Offensive security training that ends with a shell, not a quiz.
Structured paths from your first scan to advanced exploitation. Every module is gated on a real, breakable system, so progress means you did the thing — not that you watched someone else do it.
How the training works
Tracks, not playlists
A track is an ordered set of modules with a gate between them. You do not advance by marking a video watched — you advance by producing the flag that proves you did the thing the module taught.
Every lesson ends on a real box
Theory is the short half. Each module hands you a machine with the vulnerability class you just read about actually present on it, and you exploit it yourself, with no walkthrough running alongside.
Competition as assessment
CTF events are the exam nobody can cheat. A scoreboard is a ranking against everyone who sat the same problems under the same clock, which is a far harder number to fake than a completion percentage.
Writing as proof
Publishing a writeup is how a solve becomes something you can show an employer. They unlock once you have solved the box yourself, so a published writeup is evidence rather than a transcript.
What you will cover
- 01
Foundations
Networking, Linux, the shell, and how a service exposes itself. Your first nmap scan and your first understanding of what it returned.
- 02
Web exploitation
Injection, authentication and session flaws, SSRF, file upload, deserialisation — found by reading an application rather than by running a scanner at it.
- 03
System exploitation
Privilege escalation on Linux and Windows: misconfigured services, weak permissions, credential reuse, kernel and userland escalation paths.
- 04
Active Directory
Enumeration, Kerberos attacks, delegation abuse, lateral movement, and the path from one domain user to Domain Admin.
- 05
Binary exploitation
Memory corruption from first principles: stack overflows, ROP, heap exploitation, and the mitigations you have to defeat along the way.
- 06
Operating
Tradecraft: pivoting, tunnelling, evasion and reporting — turning an exploit into an engagement someone will pay for.
Training questions, answered
Is OFFCON suitable for a complete beginner?
Yes, provided you are comfortable with a computer and willing to read. The foundations track assumes no security knowledge at all and starts at what a port is. What it does assume is that you will spend time stuck — that is the actual skill being trained, and no course can remove it.
How long does it take to become employable?
For someone studying seriously alongside other commitments, twelve to eighteen months to junior penetration tester is a realistic and commonly observed range. Anyone promising ninety days is selling something. What shortens it is volume of hands-on work and visible proof of it — solved machines, published writeups, CTF placements.
Do I get a certificate?
Tracks that are marked as certificate-bearing issue one on completion, and CTF events can issue participation and placement certificates. Treat them as supporting evidence rather than as the thing itself — in this field a portfolio of solved machines and written work carries further than a certificate does.
How does this compare to a university degree?
They answer different questions. A degree gives you theory, mathematics and a credential that passes an HR filter. This gives you the practical ability the job is actually assessed on at interview. People who have both do best; if you have to pick one to start, the hands-on skill is the one you can demonstrate in a technical interview.
Is everything free?
A free account covers registration, the starting machines, the community and entry to free CTF events. Paid tiers add the full machine catalogue, the guided tracks and priority lab capacity. Pricing is listed publicly, in local currency where we support it.