Start as an unprivileged domain user. Use BloodHound to map attack paths, Kerberoast a service account, move laterally via Pass-the-Hash, and achieve Domain Admin through a DCSync attack. Full Ficsit Inc. environment with real telemetry generated in Foyl SIEM and Foyl EDR.

Methodically attack a vulnerable mock application — SQLi to extract credentials, SSRF to probe internal services, IDOR to access other users' data, and authentication bypass to escalate privileges. Structured around a PTES / OWASP Top 10 methodology.

Build a target network map from scratch using nmap scan types, service fingerprinting, OS detection, and directory brute forcing. Learn when to use stealth scans vs aggressive scans, and how scan timing affects detectability.

Exploit AWS IAM misconfigurations to escalate from a low-privilege access key to admin, discover exposed S3 buckets, abuse Azure managed identity, and exfiltrate data via cloud-native services. IMDSv1 metadata abuse included.

Design and execute a simulated phishing campaign — craft lure pretexts, build an AiTM proxy with Evilginx2, deliver the campaign, capture session cookies, and replay them to bypass MFA. Mirrors the IRON CHIMNEY THREAT-001 scenario from Foyl Learn.