Practical Red Team and Blue Team Bootcamp
A hands-on programme for people starting a security career. You build a strong foundation first, then learn how attackers work (the red team) and how defenders detect and respond (the blue team).
- Length
- 3 months
- Modules
- 12, one per week
- Major labs
- 12
- Lab time
- About 70%
- Pass mark
- 60% overall
How the programme is built
About 60% of the programme builds a strong foundation, led by reconnaissance. The remaining 40% moves gradually towards advanced red team and blue team work, so beginners gain confidence before the difficulty rises.
| Weeks | Level | What you cover |
|---|---|---|
| 1 to 4 | Basic, reconnaissance-led | Foundations, passive and active reconnaissance, vulnerability assessment |
| 5 and 6 | Basic to intermediate | Exploitation fundamentals, web application attacks |
| 7 to 12 | Intermediate to advanced | Credentials, post-exploitation and Active Directory, wireless and social engineering, blue team, forensics, final project |
The 12 modules
9 of 12 modules are available as full courses today. The others are in preparation.
| Week | Module | Level | Status |
|---|---|---|---|
| 1 | Foundations, Attacker Mindset & Lab Setup | Basic | Course available |
| 2 | Passive Reconnaissance & OSINT | Basic | Course available |
| 3 | Active Reconnaissance: Scanning & Enumeration | Basic | Course available |
| 4 | Vulnerability Assessment | Basic | Course available |
| 5 | Exploitation Fundamentals | Basic to Intermediate | Course available |
| 6 | Web Application Attacks | Basic to Intermediate | Course available |
| 7 | Password & Credential Attacks | Intermediate | In preparation |
| 8 | Post-Exploitation, Privilege Escalation & Active Directory | Intermediate | In preparation |
| 9 | Wireless & Social Engineering | Advanced | In preparation |
| 10 | Blue Team Essentials: Detection, Logging & Incident Response | Advanced | Course available |
| 11 | Digital Forensics & Data Recovery | Advanced | Course available |
| 12 | Capstone: Red vs Blue Engagement & Reporting | Advanced | Course available |
Weekly format
Every module has two sub-modules and one major lab.
| Session | Length | Purpose |
|---|---|---|
| Class 1 | 2 hours | First sub-module: ideas with demonstrations and case studies |
| Class 2 | 2 hours | Second sub-module: ideas with demonstrations, case studies and real examples |
| Practical day | 2 hours | The module's major lab, done hands-on |
Assessment and completion
| Component | Weight | How it is measured |
|---|---|---|
| Weekly lab reports and online lab rooms | 40% | 12 weekly practical submissions |
| Mid-term practical | 15% | Reconnaissance and vulnerability assessment (week 6) |
| Final practical exam (capture the flag) | 30% | A timed, hands-on challenge |
| Final project and presentation | 15% | A full practice engagement and its report |
- Pass mark: 60% overall, at least 50% in the final practical, and all weekly lab reports handed in.
- At least 85% attendance for the instructor-led programme.
- Lessons, labs and knowledge checks on the portal are scored automatically. Your instructor assesses the mid-term, the final exam, the final project and attendance.
Tools you will use
The programme needs no paid software. A laptop that can run virtual machines (16 GB of memory is recommended) helps.
| Area | Tools |
|---|---|
| Lab and operating systems | VirtualBox, Kali Linux, Proxmox VE, Metasploitable 2, DVWA, OWASP Juice Shop |
| Recon and OSINT | Maltego CE, SpiderFoot, theHarvester, Recon-ng, OWASP Amass, Sherlock, Shodan |
| Scanning and enumeration | Nmap, masscan, enum4linux-ng, Gobuster, ffuf, Nikto |
| Vulnerability assessment | OpenVAS / Greenbone CE, Nuclei |
| Exploitation frameworks | Metasploit Framework, Armitage, Sliver, Exploit-DB / searchsploit |
| Web | OWASP ZAP, SQLmap, wfuzz, PortSwigger Academy |
| Credentials and Active Directory | Hashcat, John the Ripper, Hydra, Responder, BloodHound CE, NetExec, Impacket |
| Wireless and social engineering | Aircrack-ng, Kismet, Wifite, GoPhish, SET |
| Blue team | Wazuh, Security Onion, Suricata, Velociraptor |
| Forensics and recovery | Autopsy, The Sleuth Kit, Volatility 3, TestDisk, PhotoRec, GNU ddrescue, Foremost, bulk_extractor |
| Reporting | Dradis CE, Ghostwriter |
Optional professional tools
Each of these extends a free tool used in the programme. They are mentioned for context. CodeX2 is not affiliated with these vendors.
| Tool | Category | What it adds |
|---|---|---|
| Burp Suite Professional | Web testing | Industry-standard web testing tool; extends the free proxy tools used in Module 6. |
| Tenable Nessus / Qualys | Vulnerability management | Enterprise scanning; extends OpenVAS (Module 4). |
| Metasploit Pro | Exploitation | Automation and reporting on top of the Framework (Module 5). |
| Cobalt Strike | Adversary simulation | Commercial red-team platform; extends Sliver (Module 8). |
| Maltego Pro / XL | OSINT | Larger graphs and premium data feeds (Module 2). |
| Splunk / Microsoft Sentinel | SIEM | Enterprise log analytics; extends Wazuh (Module 10). |
| Magnet AXIOM / EnCase | Forensics | Commercial forensic suites; extend Autopsy (Module 11). |
| PlexTrac | Reporting | Professional reporting platform (Module 12). |
Rules of engagement
Every offensive technique in this programme is taught and practised only in isolated, simulated environments and only with authorisation. Testing a system you do not own or have written permission to test is illegal. Read the Terms and Conditions and the Disclaimer before you begin.
Questions about the bootcamp
How long does the bootcamp take?
It runs for three months, one module per week for 12 weeks. That is about 6 hours a week, or roughly 72 contact hours, plus your own lab time.
Do I need experience?
No. The first modules start from the beginning. The programme is built for final-year students, fresh graduates and anyone moving into security at a basic to intermediate level.
Is it safe to practise attack techniques?
Yes. All offensive techniques are taught and practised only inside isolated, simulated labs, always alongside how defenders detect and stop them.
Does the bootcamp give me an industry certification?
No. It can help you prepare for exams such as CEH, CHFI, CISM, Security+ and PenTest+, but CodeX2 is not affiliated with those bodies and does not issue their certifications.