Level 2 · M.Sc

Whitehat Defensive Security

Syllabus · 42 phases · ~1 year

Every unit this programme teaches, in the order it is taught. Headlines only — the material itself opens once you are enrolled.

Dates, price and prerequisites

Phase 0 Provisioning the sovereign host & the Bastion lab
Phase 1 Terminal internals: TTYs, PTYs & session recording
Phase 2 Fonts, keymaps & selections from the CLI
Phase 3 Interactive-prompt handling & automation with expect
Phase 4 fish I: interactive mastery
Phase 5 fish II: scripting, functions & control flow
Phase 6 POSIX sh & bash for portability
Phase 7 The line editors: ed & ex
Phase 8 sed & awk: the super-admin data language
Phase 9 vim, deep
Phase 10 emacs, deep
Phase 11 tmux mastery
Phase 12 The combined workflow: xmonad + tmux + emacs + fish
Phase 13 Git as a content-addressed object store
Phase 14 Branching, merging, reflog & history surgery
Phase 15 Git for defense: signing, hooks & /etc tracking
Phase 16 systemd I: units, lifecycle & journald
Phase 17 systemd II: timers, sandboxing & service hardening
Phase 18 The kernel runtime surface: sysctl, /proc & /sys
Phase 19 dbus & the system message bus
Phase 20 Processes, files & resources
Phase 21 Networking observability
Phase 22 Syscall & library tracing
Phase 23 Performance & kernel tracing
Phase 24 File formats, magic & headers
Phase 25 ELF in depth
Phase 26 Advanced hex editing & binary diffing
Phase 27 Archives, compression & structured data
Phase 28 Identity: users, groups & the permission model
Phase 29 Extended attributes, ACLs, capabilities & immutability
Phase 30 GPG & SSH: keys, certs & trust
Phase 31 Mandatory access control: SELinux
Phase 32 /etc mastery, config-drift & host integrity baselining
Phase 33 Isolation & containers: namespaces → rootless podman
Phase 34 Threat detection: NIDS, HIDS, eBPF monitoring & deception
Phase 35 tty/session monitoring, USB/peripherals & network trust
Phase 36 Kernel modules & rootkit detection (defensive)
Phase 37 OpenBSD as a security appliance: pf, base & the router/firewall
Phase 38 Hardening the server stack: nginx/haproxy/apache + sqlite
Phase 39 Detecting an attacker with an account (the purple-team core)
Phase 40 Toolchain literacy: compile, debug & inspect
Phase 41 Capstone: defend the Bastion + hardening + portal