Start learning at RedSec.
A free, open learning library for offensive security. Work through structured tutorials, labs, references, and reporting guides in the order that matches your goal.
- 698+
- lessons
- 22
- sections
- 0
- accounts required
Getting started
New here? Start with the platform, safe practice, and study habits.
Security foundations
Core concepts: risk, trust boundaries, threat modeling, and HTTP basics.
Tools and workflows
Practical workflows for notes, terminals, proxies, wordlists, and repeatable testing.
Linux
Shell skills, permissions, services, logs, and safe privilege escalation practice.
Networking
TCP/IP, DNS, TLS, routing, service discovery, and packet analysis.
Web security
How modern web apps work and where common security assumptions fail.
API security
REST, GraphQL, authorization, schema review, and safe API testing.
Authentication
Login flows, sessions, reset logic, MFA, OAuth, and identity mistakes.
Access control
Ownership checks, role boundaries, multi-tenant data, and authorization review.
Injection
SQL, command, template, LDAP, and deserialization injection fundamentals.
Client-side security
Browser trust, JavaScript review, XSS, CORS, CSP, and frontend storage.
Cloud security
Identity, storage, serverless, metadata, logging, and cloud review patterns.
Containers
Docker, Kubernetes, image hygiene, runtime boundaries, and cluster basics.
Active Directory
Windows domains, Kerberos concepts, delegation, and defensive lab practice.
Cryptography
Practical crypto failures: encoding, randomness, modes, tokens, and protocols.
Forensics
Files, memory, logs, packet captures, timelines, and evidence handling.
Reverse engineering
Static and dynamic analysis, file formats, strings, control flow, and patching basics.
Binary exploitation
Memory layout, mitigations, crashes, and lab-only exploitation concepts.
CTFs
Capture the flag: formats, tooling, and worked challenges.
Bug bounties
Hunt real targets: recon, scoping, and reports that pay.
Finding vulnerabilities
The core bug classes and how to actually find them.
Reporting and career
Clear writeups, responsible disclosure, portfolios, interviews, and growth.