// THE CODEX · 必修 · MUST KNOW

TEN TECHNIQUES
EVERY HACKER MUST MASTER

ハッカー必読の秘伝

Not a course — a scroll. The core canon every operator carries in their head: the ten ideas that turn a script-kiddie into a hacker. Unlock each technique to master it and rank up.

⚡ Browse all courses ↓ Start the scroll
◈ TECHNIQUES MASTERED0 / 10
👑 S-RANK HACKER UNLOCKED
01
TECHNIQUE 01RANK S
キルチェーン

SEVEN GATES

The Cyber Kill Chain

Every intrusion walks the same seven stages. Break a single link and the whole attack collapses.

  • Recon → Weaponize → Deliver → Exploit → Install → C2 → Actions — the seven gates of Lockheed Martin's model.
  • Attackers must pass all seven; defenders only need to break one.
  • Every tool and lesson on this site maps to a gate — recon (nmap), exploit (web/binary), C2 (reverse shell).
  • Ask of any finding: which gate does this open?
⚔ Train this · Network Security

✓ MASTERED · 秘伝伝授

02
TECHNIQUE 02RANK S
攻撃者の眼

ADVERSARY EYE

The Attacker Mindset

The rarest skill and the one no tool grants: seeing systems as goals and trust, not features.

  • Assume every input is hostile until proven otherwise.
  • Chase the weakest link, not the strongest wall — attackers pick the path, defenders must cover them all.
  • Abuse intended functionality; the best exploits use features exactly as designed.
  • Delete the phrase "no one would ever do that" from your vocabulary.
⚔ Train this · Cybersecurity Fundamentals

✓ MASTERED · 秘伝伝授

03
TECHNIQUE 03RANK A
偵察

GHOST WALK

Reconnaissance

You cannot hit what you cannot see. The bigger your map, the smaller the exploit you need.

  • Passive first (OSINT, DNS, TLS certs, Google dorks) — no packets, no trace.
  • Then active: nmap for ports/services/versions, dirb/ffuf for hidden paths.
  • Enumerate relentlessly — 80% of the work is mapping, 20% is the shot.
  • Every open port is a door; every version number is a lead.
⚔ Train this · OSINT

✓ MASTERED · 秘伝伝授

04
TECHNIQUE 04RANK S
十の罪

TEN SINS

OWASP Top 10

Nine out of ten web hacks are the same ten flaws. Learn them and you own most of the web.

  • Broken Access Control & Injection (SQLi) top the list year after year.
  • Also: Cryptographic Failures, Insecure Design, Misconfiguration, Vulnerable Components, Auth Failures, SSRF.
  • Every bug bounty payout is one of these wearing a disguise.
  • Memorise the ten; pattern-match everything you test against them.
⚔ Train this · Web Application Security

✓ MASTERED · 秘伝伝授

05
TECHNIQUE 05RANK A
逆シェル

CALLBACK JUTSU

Reverse Shells

Firewalls block what comes in — so make the target reach out and call you instead.

  • You listen: nc -lvnp 4444. The target connects back to you.
  • Bind shell = target opens a port (often blocked). Reverse shell = target dials out (usually allowed).
  • Upgrade a dumb shell to a real TTY: python3 -c 'import pty;pty.spawn("/bin/bash")'.
  • The moment a shell connects back is the moment you own the box.
⚔ Train this · Python for Hackers

✓ MASTERED · 秘伝伝授

06
TECHNIQUE 06RANK A
権限昇格

ASCENSION

Privilege Escalation

A foothold gets you uid=1000. The prize is uid=0. Ascension is the climb between.

  • Hunt SUID binaries, sudo misconfigs (GTFOBins), writable cron, and Linux capabilities.
  • Enumerate first (sudo -l, find / -perm -4000) — the box tells you how to own it.
  • On Windows the same idea = tokens, services, and unquoted paths.
  • Root/SYSTEM is not luck — it is a checklist walked patiently.
⚔ Train this · Linux for Hackers

✓ MASTERED · 秘伝伝授

07
TECHNIQUE 07RANK B
一方通行

ONE-WAY GATE

Hashing vs Encryption vs Encoding

Confuse these three and you will misjudge every finding. Know which door swings back.

  • Hashing = one-way, irreversible (passwords → bcrypt/argon2, always salted).
  • Encryption = two-way, needs a key (AES, RSA) — reversible by design.
  • Encoding (Base64, hex) = not security — just a costume, decode it instantly.
  • See a hash? You crack or bypass. See ciphertext? You hunt the key.
⚔ Train this · Cryptography for Hackers

✓ MASTERED · 秘伝伝授

08
TECHNIQUE 08RANK B
三柱

THREE PILLARS

The CIA Triad

All of security reduces to three words. Every attack breaks one pillar; every defence guards one.

  • Confidentiality — only the right eyes (leaks break this).
  • Integrity — data unaltered (tampering breaks this).
  • Availability — up when needed (DoS breaks this).
  • Explain any finding by which pillar it shatters — that is impact.
⚔ Train this · Cybersecurity Fundamentals

✓ MASTERED · 秘伝伝授

09
TECHNIQUE 09RANK B
港図

PORT MAP

Common Ports

Ports are doors. A real operator reads the usual suspects on sight, no lookup needed.

  • 22 SSH · 80/443 HTTP(S) · 21 FTP · 25 SMTP · 53 DNS
  • 445 SMB · 3389 RDP · 3306 MySQL · 5432 Postgres · 6379 Redis
  • An open port is an attack surface; a version banner is a lead.
  • Nmap shows the doors — knowing them by heart shows the way in.
⚔ Train this · Network Security

✓ MASTERED · 秘伝伝授

10
TECHNIQUE 10RANK A
弱点の名

THE NAMING

CVE & CVSS

Every known weakness has a true name and a danger score. Learn to read both at a glance.

  • CVE-YYYY-NNNNN — the unique name of a public vulnerability.
  • CVSS 0–10 — its severity score (9.0+ = drop everything).
  • Hunt them on NVD and exploit-db; a version + a CVE = a way in.
  • Patching is just breaking the exploit before the attacker fires it.
⚔ Train this · Bug Bounty Mastery

✓ MASTERED · 秘伝伝授

// プロトコル · THE WIRE · PROTOCOLS

Know the wire.

Every attack is packets moving. Master the protocols — TCP/IP, UDP, DNS, TLS — and the network stops being a black box.

◈ PROTOCOLS0 / 6
⚡ THE WIRE MASTERED
P1
PROTOCOL 01RANK A
レイヤー

THE STACK

TCP/IP & The Model

Every packet you'll ever attack rides the same layered stack. Understand the layers and the whole internet clicks.

  • Four layers: Link (Ethernet/MAC) → Internet (IP) → Transport (TCP/UDP) → Application (HTTP, DNS…).
  • Encapsulation: each layer wraps the one above in its own header — attacking means peeling the layers.
  • IP addresses + subnets (CIDR like /24) decide who can reach whom.
  • Wireshark shows you every layer of a real packet — read one and it clicks.
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

P2
PROTOCOL 02RANK A
三段握手

THE HANDSHAKE

TCP — The Reliable Connection

TCP is a phone call: both sides shake hands, then talk in order. That handshake is also its biggest tell.

  • The three-way handshake: SYN → SYN-ACK → ACK opens every connection.
  • Connection-oriented, ordered, reliable — retransmits lost data. Ports 80, 443, 22, 3389 ride TCP.
  • Scanners abuse it: a SYN scan half-opens connections to map ports fast.
  • RST tears a connection down — useful for hijacking and evasion.
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

P3
PROTOCOL 03RANK B
無手順

GHOST PACKETS

UDP — Fire and Forget

UDP just throws packets and hopes. No handshake, no promises — which makes it fast, spoofable, and dangerous.

  • Connectionless: no handshake, no ordering, no delivery guarantee. Speed over reliability.
  • Carries DNS, DHCP, SNMP, VoIP and most online games.
  • Trivial to spoof the source — the root of amplification DDoS (DNS/NTP/memcached).
  • Harder to scan (no handshake) — an open UDP port often just stays silent.
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

P4
PROTOCOL 04RANK A
名前解決

THE ORACLE

DNS — The Internet's Phonebook

Nothing on the internet finds anything without DNS. Bend the phonebook and you redirect the whole world.

  • Resolves names → IPs via recursive lookups; records: A, AAAA, MX, TXT, CNAME, NS.
  • Recon goldmine: subdomains, mail servers, and SPF/DKIM hiding in TXT records.
  • Attacks: cache poisoning, DNS tunneling and exfiltration straight past firewalls.
  • Usually UDP/53 (TCP/53 for large answers & zone transfers).
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

P5
PROTOCOL 05RANK A
暗号化

THE ENVELOPE

HTTP/S & TLS

The web speaks HTTP; TLS is the sealed envelope around it. Know both — most bugs and most defenses live here.

  • HTTP = request/response: methods (GET/POST…), status codes, headers, cookies.
  • Plain HTTP is readable on the wire — anyone in the path can sniff or tamper with it.
  • TLS wraps it: a handshake exchanges keys, then encrypts everything (that's the padlock).
  • Attacks: MITM on plain HTTP, cookie theft, downgrade & certificate-trust abuse.
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

P6
PROTOCOL 06RANK B
隣接

THE WHISPER

ARP & ICMP — The Local Wire

Before packets leave your LAN, ARP decides where they go — and it trusts anyone. That trust is a classic attacker's door.

  • ARP maps an IP → a MAC address on the local network — with no authentication.
  • ARP spoofing lets you become the man-in-the-middle on a LAN by poisoning the cache.
  • ICMP powers ping and traceroute — recon, and covert ICMP tunnels.
  • Both live below TCP/UDP — the plumbing attackers love because defenders forget it.
⚔ Train this · Network Protocols

✓ MASTERED · 秘伝伝授

// 上級 · ADVANCED ARC · A → S

Beyond the canon.

You know the ten. This is where operators become red-teamers — the techniques that own whole networks, not single boxes.

◈ ADVANCED TECHNIQUES0 / 6
⚔ ADVANCED ARC CLEARED
11
TECHNIQUE 11RANK A
横移動

TUNNEL WALKER

Pivoting & Lateral Movement

One box is never the goal — it's the on-ramp. Pivot through it to reach the network hiding behind it.

  • Turn a foothold into a router: SSH tunnels, proxychains + a SOCKS proxy, or chisel.
  • Local vs remote vs dynamic port-forwarding — know which opens the door you need.
  • Map the internal subnet from the inside; the crown jewels are never internet-facing.
  • Every hop is a new vantage point — and a new place to get caught. Move deliberately.
⚔ Train this · Network Security

✓ MASTERED · 秘伝伝授

12
TECHNIQUE 12RANK S
城攻め

DOMAIN FALL

Active Directory Attacks

In the enterprise, one Domain Admin owns everything. AD is the castle — and it has many unlocked gates.

  • Kerberoasting & AS-REP roasting — crack service/user tickets offline.
  • BloodHound maps the shortest path from any user to Domain Admin.
  • Pass-the-Hash, DCSync, and the Golden Ticket — from creds to total control.
  • The vast majority of real enterprise breaches walk straight through Active Directory.
⚔ Train this · Active Directory & Red Teaming

✓ MASTERED · 秘伝伝授

13
TECHNIQUE 13RANK S
常駐

GHOST IN THE MACHINE

C2 & Persistence

Access you can't keep is access you don't have. Persistence is how you survive a reboot — and the blue team.

  • A C2 (command-and-control) channel: beacons that phone home on an interval (Sliver, Mythic, Cobalt Strike).
  • Persistence footholds: scheduled tasks, registry run-keys, services, cron, startup items.
  • Blend into normal traffic — HTTPS beacons, sane jitter, trusted-looking domains.
  • The art is staying quiet: loud persistence is just a tripwire for the defender.
⚔ Train this · Active Directory & Red Teaming

✓ MASTERED · 秘伝伝授

14
TECHNIQUE 14RANK S
隠形

SHADOW CLOAK

Evasion & OPSEC

Modern targets have EDR watching everything. The advanced game isn't just exploiting — it's not getting seen.

  • Living off the land (LOLBins): use trusted built-in binaries so nothing new touches disk.
  • In-memory execution, AMSI/logging awareness, obfuscation — shrink your signal.
  • Know what the defender sees: every action writes a log somewhere.
  • OPSEC is a mindset — assume you're watched. (On authorized engagements and your own systems only.)
⚔ Train this · Malware Analysis & RE

✓ MASTERED · 秘伝伝授

15
TECHNIQUE 15RANK S
メモリ破壊

STACK BREAKER

Memory Corruption & ROP

When there's no logic bug to abuse, you go lower — turn a crash into a shell by rewriting memory itself.

  • A buffer overflow overwrites the return address → hijack execution (ret2win).
  • Modern mitigations — ASLR, NX, stack canaries, PIE — and how each is defeated.
  • ROP (Return-Oriented Programming) chains existing code when you can't inject your own.
  • The deepest offensive skill: making the CPU run your instructions.
⚔ Train this · Exploit Development

✓ MASTERED · 秘伝伝授

16
TECHNIQUE 16RANK A
連鎖

CHAIN REACTION

Vulnerability Chaining

One medium bug is a shrug. Three chained together is a critical. Real impact is the combo, not the single hit.

  • Low + low can equal critical: e.g. open redirect → SSRF → cloud metadata → creds.
  • Think in reachability: what does this bug unlock that the next one needs?
  • The best bug-bounty reports tell a story — each step raises the impact.
  • Chaining is where a scanner stops and a hacker begins.
⚔ Train this · Bug Bounty Mastery

✓ MASTERED · 秘伝伝授

Scroll mastered. Now wield it.

The Codex is the map. The courses are the training ground — real Docker labs where you fire every technique at targets you own.

Enter the courses 🔥