Course Syllabus

A module-by-module breakdown of everything covered in each NWCA course.



Cybersecurity Fundamentals

A beginner-friendly foundation in core security principles, networking, Linux/Windows basics, common protocols, and a hands-on Wireshark project.

Welcome to Cybersecurity Essentials
  • 1. Welcome to the Course
  • 2. About Your Instructor
  • 3. Asen's Real-World Experience
  • 4. What to Expect
  • 5. Designed for Everyone
  • 6. Beginner-Friendly Approach
  • 7. What You'll Gain from the Course
  • 8. Let's Begin
Module 1: Core Cybersecurity Principles
  • Cybersecurity Fundamentals — Introduction
  • 1.1 — Core Cybersecurity Principles
  • 1.2 — History of Cybersecurity
  • 1.3 — Understanding Risk and Human Factors
  • Module 1 Quiz
Module 2: Basic Networking Concepts
  • 2.1 — Basic Networking Concepts
  • 2.2 — IP Addressing and Subnetting
  • Module 2 — Real-Life Story
  • 2.3 — Common Network Vulnerabilities
  • Module 2 Quiz
Module 3: Intro to Linux & Windows
  • 3.1 — Intro to Linux and Windows
  • 3.2 — Security-Relevant Log Files
  • 3.3 — Command-Line Tools for Defense
  • Module 3 — Real-Life Story
  • 3.4 — Hands-On with the Command Line
  • Module 3 Quiz
Module 4: Common Protocols and Security Controls
  • 4.1 — Understanding HTTP and HTTPS
  • 4.2 — DNS: The Internet's Phonebook
  • 4.3 — SSH and FTP: Remote Access and File Transfer
  • Module 4 — Real-Life Story
  • 4.4 — Firewalls
  • Module 4 Quiz
Module 5: Hands-on Wireshark Project
  • Module 5.1: Wireshark Project
  • Wireshark Project


Web Application Pen Testing: Beginner to Job Ready

A hands-on path from web pentesting fundamentals through reconnaissance, auth/session flaws, injection attacks, AI attacks, and a final exam against a live MedPortal target — job-ready reporting included. Practice lab available anytime for student to apply what they've learned.

Introduction to Web Application Pen Testing
  • Course Introduction
Module 1 — Foundations of Web Penetration Testing
  • 1.1 — What is Web Application Penetration Testing?
  • 1.2 — Types of Pen Tests: Black, White, and Gray Box
  • 1.3 — How Websites Work
  • 1.4 — HTTP Essentials for Testers
  • 1.5 — Authentication Basics, Sessions, and Secure Cookies
  • 1.6 — OWASP Top 10
  • 1.7 — BurpSuite: What It Is and Why Testers Use It
  • 1.8 — Burpsuite Community Installation Demo
  • 1.9 — Burpsuite Pro Installation Demo
  • 1.10 — Burpsuite Community Main Tabs Demo
  • 1.11 — Burpsuite Internal Browser / External Browser Demo
  • Module 1 Quiz
Module 2 — Reconnaissance & Attack Surface Mapping
  • 2.1 — Simulated Gray-Box Penetration Test
  • 2.2 — Mapping the Application: Reconnaissance to Active Scanning
  • 2.3 — Passive Recon Demo
  • 2.4 — Active Recon: NMAP Demo
  • 2.5 — Active Recon: Burp Crawl
  • 2.6 — Mapping Out the Web Application
  • 2.7 — BurpPro Active Scan
  • Module 2 Quiz
Module 3 — Authentication & Session Management
  • 3.1 — Authentication Vulnerabilities
  • 3.2 — Session Management Vulnerabilities
  • 3.3 — Demo: Authentication Testing — Part 1
  • 3.4 — Demo: Authentication Testing — Part 2
  • 3.5 — Demo: Session Management Flaws
  • Module 3 Quiz: Authentication & Session Management
Module 4 — Authorization Vulnerabilities
  • 4.1 — Authorization Vulnerabilities
  • 4.2 — Demo: IDOR — Insecure Direct Object References
  • 4.3 — Demo: MFLAC — Missing Function-Level Access Control
  • 4.4 — Demo: No JWT Signature Verification
  • Module 4 Quiz: Authorization Vulnerabilities
Module 5 — Business Logic Flaws
  • 5.1 — Business Logic Flaws
  • 5.2 — Demo: Business Logic Flaw
  • Module 5 Quiz: Business Logic Flaws
Module 6 — File Upload Vulnerabilities
  • 6.1 — File Upload Vulnerabilities
  • 6.2 — Demo: Unrestricted File Upload
  • Module 6 Quiz: File Upload Vulnerabilities
Module 7 — Injection Attacks
  • 7.1 — Cross-Site Scripting (XSS) Vulnerabilities
  • 7.1.1 — Demo: Reflected XSS
  • 7.1.2 — Demo: Stored XSS
  • 7.1.3 — Demo: DOM-Based XSS
  • 7.2 — SQL Injection Vulnerabilities
  • 7.2.1 — Demo: SQL Injection
  • 7.2.2 — Bonus Demo: SQLMap Walkthrough
  • 7.3 — Server-Side Request Forgery (SSRF) Vulnerabilities
  • 7.3.1 — Demo: Server-Side Request Forgery
  • Module 7 Quiz: Injection Attacks
Module 8 — AI Attacks
  • 8.1 — AI Attacks and Prompt Injection
  • 8.2 — Demo: AI Prompt Injection
  • Module 8 Quiz: AI Attacks
Module 9 — Security Misconfigurations
  • 9.1 — Security Misconfigurations
  • 9.2 — Demo: Security Misconfigurations
  • Module 9 Quiz: Security Misconfigurations
Module 10 — Penetration Test Reporting
  • 10.1 — Penetration Test Reporting
  • 10.2 — Sample Report Walkthrough
  • 10.3 — True Story: Reporting in Practice
  • Module 10 Quiz: Penetration Test Reporting
Module 11 — Course Closeout
  • Closing Remarks & Next Steps
Module 12 — Final Exam
  • Final Exam
Certificate
  • See Your Certificate


Agentic AI in Cybersecurity Mini-Course

A short, focused introduction to agentic AI concepts and their application in cybersecurity — Fundamentals track.

Agentic AI in Cybersecurity (Mini-Course)
  • Agentic AI in Cybersecurity (Main Lesson)
    • What is AI and an LLM?
    • What is Agentic AI?
    • Simple Analogy: Traditional AI vs. Agentic AI
    • How Agents Work
    • What is MCP (Model Context Protocol)?
    • Tools Agents Can Use
    • Where Agents Fit in Cybersecurity
    • Where Does the AI Brain Run? (Local vs. Cloud)
    • Limitations of AI Agents
    • Human vs. AI
    • Guardrails: Keeping the Agent in Scope
    • AI Agent Attack Risks (Prompt Injection, Indirect Prompt Injection, Memory Poisoning)
    • Recap & What's Next
  • Demo: Agentic AI
    • Live demo setup: an AI agent (Claude Code) paired with an MCP tool orchestrator (HexStrike AI)
    • Authorized gray-box web app penetration test against a training target
    • Automated reconnaissance and scanning with nmap, feroxbuster, sqlmap, and custom scripts
    • Live findings walkthrough: SQL injection, missing authentication, IDOR, outdated software, information disclosure
    • Auto-generated penetration test report
  • Course Notes
  • Agentic AI Mini-Course Quiz