COMING SOON

Cyber

Learn how attackers think so you can defend like a pro. This section will take you from the basics of staying safe online to breaking (and fixing) deliberately vulnerable apps in a safe, legal practice space.

Cyber fundamentals

• The CIA triad: confidentiality, integrity and availability
• Passwords, passphrases, hashing and multi-factor authentication
• How the web works: requests, cookies, sessions and HTTPS
• Command-line basics: files, permissions and finding hidden things

Attack types

• Phishing and social engineering: spot the fake
• Malware, ransomware and how it spreads
• Web attacks such as SQL injection, cross-site scripting (XSS) and broken access control
• Brute force and credential stuffing, and why rate limits matter

Incident response

• The incident response cycle: prepare, detect, contain, eradicate, recover, learn
• Reading logs to work out what happened and when
• Tabletop scenarios: you're the response team, so what do you do first?

Hands-on labs

Ready to practise? These free, well-loved labs are built to be hacked:

• OverTheWire Bandit: a wargame played in a real Linux terminal, where every level hides the password to the next. Start here to learn the command line.
• OWASP Juice Shop: a fake online shop packed with real-world security flaws to find, exploit and fix. Ask your teacher about running a classroom copy.

School CTF Day

We'd love to run a capture-the-flag (CTF) event at school: teams race to find hidden "flags" in puzzles and in a practice copy of OWASP Juice Shop, with a live scoreboard and prizes. There will be challenges for every level, from secret-code puzzles to SQL injection.

Golden rule: only ever test systems you own or have written permission to test. Everything in this section is built to be hacked. The rest of the internet isn't.