OpenVAPT Academy

Learn vulnerability assessment from the bottom up: start with security theory, then apply each idea to real checks on a safe simulated server, and finish by running, fixing, reporting and building your own checks. Free, with nothing to sign up for and nothing stored.

Modules

Levels

Glossary Terms

131

Cost

Every module also works offline in the tool: openvapt learn, openvapt learn F1 and openvapt learn F1 --quiz. The course was developed by AI Cybersecurity Engineers and has not been reviewed by a human educator; see the AI Disclosure.

Foundations

F115 min Security Basics The core ideas every later lesson builds on: what we protect, what threatens it, and how risk is reasoned about. F220 min What VAPT Is, and Doing It Legally How vulnerability assessment and penetration testing differ, how professional assessments are structured, and why authorisation is the first rule. F320 min Vulnerabilities, CVE, CWE and CVSS How vulnerabilities are named, classified and rated, and how to read a severity rating critically.

Practitioner

P130 min Linux Server Hardening Patching, accounts, privileges, file permissions, scheduled jobs and kernel settings: the foundations of a defensible Linux server. P215 min SSH Security How SSH authentication and cryptography settings decide whether remote administration is a strength or a door. P320 min Network Exposure and Firewalls What a server exposes to the network, and why databases and cleartext services should not be reachable. How a host firewall acts as a safety net. P420 min TLS, Certificates and HTTPS How encryption in transit works in practice, which TLS versions are acceptable, and how certificates and HSTS keep users safe. P520 min Web Security Headers and Cookies The HTTP response headers and cookie flags that let browsers defend users against cross-site scripting, clickjacking and session theft. P625 min Information Exposure and Misconfiguration How forgotten files, verbose errors and version banners hand attackers the map, and sometimes the keys. P725 min Identity, Passwords and Privilege How accounts, password storage, lockout and privilege escalation paths decide who really controls a server. P830 min Data Services: Databases, File Shares, DNS and Mail Why databases, caches, file shares, DNS and mail servers cause so many breaches, and the configuration settings that decide whether they are safe. P925 min Containers and Kubernetes How container isolation really works, the configuration mistakes that break it, and how to protect the Docker and Kubernetes control planes on a host. P1025 min Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities How known vulnerabilities are matched to installed software, why version comparison is subtle, and how to prioritise with the CISA Known Exploited Vulnerabilities list. P1125 min Service Hardening With systemd How systemd starts services, why most services should not run as root, and how a few unit settings contain a compromised application. P1220 min Firewall Policy Versus What Is Listening Why "the firewall is on" is not the same as "the service is protected". How to compare firewall rules with the sockets that are really open. P1330 min Application Servers: Tomcat, Node.js and Python The recurring mistakes when Java, JavaScript and Python applications go to production: exposed app ports, debuggers, development servers, default credentials and unsupported runtimes. P1425 min CMS Hardening in Depth: WordPress, Joomla and Drupal Beyond version banners: protecting CMS configuration files, switching off debug output and in-browser code editing, and keeping security updates flowing. P1525 min Access Control: Accounts, Sudo and Logins Who may log in, from where, and what they may do once inside: the account, PAM, sudo and SSH settings that enforce it, and the files that define it. P1620 min Logging, Auditing and Time How logs, the audit daemon, synchronised time and log-driven blocking turn a server from a black box into something you can investigate and defend. P1735 min Kernel, Filesystem and Boot Hardening Why the kernel's own switches, the layout and permissions of the filesystem, and what happens before login decide how far an attacker with a foothold can get. P1830 min Web Server Hardening: nginx and Apache Reading nginx.conf and apache2.conf the way an assessor does: the dozen directives that decide what a server reveals, which TLS it speaks, and which files it will hand out. P1930 min Database, Mail and DNS Hardening Beyond binding and authentication: the option-file settings that limit what a compromised database credential can do, make mail and database traffic encrypted by rule, and keep DNS honest. P2020 min Secrets, Cron and Account Hygiene The small cross-cutting habits that stop a low-privilege foothold becoming root. No secrets in readable files, restricted SSH keys, cron that runs only root-owned code, a clean PATH and consistent account files. P2130 min Audit Logging and Monitoring Depth What the Linux audit daemon should record, how its rules and log files are protected, and why a copy of every log must leave the machine. P2235 min Authentication Policy and Package Hygiene The PAM and login.defs settings that decide how passwords are checked, reused and locked, and how root's environment can be hijacked. How packages arrive on the machine and which services came with them. P2325 min Test Design for Security Checks How testers choose a small set of cases that still catches mistakes, and how the same ideas make a security check trustworthy. P2425 min Securing Self-Hosted AI Services Why model servers, AI web interfaces, AI dashboards and vector databases are often left open, and how to find and close them from the machine itself. P2520 min Availability Without Load Testing Why a self-assessment never floods a server to test it, and which settings show whether a site can resist floods and slow requests.

Applied

A120 min Running an Assessment Putting theory into practice: plan, preview, scan and triage an assessment of a machine you own. A220 min Remediation and Verification Fixing findings safely, proving the fix worked, and tracking progress over time. A315 min Reporting and Communication What a good assessment report contains, how to read OpenVAPT's report, and how to share results safely. A430 min Building Your Own Check The engineering view: how a detection is designed, kept read-only, tested against false results and documented. A535 min Container Runtime Hardening Depth Beyond "is the daemon on TCP": the daemon defaults, socket ownership, confinement profiles, resource limits and image trust that decide what a compromised container can do to its host. A635 min Application Framework and CMS Configuration How Laravel, Symfony, Rails, Spring Boot, Flask, Drupal, Joomla, Magento, Ghost and WordPress each express the same five production mistakes, and how to find them from the files on disk. A725 min Security Testing in Agile Teams and CI How short development cycles change security testing, and how scan baselines, exit codes and SARIF output let a pipeline catch regressions. A820 min Tracing Findings to Security Requirements How to write security requirements that can be verified, and how standard identifiers link each finding back to the requirement it breaks.

How Each Module Works

Theory

Objectives, plain explanations and key terms.

Apply

The real OpenVAPT checks that put the theory into practice.

Lab

Hands-on steps on the simulated server or your own machine.

Check Yourself

A short quiz with explanations, never stored.

Using the Academy in your work? Please cite it. Every module page has a Cite This Page box, and How to Cite OpenVAPT has references for the whole Academy. Full guide: Citing OpenVAPT.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt