Skip to content
Haydar Najm Alhindawi — HNHaydar Najm Alhindawi

Learn Cybersecurity and Ethical Testing

An introductory path for people with no security experience. Each lesson explains one idea in plain language, adds a safe hands-on exercise on your own device or an authorized training environment, and ends with a short quiz. The goal is a sound defensive foundation: how systems work, where weaknesses appear and how to report them responsibly.

Notice: everything here is for defensive learning and authorized testing only. Never test a system you do not own or lack written permission to test. Unauthorized testing is illegal in most countries.

How to start

Start at lesson one and go in order. Give each lesson one session, do the exercise before moving on, then answer the quiz. The whole path takes roughly three to four hours of reading and practice; spreading it over a week helps the ideas stick.

Before you start

  • A computer you own, with permission to install software.
  • A stable internet connection and a modern browser.
  • Willingness to read some technical English documentation.
  • No prior programming background is needed.

1. Ethics, permission and scope

about 25 min

Objectives

  • Distinguish authorized testing from illegal intrusion.
  • Know what a written testing authorization must contain.
  • Understand scope and why you must not exceed it.

Ethical security starts with permission, not tools. What separates a security tester from a criminal is not skill or software but written consent from the system owner stating what may be tested, when and how. Probing a server, site or network you do not own — even a simple port scan — can count as unauthorized access.

The document governing this is usually called a testing authorization or Rules of Engagement. It lists systems in scope, systems explicitly excluded, the allowed time window, forbidden test types such as denial of service, an emergency contact, and how results are delivered and stored. If any item is missing, the agreement is incomplete.

Scope is the boundary. If permission covers one subdomain, testing others breaks the agreement even if the same company owns them. If you notice an exposed system outside scope, stop and report it rather than continue.

Respect data privacy. If you reach user data during an authorized test, do not copy, publish or keep it; prove the issue with as little data as possible and document the steps for the owner only.

Safe hands-on exercise: Write an authorization for your own system

  1. Open a text file and write: “I own this device and authorize myself to test it.”
  2. State the scope: your own computer and the local address 127.0.0.1 only.
  3. State exclusions: every other device on your home network and any cloud service.
  4. State the duration (one week) and what you will do if something breaks.
  5. Save it; you will reuse the template in lesson six.

Comprehension quiz

A friend asks you to scan his company's website “because he works there”. What do you do?
What does “out of scope” mean?
Next step: Move to lesson two to see how data actually travels between your device and servers.