// networking basics — capstone

Capstone — You're Ready to Choose a Track

Thesis: If you can do everything below without notes, you have the complete shared foundation of cybersecurity — and the red/blue decision is now about interest, not readiness. Every track-specific skill lands on a foundation you've already built. That's why the foundation came first: pick either track and you're standing on ground you already understand.

Prerequisite: all of Modules 0–12. This is not a new lesson — it's the proof that the chain held.

The complete-foundation checklist

This is one long Mastery Check spanning the whole course. Go through it honestly, out loud and at a keyboard. Every item you can't do cold points you back to a specific module to redo — including its lab. Do not treat "I sort of remember that" as a pass; the whole method of this course is never moving on past something you half-understand, and this is the last gate.

You should be able to, without notes:

• (M0) Explain the CIA triad and use the precise vocabulary — threat, vulnerability, exploit, risk, attack surface, attack vector — correctly in a sentence, and state the authorization rule that separates a tester from a criminal.
• (M1) Stand up an isolated VM lab, snapshot and roll back a machine, and prove a host-only network can't reach the internet.
• (M2) Trace data down and up the OSI/TCP-IP stack and explain encapsulation; reason about IPv4 addressing, private ranges, and subnetting (compute network/broadcast/usable hosts for a /24 and a /26); explain ARP, the default gateway, and NAT.
• (M3) Draw the three-way handshake from memory with correct flags, explain TCP vs. UDP, and read connection states.
• (M4) Identify what talks on the core ports on sight, walk through DNS resolution (root → TLD → authoritative), and know the main record types and the DORA exchange.
• (M5) Capture live traffic and find the three-way handshake, a DNS exchange, and an HTTP request in it — and articulate the capture-filter vs. display-filter distinction.
• (M6) Read an HTTP request/response fluently — methods, status codes, headers, URLs — and explain cookies/sessions and what HTTPS does and doesn't guarantee.
• (M7) Correctly distinguish encoding, hashing, and encryption; explain salting and slow hashes; explain symmetric vs. asymmetric and why TLS uses both; say what a certificate proves.
• (M8) Navigate both the Linux and Windows security models, map their concepts to each other, and explain what Active Directory centralizes and why a domain controller is the crown jewel.
• (M9) Explain authentication vs. authorization, the MFA factors, why credentials are the main battleground, and the shape of NTLM vs. Kerberos.
• (M10) Write Bash to reshape output, Python to build a small tool, and regex to extract fields from text — and know which to reach for when.
• (M11) Say where logs live on Linux and Windows, pull meaningful events out of them with your scripting skills, and explain what a SIEM centralizes.
• (M12) Speak in CVE / CVSS / ATT&CK terms and map an attack onto the attacker lifecycle.

If every box is checked cold, you're done with the foundation. If any isn't, you know exactly where to go.

A capstone exercise (put it all together)

Do this end-to-end in your lab — it exercises the whole chain at once:

1. Recon (M2–M5). From your attacker box, discover a target on your isolated network, identify what's listening, and confirm your findings by capturing the traffic and reading it. Point at a handshake and a DNS query in your own capture.
2. Read the web tier (M6). Interact with a web service on the target with curl, read the full request/response, and find its session cookie.
3. Reason about identity and crypto (M7, M9). Locate a stored credential or hash on the target; identify whether it's encoded, hashed, or encrypted, and explain how it should have been stored.
4. Map the OS (M8). State whether the target is Linux or Windows and name three security-relevant facts about it (permission model, where its logs live, how it runs services).
5. Automate (M10). Write one Bash pipeline and one small Python script that parse some output you generated (a scan result or a log) into something clean.
6. Read the telemetry (M11). Find the evidence of your own activity in the target's logs — the failed/successful logins, the connections. You just played both sides.
7. Frame it (M0, M12). Write a short "finding" the way a professional would: name the asset, the vulnerability, the risk in plain terms, and the ATT&CK-style technique you'd map each step to.

Notice what just happened: that single exercise touched every module in the course, and you did the groundwork of both a red operation (recon, access, automation) and a blue investigation (reading the logs, framing the finding) with the same skills. That is the whole thesis of this curriculum, demonstrated.

How the split builds on this foundation

You are now standing exactly where the two tracks diverge. Both grow directly out of what you've learned:

• Red team / offense takes these fundamentals toward reconnaissance, exploitation, post-exploitation, and reporting — everything you learned, aimed at finding and proving weaknesses. Its exploitation stands on your networking + web + OS knowledge; its credential attacks stand on your identity + crypto knowledge; all of it is accelerated by your scripting.
• Blue team / defense takes the same fundamentals toward monitoring, detection engineering, incident response, threat hunting, and hardening — aimed at catching and stopping attacks. Its detection stands on your logging + telemetry + networking; its identity defenses stand on the same crypto and identity modules; all of it, likewise, accelerated by your scripting.
• Purple is simply both, working from the shared vocabulary of Module 12 — which you now speak.

Every track-specific skill lands on a foundation above. Exploitation on networking + web + OS. Detection on logging + telemetry + networking. Credential attacks and defenses on identity + crypto. And all of it accelerated by the scripting from Module 10. That's why the foundation comes first — pick either track and you already understand the ground it stands on.

Recommended tools and references (keep these close)

• Wireshark & tcpdump — keep reading real traffic; it's the highest-leverage skill here (Module 5).
• A vulnerable-by-design practice environment (intentionally weak VMs and web apps) and sanctioned learning platforms — your legal playground (Modules 0–1).
• dig/nslookup, curl, ss/netstat, and nmap (used gently for learning) — everyday network literacy tools (Modules 2–4).
• CyberChef — browser-based encoding/decoding, hashing, and data transformation; superb for crypto/encoding intuition (Module 7).
• The MITRE ATT&CK website — the shared map; browse it early and often (Module 12).
• Python's requests and re docs, and a good regex tester — your scripting reference set (Module 10).
• Official OS documentation — Linux man pages, Microsoft's Windows/AD docs (Module 8).
• A note-taking habit (this vault) — document every command, capture, and finding. Professional security work is documentation.

Above all: build the lab, break things in it, and read real packets and real logs. Every concept in this curriculum becomes permanent the moment you see it happen with your own eyes rather than just reading about it. You built that habit here. Now choose a direction — and keep it.