Course plan: cybersecurity from scratch
Everything you learn with HACKME, level by level. Right now there are 23 lessons and 72 games ready to play; levels marked “Coming soon” are on the way.
Level 1 · First steps
When you finish, you will be able to: Understand how an attacker thinks and what you are protecting. Create strong passwords, turn on two-step verification, spot fake emails, messages and calls, and look after your router, your phone and your backups.
0A · Start here
What cybersecurity is, plain and simple, starting from zero. · 3 lessons · 7 games
- What cybersecurity is and why it's your business
Cybersecurity means protecting what you have in the digital world: your accounts, your photos, your money in the bank, your messages and the devices you…
- Who attacks, what they want and how they move forward
It's almost never someone who picked you personally. The most common attacks are mass attacks: a program sends the same trap message to a million people…
- The three things we protect
Everything cybersecurity does can be summed up as protecting three things. Professionals call them the CIA triad: Confidentiality, Integrity and…
1A · Passwords
The first door anyone tries to open. · 3 lessons · 10 games
- Why a short password falls in seconds
Passwords aren't "guessed" like in the movies: a program tries combinations at full speed. That's called brute force.
- Make a steel-strong password, and what to do if you get hacked
The recipe that works best: a phrase of 4 to 6 random, unrelated words separated by hyphens. For example "moon-bike-cloud-thunder-ladder".
- The second step: apps, keys and codes
Two-step verification asks for two proofs that it's you: something you know (your password) and something you have (your phone or a key) or something you…
1B · Phishing
Learn to spot scams before you take the bait. · 3 lessons · 11 games
- How to read a web address and spot a fake email
Phishing is a message that pretends to come from someone you trust (your bank, a company, someone you know) so that you hand over your details or tap a…
- WhatsApp, texts, and messages that really are real
Scams by WhatsApp and text message use the same old trick: pretending to be someone you know or a company, and rushing you.
- Calls, messages, and stories: how they trick you
Scammers don't only use email. They switch channels depending on where they can reach you: a message, a call, a social network.
1C · How the internet works
To attack or defend, you need to know which roads things travel on. · 3 lessons · 9 games
- What happens when you open a website
When you type an address, your browser (the program that requests pages and shows them to you) doesn't know where that website is.
- The padlock, public Wi-Fi, and who attacks
The padlock in the browser means the connection to that website is encrypted. It doesn't mean the website can be trusted: phishing sites can have a…
- Your home network: the router and the Wi-Fi
The router is your home's front door to the internet. Everything you have connected goes through it: phones, computers, the TV, cameras, even the…
1D · Your phone and your computer
Updates, permissions, backups and what to do if you lose your phone. · 2 lessons · 7 games
- Update, lock and choose your apps wisely
Your phone and your computer hold more of your life than your home does. Keeping them safe comes down to three habits: keep them updated, lock them, and…
- Backups, ransomware and what to do if you lose your phone
Any device can be lost, broken, stolen or locked by an attack. The final defense isn't a piece of technology: it's having a copy of what matters.
Level 2 · Opening doors
When you finish, you will be able to: Tell the difference between who you are and what you are allowed to do in a system, recognize wrong permissions, files that should never be public and leaked keys, and know what to do when one leaks.
2A · Permissions and roles
When anyone can make themselves an administrator. · 2 lessons · 7 games
- Who you are and what you can do
A system asks two different questions. The first: who are you? That's authentication (for example, logging in with a username and password).
- Anything in the browser can be changed
Anything that comes from the browser can be written by the person using it: hidden buttons, data in the address, form fields, local storage.
2B · Exposed files
What was left open by mistake. · 2 lessons · 7 games
- Which files must never be public
A website is a folder of files on a server. Anything inside the public part can be downloaded by anyone who knows (or guesses) its name.
- If a file has already been exposed
Even when you're careful, it happens: a PDF with data uploaded "just for a little while", a .env file left on the server.
2C · Leaked keys
What happens if you post a key online. · 2 lessons · 7 games
- Keys: where they live and how they leak
An API key, a token, or a database password is a key in the real sense: it opens doors. If it falls into someone else's hands, that person can act as…
- A key leaked: what to do
When a key leaks, the order of your actions matters. First, cut off the attacker's access: revoke (cancel) the leaked key in the service.
Level 3 · Technical foundations
When you finish, you will be able to: Use a real terminal: move around a server, search files, read logs, understand permissions and respond to a small incident. Then, encryption and how data travels across a network.
3A · Systems and the terminal
Files, permissions and the command line, on a practice server. · 3 lessons · 7 games
- The terminal from scratch
The terminal is a window where, instead of clicking, you type instructions. Servers (the computers that run websites and apps) almost never have a screen…
- Searching files and reading logs
Servers write down almost everything that happens in files called logs: who logged in, who failed, which page was requested.
- Permissions: who can do what
In Linux, every file says who can read it (r), change it (w) and run it (x). And it says this for three groups: the owner, the group and everyone else.
3B · Encryption Coming soon
Truly hiding messages.
3C · Networks Coming soon
What travels through the air and the cables.
Level 4 · Systems and identity
When you finish, you will be able to: Set up devices wisely, control who gets in and to what, keep everything up to date and recover if something goes wrong.
4A · Hardening a device Coming soon
Configuring Linux and Windows wisely.
4B · Who gets in, and to what Coming soon
Accounts, permissions and zero trust.
4C · Patches and backups Coming soon
What I have, what breaks and how I recover.
Level 5 · Web, APIs and secure code
When you finish, you will be able to: Understand how the web talks (requests, APIs, sessions), see how an injection or XSS tricks a website (only on a toy site) and write code that does not fall into those traps.
5A · How the web talks Coming soon
Requests, responses, APIs and sessions.
5B · Injections and XSS Coming soon
Tricking a website with text (on a toy site).
5C · Secure code Coming soon
Designing well and watching what you import.
Level 6 · Authorized ethical hacking
When you finish, you will be able to: Practice ethical hacking with a method and with permission: define the scope, look for flaws, test them in a simulated environment and report what you found.
6A · Scope and threats Coming soon
What may be tested and what can go wrong.
6B · Finding flaws Coming soon
Assessing vulnerabilities methodically.
6C · Exploiting and reporting Coming soon
Testing with permission and reporting what you found.
Level 7 · Defense and monitoring
When you finish, you will be able to: Read logs, tell the odd from the normal, detect attacks with alerts and rules, and defend a network with firewalls.
7A · Reading logs Coming soon
Logs, and telling the odd from the normal.
7B · Detecting attacks Coming soon
Alerts, rules and the map of attack techniques.
7C · Defending the network Coming soon
Firewalls, devices and malware.
Level 8 · Incidents and resilience
When you finish, you will be able to: Respond to an incident in the first minutes, collect evidence without breaking it and keep things running while you recover.
8A · Responding to an incident Coming soon
What to do in the first minutes.
8B · Forensics and evidence Coming soon
Rebuilding what happened without breaking the evidence.
8C · Keeping things running Coming soon
Continuity and recovery.
Level 9 · Cloud and devices
When you finish, you will be able to: Protect accounts and permissions in the cloud, understand containers and suppliers, and look after phones and connected devices.
9A · The cloud Coming soon
Accounts and permissions in the cloud.
9B · Containers and suppliers Coming soon
What you use but didn't write yourself.
9C · Phones and connected things Coming soon
Mobile, IoT, wireless networks.
Level 10 · Governance and risk
When you finish, you will be able to: Measure risks, choose controls, learn the basics of privacy laws and build a security program for an organization.
10A · Risk and controls Coming soon
Measuring, deciding and prioritizing.
10B · Privacy and laws Coming soon
Personal data and privacy laws around the world.
10C · A security program Coming soon
Metrics, team and professional ethics.
Level 11 · AI and professional wrap-up
When you finish, you will be able to: Use AI safely (and know how it gets attacked), solve a full campaign from start to finish and present a final project.
11A · Security with AI Coming soon
Using AI without opening new doors.
11B · Full campaign Coming soon
Attacking and defending in one exercise.
11C · Final project Coming soon
Everything together, on the way to a certification.