The course
Termux and the command line
Twelve tracks, in order, from opening a prompt for the first time to assessing your own systems, understanding how web applications break, and writing up what you find. Every lesson is done on the phone in your pocket, offline and without root.
Who it is for
Written for someone starting from nothing on an Android phone. You do not need prior Linux, a laptop, or root. If you already work at a prompt, the later tracks stand on their own.
What you need
An Android device with Termux installed from F-Droid. Budget about 20 minutes per lesson.
What you will be able to do
You will be comfortable at a Linux prompt, able to write small scripts and explain what happens on a network, and able to assess your own devices, reason about how something could fail, and write the result up so another person can act on it.
How it is put together
The tracks run in order, and each one assumes the one before it. Every lesson takes about twenty minutes and ends with something you can do rather than something you have read. After each lesson there is a practice set: a few questions that explain the reasoning, and a task where you run a real command on your own phone and paste what it printed.
Nothing needs a laptop, a server, or root. Everything runs in Termux on the phone in your pocket, and nothing in the course requires a network connection. The later tracks are self-contained, so if you already work at a prompt you can start at the one that matches what you know.
Open a track to see its lessons.
Start from a fresh Termux install and learn the commands everything else is built on. You will move around the filesystem, read and search files, chain commands together, and set sensible permissions. Nothing here is advanced. It is the vocabulary the rest of the course assumes.
When you finish this track you can find your way around a Linux filesystem and get what you need out of a file.
Before it Nothing. Start here.
Typing commands one at a time gets old when you need to do the same thing twice. This track turns commands into scripts and scripts into scheduled jobs. You will also learn the text tools that make short work of big files.
When you finish this track you can write a small script, run it on a timer, and process a large file without opening it.
Before it Finish Foundations first, especially pipes and redirection.
Every cell in this track runs real Python in your browser. There is nothing to install and no server: press Run and the code executes, so you can make a mistake, read the error, and change it, which is the way anyone actually learns. The track starts from a print statement and ends at the standard library modules the rest of the course uses.
When you finish this track you can write and run small Python programs, read a traceback, and use the standard library.
Before it Nothing. This one stands on its own.
Most of what a phone does is a conversation over a network. This track makes that conversation visible. You will see how names become addresses, how an HTTP request is shaped, and how to move files between two machines without a cable.
When you finish this track you can explain what happens when you open a page, read a response by hand, and copy files between hosts.
Before it Foundations, and some comfort with pipes.
The conceptual heart of the course. It opens with the security mindset and threat modelling, which are ways of reasoning rather than pieces of software, then moves to the practical work: hashing, passwords and keys, reading a log, and reducing what your phone exposes. Everything here is defensive and aimed at your own device.
When you finish this track you can say what security actually protects, reason about what could go wrong with a system, and harden your own.
Before it Foundations and the shell-in-practice track.
Every assessment starts by answering a boring question: what do I actually have? This track teaches the phases security work moves through, how to inventory your own devices, how to read a port scan rather than just run one, what a service version tells you, and how to judge whether a finding is worth acting on. You scan your own device and your own network, and nothing else.
When you finish this track you can describe what is running on your own devices, read a scan properly, and judge a version or a finding on evidence.
Before it Networking, and the security fundamentals track.
The bug classes behind most real breaches, each one shown against a small server you write and run on your own phone. You trace a request end to end, learn why any input you did not create is hostile until proven otherwise, then work through injection, cross-site scripting, broken access control and misconfiguration. Every lesson ends with the fix, not only the flaw.
When you finish this track you can explain how a request is handled, recognise the common bug classes, and say how each one is prevented.
Before it HTTP from the networking track, and some Python or willingness to read it.
The cryptography a working person actually meets, taught by doing it rather than by proving theorems. You separate the three things people constantly confuse, work with symmetric and asymmetric keys, read a certificate and follow the chain of trust, sign a file and verify somebody else's signature, and then look at the mistakes that break real systems.
When you finish this track you can tell hashing from encoding from encryption, read a certificate, and verify a signature.
Before it Encoding and hashes from the security track, and some comfort with the shell.
The defender's half of the course, done on a phone. You write down what normal is, watch the files that matter for a change, read logs as a story rather than line by line, make the device tell you when something moves, and walk the six phases of responding to a small incident calmly. Two ideas run through all of it: perfect security does not exist, and detection without a response achieves nothing.
When you finish this track you can baseline a device, notice a change, build a timeline from logs, and work an incident in order.
Before it Logs and detection from the security track, and cron from the shell track.
A password generator, an encoder, a checksum tool, a token inspector, a permissions converter and a subnet calculator. Each one exists twice: as something you can use, and as a lesson that shows you how to write it. Every one runs on commands the earlier tracks already gave you, and every one is a job people reach for a website to do.
When you finish this track you can build a small tool that does the job, and check its answers rather than trusting them.
Before it The shell in practice track, and either security fundamentals or networking for the later tools.
Three guided builds that tie the earlier tracks together. Each one starts from an empty file and ends with something you can run: a backup script, a log analyser, and a terminal dashboard. Nothing is left as an exercise.
When you finish this track you have three working tools of your own, and the habit of building more.
Before it Everything above, especially shell scripting.
The part that turns skill into work. What written authorisation actually means and why verbal permission is not enough, how to write a finding somebody can act on, what to do when you find a problem in something you do not own, and what certifications and labs do and do not prove. This is not legal advice, and the law differs by country.
When you finish this track you can write a finding, disclose a problem responsibly, and choose what to learn next on evidence.
Before it Any of the security tracks. This one is about practice rather than tools.
Practise as you go
Every lesson has a practice set with the reasoning explained, and there are 12 terminal challenges worth 240 points to play in the browser as you go. When you want the real thing, the Termux CTF puts the same ideas on your own device.