Ethical Hacking Training Online.
Two months, $1,199. Month 1 is the CEH v13 foundation — reconnaissance, system hacking, Active Directory, web application attacks, wireless and mobile. Month 2 is entirely AI red-teaming: NVIDIA's garak, Microsoft's Pyrit, every entry of the OWASP LLM Top 10 with a lab, and attacks against live LangChain, AutoGen and CrewAI agents. The EC-Council CEH exam voucher (~$1,200) is separate and paid to EC-Council.
Is it possible to learn ethical hacking online?
Better than most technical subjects, actually — everything you are attacking is already a networked target. There is nothing to be gained by sitting in the same room as a vulnerable web server.
What does not work online is the lazy version. Watching recorded lectures without running the tools yourself produces vocabulary, not capability, and interviewers can tell the difference in about ninety seconds. The only question worth asking about any online offensive-security course is whether it hands you live targets and whether a human reviews what you did to them.
Month 1 — the CEH v13 foundation
Maltego, theHarvester, Shodan, Censys, Sublist3r and Amass for subdomain enumeration and ASN-based discovery. Nmap in depth — TCP SYN, TCP Connect, UDP, FIN, NULL, XMAS, idle scan, version detection, OS fingerprinting, and the NSE scripting engine. SNMP enumeration with snmp-check and onesixtyone, SMB with smbclient and enum4linux, DNS with dnsenum and fierce.
Hydra for network protocol brute force, John the Ripper for offline cracking, Hashcat for GPU-accelerated work, Responder for LLMNR/NBT-NS poisoning. Windows privilege escalation — kernel exploits, weak service permissions, unquoted service paths, AlwaysInstallElevated. Linux privesc — sudo misconfiguration, SUID binaries, cron abuse. Pivoting with SSH tunnelling, ProxyChains, Chisel and Ligolo-NG. Active Directory: Kerberoasting with Rubeus and Impacket, AS-REP roasting, Golden and Silver Tickets with Mimikatz, DCSync, NTLM relay, BloodHound.
OWASP Top 10 (2021) end to end. SQL injection with sqlmap, command injection, NoSQL and LDAP injection. Burp Suite Professional in real depth — proxy and scope configuration, repeater workflows, all four intruder attack types, session handling rules, Collaborator. Authentication bypass: JWT attacks including the none-algorithm attack, weak signing keys and JKU/KID header injection; OAuth 2.0 misuse; SAML XML signature wrapping and response replay.
aircrack-ng for handshake capture, hcxdumptool for PMKID attacks, hashcat for offline cracking, evil twin and rogue AP with hostapd-mana. Android: apktool, jadx, MobSF, Frida for runtime instrumentation, Drozer. iOS: objection, class-dump, MobSF. IoT firmware with binwalk and firmware-mod-kit, UART access via JTAG/SWD. Social engineering with GoPhish and Evilginx2.
Month 2 — AI red-teaming
This is the part almost no ethical hacking course currently teaches, and it is the reason the curriculum has been revised three times in the last eighteen months — the OWASP LLM Top 10 went in during late 2024, garak and Pyrit in mid-2025, agentic red-teaming in early 2026.
The PortSwigger AI scanner workflow, plus the Autonomous Replicator and AI-Assisted Exploit Chaining Burp extensions. These are commercial extensions running roughly $50–300 per year and they compress manual Burp workflows substantially.
garak is NVIDIA's open-source LLM red-team framework and ships with around 40 probe categories. You run it against a direct OpenAI or Anthropic API, an Azure OpenAI deployment, an AWS Bedrock model, and a self-hosted vLLM or TGI deployment. Jailbreak families covered include DAN, AIM and Crescendo.
Pyrit — the Python Risk Identification Tool, open-sourced by Microsoft in 2024 — is an orchestration framework for chaining adversarial attacks rather than a probe library, which makes it complementary to garak rather than a replacement. Every entry of the OWASP LLM Top 10 gets a hands-on lab, LLM01 Prompt Injection through LLM10 Model Theft. Also Promptfoo, Lakera AI and HiddenLayer.
The attack taxonomy for agent systems: tool-use abuse, prompt-chain exploitation, reflection-loop manipulation, authentication boundary attacks, excessive agency exploitation (LLM08), and supply-chain attacks specific to agent frameworks. Labs attack a vulnerable LangChain agent, a vulnerable AutoGen agent, and a vulnerable CrewAI multi-agent setup.
AWS Bedrock model red-teaming, Azure AI Studio adversarial testing, Google Vertex AI pentest. Traditional cloud attack surface alongside it — S3 misconfiguration, IAM privilege escalation, Lambda abuse, GuardDuty evasion. Capstone is a full engagement with an executive summary, technical findings, CVSS scoring and remediation guidance.
Which AI red-team tools do you actually use?
| Tool | What it does | Why it is on the list |
|---|---|---|
| garak (NVIDIA) | Open-source LLM red-team framework | De-facto standard for prompt injection and jailbreak testing |
| Pyrit (Microsoft) | Python Risk Identification Tool for AI | Used internally by the Microsoft AI Red Team |
| PortSwigger AI Scanner | AI-augmented web vulnerability discovery | Compresses manual Burp Suite workflows |
| Promptfoo | LLM evaluation and adversarial testing | Adversarial regression suite for production LLMs |
| Lakera AI | LLM firewall and red-team API | Test prompt-injection defences from both sides |
| HiddenLayer | AI model security platform | Model tampering, extraction and evasion detection |
Is TryHackMe legal? And where is the line?
TryHackMe is entirely legal. So are Hack The Box, PortSwigger's Web Security Academy and PentesterLab. They are legal for one reason: you are attacking machines the platform owns and has explicitly authorized you to attack.
That authorization is the entire legal distinction in this field. The identical technique, run against a system you do not have written permission to test, is a federal crime in the US under the Computer Fraud and Abuse Act — regardless of your intent, and regardless of whether you broke anything.
Worth internalizing early: the skill is not illegal, the target selection is. Every lab in this course runs against institute-owned infrastructure or platforms with published testing authorization.
Can I self-study ethical hacking instead?
Plenty of good pentesters did exactly that. TryHackMe and Hack The Box run about $10–20 a month, PortSwigger's Web Security Academy is free and genuinely excellent, and the tooling is open source. If you are self-directed and you enjoy being stuck, that path works and costs almost nothing.
Where it reliably breaks down is coverage. People gravitate toward the techniques they already find satisfying — usually web — and quietly skip Active Directory or wireless entirely. Then that gap surfaces in an interview. A cohort forces the boring weeks and gives you someone to ask why an exploit that should work does not. Decide based on your own history with unstructured learning, not on which option sounds more serious.
Who teaches it?
Fourteen years of practising security assessment work, including engagements for Fortune 500 companies. He brings real scenarios into the classroom rather than textbook exercises — 8,000+ students taught with a 97% success rate on the certification track.
Networkers Home was founded in 2007 by Vikas Swami, Dual CCIE #22239, who co-delivers the Month 2 AI red-team material.
CEH v13 or CompTIA PenTest+ — which certification should you pay for?
The course fee does not include either exam, and no honest provider bundles them — vendors change pricing on their own schedule.
CEH v13 costs roughly $1,200 through EC-Council and Pearson VUE. It carries the most name recognition with non-technical recruiters and HR filters, which is its genuine value.
CompTIA PenTest+ (PT0-002) costs about $390. This course's material covers roughly 80% of the PenTest+ blueprint as a side effect, so if budget is the constraint and you mainly need a credential that clears filters, PenTest+ gets you a comparable result for a third of the money.
And if what you actually want is to prove capability rather than clear a filter, neither is the answer — OSCP is. It is harder, it is respected by people who do the work, and this course is reasonable preparation for starting down that road, though not a substitute for it.
What do ethical hacking roles pay in the US?
| Role | Experience | US range |
|---|---|---|
| Junior Penetration Tester | 0–2 yrs | $75,000–100,000 |
| Penetration Tester | 2–4 yrs | $100,000–135,000 |
| Senior Pentester / Red Team | 4–7 yrs | $130,000–175,000 |
| AI Red Team Engineer | 2–5 yrs | $140,000–200,000 |
How to read this table: US labour-market reference ranges compiled from public US job postings — not Networkers Home placement outcomes. This is a certification course, not a placement programme, and the institute does not run a US hiring pipeline. You are buying the training, the labs and the certification preparation.
How do US students attend?
Recorded and posted within ~30 minutes.
Identical syllabus and trainer.
Lab targets are hosted and internet-reachable, so unlike the hardware-based Cisco courses there is no remote latency to work around — you attack them from your own machine.
When this is the wrong course for you
- You want OSCP specifically. Do Hack The Box and PWK instead — this is preparation for that road, not a replacement.
- You have a strong track record finishing self-paced material. TryHackMe plus PortSwigger's free academy will get you a long way for under $200 a year.
- You only want the CEH certificate and none of the AI material. Half of what you are paying for here is Month 2.
- You need US placement support. This is a certification course; NH does not run a US hiring pipeline.
Ethical hacking training online — frequently asked
Is it possible to learn ethical hacking online?
Yes, and offensive security is arguably better suited to online delivery than most technical subjects, because everything you attack is already a networked target. Networkers Home runs ethical hacking as a two-month live cohort on Zoom with lab targets hosted for you — vulnerable web applications, an Active Directory attack range, wireless capture exercises, and in Month 2 a set of deliberately vulnerable LLM agents. The one thing that does not work online is a lazy version of it: watching recorded lectures without running the tools yourself teaches you vocabulary, not capability. The distinguishing feature of a serious online program is whether it hands you live targets, and whether someone reviews what you did to them.
What is the best online course for learning ethical hacking?
It depends on what you want at the end. If you want the credential most HR filters recognize, EC-Council's CEH is that credential, and any CEH-aligned course serves. If you want to prove you can actually break in, OSCP from Offensive Security is the harder and more respected route, and TryHackMe or Hack The Box are excellent low-cost practice grounds for it. Networkers Home's two-month program is CEH v13-aligned in Month 1 and then spends Month 2 entirely on AI red-teaming — garak, Microsoft Pyrit, the OWASP LLM Top 10, and agentic AI attacks. That second month is the differentiator, because almost no ethical hacking course currently covers it and it is where hiring demand is growing fastest. If you only want the CEH cert and nothing else, a cheaper CEH-only course is a reasonable choice.
Is TryHackMe legal?
Yes. TryHackMe is entirely legal, and so are Hack The Box, PortSwigger Web Security Academy and PentesterLab. They are legal for one specific reason: you are attacking machines the platform owns and explicitly authorizes you to attack. That authorization is the whole legal distinction in offensive security. The same technique run against a system you do not have written permission to test is a crime in the US under the Computer Fraud and Abuse Act, regardless of intent and regardless of whether you caused damage. This is worth internalizing early — the skill is not illegal, the target selection is. Every lab in this course runs against institute-owned infrastructure or platforms with published testing authorization.
Can I self-study ethical hacking?
Many good pentesters did exactly that, so the honest answer is yes. TryHackMe and Hack The Box subscriptions run about $10–20 a month, PortSwigger's Web Security Academy is free and genuinely excellent, and the tooling is open source. If you are self-directed and enjoy being stuck, that path works and costs almost nothing. Where self-study reliably breaks down is structure and blind spots — people gravitate to the techniques they already find satisfying and skip Active Directory or wireless entirely, then discover the gap in an interview. A cohort forces coverage and gives you someone to ask why an exploit that should work does not. Choose based on your own track record with unstructured learning, not on which option sounds more serious.
Is the CEH v13 exam included in the course fee?
No, and no honest provider bundles it. The EC-Council CEH v13 exam voucher runs roughly $1,200 USD and is paid directly to EC-Council through Pearson VUE. The $1,199 course fee covers the two-month live cohort, lab access, and all recordings. Worth knowing before you commit: CompTIA PenTest+ costs around $390 and this course's material covers roughly 80% of the PenTest+ blueprint, so if budget matters and you mainly need a credential, PenTest+ is a cheaper path to a comparable filter-passing result. CEH carries more name recognition with non-technical recruiters; PenTest+ costs a third as much.
What time do the live classes run for US students?
US-East weeknights run Tuesday and Thursday, 7:00–9:30 PM ET. US-West weekends run Saturday and Sunday, 10:00 AM–2:00 PM PT. Both cover the identical two-month syllabus with the same trainer. Sessions are recorded and posted within about 30 minutes. Lab targets are hosted and reachable over the internet, so there is no remote-hardware latency to work around — you attack them from your own machine wherever you are.