My Journey to an Orange Belt in Cybersecurity

Recently, I captured the last flag of the orange belt curriculum at pwn.college. It took hundreds of challenges, more late nights than I want to admit, and left me with a tool stack I now know better than some of my friends. So here is the story behind: how I got there, what each module taught me, and what still waits on the road ahead.

Why pwn.college?

pwn.college is a free platform from Arizona State University, created by Yan Shoshitaishvili and Connor Nelson. It powers ASU's own security courses, and anyone in the world can use it. In particular, the following things won me over.

Zero setup. The hardest part of any learning journey is the beginning: building an environment and convincing yourself it is worth the effort. Here, that step simply does not exist. A terminal, a VS Code editor and a full Linux desktop run in your browser, ready the moment you click "Start". No freemium tier either, everything is free.

Flags. Every challenge works like a capture-the-flag (CTF) puzzle: a secret string, the flag, appears only once you solve it correctly. No partial credit, no grader to argue with. The difficulty climbs one small step at a time, until you look back and realize you have quietly mastered the topic. Better still, the platform is open source on GitHub, and anyone who wants to give back can build and share their own dojos.

Sensai. The built-in AI tutor behaves like a patient academic mentor, not an answer machine. Before it offers anything, it asks what you tried, what happened and why you think it failed. More often than not, explaining that was enough to find the answer myself, bringing me back to my early college days before ChatGPT, when talking to a rubber duck was still a thing. When I was truly stuck, the Discord community, the FAQ and the documentation filled the gap.

Belts. Like a martial art, pwn.college ranks you with belts, starting at white. Orange is the first colored belt on the way to blue, and you have to earn them one at a time, in the given order.

White belt: the fundamentals

Before the first colored belt, there are four introductory dojos.

Getting Started. A gentle tour of the platform itself: the browser desktop, the editor, the terminal, and how challenges and flags work.

🐧 Linux Luminarium. An insightful walk through the command line: file paths, pipes and redirection, shell variables, processes, users and permissions. I knew much of it already, but working through the topics one by one was a welcome refresher, and genuinely fun.

💻 Computing 101. This is where you learn everything from scratch, and it is not as scary as it sounds. You use system calls and write programs in raw x86 assembly, step through them in a debugger (gdb), learn how memory is laid out, gain hands-on experience on using command-line programs such as netcat or curl, and eventually build a working web server. It quietly lays the foundation for everything that follows.

🔤 Playing With Programs. Just as much fun. It teaches you to read manuals and documentation instead of blindly trusting LLMs, and then to notice how ordinary, trusted commands can be tricked into reading files they were never meant to touch. It is the first time the platform makes you think like an attacker.

Orange belt, part 1: the network

The orange belt dojo, Intro to Cybersecurity, has seven modules, the same material ASU teaches in a full semester of its introductory security course. Here they are in the order I tackled them, grouped by theme. Fair warning: the first four are demanding in their own ways, and the last three took an insane amount of time.

Web Security

This module is a beast. It starts from a simple truth: web servers glue user input into commands, file paths and database queries, and every seam is a potential crack.

Path traversal: a few ../ sequences walk you out of the folder you were supposed to stay in.
Command injection: a stray semicolon in a form field turns into a second shell command.
SQL injection: your input stops being data and starts rewriting the database query itself.
Cross-site scripting (XSS): you plant JavaScript that runs in someone else's browser.
Cross-site request forgery (CSRF): you trick a logged-in victim's browser into sending a request they never meant to make.

Be warned: by the end of every challenge, you will have more Firefox windows and terminal tabs open than you can count. You will also understand exactly why these bugs still make headlines today, and how to defend against them.

Intercepting Communication

This module reminded me that the internet is a stack of layers, each one trusting the one below it a little "too much". Ethernet moves frames between machines, IP routes packets across networks, TCP builds reliable conversations, and UDP just fires and forgets.

The challenges climb that stack one layer at a time. For example, they consist of connecting to and scanning remote hosts, sniffing traffic, configuring firewalls, running denial-of-service (DoS) attacks and spoofing UDP packets. On another note, ARP stands out as a naive protocol that maps IP addresses to hardware addresses and blindly believes any answer it receives; if you abuse that trust well, all the network traffic might just flow through you. The finale is the classic man-in-the-middle (MITM) attack: reading and rewriting a conversation while both sides believe they are talking privately.

Orange belt, part 2: secrets and permissions

Cryptography

Computationally, this was the easiest module for me. I solved the first challenges with pen and paper to really grasp the basics. Exclusive OR (XOR) is the atom of modern cryptography, and a one-time pad is perfectly secure, right up until someone reuses the key.

From there, the module moves to AES, the cipher that protects most of the internet. The lesson is that a strong cipher used the wrong way is still weak. In ECB mode, identical plaintext blocks produce identical ciphertext, which lets you recover a secret one byte at a time. In CBC mode, flipping bits in one block lets you edit the next. Diffie–Hellman key exchange, RSA, hashing and TLS are also thoroughly explored.

Then came the padding oracle attacks (POA), and the easy module stopped being easy. The idea sounds harmless: a server merely tells you whether a decrypted message has valid padding. That single yes or no is enough to decrypt any message byte by byte, and even to forge new ones. In retrospect, it was a relief to see that the answer is rarely a fancier cipher, but using the existing one properly: more advanced authenticated encryption such as AES-GCM, and servers that never reveal why a decryption failed.

Access Control

This module was more theoretical, and it reminded me of some of the mandatory courses in my computer science bachelor's degree. Linux decides who may touch what through file permissions, ownership and the setuid bit, a model called discretionary access control: the owner of a file decides who gets in. The challenges ask you to find the weak points in those decisions and slip through them. The module closes with mandatory access control, where a system-wide policy, not the owner, has the final say. Together, they make a compact introduction to how operating systems think about security.

Orange belt, part 3: into the binary

Reverse Engineering

This is where things got spicy, and where the platform started driving me crazy.

The entire module revolves around cIMG, short for "Connor Image Format." It does not exist anywhere outside pwn.college, so there is no documentation to look up and no Stack Overflow thread to rescue you. The only source of truth is the program that renders it. Across 39 challenges, you work out the format piece by piece: first the magic number that identifies the file, then the version, the dimensions, colors, a framebuffer, sprites and finally full animations. Early levels hand you the source code in Python or C. Later ones give you only the compiled binary.

That is where Ghidra comes in. It takes raw machine code and decompiles it into C-like pseudocode, turning assembly into something a human can reason about. By the end, I was not just reading the cIMG binaries but patching them, rewriting their instructions to make them behave the way I wanted.

Binary Exploitation

If reverse engineering is reading a program, binary exploitation is taking control of it. This module was extremely difficult.

The core idea is the stack buffer overflow. A program reserves, say, 64 bytes for your input, but does not check how much you actually send. Write past the end, and you overwrite the return address, which tells the program where to go when the current function finishes. Point it somewhere new, and the program obediently jumps into a part of the code it was never meant to reach.

Modern defenses make this much harder. Stack canaries detect the overwrite, and ASLR together with position-independent executables (PIE) shuffles every address on each run. Getting the base addresses right was a constant struggle. This is the module where I truly mastered gdb, leaning on Ghidra and everything the previous module taught me.

The last stretch adds shellcode: tiny payloads of raw machine code that you inject into the program and then hijack execution to run. Along the way, you learn NOP sleds, which give your jump a wide landing zone, and NULL-free shellcode. Many input functions treat a zero byte as the end of a string, so a single NULL inside your shellcode can cut your payload short.

Integrated Security (the final boss)

Up to this point, every module isolates a single concept. Integrated Security, however, brings them together: each of its 13 challenges combines two or more earlier skills into one end-to-end attack, with little guidance on how the pieces connect.

In some challenges, you face a web server that looks bulletproof until you find a few cracks and inject malicious SQL. In others, a crypto flaw that is useless on its own becomes your way to smuggle in shellcode. Elsewhere, you hijack an image parser that handles memory a little too carelessly. Every tiny detail from the previous six modules suddenly matters, and the hard part is no longer any single technique but seeing how they fit together.

It was the hardest part of the entire orange belt, and capturing its final flag is the moment this article exists to celebrate.

The road to blue?

Technically, the orange belt is the end of the introduction, not the end of the road, and whether I walk the rest of it is another question. Belts must be earned in order, and each colored belt means finishing an entire dojo, every challenge included:

Yellow belt: Program Security. Five modules and roughly 160 challenges that pick up where Binary Exploitation left off. Reverse engineering is supposed to return at a harder level. Return-oriented programming (ROP) now deals with the question: what if the stack is not executable? The answer: instead of injecting code, you stitch together tiny fragments of code the program already contains. Dynamic Allocator Misuse then shifts the focus from the stack to the heap, the part of memory a program requests and frees while it runs, which comes with its own kind of bugs. Program Exploitation stands out as the final module of this dojo.
Green belt: System Security. Here, the focus is supposed to shift from single programs to the systems around them. The dojo covers sandboxing and how to escape it, race conditions, kernel security, microarchitecture exploitation (attacks in the spirit of Spectre, which abuse how the CPU itself speculates), and a final System Exploitation module. Earning green belt also opens the door to CTF Academy, an ASU initiative that helps pwn.college students make the jump to real team competitions.
Blue belt: Software Exploitation. The deep end. It consists of format string exploits, file struct exploits, exploitation primitives, heap allocator exploitation and kernel exploitation, and lets you take control of hardened, modern software. This is the final destination of the core curriculum.

It seems odd at first that yellow outranks orange. The order, however, matches the belt ranks of the American Taekwondo Association (ATA), where orange comes right after white. The borrowing goes deeper than colors: the ATA describes its orange belt with the image of a rising sun, and the Intro to Cybersecurity dojo opens with that very same line.

The belts are real, too. pwn.college currently ships embroidered belts only to blue belts. Until then, the crew awards them in person, at ASU or at a security conference.

Advice for newcomers

If you are thinking about starting, here are some tips and tricks that helped me get that far:

Understand tools. Make sure you know how to get the best out of debuggers, reverse-engineering programs, command-line programs, manuals, etc.

Do not take shortcuts, follow the lead. The AI tutor not only provides further explanations and coding suggestions, but also offers a step-by-step methodology for approaching the problems. If you follow it well enough, you will slowly develop a pattern-matching capability, and it will help you solve CTF challenges more independently.

Explain before you ask. Writing down what you have tried so far and why it failed solves more problems than any hint. I would also suggest doing the early challenges by hand, and a fair amount of manual work before automating stuff or letting an AI refactor everything. Otherwise, the shortcuts you take now become the gaps that slow you down later.

Be careful with general-purpose AI. Leaning on Claude, ChatGPT and the like before working through the given resources might feel faster, but in my experience it is mostly counterproductive. The challenges are built to make you understand the material, and each level assumes you learned the last one.

Final thoughts

For now, a full-time career in cybersecurity seems far-fetched to me. This side quest was about onboarding myself into topics I once knew little about, and understanding them well enough to break them down. Just for the record: I wouldn't call myself a hacker yet, but I am definitely closer than I think.

Moreover, I believe the mindset taught here carries over to almost any field, for example the security of machine learning models and differential privacy. One of my favorite Portuguese words, malandragem, captures it well: never losing your inner child, staying playful in whatever you do, and slipping out of rigid frames.

Thanks to Yan, Connor, the rest of the pwn.college crew and ASU for opening this up to the world for free!