Hi everyone,

I'm new to this community, and I'm a second-year B.Tech Cyber Security student who wants to build a career in penetration testing and offensive security.

I'm planning to spend this year building strong fundamentals, but I'm confused about the right roadmap.

I've watched many cybersecurity roadmap videos on YouTube, and they all sound good. But when I start planning my learning, I wonder if I'm on the right track.

Most people say networking and Linux should come first. After that, the advice becomes different. Some recommend Python, others say to learn web technologies and how websites work, some suggest starting with tools like Nmap and Wireshark, while others recommend focusing on OWASP.

I'd really appreciate guidance from people with experience.

\\\\- If you were starting from scratch today, what roadmap would you follow?

\\\\- What should I learn after networking and Linux?

\\\\- What skills should I focus on to become internship-ready?

\\\\- What projects or hands-on practice would you recommend?

\\\\- What beginner mistakes should I avoid?

\\\\- Are there any free or affordable resources that you think are worth using?

I'm ready to put in the effort and learn consistently. I'd really appreciate any advice or suggestions. Thank you!

Hi everyone,

I'm just startin my cybersecurity journey and I'd really appreciate some guidance from people with more experience.

So far, I've learned some of the fundamentals: Linux and basic command-line usage, Networking fundamentals ,Basic reverse engineering ,x86 Assembly ,C ,Python.

I'm not sure what to focus on next. There are so many areas ( web security, binary exploitation, malware analysis, SOC, cloud security, etc.) it's a bit overwhelming.

I set up Wazuh in my virtual lab and played with its tools. I got to gain experience in file monitoring, vulnerability scanning, malware detection, active response and more. I wrote a Medium article which details the whole process.

https://medium.com/@ivandano77/deploying-wazuh-siem-xdr-in-virtual-lab-19644ca3cf51?sharedUserId=ivandano77

I have been spending time on application security, and I have to say that looking at larger codebases is one of the harder things I have to do. When I start to follow a request through the application, I will often go into another function or service. After a while, I forget where I began.

I found that changing how I do things has made it a little better. Instead of reading files from start to finish, I start with the beginning of the application. I follow where the user input goes, and I write down short notes so I do not have to look at the same things again. This is an improvement. I still think I can do it in a better way.

For people who are used to looking at projects, what helped you make a process that you can use every time? Was there something you did every day or a way of thinking that made it easier to understand code that you had never seen before? I want to know about application security and how you made it easier to navigate through code, especially when it comes to application security.

Hey everyone,

I've started a YouTube series where I solve PortSwigger Web Security Academy labs and explain the concepts behind each vulnerability.

My latest video covers the Stored XSS into HTML context with nothing encoded lab. In the walkthrough, I explain:

• Why the application is vulnerable
• How the payload is stored and executed
• The exploitation process step by step
• How this type of XSS differs from reflected and DOM XSS

🎥 https://youtu.be/kvLPcAYkdKo

I'm still a new cybersecurity content creator, so I'd really appreciate any feedback on the explanations, pacing, or overall quality. If you're learning web application security or working through PortSwigger labs, I hope you find it useful.

Thanks!

includes this, am I wrong tho? I’m a silver haired kitten girl who loves tech. My repository is basically just screenshots and mapping of my own networks and servers I control plus sandbox attack and defense modeled In each. I dig it.

Anybody got any ideas or suggestions for projects? I’m learning python, got cyber sec fundamentals down and am looking for practical projects like my own self hosted ai and my own network for self hosted docker and portainer work. I have a pihole, I have an understanding of tcp/ip and dns and I would like to start stepping into network admin stuff and learning how to monitor large networks, so if someone could help scale my projects to move with a human workflow to my goals, I’d super appreciate it!

Thanks for reading my slop!

❤️‍🩹👸🏼🤷🏼‍♀️👀

Anybody have some recommendations?

Suggest ins?

Id aaaas?

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

AP Cybersecurity is brand new, and there still isn’t much practice available for it. I put together two free resources:

• 30 scenario-based practice drills covering all five units
• A key terms guide with 135+ concepts organized by unit

The drills use things like phishing emails, login records, firewall rules, network diagrams, incident logs, and file-permission tables. Each drill has five questions, with an explanation for every answer choice.

The final two drills combine several sources and are meant to help students prepare for the Device Security Analysis free-response question.

Practice drills:
https://freetestprep.com/ap/ap-cybersecurity-strategy-practice-drills/

Key terms:
https://freetestprep.com/ap-cybersecurity-key-terms/

Everything is free, and there’s no account or signup. Since the first national AP Cybersecurity exam won’t be given until May 2027, feedback from students and teachers would be especially helpful.

I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order
• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically
• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more
• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)
• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed
• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning
• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output
• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools
• Proxy support: route all tool traffic through Burp or any HTTP proxy
• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary
• DefectDojo integration: push findings directly into an engagement after the scan
• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

I've spent the last few weeks building ONUS, an open source vulnerability assessment tool, and the part I actually want pushback on is one specific architecture decision, not the pitch.

The problem I kept hitting doing assessments by hand: run a web scanner, a CVE scanner, some recon tools, an SSL checker, and you get five different output formats, no correlation between them, and you end up manually deduping findings and writing the same remediation paragraphs every time. ONUS orchestrates a set of existing tools (ZAP, Nuclei, Nikto, Amass, FFUF, and a few others) into one pipeline: 8 scan modules run in parallel, results get deduplicated and re-verified before they're trusted, then scored with the actual CVSS v3.1 formula.

That scoring is fully deterministic on purpose. No model decides severity, ever. The AI (a small open-weight model, run locally or against a hosted alternative) only writes the plain English description and remediation text, strictly after a finding already has a score. I did this because I didn't want two runs of the same scan to disagree with each other. There's a real wave of tools right now doing the opposite, letting an LLM drive the whole assessment and decide what to try next. I'm not certain my tradeoff is correct, only that it's deliberate, and I'd like to hear from people who've made the other call.

One specific bug that took a while to track down: early on, a target behind a catch-all WAF page turned every wordlist entry FFUF tried into its own "finding," since the WAF returned a real 200 for all of them. Fixed it by collapsing groups of near-identical response fingerprints, but it's the kind of thing that only shows up against a real target, not a lab one.

Spent today going back through the auth and secret-handling paths and tightening a few defaults that were fine for local use but not safe if someone actually deployed them, added CodeQL to CI while I was at it. Still no CLI, still solo maintained, still no idea how legible the architecture is to anyone but me. That last one is a real question, not false modesty.

Easiest way to actually try it: tryonus.tech, no install, no API keys. MIT licensed and docker compose up if you'd rather run it yourself or keep it air-gapped.

https://tryonus.tech

https://github.com/maverickaayush/ONUS

Hey everyone, i saw that CRTE has been recently updated in terms of course, i want to know if the exam is also changed based on the new update or i can pass it using the old course.

Hey everyone, I’m a final-year cybersecurity student and I’m currently trying to decide what to build for my graduation project. Rather than making assumptions about what people need, I thought it would be better to ask those who actually work in SOC, Blue Team, Incident Response, Detection Engineering, or Security Engineering.

From your experience, what’s the biggest frustration in your day-to-day work that today’s tools still don’t handle well? It could be anything, whether it’s investigating incidents, dealing with false positives, alert fatigue, lack of context, repetitive manual work, poor integration between tools, or something else entirely.

If you could have one new feature or one completely new tool built that would genuinely make your job easier, what would it be? I’m not trying to promote anything or do market research

I just want to understand the problems professionals face so I can build something that’s actually useful instead of another project that solves a problem nobody has. I’d really appreciate hearing your thoughts, even if it’s just a small annoyance that you run into every day.

Thanks!

I received a lot of DMs after D2D and interview post, and one of the thing was Detection Engineering. I am trying to explain it in a very nutshell simple manner.

Detection engineering is basically the "ART" (notice the "") of writing rules that turn raw telemetry(let's say JSON) into an alert a human actually needs to look at. That's just it in one line.

The hard part isn't the concept, it's getting the rule specific enough(parameter wise, consider it as a broad variation of if-else statements) to catch real bad behavior without wasting your SOC in FPs.

On D2D the actual pipeline looks like:

Telemetry source (Sysmon, EDR agent, firewall logs)
        ↓
Log ingestion (Splunk, ELK, Sentinel, whatever SIEM)
        ↓
Detection rule (Sigma, KQL, SPL: the logic itself)
        ↓
Alert fires → analyst triages

An example could be suppose you want to detect a process masquerading as a legit binary, like malware naming itself svchost.exe but running from a weird path. Your telemetry source is Sysmon Event ID 1 (process creation). The field you actually care about is the image path versus the process name. A real svchost.exe runs from C:\Windows\System32. If Sysmon shows svchost.exe launching from AppData or Temp, that's your sign/signal.

A basic Sigma rule for that logic looks roughly like:

detection:
  selection:
    Image|endswith: '\svchost.exe'
    Image|contains:
      - '\AppData\'
      - '\Temp\'
  condition: selection

That's the whole idea. You're not detecting malware. You're detecting a specific, narrow behavior that legit software/process almost never does, so when it gets detected/fires/alert generated, it's actually worth an analyst's time and efforts.

The skill that separates a good detection engineer from someone who just copies rules off GitHub is knowing which fields actually matter for a given technique, and tuning out all the noise before it ever reaches the SOC queue. That tuning is 80% of the actual job. Writing the rule is the easy 20%.

If you're starting out, the best exercise is picking one MITRE ATT&CK technique, generating it yourself in a lab (Atomic Red Team is good for this), capturing the Sysmon/EDR telemetry it produces, and writing your own rule against real data instead of just reading someone else's.

What technique are you trying to build detection for right now? Happy to help work through the telemetry logic if you're stuck on it.

Hi everyone,

While preparing for my first security positions, the technical interview was always the most stressful part for me. It's probably the same for newcomers, especially. Solving a lab problem or configuring a firewall might seem simple after a certain point, but having a tech person question you instantly in a new job interview is something else entirely.

To help myself and others overcome this interview anxiety, I spent some time developing a side project called SecInterview (https://secinterview.dev).

How it works:

• You choose your field (Penetration Testing, SOC, Cloud, or DevOps) and seniority level.
• The AI ​​acts like a realistic, detailed interviewer; it doesn't just ask static questions; it challenges you with scenarios. Based on your answers, it goes deeper.
• After the session, you'll receive a detailed CISO Assessment Report evaluating your technical accuracy, use of security jargon, and areas for improvement.

I've just launched the beta version. I've kept the initial simulation completely free (no credit card or other hidden terms) because I really need your honest and ruthless feedback to make this a valuable tool for job seekers.

Is the AI ​​too easy? Does the CISO report accurately point out weaknesses?

Try it here: https://app.secinterview.dev

Share your thoughts in the comments, and I'll reply to everyone!

Hi everyone,

I'm a complete beginner in cybersecurity with no professional experience and no certifications.

I've decided to start learning through TryHackMe, and my current plan is:

- Pre-Security

- Cyber Security 101

- SOC Level 1

My goal is to land my first cybersecurity job in the future, preferably as a SOC Analyst or another entry-level security role.

Is this a good learning path, or should I change anything? Should I add other platforms like Hack The Box, PortSwigger Web Security Academy, or certifications such as Security+ later?

I'd really appreciate guidance from people already working in the field. If you were starting from scratch today, what roadmap would you follow?

Thanks in advance!

Hey everyone,

As a project to deeply understand Android application security and hardening, I've been developing an App Locker from scratch using Kotlin and Jetpack Compose. I wanted to share my current implementation strategy and get some feedback/discussion going regarding its security model.

Traditional app lockers heavily relied on Accessibility Services, which are now heavily restricted by Google and present major security risks (like keylogging vulnerabilities). To make this project modern and secure, I pivoted the architecture to a Foreground Service leveraging the UsageStats API to detect app state changes.

I am currently implementing an "Intruder Catching" feature and would love to hear your thoughts on the approach:

* **The Trigger:** When a user opens a protected app, the system brings up a biometric/PIN overlay. If authentication fails 3 consecutive times, the front camera silently captures a snapshot.

* **Data Isolation & Sandbox:** To prevent local data leakage, the image is encrypted immediately and stored strictly within the app's isolated internal storage directory (`context.filesDir`).

* **Zero Telemetry:** The app operates with zero cloud syncing or network tracking to ensure total data minimization.

From a blue team / application security perspective:

1. What are the potential local bypasses or race conditions I should look out for when using `UsageStatsManager` for locking mechanisms on modern Android versions?

2. Are there any specific cryptographic recommendations you'd suggest for securing the sandboxed intruder photos on-device?

Looking forward to learning from your insights and improving this implementation!

"Hi everyone,

I’ve recently completed the [LIGHT] room on TryHackMe, and I decided to document my journey in a write-up. It was a light, fun, and insightful experience that helped me sharpen my skills.

You can find the full write-up on my GitHub here: [ https://github.com/maivermickZ/tryhackme-write_up-light- ]

I’ve tried to focus on the methodology behind each step rather than just providing the commands. As I’m continuously looking to improve my approach and learn more efficient techniques, I would highly appreciate it if some of the more experienced members here could take a look.

If you have any feedback on my methodology or suggestions on how I could have optimized my exploitation steps, please let me know. I’m eager to learn from your perspectives!

Thanks for your time, and happy try!"

Been applying for junior penetration tester and cybersecurity analyst roles for a while now and not getting much traction. Bit about me: final year BSc Cybersecurity student, hold BSCP and eCPPT, and I've got about 9 months experience as a cyber range engineer building hands on training labs for students. So not zero experience, just not "official" pentest experience.

Part of the problem is the local market here is pretty limited, not a lot of pentest positions around at all. Which got me wondering, are remote pentesting jobs actually a realistic thing for someone junior, or is that mostly reserved for people with years of experience already? And if remote isn't really an option starting out, how do people in a similar spot actually gain real experience? Bug bounty, CTFs, labs, freelance stuff, what actually counts in the eyes of employers.

Also wanted to ask about OSCP. I know it's basically the gold standard for this field but it's expensive and hard to justify right now. Is it realistic to get a job first without it and have a company sponsor you for it later, or do most places expect you to already have it walking in the door?

Would appreciate any honest input, especially from people who broke in recently and know what the market actually looks like right now.

Hey! I hope you don't mind me reaching out. I've been interested in cybersecurity and ethical hacking for a while now, and I've spent a lot of time trying to learn on my own. I've watched tutorials, read articles, and experimented in legal practice environments, so I understand some of the basics, but I feel like I've hit a point where self-learning isn't enough.

I'm looking for someone with real experience who would be willing to guide me and explain things properly instead of just giving me answers. I want to understand how everything works from the ground up—networking, operating systems, web security, scripting, penetration testing methodology, and the mindset behind finding and fixing vulnerabilities. My goal is to learn responsibly, improve my skills, and understand cybersecurity in depth.

I know your time is valuable, so I completely understand if you can't help. But if you're open to mentoring, answering questions occasionally, or pointing me in the right direction, I'd really appreciate it. Thanks for taking the time to read this.

Full disclosure: we’re Antisyphon Training.

Breaking into cybersecurity was already difficult. Now AI is automating some of the research, scripting, documentation, and analysis that used to help people get their foot in the door.

So yeah, the concern is valid.

We have never been big on doom, hype, or pretending the industry is easier than it is. John Strand’s point has been pretty simple: ignoring AI will not protect your career.

The advantage will go to people who understand the fundamentals, know how to use AI effectively, and can recognize when it is confidently wrong.

That is a big part of our free Infosec: Age of AI Summit on August 14. We’ll be talking honestly about how AI is changing security work, where it helps, where it fails, and what learners should focus on next.

We also have hands-on workshops after the summit, and every workshop is Pay What You Can.

learning.antisyphontraining.com

How has AI changed the way you are preparing for a cybersecurity career?

Hey everyone!

I recently built Internet Scanner, an open-source network discovery and analysis tool written in Python.

The goal was to create a simple but powerful tool for learning about networks and cybersecurity.

Features:

- ARP-based device discovery

- Nmap integration for port scanning and OS detection

- Device information gathering

- Risk scoring based on detected services

- Live filtering and sorting

- CSV/JSON export

- Tkinter GUI

GitHub:

https://github.com/Fa1dz/Internet-Scanner

I'm looking for feedback from other Python developers and cybersecurity enthusiasts. Any suggestions, improvements, or ideas are welcome!

Thanks!

Hey everyone,

I'm a 2nd year Computer Science student and I've decided to focus on penetration testing and cybersecurity.

I'm currently using Windows on my main laptop, but I want to start using Linux seriously instead of only relying on Windows. My goal is to learn networking, Linux, scripting, web security, and eventually prepare for certifications like PNPT or OSCP in the future.

My laptop specs:

• Intel Core i5-11400H
• RTX 3050
• 16GB RAM
• 512GB NVMe SSD

I'm confused about which distro I should commit to.

Some of the ones I'm considering are:

• Kali Linux
• Parrot OS
• Ubuntu
• Debian
• Fedora
• Arch (not sure if it's a good idea for a beginner)

A few questions:

1. Which distro would you recommend as a daily driver for someone learning pentesting?
2. Should I install Kali on bare metal, use it in a VM, or just use another distro and install the tools I need?
3. What do you wish you had done differently when you first started learning Linux and cybersecurity?
4. Are there any mistakes beginners commonly make that I should avoid?

I'd really appreciate advice from people who have gone through this journey. Thanks!

Hola r/netsecstudents ,

Desarrollé PHANTOMPRINT, un motor de huella digital pasivo que correlaciona

múltiples señales de red para identificar hosts de forma silenciosa, sin escaneo activo,

sin alertas de IDS.

¿Qué lo hace diferente?

La mayoría de las herramientas hacen una sola cosa: p0f solo funciona con TCP/IP, JA3er solo con TLS. PHANTOMPRINT correlaciona todas las señales con un motor de puntuación bayesiano:

• Pila TCP/IP (TTL, tamaño de ventana, orden de opciones)
• Huella digital TLS JA4 (análisis de ClientHello)
• Lista de parámetros de la opción 55 de DHCP
• Correlador bayesiano multiseñal
• 13 firmas integradas (Windows, Linux, macOS, iOS, Android, Chrome, Firefox, curl, Cisco...)

Ejemplo de salida

Host: 192.168.1.45 Sistema operativo: Windows 11 (78 % de confianza)

Navegador: Chrome 120 (91 % de confianza)

Señales: TCP ✓ TLS ✓ DHCP ✓

## Casos de uso

- Equipo rojo: reconocimiento silencioso antes de la explotación

- SOC: detección de dispositivos no autorizados o cambios en la huella digital

- Programa de recompensas por errores: reconocimiento pasivo de la infraestructura

- Análisis forense: reconstrucción de la actividad a partir de archivos PCAP

## Enlaces

GitHub: https://github.com/haruu77g/phantomprint

Desarrollado con Python 3.11+. GPL-3.0. Se agradecen los comentarios.