← Back to catalogue

Level 2 · M.Sc

MSc Blackhat Offensive Security

Security · Live · v0

Offensive security foundations, taught CTF-style — reconnaissance, exploitation theory, and detection-first analysis.

Path type

Security

Requirements

Open entry

Enrollment

€19.90

Deadline

Next cohort starts 2027-09-06 (AY 2027/28)

Length

~1 year · 42 phases

Language

English · Español

Content freshness

Curriculum updated 2026-08-23 · content rev 803433c2

Cortex Credits (CC)

126 CC
What are Cortex Credits?

Syllabus

View the phase syllabus

0. Foundations & operator tooling
1. The authorized-self-attack ethic & rules of engagement
2. Stand up the shared reference lab
3. The attacker's model & the trace-first doctrine
4. OSINT, host discovery & the network map
5. Port scanning mastery, evasion & firewall-rule mapping
6. Port scanning mastery II: service/version + NSE
7. DNS & infrastructure enumeration
8. Web surface enumeration
9. Recon debrief: the map & the trace it left
10. Vulnerability scanning
11. Web-app probing & template scanning
12. TLS & crypto-posture inspection
13. Manual verification vs scanner noise
14. Vuln-assessment debrief
15. Passive capture & the silent observer
16. Dissection with tshark
17. MITM, wireless & name-service poisoning
18. Packet crafting I: hping3
19. Packet crafting II: Scapy at the CLI
20. Interception debrief
21. Credential attacks I: online & poisoning
22. Credential attacks II: offline cracking
23. Initial access via the web
24. Foothold & reverse shells
25. Privilege-escalation enumeration
26. Linux privesc exploitation paths
27. Container & boundary-escape concepts
28. Post-ex enumeration, looting, pivoting & tunnelling
29. Persistence mechanisms
30. Hiding I: userland (LD_PRELOAD)
31. Hiding II: capture & tampering
32. Beaconing, covert channels & exfil
33. Persistence & hiding debrief
34. Evasion & anti-forensics analysis
35. Framework literacy: Metasploit at the CLI
36. Lightweight C2 & tradecraft: the traces convenience cannot erase
37. The professional pentest report: every finding carries its detection
38. The purple-team debrief
39. Capstone: full authorized engagement
40. Hardening feedback loop & postmortem
41. Portal integration

Syllabus →

Enrolment prerequisites

• A verified account and admissions-committee approval.