Test yourself
252 questions and 63 tasks, in 63 sets. There is one for every lesson in the course, so wherever you have just finished reading, there is something to check it landed.
7 sets in this track.
Getting started with Termux
The prompt, where you are, and what to do before installing anything.
Finding your way around
Absolute and relative paths, hidden files, and reading a long listing.
Reading and searching text
Printing part of a file, counting it, and finding the lines that matter.
Pipes and redirection
Chaining commands, writing output to a file, and the sort-then-count habit.
Permissions and ownership
Reading a mode string, setting one with chmod, and the world-writable risk.
Managing packages
Refresh the index, install and remove packages, and find where Termux keeps them.
Shell config and aliases
Your bashrc, short names for long commands, the prompt, and the search path.
6 sets in this track.
Shell scripting basics
A shebang, variables, quoting, and reading the exit code of a run.
Processes and jobs
What is running, how to stop it, and why command lines are public.
Environment variables
What the shell remembers, and how PATH decides which command runs.
Shaping text with awk and sed
Rewriting lines with sed, pulling fields out with awk, and totalling a column.
Archives and compression
Packing a folder with tar, listing it before you extract, and gzip on one file.
Scheduling work with cron
Reading the five time fields, absolute paths, and logging what a job did.
5 sets in this track.
Working with text in Python
Split, join, slice and clean text, and read the four lines it prints.
Hashing and encoding in Python
Encode, hash and base64 a message, and read the five lines it prints.
Addresses in Python
Read a network and split it, and read the four lines it prints.
Secrets and tokens in Python
Generate, hash and compare a token, and read the five lines it prints.
Run your first Python
Run a few short lines of Python and read what each one prints.
5 sets in this track.
Networking basics
Addresses, reachability, and reading a port scan.
DNS and addresses
Turning a name into an address, reading the reply, and telling the two apart.
HTTP and APIs from the shell
Reading a response, what the status code means, and shaping a JSON reply.
SSH and remote work
Making a key pair, trusting a host once, and running the SSH server on the phone.
Moving files between machines
Copying with scp, sending only the difference with rsync, and previewing a transfer.
7 sets in this track.
The security mindset
What security protects, four words that are not the same, and why blast radius beats zero risk.
Thinking in threats: modelling a system
Four questions, a picture drawn in text, STRIDE, and a decision beside every item.
Encoding and hashes
Why encoding is not encryption, and how to verify a file.
Passwords and keys
How hashing, long passphrases and a protected key keep a secret yours.
Reading logs and spotting oddities
Counting failed logins per source, ranking them, and reading the shape of a burst.
Hardening your Termux setup
Fewer listeners, current packages, and permissions that keep others out.
Safe habits and privacy
What your shell leaves behind, and where a secret can end up.
5 sets in this track.
The phases of a security assessment
Scope, baseline, enumeration and judgement, and the order they come in.
Taking inventory of your own devices
Reading your own addresses, and telling the loopback from the one the network sees.
Reading a port scan properly
Reading the columns and states of an nmap scan against your own device.
Service versions and what they tell you
Asking a service what it is, and reading the version it answers with.
Finding and judging a vulnerability
Reading a version in full, comparing versions correctly, and turning both into a decision.
5 sets in this track.
How a web request is handled
Reading a request end to end, and closing the path traversal it can carry.
Input you do not control
Why every request value is hostile until checked, and how an allowlist beats a blocklist.
Injection: when data becomes code
How a value crosses into a shell command or a query, and the two fixes that stop it.
Cross-site scripting
A value crossing into a browser as markup, and the escaping that keeps it text.
Broken access control and misconfiguration
Records handed to the wrong caller, and the checks that deny by default.
5 sets in this track.
Hashing, encoding and encryption
Tell a one-way hash from a reversible encoding and from encryption that needs a key.
Symmetric and asymmetric keys
One shared key, or a pair of related keys? See how each is made and used.
TLS and the chain of trust
What the padlock promises, what a certificate says, and who vouches for it.
Signing and verifying a file
Prove a file came from a key holder and has not changed since.
Common crypto mistakes
A reused nonce, ECB mode, a fast hash for passwords, and rolling your own.
5 sets in this track.
Baselines
Write down what normal is, so a change later has something to compare against.
File integrity
Hash the files that matter, check them later, and read a mismatch honestly.
Reading logs for a story
Read a log as a whole and build a short timeline of who did what and when.
Alerting on your own device
Make the phone tell you when something changes, with a check on a timer and a log you read.
Incident response, in six steps
Preparation, identification, containment, eradication, recovery and lessons learned.
6 sets in this track.
Build a password generator
Run the genpass.sh script you built, and read the entropy it reports.
Build an encoder and decoder
Run the encdec.sh script you built, and let its round trip check catch a bad decode.
Build a hash and checksum tool
Hash files, write a checksum file, check it later, and read what a match really proves.
Build a JWT inspector
Split a token, decode its base64url parts, and check the signature by hand.
The permissions calculator
Reading a mode two ways, the special bits, and setting a mode with chmod.
The subnet calculator
Network, mask, broadcast and host count, and splitting a network into smaller ones.
3 sets in this track.
4 sets in this track.
Rules of engagement and the law
Written authorisation, the parts of a scope, and why permission comes before any test.
Writing a finding someone can act on
The five parts in order, honest severity, and both the problem and the fix.
Responsible disclosure
Report privately, give a window, find the contact, and keep a record.
Certifications, labs and what they actually prove
What a certificate shows, where to practise legally, and how to build a portfolio.
What the tasks are for
A question tells you whether you remember something. A task tells you whether you can do it, because the only way through one is to run the command and read what came back. Each task states plainly that the command runs in Termux on your own device: nothing on these pages executes anything, and the box only reads what you paste into it.
The marking describes what a correct answer means rather than what it looks like, so a different port, a different owner name, a different version string or a different ordering all pass. Paste something that is not the output of that command and every check fails, and the page shows you what it actually read so you can see why.