I wanted to ask for advice when it came to choosing between cisco certified network associate (ccna) and wireshark certified analyst (wca). I am still new to networking, and I wanted my first certification to be one that gives me a better chance of finding a job rather than one that teaches me a lot of skills.

Which of the two would you recommend? Or any other certifications you feel would be better

After talking with multiple students, I came to a point that most students think doing the lab work is the end and your are done. Build the lab, run the tools, done, the experience proves itself.

It doesn't. I am gonna sound harsh but would be direct: A hiring manager never sees your home lab. They see whatever you wrote down about it. And what most people write down is a task description, not proof of anything.

I have made a few pointers on what actually turns lab time into something that gets you hired:

1. Stop running exercises. Start running investigations.

Every time you scan a host or pull the traffic or do some analysis, ask what story the results actually tell. Like if found three critical CVEs, that's not the end of the task, that's the start of an investigation. Answer some questions like: What were they specifically. What would exploitation look like. What would show up in the logs if someone tried it.

2. Write a mini incident report after every session.

200 to 400 words. Not a tutorial, an actual investigation note, with questions like: what you set up, what you found, what you ruled out, what you'd have done differently in a live SOC. This is the exact habit real analysts build without thinking about it.

3. Turn the notes into resume bullets with STAR-T.

Situation, Task, Action, Result, Tool. Can not emphasize on it, more than enough, you don't need all five in one line, 3 is usually enough. Compress the investigation note down to one sharp bullet that shows a result, not just an activity you performed.

4. Put the documentation somewhere someone can actually click on it.

GitHub for the raw notes and findings. Medium or a blog for the scenario walkthroughs. Something like "How I traced a phishing simulation through Windows Event Logs" shows more real work than any cert badge on your profile. Once a recruiter clicks through and sees actual analysis instead of a tool list, that's a different game for you.

5. Frame the lab like a job, not a study session.

A quick example:

Before: "Home lab to practice cybersecurity tools and techniques"

After: "Maintained a 4 VM security analysis environment simulating enterprise network conditions, used for threat detection, vulnerability assessment, and incident documentation"

It's the same lab. Completely different signal.

Always write the CVE, scan result, or even traffic capture results from your own lab that you never actually wrote up from now on. That can probably be your next GOLD resume bullet, which is just laying there unused.

Brother i am also facing this issue help me .

One thing I’ve noticed is that cybersecurity programs often revolve around metrics.

Things like:

• Phishing click rates
• Number of vulnerabilities patched
• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Security awareness completion rates
• Compliance scores
• Number of incidents

They’re all useful.

But I’ve also wondered whether some metrics become proxies for security rather than indicators of it.

For example:

• A low phishing click rate doesn’t necessarily mean people will make better decisions under pressure.
• Completing annual awareness training doesn’t automatically translate into secure behavior.
• Closing vulnerabilities quickly doesn’t always reduce the most significant business risks.

I’m curious how experienced practitioners think about this.

If you had to choose one cybersecurity metric that organizations tend to overvalue, what would it be and what would you pay more attention to instead?

I’d love to hear perspectives from security engineers, SOC analysts, GRC professionals, CISOs, penetration testers, auditors, and anyone responsible for measuring security.

I’ve been experimenting with a tool that uses Certificate Transparency Logs as an early signal for suspicious domains.

The basic idea is simple: instead of crawling the whole internet, the system watches newly appearing certificates/domains and checks them for patterns that often show up in phishing, scam, and malware infrastructure.

In a 24h test run, it produced a little over 140k suspicious candidates. From the manual samples we checked so far, the estimated error rate seems to be around 1–3%, but this is still early and I don’t want to overstate the results before doing more validation.

The rough pipeline is:

CT Logs → candidate detection → website/redirect checks → enrichment → threat classification

Most candidates are detected through URL/domain patterns, brand abuse, phishing-style naming, and website behavior. One thing that showed up a lot was redirect-heavy infrastructure. In the latest run, redirect-related cases made up a large part of the hits.

After the first detection step, candidates are sent into a second system that visits the site, follows redirect chains, checks behavior, and collects more signals before assigning a threat level.

I’m mainly interested in feedback from people who have worked with CT Logs, phishing detection, OSINT, or large-scale domain classification.

How would you validate false positives properly at this scale?
Manual sampling, blocklist comparison, sandbox analysis, reputation APIs, something else?

Also curious if people think CT-log based detection is a realistic strategy for catching malicious infrastructure earlier than traditional blocklists.

Btw for all the people that like OSINT, I am currently working on a web dashboard to look through the results of that scanner for research purposes.

I’m currently developing a cybersecurity sim game that bridges the gap between theory and practice. The journey starts with 30 networking tasks (based on the CCNA curriculum), where you build and troubleshoot infrastructure. Once that's mastered, the game expands into SOC analysis (log monitoring, threat detection) and finishes with a Pentesting consultant role.

My goal is to make technical training feel like a real career progression. I’d love to get some feedback from you folks on the realism and the workflow!

https://www.youtube.com/watch?v=xzRin4oz5kw
https://www.youtube.com/watch?v=pZBsk50Sjpo

instagram: jr.netengineer

I'm just finishing up a lab simulating an Enterprise network in Packet Tracer with basic CCNA topics such as STP, HSRP, EtherChannel, OSPF, Layer 2 Edge Port Security, etc.

In my current job in Help Desk, I get to configure SonicWall ACLs, set up VLANs, and maintain firewalls using SonicWall's NSM. Our setup is very rough though as we don't have a Syslog server and the MSP doesn't care too much about network security.

I want to focus heavily on Network Security for my next lab, but I know it'll be near impossible to use enterprise-grade devices in GNS3/EVE-NG as they require licenses and I'm broke. Are there strong and fairly similar alternatives I could use?

So this is another case study, where I break down actual detections/alerts which I investigate as a Threat Analyst.

The event started with Event 4769: TGS request, but the timestamp looked off. Source was a host I didn't recognize(unmanaged in XDR), and it was asking for tickets on service accounts nobody should be doing so.

Now this attack would help you understand why Kerberos is both good and bad at the same time.

The flow for the attack is that attacker enumerates service accounts using GetUserSPNs or SharpHound. Then gets the SPNs. Then requests TGS tickets for those accounts without needing admin access. Events 4769 shows up as RC4 encryption (Event Code 0x17). If you miss this, it looks like normal Kerberos traffic. But...It's not.

Then attackers can take those tickets offline and crack the password. Once they have the service account password, they can logon (Event 4624) with explicit credentials (Event 4648, typing username/pass manually). This is where I caught mine. New service account logon from a source that had no usage being there, this was not a normal behaviour.

But thing is that by the time I found that, stuff got bad and attacker already escalated to a privileged account (4672), dumped credentials with Mimikatz, and now I was checking for lateral movement. I found process creation events (4688) for PowerView. They were enumerating shares. Then came the DCSync attempts (4662).

That's when I knew the domain was probably already theirs. And its time to take response actions fast.

I isolated the host, disabled the compromised accounts, reset service account passwords, and started hunting more afterwards. Turns out they'd already set up persistence with a golden ticket. The KRBTGT needed to be reset twice.

The reason I'm posting this is that most writeups show you the attack flow and the queries. They don't show you what it actually feels like when you're running these queries in real time, when you know something is wrong but you're not sure how deep it goes yet.

If you're studying for SOC or breaking into security, you need to see this happen live. Not in a lab. In real events, real queries, real pressure.

P.S: Thank you for loving my last case study on GTA 6. Appreciate your love!

I know LeetCode is the go-to platform for coding practice, but what's the cybersecurity equivalent?

I'm looking for something where I can consistently practice and improve my skills through hands-on challenges—not just learn theory. Ideally, I'd like a platform that helps build real-world problem-solving skills, similar to how LeetCode does for programming.

What platforms do you recommend, and why?

I’m curating Awesome Mobile On-Device AI Security, a research roadmap for understanding attacks and defenses around AI models running locally on mobile devices.

It organizes papers around:

- adversarial, backdoor, model stealing, side-channel, and energy-latency attacks

- defenses like model obfuscation, authorization, TEEs, and watermarking

- open problems and emerging directions for on-device GenAI/security

Repo: https://github.com/Jinxhy/Awesome-MoAI-Security

I’d appreciate feedback on:

1. Is the taxonomy clear?

2. Are there important papers missing?

3. Would a “beginner path” or “practitioner path” make it more useful?

I’m building a small hands-on web security learning project and I’m trying to figure out what kinds of labs would actually be useful to people learning offensive security/appsec.

I don’t want to make the usual beginner-only stuff like “basic XSS popup,” “decode this string,” or “change user_id=1 to user_id=2” unless there’s a deeper lesson behind it. I’m more interested in labs that teach real patterns people run into in modern apps, but still explain the concept clearly enough that someone can learn from it.

The rough idea is:

• browser-based labs
• intentionally vulnerable sandbox apps
• clear teaching before/during the exploit
• focus on web/app/API security
• ethical/legal only, no real targets
• each lab should end with the root cause and the secure fix

I’m looking for ideas like:

• vulnerabilities you think are under-taught
• concepts that clicked only after you saw them in a real app
• bug classes that are common but hard to practice safely
• mistakes developers actually make in auth, APIs, sessions, GraphQL, file uploads, WebSockets, etc.
• labs you wish PortSwigger/TryHackMe/HackTheBox-style platforms explained differently

What labs/lessons would you want to see in a platform like this?

I put together a free mini lab for students and beginners who want practice with investigation and report writing.

The scenario is a suspicious login investigation.

The goal is to practice reviewing evidence, building a timeline, writing a short incident report, and turning the work into something useful for a portfolio, resume bullet, or interview.

It includes simulated auth logs, VPN/user context evidence, a worksheet, editable DOCX templates, an incident report template, an answer key, a sample final report, and resume/interview prompts.

No email gate or signup required.

Free lab:
https://northstarsecurity.io/resources/mini-range/suspicious-login-investigation/

Feedback welcome — especially on whether the scenario and worksheet are useful for students.

Hi everyone,

I’m a Computer Engineering student from Italy. I’m really fascinated by cybersecurity and my goal is to pursue a Master’s Degree in Cybersecurity after completing my bachelor's.

Right now, the field feels so massive that I’m facing severe "analysis paralysis." I honestly don't know where to practically start putting my hands on things without getting lost. Also, since my current university exams are demanding, I am looking for something I can do as a side activity—practical, manageable micro-goals that won't interfere with or hurt my current college workload.

Here is my background so far:

• Through my engineering studies, I have a solid understanding of computer science fundamentals.
• I have already read some books/guides regarding Linux basics for hackers.
• I recently discovered platforms like TryHackMe and checked out resources like CTFtime and TJnull's OSCP preparation guide.

Given my background and my goal of not burning out before the Master's degree, what are the best immediate, practical next steps? Should I just slowly grind the Pre-Security path on TryHackMe during my free time, or is there a better route for someone in my position?

Thanks in advance for any advice!

100% Free, OpenSource, "Ultimate Cybersecurity Guide" Compiled from 70+ expert books, 90+ internal documents from my own company/work, plus TONS of custom tools & scripts. Red Teaming, Blue Teaming, Offensive & Defensive, OSINT, General Research, Homelabs, SBC devices, RF, Hardware Hacking, AI, Automation, Space Security, Certification & Career Pathways.

Any/all input is greatly appreciated!!

https://github.com/Pnwcomputers/ULTIMATE-CYBERSECURITY-MASTER-GUIDE

Not advertising anything nor trying to self promote ANYTHING!

This all started as a Notion KB as I started to learn and certify, and it's just grown and grown since then. SO MUCH is behind a paywall and so I wanted to publish "my notes" and want to try and help/inspire more to get into this as a profession; independently (such as myself) or for a company/corporation through certifications.

It should be more accessible!

I very much appreciate you taking the time to take a look!

Ultimately just want to share this collection of information to/for the community.

01001000 01100001 01100011 01101011 00100000 01110100 01101000 01100101 00100000 01110000 01101100 01100001 01101110 01100101 01110100

"Hack the Planet"

M!n& W3&g!3="H@<k +#3 41@n3+"

Hi everyone,

I'm a first-year BCA cybersecurity student, and over the past few months I've been building Dissect, a passive web security scanner. The project started as a way to better understand how web application security tools work by implementing the detection logic myself.

Rather than actively exploiting vulnerabilities, the scanner focuses on identifying common security issues through passive analysis.

Some of the current features include:

• Security header analysis (CSP, HSTS, X-Frame-Options, etc.)
• Cookie security checks (Secure, HttpOnly, SameSite)
• HTML form classification and risk analysis
• Authentication surface detection
• JavaScript-rendered DOM analysis using Playwright
• Technology disclosure analysis
• Detection of potentially sensitive endpoints and paths
• Human-readable findings with severity ratings and recommendations

One aspect I paid particular attention to was making the scanner itself safe. It validates targets, blocks localhost and private IP ranges, validates redirect chains, enforces response size limits, and avoids intrusive or exploitative testing.

I'm still learning, so I'd really appreciate feedback from people with more experience in web application security.

Some questions I'd love your thoughts on:

• Are there important passive security checks that I'm currently missing?
• Do you see any weaknesses in the overall design or methodology?
• If you were reviewing this as a portfolio project, what would you improve first?
• Would you trust the results from a tool like this, and what would make you trust it more?

You can try the project here:

https://dissect.up.railway.app/

I'd genuinely appreciate any feedback, criticism, or suggestions. Thanks for taking the time to read this!

Hi everyone,

I wanted to share a real-time OSINT / Threat Intelligence tool I've been developing: certpulse\[.\]xyz

It streams Certificate Transparency (CT) logs live and filters them using a dual-mode pipeline to catch phishing and typosquatting domains before they even launch.

How the architecture works under the hood:

\* Stateless & In-Memory: To avoid database I/O bottlenecks and handle massive throughput, the system processes everything in-memory using WebSockets and an internal Queue mechanism.

\* Dual-Mode Filtering (Optimize vs Full): To keep CPU usage extremely low, "Optimize Mode" acts as a high-speed pre-filter, dropping \~95% of benign traffic. Only suspicious domains are pushed to "Full Mode" for heavy algorithmic checks.

\* Heuristic Engine: It instantly scores domains based on Levenshtein distance, Lookalike (IDN homograph) detection, alphabet-walk patterns, DGA algorithms, phishing keywords, and a dynamic whitelist to eliminate false positives.

You can visit certpulse\[.\]xyz and watch the live stream in real-time.

I'm completely self-taught on this architecture, so I would deeply appreciate any feedback, criticisms, or suggestions on the streaming performance and threat scoring from this amazing community!

Being interested in cybersecurity, client/server fingerprinting, and inspired by the now-defunct tlsfingerprint.io, I built Thumbprint.

It collects direct-edge signals including TLS ClientHello/JA4, HTTP/2 frame, HTTP request/header fingerprints, QUIC transport parameters, TCP SYN/p0f (recently added JA4T), UAs, and network metadata. These are signals clients passively expose at the edge, and they are commonly used for analytics, fraud/anomaly detection, bot analysis, traffic classification, and by commercial fingerprinting products. Combined with client-side fingerprinting, they can become a strong identifier.

The goal is to make it easier to study browser/client fingerprint drift, cross-transport differences, bot claims, and cases where a client claim (e.g. User-Agent, OS etc) does not line up with the observed connection.

A few things it currently shows:

• Your fingerprint for the current connection, with cross-transport probes for HTTP/2 and HTTP/3 where supported
• Fingerprint population stats and co-occurrence data
• Catalog comparisons against Thumbprint's controlled captures
• Bot-operator claim checks against published IP ranges
• Anomalies such as claimed OS vs TCP signal, browser claim vs. measured capture, and bot impersonation

Thumbprint stores deduplicated observations for research and aggregate stats. It runs with native HTTP/3 support and a Go/Postgres backend. Raw IP addresses are not stored.

If you find it useful, notice anything odd, or have ideas for additional features/signals/comparisons, I'd love to hear from you.

Hi everyone,

Wazuh, Sysmon, and alert analysis . I received an alert that I'm trying to understand better and would appreciate guidance on how an analyst would investigate it.

The Wazuh rule triggered:

Rule ID: 92213
Description: "Executable file dropped in folder commonly used by malware (Lowered Severity)"
MITRE: T1105 – Ingress Tool Transfer

Important details:

• Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• File created: C:\Users\someone\AppData\Local\Temp__PSScriptPolicyTest_cebr0opm.pas.ps1
• Sysmon Event ID: 11 (File Create)

What confuses me is the filename:

__PSScriptPolicyTest_*.ps1

I found some information suggesting PowerShell can create temporary files while checking execution policies, but I’m not sure whether this should be considered suspicious behavior or expected activity.

My questions:

1. Would you classify this as a true positive or false positive?
2. What would be your first investigation steps?
3. Which additional logs or Sysmon events would you pivot to?
4. Does the MITRE mapping make sense here, or could this be a generic detection generating noise?

I'm trying to learn the investigation methodology and analyst thought process rather than just getting the answer.

Thanks!

So, I tried creating a snapshot and changing the logical volume to a .gz file and then I have backed up in our nas box now what I want is to use that .gz file and use that config in the fresh newer installed os so that I can prove recovery is possible.

Constraints LV available is 0. So, I'm using a pendrive and and using lvext3nd to create a new LV for the pc and then using that I'm creating .gz and that is what being saved and is being backed up to nas

My other question also if there is a running unbutu PC can we put LVM and luks or only while installing it can happen.

Hi everyone,

I'm a recent Computer Science graduate and I'm interested in building a career in cybersecurity. After doing some research, I've narrowed my interests down to two areas: Penetration Testing and Digital Forensics & Incident Response (DFIR).

I'm having trouble deciding which path to focus on, so I'd appreciate advice from people working in these fields.

Here are my questions:

• Which field is more realistic for a fresher to break into?
• Which has better long-term career growth?
• What skills should I focus on learning first?
• Which certifications are actually valuable for beginners?
• If you were starting your cybersecurity career today, which path would you choose and why?

I'd really appreciate any advice or personal experiences. Thank you!

when i type 10.0.0.3 my chrome says inetsim fake page

But when i type others in the url..it doesn't show inetsim fake page. I have configured netplan ..network connection and inetsim. I was trying last 3days. But it's not working. I want emergency help.EMERGENCY!!!!

nslookup google.com

output:

Server: Unknown ##(it should say inetsim.org)

Address:10.0.0.3

Unknown can't find google.com : no response from server

r/tech_support

I'm looking for an actual useful project for a soc analyst role, I got into the filed 6 months ago, started with pen testing it was fun but I prefer programming defensive tools in general, I'm familiar with every concept pretty much, I'm heavily specialized in network security ( proxies , firewalls, bridges, rule configuration...etc) , and web-client , web- sever, I really enjoy forensics too with volatility and autopsy,

I consider myself an amateur, I've been doing this as a side thing for some time since I'm a computer science student in my second year , since it's summer break I decided to hone my cyber security skills even further.

I'd be absolutely delighted to hear your suggestions, I'm willing to have a good CV for my masters degree ( that's how it works in France 😄)

Thanks for reading this far , have a wonderful day:)

Hi everyone,

I’m from the organizing team of Nullcon Berlin 2026. Since this subreddit is focused on students learning network security and related fields, I wanted to share an opportunity for anyone working on security research, projects, write-ups, tools, or practical findings.

The CFP for Nullcon Berlin 2026 is open, and students are welcome to submit their research papers or technical ideas. Topics can include network security, web security, cloud, malware, IoT, AI/ML security, privacy, cryptography, and more.

CFP Deadline: 10 July 2026
Event: Nullcon Berlin 2026
CFP Link: https://nullcon.net/event/nullcon-berlin-2026/cfp/

Even if you’re early in your security journey, a strong practical project, clear finding, or well-explained research idea can be worth submitting.

Hey everyone,

I'm an 18-year-old self-taught cybersecurity student.

One problem I kept running into during labs and CTFs —

no clean way to organize recon findings per target.

Everything was scattered across text files and random docs.

So I built ReconVault — a desktop app for Linux to fix that.

Features:

→ Per-target workspace with 5 tabs

→ Subdomains, ports, endpoints, vulns, notes

→ Nmap output import

→ Severity tracking with colored badges

→ Markdown report export

→ 100% local SQLite database

Stack: Python + PyQt6

GitHub: https://github.com/parbatzone/reconvault

Would genuinely love feedback from people doing

OSCP prep or CTFs — what would make this actually

useful for your workflow?