The Attacker's Mindset (Part 1/3): Foundations of Offensive Security

This is part 1 of a 3-part series about a hands-on offensive security training I gave at the Algérie Télécom Skills Center in Saïda, as part of the 7-77 Digital Skills Programme: three sessions in one week, from "what is a request?" to finding and reporting real vulnerabilities.

Most people are taught that cybersecurity is either memorizing 500 dry definitions for an exam, or staring at green-on-black terminals running scripts they don't understand.

For this training I threw that playbook out. Day 1 needed no laptop. The goal was simple: demystify offensive security and build "the attacker's mindset" before anyone touches a tool.

Here is what we covered.

1. The web is just a conversation

A website isn't magic. Your browser sends a request, the server sends an answer. Everything else is detail.

An attacker isn't doing anything mystical. They simply ask the server questions the developer never anticipated.

2. Blue team vs. red team

• Blue team defends: detection, monitoring, the SOC, incident response.
• Red team breaks in, legally, to find the gaps before someone malicious does.

You can't defend what you don't know how to break. Both sides need the same understanding of how systems fail.

3. A methodology, not random chaos

Real offensive work follows a loop:

1. Recon: find what the site doesn't advertise.
2. Discovery: identify the soft spots.
3. Exploitation: prove the flaw actually exists.
4. Reporting: explain the impact and how to fix it.

4. The line between a career and a criminal record

The technical skill needed to test a system and to attack it is identical. The only difference is permission.

We walked through Article 394 bis of the Algerian Penal Code, which covers unauthorized access to computer systems, so everyone understood why legal and ethical boundaries are non-negotiable. Only test systems you own, systems you have written permission to test, or labs built to be attacked.

5. Popups don't pay. Reports do.

A company doesn't pay a security engineer for an alert(1) popup. It pays for a clear, repeatable vulnerability report:

• What happened
• Steps to reproduce it
• Impact on the business
• Fix: how the engineering team can patch it

That idea ran through the whole week: on day 3, a finding only counted with an explanation and a report.

Take it with you

Every slide is published as a standalone web page, along with a 90-day offensive security roadmap for self-study. All free:

• 🔗 Workshop 1 slides: https://medjahdi.dev/src/workshop-1
• 🗺️ Offensive security roadmap: https://medjahdi.dev/src/roadmap-red

Next, in part 2 (Tuesday): we leave theory behind, spin up a sealed Docker lab, and find XSS and SQL injection by hand.