FM201 — The Five Stages of Hacking

Offensive security, hands-on — from recon to root.

FM201 takes you through a penetration test the way it actually happens, structured on the five stages of hacking:

…and finished by a professional Methodology & Reporting unit. Its 79 lessons are organised into 14 units — with dedicated sub-units for Web Foundations, Web Vulnerabilities, Authentication & Password Attacks, System Exploitation, and a full Active Directory track — so a large syllabus stays easy to navigate. Hands-on lessons run in isolated, browser-based labs, and every lesson is available in English and Arabic.

What you'll learn

• Reconnaissance — OSINT, WHOIS/DNS, email & people harvesting, metadata OSINT, breached-credential discovery, email security & spoofability, historical recon, and offensive phishing
• Scanning & Enumeration — Nmap, Gobuster, traffic analysis with Wireshark and tcpdump, service enumeration, vulnerability scanning, subdomain enumeration, and technology fingerprinting
• Gaining Access — Web Foundations (how the web, JavaScript and SQL work), then the full web-vulnerability set (SQL injection, XSS, IDOR, command injection, file upload, XXE, SSRF, CSRF, path traversal) with Burp Suite and SQLMap; authentication & password attacks (Hydra, John the Ripper); and system exploitation (Metasploit, payloads, shells, classic CVEs)
• Maintaining Access — privilege escalation, persistence, pivoting & tunnelling, command-and-control concepts, and a full Active Directory attack track (enumeration, Kerberos attacks, credential theft, lateral movement, domain dominance)
• Clearing Tracks — anti-forensics, log tampering, steganography, and why defenders still catch it
• Methodology & Reporting — scoping, note-taking, and writing a report a client can act on
• An OWASP Top 10 (2025) reference unit and three unguided capstones

Who it's for

Learners who've completed FM101 — Foundations (or have equivalent Linux, Windows, networking, and crypto basics) and want a practical, structured offensive-security path toward penetration testing or red teaming.

Prerequisites

FM101 — Foundations, or equivalent fundamentals, and a willingness to work methodically.

Format

Self-paced · 79 bilingual lessons (English/Arabic) · 14 units across the five stages · isolated, browser-based labs with capture-the-flag checks · new hands-on labs rolling out across the curriculum.

Outcome

You'll be able to reason through a structured engagement end to end — recon, exploitation, post-exploitation, and reporting — and you'll be ready to pair it with FM301 — Defensive Blue Team, where every attack here has its detection story.