. Must-haves:
- • Autorize — automated authz testing.
- • JWT Editor — tamper, sign, none-alg attacks.
- • Param Miner — find hidden parameters & headers.
- • Logger++ — better history with filters.
- • Turbo Intruder — race conditions at 30k req/s.
Theory's done. Time to break something. Below is a miniature checkout with a proxy in the middle. Your job: intercept the purchase request and change the price after the browser has sent it.
This bug — client-side trust / parameter tampering — is the bread and butter of bug bounty programs. When a server believes whatever the browser sends, you can buy a $499 device for $1.
The server trusted client-side data. You just paid $0 for a $499 device. This bug class — Insecure Direct Object / Mass Assignment / Client-Side Trust — is responsible for thousands of disclosed CVEs.