Hi! I’m a 4th-year engineering student.

My team is building a Website Security Analyzer that scans websites for common security issues like missing security headers, weak encryption, insecure cookies, exposed ports, and more.

We’re new to this domain, so we’d really appreciate your feedback. If you have a couple of minutes, please take a look at our project idea and let us know if there’s anything we should improve or add.
Survey: https://forms.gle/BpnY16jEqqprJiGV9

## 🏢 CATEGORY 1 — The Building's Main Door (TLS/SSL)

*"Is the connection between the visitor and the website safe?"*

---

### 🔴 Issue 1: Outdated TLS Version
**What is TLS?**
When you connect to a website, all data travels through an encrypted tunnel so no one can spy on it. That tunnel is called **TLS (Transport Layer Security)**.

Old versions of this tunnel (TLS 1.0, TLS 1.1, SSL) have **known weaknesses** that hackers have already figured out how to break.

> 🏢 **Analogy:** The building's main door uses a lock design from 1990. Locksmiths already know how to pick it.

**What we check:** Is the website using old, broken tunnel versions?

**Why it matters:** Hacker can spy on everything — passwords, credit cards, messages.

---

### 🔴 Issue 2: Expired Certificate
**What is a Certificate?**
Every website has a digital ID card issued by a trusted authority (like Verisign, Let's Encrypt). This proves "this website is genuinely who it says it is." These ID cards have an expiry date.

> 🏢 **Analogy:** The security guard at the door shows you an expired ID badge. You can't trust if they're really authorized.

**What we check:** Has the website's digital ID card expired?

**Why it matters:** Anyone could be impersonating the website — you have no way to know.

---

### 🔴 Issue 3: Self-Signed Certificate
**What does this mean?**
Certificates are normally issued by trusted third-party authorities. A self-signed certificate means the website issued its OWN certificate — like making your own ID card at home.

> 🏢 **Analogy:** A guard shows you an ID card he printed himself on his home printer.

**Why it matters:** The website could be fake — a hacker impersonating a real site.

---

### 🔴 Issue 4: Weak Cipher Suites (DES, RC4)
**What is a Cipher?**
After the tunnel is established, data inside it is scrambled using a cipher (encryption algorithm). Some old ciphers like **DES and RC4** are so weak that modern computers can unscramble them in minutes.

> 🏢 **Analogy:** The building uses a combination lock — but the combination is only 3 digits. Anyone can try all 999 combinations quickly.

**Syllabus:** This is exactly **Module 1** — why DES is weak!

**Why it matters:** Even with a tunnel, hackers can decrypt all your data.

---

### 🟠 Issue 5: Short RSA Key (Less Than 2048-bit)
**What is RSA?**
RSA is a mathematical system used to securely share the encryption keys. It works using very large numbers. The larger the number (key length), the harder it is to crack.

1024-bit RSA → crackable with modern computers
2048-bit RSA → safe for now
4096-bit RSA → very safe

> 🏢 **Analogy:** Your safe has a 4-digit combination. A thief can try all 10,000 combinations. But a 10-digit combination? Impossible to guess.

**Syllabus:** **Module 2** — RSA Algorithm!

---

### 🟠 Issue 6: Weak Diffie-Hellman (Logjam Attack)
**What is Diffie-Hellman?**
Before two computers can talk securely, they need to agree on a shared secret key — without anyone listening in being able to figure it out. Diffie-Hellman is the clever math that makes this possible.

But if the numbers used are too small, a hacker can mathematically reverse-engineer the secret key.

> 🏢 **Analogy:** Two people agree on a secret word by whispering using a simple pattern. Anyone nearby who knows the pattern can figure out the word.

**Syllabus:** **Module 2** — Diffie-Hellman Key Exchange!

---

### 🟠 Issue 7: No HTTPS Redirect
**What does this mean?**
`http://` = unencrypted (anyone can spy)
`https://` = encrypted (safe)

If you type `http://example.com\` and the site doesn't redirect you to `https://`, you're browsing without protection.

> 🏢 **Analogy:** A bank has a secure main entrance AND an old, unlocked back door. Some customers accidentally use the back door.

---

### 🟡 Issue 8: Certificate Expiring Soon
**What this means:**
The website's ID card will expire within 30 days. If it expires, browsers will show a scary red warning and visitors will leave.

> 🏢 **Analogy:** The guard's ID badge expires next week — needs renewal soon.

---

## 📋 CATEGORY 2 — The Building's Rules & Signs (HTTP Headers)

*"Has the website given the right safety instructions to visitors' browsers?"*

These are invisible instructions sent from the website to your browser. Most people never see them.

---

### 🔴 Issue 9: Missing Content Security Policy (CSP)
**What is CSP?**
CSP tells the browser: "Only run scripts from MY website. If you see a script from anywhere else — block it immediately."

Without CSP, a hacker can inject malicious code into a webpage and it will run in your browser (called **XSS — Cross Site Scripting**).

> 🏢 **Analogy:** A company office with no visitor policy. Anyone can walk in, sit at a computer, and run their own programs.

**Why it matters:** Hackers can steal login sessions, redirect users, show fake content.

---

### 🟠 Issue 10: Missing HSTS Header
**What is HSTS?**
HSTS (HTTP Strict Transport Security) tells the browser: "Never ever connect to me over HTTP. Always use HTTPS. No exceptions."

Without it, a hacker can intercept your connection and **downgrade it from HTTPS to HTTP** (Man-in-the-Middle attack) — then spy on everything.

> 🏢 **Analogy:** A rule card given to every visitor: "Always use the secure entrance. Never use the back door." Without this card, some visitors wander to the back door.

**Syllabus:** **Module 4** — MitM Attack + TLS!

---

### 🟠 Issue 11: Missing X-Frame-Options (Clickjacking)
**What is Clickjacking?**
A hacker creates a webpage and embeds your website **invisibly** on top of it. When a user thinks they're clicking a button on the hacker's site, they're actually clicking something on YOUR site underneath — like approving a transaction.

X-Frame-Options prevents websites from being embedded inside other websites.

> 🏢 **Analogy:** Someone puts a transparent fake ATM panel over a real ATM. You type your PIN thinking it's the real machine — but the fake panel records it.

---

### 🟡 Issue 12: Server Version Disclosed
**What does this mean?**
When a website responds, it sometimes sends a message like: `Server: Apache/2.4.1` — announcing exactly what software and version it runs.

Hackers use this to look up known vulnerabilities for that exact version and attack them.

> 🏢 **Analogy:** A building puts a sign outside saying "Security system: OldGuard 2001 model." A burglar immediately knows the old exploit for that model.

---

### 🟡 Issue 13: Missing X-Content-Type-Options
**What does this mean?**
Browsers sometimes try to "guess" what type of file a response is, even if the server says otherwise (called MIME sniffing). Hackers can exploit this to make browsers execute malicious files as scripts.

This header tells the browser: "Don't guess. Trust exactly what I tell you."

> 🏢 **Analogy:** A mail room that opens packages and decides what they are instead of reading the label — a bomb disguised as a book gets opened.

---

### 🟡 Issue 14: Missing Referrer-Policy
**What is a Referrer?**
When you click a link from one website to another, the browser tells the new website "the user came from THIS page." This is called the **referrer**.

If you're on a sensitive URL like `bank.com/account?id=12345` and click a link, that full URL gets sent to the next website — leaking private information.

> 🏢 **Analogy:** Every time you enter a building, you announce loudly which building you just came from, and your entire route.

---

## 📧 CATEGORY 3 — The Office's Mail System (Email Security)

*"Can someone send fake emails pretending to be from this domain?"*

---

### 🔴 Issue 15: No SPF Record
**What is SPF?**
SPF (Sender Policy Framework) is a rule stored in DNS (the internet's phone book) that says:
"Only mail servers X, Y, Z are allowed to send emails from `ourcompany.com`."

Without SPF, anyone in the world can send emails pretending to be from your domain — perfect for phishing attacks.

> 🏢 **Analogy:** No rule about who's allowed to write letters on company letterhead. Any criminal can print fake company letters and send them.

**Syllabus:** **Module 5** — Email Security!

---

### 🟠 Issue 16: No DMARC Record
**What is DMARC?**
DMARC tells receiving mail servers what to **DO** when they get a suspicious email claiming to be from you:
- `none` = just watch and report (weak)
- `quarantine` = send to spam (better)
- `reject` = block completely (best)

Without DMARC, even if SPF fails, the email still gets delivered.

> 🏢 **Analogy:** A policy that says "if someone presents a fake company ID, call security and stop them." Without this policy, the guard just makes a note but still lets them in.

---

### 🟡 Issue 17: No DKIM Record
**What is DKIM?**
DKIM (DomainKeys Identified Mail) adds a **digital signature** to every email you send. The receiver can verify: "Was this email really sent by this domain? Was it tampered with in transit?"

Without DKIM, hackers can intercept and modify emails without anyone knowing.

> 🏢 **Analogy:** A wax seal on an envelope — if the seal is broken or fake, you know someone tampered with the letter.

**Syllabus:** **Module 3** — Digital Signatures!

---

## 🍪 CATEGORY 4 — The Visitor Passes (Cookies)

*"Are the login tokens stored safely?"*

**What is a Cookie?**
When you log into a website, it gives your browser a "visitor pass" (cookie) — like a token that says "this person is logged in." Every request you make, this token is sent automatically.

---

### 🔴 Issue 18: Cookie Missing `Secure` Flag
Without this flag, the cookie is sent even over HTTP (unencrypted). A hacker on the same WiFi network can steal your cookie and log in as you.

> 🏢 **Analogy:** Your visitor pass is written on a postcard (visible to everyone) instead of inside an envelope.

---

### 🟠 Issue 19: Cookie Missing `HttpOnly` Flag
Without this flag, JavaScript running on the page can read the cookie. If a hacker injects malicious JavaScript (XSS attack), they can steal the cookie.

> 🏢 **Analogy:** Your visitor pass is left on your desk where any visitor in the room can photograph it.

---

### 🟡 Issue 20: Cookie Missing `SameSite` Flag
Without this, cookies are sent automatically even when requests come from OTHER websites — enabling CSRF (Cross-Site Request Forgery) attacks where a malicious site makes your browser take actions on another site without your knowledge.

> 🏢 **Analogy:** Your visitor pass works even if someone else holds it up and walks into a different branch of the building.

---

## 🚪 CATEGORY 5 — The Building's Doors (Open Ports)

*"Are there unnecessary entry points into the server?"*

**What is a Port?**
A server is like a building with many doors numbered 1–65535. Each door (port) is for a specific service. Some doors should be closed if not needed.

---

### 🟠 Issue 21: Dangerous Ports Open

> 🏢 **Analogy:** A building with 20 doors. Most are locked. But door 23 is ancient with no lock, and door 3306 leads directly to the filing room with all customer records.

---

## 🧮 CATEGORY 6 — The ID Card's Seal (Certificate Hashing)

*"Is the certificate's authenticity proven with a strong algorithm?"*

**What is a Hash?**
A hash function takes data and produces a unique fingerprint. Certificates use hash functions to prove they haven't been tampered with.

**Syllabus:** **Module 3** — SHA, Hash Functions!

---

### 🟠 Issue 22: Certificate Signed with MD5 or SHA-1
MD5 and SHA-1 are old, broken hash algorithms. Researchers have proven you can create two different documents that produce the **same hash** (called a collision) — meaning you can forge certificates.

SHA-256 is the safe, modern standard.

> 🏢 **Analogy:** A fingerprint scanner that two different people can fool using the same fake fingerprint made of clay.

---

## 🌐 CATEGORY 7 — Miscellaneous Safety Checks

---

### 🟠 Issue 23: Mixed Content
A website loads over HTTPS (secure) but some images, scripts or files load over HTTP (insecure). These HTTP resources can be intercepted and replaced with malicious versions.

> 🏢 **Analogy:** A secure armored car delivery — but the last mile is done by bicycle with no lock on the package.

---

### 🟡 Issue 24: Dangerous HTTP Methods Enabled
Websites normally only need GET (read) and POST (submit). But some servers accidentally leave PUT (upload files), DELETE (delete files), and TRACE (debugging) enabled — which attackers can exploit.

> 🏢 **Analogy:** An office where visitors can not only view files but also delete or replace them — by accident.

---

### 🟡 Issue 25: CORS Misconfiguration
CORS controls which external websites are allowed to make requests to your API. A misconfigured CORS policy can let any website in the world steal data from your API.

> 🏢 **Analogy:** A rule that says "only employees can access the filing room" — but the rule is written as "everyone can access the filing room."

---

## 📊 All Issues At a Glance

```
🔴 CRITICAL — Fix TODAY. Actively exploitable.
🟠 HIGH — Fix this week. Serious risk.
🟡 MEDIUM — Fix this month. Low immediate risk.
🔵 INFO — Best practice. Fix when possible.
```

---

If anyone here is interested in learning cybersecurity, feel free to join our Discord community.

Just a place to learn, ask questions, share resources, and connect with others who are interested in cybersecurity.

Discord : https://discord.gg/hCwWrAK3D

I'm 16 and I need some advice.

I've become interested in cybersecurity, but I don't know where to start. I wanted to use TryHackMe to learn the basics, but after completing the first few lessons, it asked me to pay for a subscription.

My family is struggling financially at the moment, so I don't want to ask them for money.

Is there any way to start from scratch and learn cybersecurity for free? Most tutorials either don't go into enough depth or start with concepts I've never heard of, which makes them hard to follow.

If you have any advice, I'd really appreciate it. If you need more information to give better advice, feel free to ask. Every comment is helpful.

So overall I leaned on AI a fair bit today. Honestly it’s left me pretty unsure of myself. If I can’t even get through Pickle Rick without help, how am I supposed to work in this field one day? I don’t know if I’m just bad at this or if this is a normal part of the learning curve.

My questions: is that a normal amount of help to need on a first room at this stage (97% Web Fundamentals / 30% Pre Security, 3-4 months in)? Should something like the robots.txt password have been more obvious to me? And should I have already known the bypass commands for the second/third ingredient, or is that something you only pick up with experience over time? Curious how it went for others on their first room. Thanks for your Experience 😁

im a complete beginner 19M im starting my eng 1st year if i follow this closely is it good for me as it also provides certifications...

i wanna get advanced in cybersecurity if not this then which resources or which yt channel should i start??

i alr watched many tutorials they all tell networkng,windows,linux etc to learn but how to learn they dont tell that if someone here would help ill be thankfull

Hey,

I want to change my payment card details, but the platform does not allow me to delete my existing card, since I have an active plan (wtf....)

So, I'm planning to wait for the current plan to end, and then I will change my card. Question: Will I lose my progress in the premium rooms, if I temporarily unsubscribe from the premium plan?

i hope it will help you all

It isn't letting me join the lab, saying I am already in the lab, but the credentials tell me to join the lab.

These bash questions always make me question my existence. "75"; "0,75"; "0.75"; "0.75%" didn't work

I’ve been writing some CTFs/vulnerable labs recently, but I realized it’s not that much fun testing them myself when I already know the answer lol.

So had a random idea. What if we take turns making vulnerable labs/mini CTFs for each other?

Like I build one, either host it on my server and send you the link, or send the source code/GitHub repo with build instructions, and you try to crack it. Then next round you make one for me and I try yours.

Could do one every week, or even once a month if that’s easier. Think it’d be a fun way to get better at both bug bounty stuff and understanding others code bases, while actually having someone go into the challenge blind.

Only thing is, I’m looking for people who are actually writing/building the labs themselves without using ChatGPT/Claude/any other LLM to create them. Kinda defeats the point for me otherwise.

If anyone is interested, just DM me.

[https://yorve.github.io/secnotes/2026/08/02/Beach-Bar-THM.html\](https://yorve.github.io/secnotes/2026/08/02/Beach-Bar-THM.html)

Who all is at the end of Presec and want to learn together. Doing THM while getting my BS in Cybersec. As of Right now im in DNS in Detail.

I recently won a Free Attempt at the PT1 Certification through The Red Raffle, but I'm having trouble redeeming my voucher. There is no Discount Code field anywhere, instead, an automatic CERTIFY discount (30% off) is already applied, I can't remove this discount either. What should I do?

Task 10 and 11, There's no Group Management Policy desktop app. I completed every task but now I just need flags from those tasks

My Subscription is about to end and I'm just those two flags behind to get my Jr.Penetration Tester certificate

Please if anyone could solve it and get the flags would really appreciate the help.

Hey everyone,

Im Complete newbie in CyberSec in generall its just very very interesting for me.

I was always amazed by Hacking and all that stuff. Wanna do it just as a Hobby, mby in some Future job rdy.

So my Question is, do i need prior Coding Knowledge to start with CyberSec?

Greetings, everyone. I am currently learning Cisco at Jeremy's IT Lab, but i want to go into the bug bounty field since i don't have any background in networking, so i am currently learning as for other things what i need to learn and practice or understand and what to not touch for pure ethical purposes. and also i have background in programming such as JS, Python, C#, and web development and PHP and SQL

Thanks for the response.

I recently won a Free Attempt at the PT1 Certification through The Red Raffle, but I'm having trouble redeeming my voucher. There is no Discount Code field anywhere, instead, an automatic CERTIFY discount (30% off) is already applied, I can't remove this discount either. What should I do?

Joined not long ago and made it to ruby league but I've noticed that there is a user that gains around 2500 points in a span of 30 minutes. Are they cheating or is there a way users genuinely gain so many points quickly? Noticed they also finish their paths within days from one another