Welcome
- CISSP
- CCSP
- CEH
- Security+
Welcome to Rolling Thunder Security, a hands-on cybersecurity knowledge hub. It provides a base knowledge on a wide variety of topics in cybersecurity, similar in scope to what a Security+ certification would cover. It covers topics from Network Security, to Cryptography, to Social Engineering and Phishing.
This site is an expressive outlet to give you a place to visualize cybersecurity concepts, to practice performing attacks, or to be interactive with data being sent through the OSI layers being encapsulated and decapsulated. You will be right there in the action with this website.
Cybersecurity is a wide field. This hub covers a lot of ground — frameworks, cryptography, networks, social engineering, web attacks — and it is normal to feel that breadth as overwhelming. Take it at your own pace. Move through the modules in whatever order serves you, revisit the visualizations and games when something does not click, and trust that the picture comes together piece by piece.
This site makes no money, runs no ads, and collects no data. It is intended to be an educational tool that gives learners another form of material to study if the more traditional methods are not working.
— Rolling Thunder Security
Welcome
- Approach
- Learn by doing
- Scope
- Security+ to PenTest+
- Format
- Hands-on labs
- Domains
- 13 modules
- Pentest track
- 9 phases + capstone
- SQLi labs
- 18 techniques
- Practice
- 10 games & tools
Cybersecurity is rarely defeated by breaking the strong thing. AES-256 holds. SHA-256 holds. Modern TLS holds. Attackers know this, so they go around the strong thing. They steal the key from a sticky note, trick the help desk into a password reset, slip a malicious link past an inattentive reader, or find one forgotten input box on one forgotten page that lets them ask the database whatever they want.
This site teaches you to think the same way. You will read about the controls, then you will sit at a keyboard and do the work. You will evaluate real phishing emails, trace the protocols that delivered them, and find the exact mechanisms the attacker leaned on. You will write SQL injection payloads against vulnerable applications. You will encrypt and decrypt, hash and verify, capture and inspect. By the end you will know the fundamentals because you will have used them.
The thirteen domains
Security Frameworks
AAA Model
Authentication
Cryptography
Asymmetric
Hashing
Social Engineering
Email Anatomy & Forensics
SPF, DKIM, DMARC
Teams Phishing Simulation
Authentication & Identity
SSO & Federation
OAuth, JWT, JWT Lab
Network Security
Perimeter Controls
Segmentation
SQL Injection
Interactive Labs
Defense & Mitigation
Software Vulnerabilities
Memory Corruption
Mitigations & Defenses
Web Application Security
CSRF & SameSite
Command Injection
Malware
Ransomware & Rootkits
Kill Chain & Defenses
Cloud Security
IAM & Zero Trust
AWS · Azure · GCP · OCI
IR & Forensics
Evidence handling
Host & network forensics
Mobile Security
OWASP Mobile Top 10
MDM, BYOD, SS7, SIM swap
Wireless & IoT
Bluetooth Classic & BLE
IoT landscape + handshake-crack lab
Offensive Security — The Engagement
The fundamentals teach how each control works. This applied track puts them to work, walking the full penetration-testing lifecycle the way a professional runs a live engagement — each phase hands-on, each phase pointing back to the fundamentals it builds on. Start the engagement →
Foundations & Methodology
Law, ethics & rules of engagement
PTES & MITRE ATT&CK
Reconnaissance & OSINT
Footprinting & DNS
Open-source intelligence
Scanning & Enumeration
Nmap port scanning
Service & version detection
Vulnerability Analysis
Validating findings
CVSS & CIS benchmarks
Exploitation
Unpatched services
Credential attacks & SET
Post-Exploitation & Priv-Esc
Windows & Linux priv-esc
Pivoting, persistence, cleanup
Web & Database Attacks
DVWA: upload, LFI, RCE
Ties to XSS & SQLi labs
Wireless Attacks
Handshake capture
WPA cracking & evil twin
Reporting & Deliverables
Writing findings
Risk rating & remediation
Full Engagement
Recon to report
The whole lifecycle, threaded
Practice & Games
Cyber Escape Room
90 minutes on the clock
Caesar to console — everything
Vocab Matching
Three difficulty tiers
Term & definition pairs
Cyber Crossword
Check & reveal hints
Foundations terminology
Hoppy Hollow
Nine security scenarios
Defend the family recipe
Port Match
TCP & UDP ports
Learn by repetition
Port Scanner Quiz
Identify open services
TCP & UDP protocols
Teams Phish Demo
Credential-capture portal
Interactive red flags
SMiShing Demo
Step-through conversation
Six red flags revealed
Password Strength
Pattern detection
NIST SP 800-63B aligned
Command Explainer
Flag & argument breakdown
Interactive reference
Tools
NIST Standards
14 reference entries
APA 7 citations included
OSI Model
Packet encapsulation
Interactive walkthrough
NIST AI 100-1
Four core functions
Trustworthy AI characteristics
Password Checker Lab
Basic to advanced tiers
HTML, CSS & JavaScript