Stage A — Foundations
The ground everything else stands on: how a computer runs programs and controls access, what actually crosses the wire when two machines talk, the protocol every web attack and defense is built on, enough Python to read and change the small tools the field runs on, how to follow a vulnerability through source code, and what the cryptographic primitives do — and what breaks when they are misused.
Published 2026-10-09 · generated from the lesson data
The milestone
Explain, packet by packet, what happens between pressing “log in” and the page rendering: the DNS lookup, the TCP handshake, the TLS handshake, the HTTP request and response, the cookie or token that carries identity, and the bytes on the wire at each step.
The lessons
1. DNS in depth
Nothing on a network happens before DNS. The login flow this whole stage builds toward starts with a name typed into a client, and the first question the machine asks is "what address is that?" — answered by DNS, before…
2. TCP/IP and ports
Every connection you will ever investigate or exploit is TCP (or UDP) to an IP address and a port. The SOC analyst triaging "suspicious outbound connection" is reading exactly the states this lesson teaches: who…
3. Linux command line for security work
Every tool in this program runs on Linux, and every one of them is driven from the command line. The walkthroughs in a-dns-depth and
4. Windows concepts for security
The servers you will attack in Stage B are Linux. The victims in Stage C and D are very often Windows: the workstation that got phished, the domain controller, the server running the business application.…
5. Git and GitHub
Every artifact this program asks you to produce — lab notebooks, Bandit notes, tools, reports, disclosures — lives in a git repository, and the public ones live on GitHub. That is not administrative overhead; it is the…
6. HTTP in depth
Everything above this lesson assumes HTTP and almost nothing below it explains it. Web vulnerability work (Stage B) is the art of sending requests a developer did not expect and reading responses the developer did not…
7. Python for security tooling
Every tool you will meet in Stage B is, under the hood, a program that opens connections, sends crafted input, and parses what comes back — and an enormous share of them are Python scripts.
8. Reading code through a vulnerability
Every vulnerability you will ever find is a story about input: where it enters, what touches it, and where it lands. Source code is where that story is written down — and the ability to read it, following one…
9. OSINT and research discipline
Every authorized engagement in b-methodology begins with reconnaissance — and the first half of reconnaissance never touches the target at all. OSINT (open-source intelligence)…
10. Cryptography: what the primitives do, and what breaks when you misuse them
Every login you will ever test touches cryptography: the password is hashed, the session cookie is signed or encrypted, the traffic runs over TLS, the server's identity is a…
In reading order, 10 lessons. Every lesson follows the same ten parts — mechanism, walkthrough, sources, proof — and every walkthrough was executed and dated.
What you can honestly claim
After Stage A you can honestly claim: nothing yet — and that is the point. This is the brief's own reasoning, not a verdict on your effort: foundations are prerequisites, not proof of skill. The checkable evidence starts in Stage B. What you can say is that you can explain the login-to-render path from first principles, with no term you cannot unpack.
What comes next
When the milestone is met, continue to Stage B — Practitioner.