Map the full attack surface.
Browse every domain from application and identity security to cloud control planes, industrial systems, AI and adversary tradecraft.
Open the research atlasIndependent offensive security intelligence
Understand the surface. Challenge the trust.
HackTheCore turns a fragmented security landscape into an operator-first research system—covering web, APIs, identity, cloud, internal networks, mobile, AI, OT/ICS and more. Built for authorized assessment, deliberate study and fast field reference.
No account required
Public-source references
Responsible use
20Research hubs
186Technical field briefs
177Knowledge definitions
105Practice questions
Choose the depth you need
Four ways into the same security landscape.
Start broad, follow an assessment, look up a concept or test your recall. Each route is designed for a different moment in the work.
Learn one domain with context.
Use curated domain hubs when you want a coherent reading order, public references and the concepts that frame the subject.
Enter the academyMove through an assessment.
Pivot across scope, reconnaissance, validation, escalation, evidence and reporting without losing the wider trust model.
Open the pentest routeFind the term, then follow the trail.
Search 177 concise definitions for fast orientation, then continue into the relevant domain and field notes.
Search the knowledge indexAttack surface atlas
Enter through the boundary you are testing.
The strongest assessments connect technologies and trust zones. These are the primary entry points; the full atlas connects all twenty research hubs.
DOM // 04
Web
Sessions, authorization, browser boundaries and application logic.
DOM // 05API
REST, GraphQL, object access, tokens, rate controls and trust.
DOM // 06Cloud
IAM, control planes, containers, automation and configuration drift.
DOM // 08Identity
SSO, federation, consent, sessions and conditional access.
DOM // 03Internal
Discovery, credentials, Active Directory, movement and pivoting.
DOM // 07Mobile
Android, iOS, instrumentation, storage and transport security.
DOM // 13AI Security
Prompt injection, retrieval, agents, tools and model interfaces.
DOM // 12OT / ICS
Industrial protocols, engineering systems, safety and segmentation.
Full directory Explore all 20 research hubs →Assessment lifecycle
From authorization to evidence.
A professional assessment is a chain of explicit decisions. The platform is organized to support that chain without turning it into a rigid checklist.
Authorize
Define permission, ownership, scope, exclusions and stop conditions.
Map
Build the surface model: assets, identities, data and trust boundaries.
Hypothesize
Turn observations into testable failure paths and likely impact.
Validate
Apply the minimum controlled action needed to prove or reject a path.
Connect
Reason across privileges, systems and control planes without overreach.
Evidence
Capture reproducible facts, affected boundaries and operational context.
Improve
Translate findings into remediation, detection and retest criteria.
Understand the system, its boundaries and the questions that matter first.
Move from context into workflows, failure patterns and practical references.
Continue into specifications, vendor documentation and recognized frameworks.
Research architecture
Enough context to decide what comes next.
The material is layered rather than forced into a course sequence. Scan a domain, open a focused brief, and verify details against the linked public sources.
- Domain-first navigation for multi-surface work
- Concise summaries before deeper technical notes
- Public references kept close to the operational context
- Cross-domain search available from every page with ⌘K or Ctrl+K
Featured research routes
Follow the trust, not the tool list.
These routes bring several layers of the platform together around high-value modern assessment surfaces.
Code & dependencies
Source Review
Trace untrusted input, dangerous sinks, authorization decisions and supply-chain exposure.
Tokens & federationIdentity Paths
Map how consent, sessions, workload identities and policy assumptions move privilege.
Control planesCloud Operations
Connect IAM, automation, Kubernetes and configuration drift into testable paths.
Build trustSupply Chain
Assess repositories, runners, signing, packages and the systems that ship software.
Models & agentsAI Security
Examine prompt boundaries, retrieval trust, tool access and inference interfaces.
Evidence & impactReporting
Turn technical proof into reproducible findings and decisions stakeholders can act on.
Responsible by design
Capability without authorization is not the mission.
Offensive knowledge has value when it improves understanding, validation and defense. Use this material only in labs, research environments and systems you are explicitly permitted to assess.
Document who can approve the work, which assets are in scope and when activity must stop.
Validate the boundary with the least impact required; avoid unnecessary access, persistence or data handling.
Record facts, uncertainty and context so findings can be reproduced and remediated responsibly.
Platform questions
What HackTheCore is—and what it is not.
What is HackTheCore?
HackTheCore is an independent offensive security research platform. It organizes domain hubs, technical field briefs, a terminology index and practice material around the questions that arise during authorized security work.
Who is the platform for?
Security practitioners, developers, defenders, students and researchers who need concise orientation, structured research routes and links to public technical sources.
Can I use it during a live assessment?
Yes—when the engagement is explicitly authorized and scoped. The domain hubs and briefs are designed to support planning, validation logic, evidence capture and reporting without replacing professional judgment.
Is this a certification course?
No. HackTheCore is a reference and study platform. Certification links are included as orientation, not endorsement and not as a substitute for official provider material.
Where does the technical information come from?
Briefs link to public specifications, vendor documentation, recognized security frameworks and open-source project documentation where relevant. The methodology page explains the editorial and source standards.
Does the exam send my answers anywhere?
The current static build evaluates and tracks practice selections in your browser session. It does not require an account.
What are the rules for responsible use?
Use the material only on systems you own or are explicitly authorized to test. Respect scope, minimize impact, protect evidence and disclose findings through an agreed process.
Start with intent
Choose a surface. Build the context. Validate what matters.
Browse the full research map, follow the guided academy structure or open the private access channel when you need to reach HackTheCore directly.