InternshipAll 90 tasks, level by level
The real graded Cybersecurity & Ethical Hacking tasks the portal assigns, grouped into three levels.
The portal assigns these Cybersecurity & Ethical Hacking tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (35 tasks)
- Set up a Kali Linux virtual machine
- Learn 20 essential Linux commands
- Understand file permissions
- Map the OSI and TCP/IP models
- Scan your own network with Nmap
- Capture traffic with Wireshark
- Explain the CIA triad with examples
- Create strong password hashes
- Set up DVWA or OWASP Juice Shop
- Study the OWASP Top 10
- Identify phishing emails
- Learn basic Bash scripting
- Configure a host firewall
- Understand encryption basics
- Publish your learning on LinkedIn
…and 20 more Level 1 tasks in your dashboard.
Level 2: Building real features (30 tasks)
| Task | What to do |
|---|---|
| Exploit and fix SQL injection in DVWA | Demonstrate SQL injection in your local lab, then show the fixed code using parameterised queries. |
| Exploit and fix reflected XSS | Show an XSS payload in the lab app and the fix with output encoding and a Content Security Policy. |
| Use Burp Suite to intercept requests | Intercept and modify a login request in your lab app; explain what an attacker could change. |
| Perform a vulnerability scan with OpenVAS or Nikto | Scan your own lab machine, then write a short report ranking the findings by risk. |
| Analyse logs for suspicious logins | Parse an SSH auth log with Python and report repeated failed logins by IP address. |
| Build a port scanner in Python | Write a TCP connect scanner using sockets with a timeout and threading; scan only your own lab. |
| Harden a Linux server | Disable root SSH login, use key-based auth, install fail2ban, enable automatic updates; document each step. |
| Crack weak hashes in a lab | Use John the Ripper or Hashcat on sample hashes you created to show why weak passwords fail. |
| Set up HTTPS with a certificate | Serve a local site over HTTPS (e.g. with mkcert or Let's Encrypt on a test domain) and explain the TLS handshake. |
| Write a threat model | For a simple student portal, list assets, threats (STRIDE), and mitigations in a table. |
| Investigate a malware sample safely | Using a public sandbox report (e.g. Any.run or VirusTotal), summarise what the malware does and its indicators of compromise. |
| Create a security awareness poster | Design a one-page poster for students on OTP fraud, phishing and password hygiene. |
| Broken access control lab | In Juice Shop or a similar lab app, find an access-control flaw, document the steps, then write the server-side fix and a test for it. |
| CSRF lab and defence | Demonstrate CSRF on a deliberately vulnerable practice app, then add anti-CSRF tokens and SameSite cookies and show the attack fails. |
| Secure file upload | Build an upload endpoint that checks type, size and content, renames files and stores them outside the web root. Test it with bad files. |
| Rate limiting and lockout | Add login rate limiting and temporary lockout to a demo app and show logs of blocked attempts. |
| Security headers | Add CSP, HSTS, X-Frame-Options and Referrer-Policy to a site, check the score with an online header scanner and explain each header. |
| Dependency audit | Run npm audit or pip-audit on a project, fix or document every high finding and add the audit to CI. |
| Wi-Fi security review | Review your home or lab router: WPA settings, default password, firmware, WPS and guest network. Write recommendations. |
| Log analysis with grep and Python | Parse a web server log to find the top IPs, 404 spikes and suspicious user agents, with a short report. |
| Secrets scanning | Scan a repository's history for leaked keys with a secrets scanner, rotate any found key in a lab, and add a pre-commit hook. |
| Docker security basics | Run a container as non-root, with read-only filesystem and limited capabilities, and scan the image for vulnerabilities. |
| Input validation library | Write server-side validation for name, email, phone, URL and file name, with tests for malicious inputs. |
| JWT security lab | Build a login with JWT, then show and fix weak secrets, missing expiry and algorithm confusion in a lab. |
| Password reset flow | Implement a secure password reset with one-time expiring tokens and no user enumeration. |
| Audit logging | Add audit logs for logins, permission changes and data exports to a demo app with tamper-evident storage. |
| Network traffic baseline | Capture normal traffic for an hour, summarise protocols and hosts, then spot an injected anomaly. |
| Cloud IAM review | In a free cloud account, review IAM users and roles, remove broad permissions and enable MFA for all users. |
| Vulnerability management plan | Design how a small company finds, prioritises (CVSS + exposure) and patches vulnerabilities, with SLAs. |
| Hash cracking defence | Compare MD5, SHA-256 and bcrypt cracking speed on lab hashes and explain why slow hashes protect users. |
Level 3: Professional work and capstone (25 tasks)
| Task | What to do |
|---|---|
| Full penetration test of a lab application | Test OWASP Juice Shop end to end and write a professional report: scope, findings, evidence, risk ratings and fixes. |
| Build a simple SIEM dashboard | Collect logs from your VM into the ELK stack or Wazuh and create alerts for brute-force attempts. |
| Capture the Flag challenges | Solve at least five beginner CTF challenges on TryHackMe or picoCTF and write up how you solved each. |
Secure a web app's authentication | Add MFA, rate limiting, secure password storage and session timeouts to a demo app; show before and after. |
| Incident response playbook | Write a step-by-step playbook for a ransomware incident: detection, containment, eradication, recovery and reporting to CERT-In. |
| Cloud security review | Review a demo AWS or Firebase project for public storage, over-broad IAM and missing logging; write fixes. |
| Network segmentation lab | Use virtual networks to separate a web server and database; show that only the needed traffic is allowed. |
| Final security portfolio | Publish a GitHub portfolio with your reports, scripts and write-ups, and present a 5-minute summary video. |
| Ethics and law summary | Explain India's IT Act 2000 sections relevant to hacking and why written permission is required before any test. |
| Secure code review | Review 300+ lines of an open-source or classmate's web app for injection, auth and data-exposure issues and write a findings report with fixes. |
| Detection rules | Write 5 detection rules (e.g. Sigma or SIEM queries) for brute force, new admin user, impossible travel and suspicious PowerShell, and test them on sample logs. |
| Phishing incident simulation | Run a tabletop exercise for a phishing incident: timeline, containment, communication and lessons learned. |
| Zero-trust design | Design zero-trust access for a small company (identity, device checks, least privilege, segmentation) with a diagram. |
| Bug bounty style report | In a legal lab target, find one vulnerability and write a professional report: summary, impact, steps, evidence and remediation. |
| Compliance checklist | Map a small web app against a basic data-protection checklist (consent, retention, access, breach notification under India's DPDP Act) and list gaps. |
| Security awareness workshop | Prepare and record a 15-minute security awareness session for first-year students with a short quiz at the end. |
| Capstone: secure a full application | Take a vulnerable lab app, fix its top 5 issues, add logging and monitoring, and document before/after evidence in a final report. |
| Security architecture review | Review the architecture of a sample 3-tier app and produce a threat list with mitigations using STRIDE. |
| Honeypot lab | Run a low-interaction honeypot in an isolated lab, collect attempts for a week and analyse them. |
| Ransomware readiness | Write a ransomware response and recovery plan with backups, isolation steps and communication templates. |
| Secure SDLC proposal | Propose security activities for each SDLC phase (requirements to maintenance) for a student project team. |
| Mobile app security test | Test a deliberately insecure Android lab app for insecure storage and traffic, and report fixes. |
| Wireless lab assessment | In your own lab network, assess Wi-Fi configuration and document secure settings (WPA3, segmentation). |
| Board-level security report | Summarise your security work as a one-page report for non-technical management: risks, status, asks. |
| Career roadmap in security | Map SOC analyst, pentester and security engineer paths with skills, certifications and a 6-month plan for yourself. |