AI Exercises

One hands-on, AI-assisted exercise per module. Do them on your own time, then share your results in the community.

• Module 01: Out of Scope!

  Rules of engagement, scope, and GDPR: find what the AI didn't catch.

  Start exercise

• Module 02: Map It, Rank It, Report It

  Attack surface mapping and risk ranking: check the AI's evidence and ownership.

  Start exercise

• Module 03: C2 Blueprint Review

  Offensive infrastructure planning: grade an AI C2 build plan against the six setup rules.

  Start exercise

• Module 04: Password Policy Autopsy

  Password and Kerberos defenses: find the spraying, AS-REP roasting, and weak-hash gaps the AI wrote in.

  Start exercise

• Module 05: Triage Trap

  Malware analysis and IoCs: catch the wrong-sample hash, hidden persistence, and beaconing the AI called telemetry.

  Start exercise

• Module 06: Offset Trap

  Buffer-overflow methodology: catch the wrong EIP offset, missed bad characters, protected JMP ESP module, and backwards remediation.

  Start exercise

• Module 07: Token Trap

  API security testing: catch the misdiagnosed JWT flaw, BOLA called BFLA, the forgotten v1 login, and the UUID-only fix.

  Start exercise

• Module 08: Packet Trail

  Sniffing and security evasion: catch ARP poisoning called MAC flooding, a dismissed DNS tunnel, and the firewall rule that let SSH out.

  Start exercise

• Module 09: Pocket Breach

  Mobile app security: catch the partial pinning, an exported reset screen, a plaintext token, and a false privacy label.

  Start exercise

• Module 10: Plant Floor

  IoT and OT security: catch a dual-homed workstation, anonymous MQTT, unsigned firmware, and weak vendor access.

  Start exercise

• Module 11: Cloud Cover

  Cloud and container security: catch a public bucket, a hidden IAM escalation path, an unhardened cluster, and a logging gap.

  Start exercise

• Module 12

  Coming soon