ব্যাচের কার্যক্রম - মেইন লাইভ ক্লাস শুরুর আগেই যারা ইনরোল করেছেন, তারা কি বসে থাকবেন? না! এই মডিউলে পাইথন এর বেশ কিছু ভিডিও দেওয়া আছে — AI টুলস দিয়ে কীভাবে সাইবার সিকিউরিটি অটোমেশন করবেন সেটাও শিখবেন। শুরু হয়ে যাক তবে শেখার জার্নি!

Weekly goal: Navigate Kali, manage users and permissions, and automate a task with a Bash script.

Live Class 1: Kali Linux Fundamentals & Filesystem
Topic: Directory structure and navigation | File operations and permissions | Important system files | Package management
HANDS-ON LABS: TryHackMe: TryHackMe Linux Fundamentals Part 1, 2 and 3 rooms

Live Class 2: Users, Networking Commands & Bash
Topic: User and group management | Network commands: ip, ss, ping, traceroute | First Bash scripts | AI terminal assistants and checking their output
HANDS-ON LABS: Own machine / Replit: write a Bash script that pings a range and lists live hosts

Weekly goal: Write a Python script that runs a scan, parses the output, and asks an LLM to summarise it.

Live Class 1: Python for Security
Topic: requests, socket, subprocess, json | Build a port checker and HTTP header grabber | Parse Nmap XML output into a clean report
HANDS-ON LABS: Own machine / Replit: build and run your own port checker and HTTP header grabber

Live Class 2: Calling LLMs from Python
Topic: LLM API basics, keys and cost control | Structured JSON output from a model | Mini project: AI recon summariser | Never send client data to public models
HANDS-ON LABS: Ollama with a local open model: build an AI recon summariser that reads Nmap output and writes a plain summary

Hosted LLM API key: optional, use a shared hosted key instead of a local model

Weekly goal: Build a target profile (domains, people, emails, technology) using passive and active recon.

Live Class 1: Recon & OSINT
Topic: Active vs passive recon | OSINT framework and methodology | Search engine dorking and Whois | Automated recon tools
HANDS-ON LABS: TryHackMe: TryHackMe OSINT and Google Dorking rooms | Own machine / Replit: build a recon profile of your own domain with whois and subdomain tools

Live Class 2: Social Engineering in the AI Era
Topic: Phishing, spear phishing, vishing | AI-generated phishing and deepfake voice | Detection, awareness and defense
HANDS-ON LABS: TryHackMe : TryHackMe Phishing Analysis room

মডিউল ১ থেকে মডিউল ৭ পর্যন্ত যা যা আলোচনা হয়েছে, সেটার উপর ভিত্তি করে থাকবে একটা বড়সড় এসাইনমেন্ট। ঝালিয়ে নিতে পারবেন নিজেকে।

Weekly goal: Explain CIA, threat vs risk, legal scope, and how an LLM and an AI agent work.

Live Class 1: Foundations & Lab Setup
Topic: CIA triad; asset, threat, vulnerability, risk | Defense in depth and security principles | Lab build: Kali, Docker, Burp Suite | Create accounts: TryHackMe, PortSwigger, GitHub
HANDS-ON LABS: Kali Linux + VirtualBox/VMware: finish your Kali + Docker lab build and take a screenshot checklist

Live Class 2: Cyber Law, Ethics & AI Foundations
Topic: Bangladesh cyber law, scope and Rules of Engagement | Ethics of offensive AI tools | How LLMs work: tokens, context, system prompt | What an AI agent is: tools, memory, planning
HANDS-ON LABS: Gandalf by Lakera: beat the first 4 Gandalf levels to see how prompts steer a model

TryHackMe Extra: TryHackMe Intro to Cyber Security path

Weekly goal: Read and write basic Python with confidence: variables, loops, functions and files.

Live Class 1: Python Setup & Basics
Topic: Install Python and an editor | Variables, data types, strings | Lists and dictionaries | Input, output and simple programs
HANDS-ON LABS: Own machine / Replit: write 8 small programs (a calculator, a number guesser, a word counter)

Live Class 2: Logic & Reusable Code
Topic: Loops and conditions | Functions and modules | Files, JSON and error handling | Debugging your own script
HANDS-ON LABS: Own machine / Replit: write a script that reads a file of hosts and prints them cleanly


TryHackMe Extra: TryHackMe Python Basics room

Weekly goal: Read a packet capture and identify the protocol, the flow, and an attack pattern.

Live Class 1: Network Fundamentals
Topic: OSI and TCP/IP models | Ports and protocols | IP addressing, subnetting, CIDR | DNS resolution and network devices

Live Class 2: Packet Analysis with Wireshark
Topic: Capture and display filters | tcpdump and tshark | Spot SYN flood and amplification patterns in a pcap | Use AI to explain a capture summary
HANDS-ON LABS: TryHackMe: TryHackMe Wireshark The Basics and Nmap rooms | CyberDefenders: open a provided pcap and identify a port scan and a flood pattern

Weekly goal: Scan a lab host, rate findings with CVSS, and exploit one known vulnerability.

Live Class 1: Network Scanning with Nmap
Topic: Scan types and service detection | OS detection and NSE scripts | AI-assisted triage of scan results

Live Class 2: From Assessment to Exploitation
Topic: Nessus and Nikto | CVE, CVSS and risk rating | Metasploit framework basics | Exploit a deliberately vulnerable lab VM
HANDS-ON LABS: Nessus Essentials: run a full Nessus scan on Metasploitable 2 and read the report Free Metasploitable 2: exploit one vulnerable service on Metasploitable 2 with Metasploit


VulnHub (Kioptrix series) Assignment: fully compromise Kioptrix Level 1
TryHackMe Extra: TryHackMe Vulnversity and Blue rooms

Weekly goal: Explain how TLS protects HTTP, and intercept and modify a request in Burp Suite.

Live Class 1: Cryptography Essentials
Topic: Symmetric (AES) and asymmetric (RSA) | Hashing, salting and password storage flaws | TLS handshake seen in Wireshark | Post-quantum cryptography overview
HANDS-ON LABS: Own machine / Replit: crack a provided list of weak password hashes with John the Ripper

Live Class 2: HTTP & Burp Suite
Topic: HTTP methods, headers, cookies, sessions | Burp Proxy, Repeater, Intruder | Build the web lab used in Weeks 9 to 14
HANDS-ON LABS: Burp Suite Community: intercept and modify a request on Juice Shop with Burp Proxy | PortSwigger Web Security Academy: PortSwigger Burp Suite basics apprentice lab

Weekly goal: Identify and exploit file inclusion and file upload flaws in practice labs, and explain the

Live Class 1: File Inclusion
Topic: Path traversal concepts | Local and remote file inclusion | AI-assisted testing and filter awareness | Secure coding fixes
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger Path traversal labs (all 6) | DVWA File Inclusion and File Upload at low and medium security

Live Class 2: File Upload Vulnerabilities
Topic: Unsafe upload patterns | Validation weaknesses | Impact and remediation
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger File upload vulnerabilities labs | DVWA File Inclusion and File Upload at low and medium security

Weekly goal: Find reflected, stored and DOM XSS and CSRF flaws in labs, and recommend CSP and SameSite fixes.

Live Class 1: JavaScript, DOM & XSS
Topic: DOM basics | Reflected, stored and DOM XSS | Session security impact
HANDS-ON LABS: PortSwigger Web Security Academy Class 1: PortSwigger Cross-site scripting labs (reflected, stored, DOM)

Live Class 2: CSRF & CSP
Topic: CSRF fundamentals | Token and SameSite protections | Content Security Policy basics
HANDS-ON LABS: PortSwigger Web Security Academy Class 2: PortSwigger CSRF labs

OWASP Juice Shop Extra: Juice Shop XSS challenges

Weekly goal: Find misconfigurations in a running app, then find the same bug classes by reading its source code with AI help.

Live Class 1: Misconfiguration & SSTI
Topic: CORS misconfiguration | Default credentials and exposed panels | Security headers and subdomain takeover | Server-side template injection
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger CORS and SSTI labs

Live Class 2: AI-Assisted Secure Code Review
Topic: Reading Flask, Django and Node.js code for common bugs | Using AI to review code and verifying its findings | Semgrep basics
HANDS-ON LABS: Semgrep Community Edition: scan the Ostad vulnerable Flask/Django repo and triage the findings | Vulnerable Flask/Django app (Ostad repo): locate three real bugs in the source, then confirm them in the running app

মডিউল ৯ থেকে মডিউল ১৬ পর্যন্ত যা যা আলোচনা হয়েছে, সেটার উপর ভিত্তি করে থাকবে একটা বড়সড় এসাইনমেন্ট ও লাইভ টেস্ট। ঝালিয়ে নিতে পারবেন নিজেকে।

Weekly goal: Map a web app's attack surface and classify findings against the OWASP Top 10.

Live Class 1: Web Attack Surface Discovery
Topic: Subdomain enumeration | Directory and content discovery | Technology fingerprinting | Automating recon with a Python script
HANDS-ON LABS: OWASP Juice Shop: find and log 5 bugs across different OWASP Top 10 categories in Juice Shop

Live Class 2: OWASP Top 10 Walkthrough
Topic: Each category with one live lab example | Detection approach per category
HANDS-ON LABS: find and log 5 bugs across different OWASP Top 10 categories in Juice Shop | PortSwigger Web Security Academy: PortSwigger Information disclosure apprentice labs

Weekly goal: Find and confirm SQL injection in practice labs and recommend parameterised queries.

Live Class 1: SQL & SQLi Fundamentals
Topic: SQL basics | SQLi types: in-band, error-based, blind | Finding injection points
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger SQL injection labs (UNION and blind sets) | DVWA SQL Injection and Blind SQL Injection modules

Live Class 2: Advanced SQLi & Tooling
Topic: UNION and blind techniques in labs | sqlmap with manual validation | WAF awareness and defense
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger SQL injection labs (UNION and blind sets)

Weekly goal: Find SSRF, XXE and a business logic flaw in a lab app.

Live Class 1: SSRF & XXE
Topic: SSRF concepts and internal service access | Cloud metadata risk | XXE detection and remediation
HANDS-ON LABS: PortSwigger Web Security Academy: PortSwigger SSRF and XXE labs

Live Class 2: Business Logic & Authentication
Topic: Logic flaws: price tampering, workflow skip, race conditions | Password attacks and wordlists in labs | Missing rate limits and app-layer DoS (concept only)
HANDS-ON LABS:PortSwigger Web Security Academy Class 2: PortSwigger Business logic vulnerabilities and Race conditions labs

Weekly goal: Test a REST and a GraphQL API and report authorisation and authentication findings.

Live Class 1: API Fundamentals
Topic: REST and GraphQL | API keys, JWT, OAuth 2.0 | Rate limiting and versioning | API attack surface mapping
HANDS-ON LABS: OWASP crAPI: complete the crAPI BOLA, broken authentication and mass assignment challenges

Live Class 2: API Vulnerability Testing
Topic: BOLA and IDOR | Broken authentication and token flaws | Excessive data exposure | Postman and Burp for API testing
HANDS-ON LABS: OWASP crAPI: complete the crAPI BOLA, broken authentication and mass assignment challenges | PortSwigger Web Security Academy: PortSwigger API testing and JWT labs