Build the bench and fuzzing rigs that turn a $30 gadget into a filed vulnerability report — and a competition writeup that gets you noticed.
You have the pentest methodology down, but the web app and the network are where everyone stops — and where the interesting bugs aren’t. The vulnerabilities that get numbered and paid out live in firmware, in silicon, and in code nobody has fuzzed yet, and you have no bench, no fuzzing pipeline, and no track record to prove you can find them. This course is the research and competition end of authorised testing, worked entirely on hardware you own or have written permission to test. You build a Raspberry Pi rig and a self-encrypting drop box; capture Wi-Fi handshakes and clone RFID fobs in a shielded lab; solder onto UART and JTAG to dump a flash chip; emulate and reverse a cheap connected device until a command-injection bug falls out; and stand up a coverage-guided fuzzer, then take a crash through coordinated disclosure. From there you climb the capture-the-flag ladder from OverTheWire to live events, writing up every solve. Five capstones — pick one and ship it.
Built by Lakshya Kumar
Paste this into any AI chat. Fill in the bracketed parts with your context — you'll get back a straight answer on whether this belongs on your plate.
We grant free access case-by-case — students, career-switchers, builders on a tight budget. Sign in to send us a note.
Sign in to applyFinished the tasks? Take the prompt to your AI and get tested on it. We copy the prompt and open the app — just paste it in.
Encrypt the disk, wire a kill switch, and phone home over cellular so a box you plant in your own lab stays yours.
Put a card in monitor mode, pull PMKID and handshake material off your own access point, and see how far an evil twin gets.
Build a payload that types itself into a shell in seconds — then write the detection rule that catches it on the way in.
Capture, decode, and replay sub-GHz and RFID signals from your own fobs and remotes inside a shielded bench.
Solder onto UART and JTAG, dump a flash chip, and glitch a target to see what firmware and keys the silicon gives up.
Emulate, reverse, and hunt the command-injection and hardcoded-credential bugs that ship on cheap connected devices.
Point a coverage-guided fuzzer at open-source code, triage the crashes, and take one bug through coordinated disclosure.
Climb from OverTheWire and picoCTF to Hack The Box and live events, building the writeup habit that proves how you think.
Plan a full engagement, mind the physical tradecraft and the law, and map the next twelve months of your specialty.
Complete all modules, then submit the required number of capstone projects. Each must earn a passing rating from an admin reviewer.
Build a complete Pi dropbox: LUKS-encrypted root, GPIO tamper-triggered LUKS-header nuke, 72-hour dead-man timer, Sliver implant with mTLS to a redirector VPS, autossh fallback, LTE/4G out-of-band exfil. Stand it up on a hostile-network sim, verify C2 beacons + each kill-switch path. Submit config bundle + logs + photos.
Pick one HID platform (Rubber Ducky / Bash Bunny / Digispark / Flipper / P4wnP1). Build a payload that detects OS, opens a reverse shell to your lab C2, and self-cleans. Then write the defensive side: a Sysmon/auditd rule that detects the payload's behaviour. Submit payload source, video, detection rule, and detection logs.
I am learning advanced hardware-class pentesting + 0-day research + competition-grade CTFs — building a pentest machine from Raspberry Pi / Arduino / ESP32, choosing form factor (workstation / drop box / implant), running custom Kali (Pi-Tail, NetHunter, Sticky Fingers), persistence with LUKS + kill switches, C2 with Sliver / Mythic / Havoc, pivoting via ligolo-ng / chisel, wireless attacks (PMKID, WPS, evil twin, EAPHammer, BLE with Sniffle, Zigbee with Killerbee, LoRa), HID/USB attacks (Rubber Ducky DuckyScript v3, Bash Bunny, O.MG Cable, Digispark, P4wnP1), RF/NFC (Flipper Zero, Proxmark3 RDV4, HackRF One + GNU Radio, RTL-SDR, IR, iButton), hardware hacking (UART, JTAG/SWD with OpenOCD, SPI flash with flashrom, I2C with Saleae, ChipWhisperer + DPA/CPA + voltage glitching), firmware analysis (binwalk, Ghidra, QEMU + FirmAE + firmadyne, U-Boot escape, Mirai-class IoT bugs), 0-day vulnerability research (AFL++, libFuzzer, syzkaller, triage, exploit primitives + ROP/JOP, ASLR/KASLR/SMEP/SMAP/CFI bypass, responsible disclosure via Project Zero / ZDI / Pwn2Own), and CTF mastery (HackTheBox + Pro Labs, TryHackMe, picoCTF, OverTheWire, PortSwigger Academy, pwn.college, DEF CON CTF, Google CTF). Help me work through the actual mechanics with reference to real devices, real CVEs, real CTF platforms, and real disclosure paths — always on equipment I own or have written authorisation to test.
Pick one authorised RF scenario in your own lab (Faraday-shielded): 125 kHz LF fob clone with Flipper + Proxmark, 433 MHz fixed-code capture+replay with HackRF + GNU Radio, or IR remote replay. Document equipment, frequencies, captures, legal basis, and a defensive recommendation. Submit photos, recordings, writeup.
Buy a $30-50 IoT device. Extract firmware (UART/JTAG/SPI). Reverse-engineer in Ghidra. Find one CVE-class bug (cmd injection / hardcoded cred / overflow / auth bypass). Reproduce on the real device. Write a full security advisory with CVSS. Optionally responsibly disclose to the vendor with a 90-day embargo. Submit advisory + PoC + reproduction logs.
Solve 10 medium-difficulty challenges across 3+ categories from HTB / TryHackMe / picoCTF / PortSwigger Academy. For each, write a complete walkthrough on a public blog or GitHub: enumeration, hypothesis-elimination, exploitation, takeaway. The walkthroughs are the deliverable — they prove how you think, not just what you solved.
Rubber Ducky, Bash Bunny, WiFi Pineapple, O.MG.