Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
osint
OSINT Ubuntu VM In this lab we will Harvest emails, subdomains, and IPs from public sources using theHarvester Hunt usernames across dozens of social platforms using Sherlock Extract DNS and domain…
Nuclei
Nuclei Ubuntu VM Lab Goal This lab introduces Nuclei , a fast vulnerability scanner based on templates. You will: Deploy OWASP Juice Shop (intentionally vulnerable app) Run basic Nuclei scans…
Metasploit
Metasploit Ubuntu VM In this lab we will Install Metasploit Framework (simple, standard install) Learn the Metasploit console basics ( , , , options) Create a safe local target service (an FTP server…
GoPhish
GoPhish Ubuntu VM This lab demonstrates what GoPhish can do from both an attacker and defender perspective You will install GoPhish , launch a phishing campaign , and observe captured credentials and…
gato x
Gato-X Ubuntu VM Background - What is Gato-X? Gato-X is an open-source GitHub Actions security auditing tool. It was built to help security teams find misconfigurations in GitHub Actions workflows…
Exploit DB
Exploid DB Ubuntu VM In this lab we will Learn how to search for public exploits Understand exploit metadata Copy and inspect exploit code Basic Exploit Searching Search for exploits related to Apache…
Evilginx
Evilginx Lab Goal The goal of this lab is to introduce Evilginx , a reverse-proxy phishing framework that has been used in real-world phishing campaigns. In this lab, we will demonstrate how attackers…
credmaster
CredMaster Ubuntu VM What is CredMaster? CredMaster is a password spraying framework used by penetration testers and red teams. Unlike brute-force attacks that try every password against one account,…
caido
Caido Lab Goal The goal of this lab is to introduce Caido and its core web application security testing features. The lab uses the free Caido Basic plan and Damn Vulnerable Web Application (DVWA) as…
burp suite
Burp Suite Burp Suite Community Edition Ubuntu VM Burp Suite Community Edition is the free version of the industry-standard web application security testing toolkit made by PortSwigger. It sits…
Insider Threat
Insider Threat An insider threat happens when someone who already has legitimate access to an organization uses that access in a way they shouldn’t. This can be intentional (data theft, sabotage) or…
External Service Exploitation
Exploited External Service External service exploitation happens when an attacker gains access to a system by abusing a service that is exposed to the internet These services are not websites only -…