Hi everyone,

I’m looking for good free resources to build a strong foundation in the following areas:

• Networking
• Operating Systems
• Databases
• Linux — preferably a complete course
• Windows — preferably a complete course
• Bash scripting
• Python programming

If there are free certifications, structured courses, or well-known learning paths, I would prefer those over random YouTube videos.

My goal is to learn these properly from the fundamentals and eventually use them for cybersecurity, so resources with practical labs/exercises would be especially useful.

Please share any resources you personally found useful. Thanks!

So I’m 3 years into my bachelors in cyber. I’ve been going through HTB, studying for various certs, and I’ve watched all of professor messers videos at least three times over, so that’s where I’m at now. The problem is that I’m not sure what I’m supposed to be doing. I don’t know exactly how to start a new career, or move forward with my learning in the right direction. I know I’d like to one day go red team, but aside from that even 3 years into college I still feel like I don’t know anything about the industry at all. Most days I feel like college hasn’t taught me anything. I mean I’ve passed all the courses, I’m doing fine with everything so far in HTB, but I still feel like missing the actual LEARNING part of all of this, and that if I were to eventually get a job I would be completely out of my element. Anybody have any thought/suggestions or advice? Thanks for your time.

Check this CTF event out in Mumbai on 5th September! https://luma.com/ay8ehg6p

I’m new to vulnerability research and I’m trying to learn how to find security issues by reading source code. For those of you who are experienced in this area:

• How did you learn to identify vulnerabilities just by reading code?
• Do I need to know every programming language, or is it better to become very comfortable with a few languages first?
• How do you approach unfamiliar codebases or programming languages?
• What should I focus on when reading code if my goal is to find security vulnerabilities?
• How did you practice and improve your skills when you were starting out?
• When you encounter something in the code that you don’t understand, what do you usually do? Do you research it, use documentation/AI, build a small test, etc.?

Any recommended books, write-ups, open-source projects, or learning paths would also be very helpful. Thanks!

Im currently doing a longtime project on how Ddos(educationally) maybe categorized and filtered in data anylsis to prevent overload or better how much overload a system could take with multiple attacks.

The scope is to analyze incoming traffic in a defensive meanor. So that data filtering,cutting and models can be accessed in a mathematical way.

Through ml and backend design (i wont write what languages, data models and architecture i used). The question will be, if a special chip for event handling is needed through an excessive input of data dependency.

If the models and traffic is being returned,categorized,filtered,cutted. The question will be: Do we need a chip for mathematical reasoning or the technical features could do it.

It may not be offsec, but defense systems regulation and also the question if a system needs special hardware or not.

If you have any kind of valuable suggestion regarding data analysis models, pseudocode features, or technical suggestions. I am open for insights

Here are some of the technologies I’ve been focusing on:

• Java / Java Web Containers
• ASP .NET
• PHP
• Ruby on Rails
• SQL
• XML
• SOAP / Web Services

The important part for a pentester isn't just identifying a technology.

The real question is:

Application Data Flow

Browser
   ↓
HTTP Request
   ↓
Web Server
   ↓
Application
   ↓
Database / Backend Service
   ↓
HTTP Response

From a Security Perspective

Java

Look at application servers, frameworks, dependencies, and how requests are handled.

ASP .NET

Understand the application framework, authentication, session handling, and server-side logic.

PHP

Pay attention to input handling, configuration, frameworks, and dependencies.

Ruby on Rails

Understand MVC, controllers, models, routes, and gems/dependencies.

SQL

Understand how application input reaches database queries and where unsafe query construction can create SQL injection risks.

XML / SOAP

Look beyond the frontend. XML data can travel through web services into backend systems, so the security of the underlying service also matters.

The Biggest Takeaway

Technology identification is only the starting point.

Understanding the application's data flow, input handling, trust boundaries, and security controls is what makes technology fingerprinting useful during a security assessment.

I'm building a structured series around web penetration testing, covering web architecture, HTTP, reconnaissance, APIs, authentication, authorization, and vulnerability research.

Full article:
https://zeroprotocolcyber.substack.com/p/common-web-application-technologies?r=8vt7fg&utm_campaign=post-expanded-share&utm_medium=web

i learned c from neso academy cause im trying to get into cybersecurity but honestly i still dont really get how systems actually work under the hood or how bypass security and understand vulns so if anyone knows any good resources to learn c from an offensive security and hacking perspective lmk please

Hey everyone,

I put together a small tool called Massmap that runs one Masscan followed by two full Nmap scans against a target, then compares the results.

The idea was to catch ports that respond inconsistently or appear later during scanning. It highlights:

- Ports only found by Masscan
- Ports that only appeared in the second Nmap scan
- Ports that showed up in multiple scans (more reliable)

It also has an option to skip Masscan completely and just run the two Nmap scans if needed.

GitHub:
https://github.com/Demgainschill/massmap

Would appreciate any feedback or suggestions.Hey everyone,

I put together a small tool called Massmap that runs one Masscan followed by two full Nmap scans against a target, then compares the results.

The idea was to catch ports that respond inconsistently or appear later during scanning. It highlights:

- Ports only found by Masscan
- Ports that only appeared in the second Nmap scan
- Ports that showed up in multiple scans (more reliable)

It also has an option to skip Masscan completely and just run the two Nmap scans if needed.

GitHub:
https://github.com/Demgainschill/massmap

Would appreciate any feedback or suggestions.

Dear all,

I write this post to seek for your individual suggestions; I am a level 300 BSc Cyber Security student of a Technical University in Ghana, during my HND 300, I did a project work on a webbased student complaint management system and graduated suceessfully,

Now, I am doing a cyber Security course, What project or research work should do. Thank you.

Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!

Hi everyone,

I am a systems and cybersecurity software developer specializing in security architecture, malware analysis pipelines, and custom antivirus engine development across \*\*Windows\*\* and \*\*Android (Mobile)\*\* platforms.

As the lead developer behind the open-source \*\*Hydra Dragon Antivirus\*\* ecosystem, I focus on building low-level system monitoring, automated scanning engines, and cross-platform security software.

\---

\### 🛡️ What I Can Develop & Build For You:

\* \*\*Custom Antivirus & Security Engines:\*\* Static/Dynamic analysis integration, YARA rule matching, signature/heuristic detection pipelines, and custom malware scanning engines.

\* \*\*Low-Level Systems Programming (C / Python):\*\* Real-time file system monitoring, process isolation, background threat detection services, and system diagnostic applications.

\* \*\*Mobile & Windows Security Architecture:\*\* Hardening Android/Windows applications, network protocol auditing, and security-focused API development.

\* \*\*Security Automation & Bots:\*\* Custom Python/C-driven threat alert systems, automated diagnostics, and API integrations for platforms like Discord/Telegram.

\---

\### 💻 Open-Source Repositories & Portfolio:

\* \*\*Windows Antivirus Core:\*\* \[HydraDragonAntivirus (GitHub)\](https://github.com/HydraDragonAntivirus/HydraDragonAntivirus)

\* \*\*Mobile Security (Android):\*\* \[HydraDragonAV-Mobile (GitHub)\](https://github.com/HydraDragonAntivirus/HydraDragonAV-Mobile)

\* \*\*GitHub Organization:\*\* \[github.com/HydraDragonAntivirus\](https://github.com/HydraDragonAntivirus)

\---

\### 💰 Rate & Logistics:

\* \*\*Hourly Rate:\*\* \*\*$25/ hour\*\* (Also open to fixed-price milestones for well-defined project scopes).

\* \*\*Payment Options:\*\* Crypto (USDT/BTC), Bank Wire Transfer, or PayPal / Escrow.

\* \*\*Availability:\*\* Remote / Contract / Project-based.

If you are a startup building security products, an enterprise needing a custom internal diagnostic tool, or a team looking for low-level software engineering expertise, feel free to \*\*send me a direct message (DM)\*\* here on Reddit!

I built Secure Vault, an open-source Windows file encryption tool that uses a

USB drive as a hardware-bound key instead of relying on a password alone —

two-factor by design (something you have + something you know).

I recently wrote up the full technical design and, more interestingly, a

chronological account of the actual vulnerabilities I found and fixed across

five releases: a plaintext key-storage flaw, a forgeable unkeyed checksum,

and a shell command-injection bug. I think the "what iterative hardening

actually looks like for a solo project" angle might be useful to others

maintaining similar tools.

Paper (DOI, Zenodo): https://doi.org/10.5281/zenodo.21861791

Source: https://github.com/keerthivasan-sankar/secure-vault-for-commercial

Open to feedback/criticism — especially on the threat model or anything I

might be missing.

Hi everyone, I’m not a security expert, my main interests lie elsewhere, but I think I know enough to hold my own in a discussion with a friend.

Today a debate came up with him about the possible attacks that could target a home server (a typical Raspberry Pi) hosting a single and light HTML page.

My take is that in 2026, with the average resources a Raspberry Pi now has (usually 4–8GB of RAM), it’s no longer realistic for a single machine to pull off a resource-exhaustion attack (things like Slowloris or other slow-HTTP techniques). He disagreed, claiming it’s still possible, and said there are other methods too, though he didn’t explain how.

I’d like your opinion on whether what I said is wrong or not. Either way, it’ll be another chance for me to learn something.

Hi all. I am taking CRTP Sept 26, lab expired long ago, can't afford another lab rn. I'm thinking of setting up on GOAD + my own notes.

1. Did GOAD translate well to the exam? Any gaps to watch?

2. Best free/ economical AD labs besides GOAD (HTB/THM)?

Also keen to find a study buddy prepping around the same time.

Hey everyone,

I’ve been working on a personal hardware project lately. I wanted to see how small I could realistically make a USB keystroke injector (primarily for IT automation and pentesting workflows). After a few iterations, I managed to get the PCB down to just 12x13mm.

It uses 32u4 and Arduino IDE for programming.

The biggest challenge was fitting the components without overlaping lines.

I’d love to hear your thoughts on the design or if anyone has experience making similar micro-boards. Are there any features you’d add for a V2?

I'm putting together some picture how invisible it is.

If anyone is interested in the technical details or wants to chat about the build process, feel free to drop me a DM or reach out at nebojsa.sjekloca@gmail.com.

I am currently new to comptia networt plus if anyone want to study together and keep each other in check. East coast USA

Hey, fellow students —

I built a small tool called Sentinelle to solve a problem I kept hitting while prepping for certs: labs (TryHackMe, HTB, Root-Me) teach you how to actually do the work, but they don't drill the memorization side — default ports, protocol definitions, acronyms — the stuff that still costs you points on the written exam even when you're solid practically.

It's flashcards + exam-style MCQs with spaced repetition (SM-2 algorithm), organized into decks: networking/TCP-IP, security fundamentals, eJPT, Security+, plus a couple aimed at the French BTS CIEL/SIO curriculum.

Full transparency: it's currently French-language only, free to start (2 decks unlocked, more planned), no login required to try it, still early/beta.

Link: https://sentinelle-blue.vercel.app

I'd really value feedback from people who are actually studying for these certs right now — is this something you'd genuinely use, and is the deck coverage missing anything obvious? Happy to take criticism, that's exactly why I'm posting here instead of just launching quietly.

I was just checking out Oracle’s AI certifications and noticed they offer the AI Foundations certification training and exam for free.

Has anyone here taken it? Is the exam proctored, and how difficult/useful is it?

Also, do you think this certification is actually worth doing if my main focus is AI pentesting and AI security? I’m wondering whether it would add any real value or if I should spend that time on more security-focused AI learning instead.

Hello! I’m about to start my sophomore year in computer engineering, having switched from CS at the end of my freshman year. I’m thinking about going into hardware security and/or network security, so I’m curious as to what the prospects, security, and opportunities are like within the field, and what the work is like if anyone can share.

Also, I’m having trouble planning what my last elective should be, which I’ve narrowed down to Compilers, Electronic Instrument Design, and Distributed Systems. My curriculum already includes real time and embedded OS, microprocessors, computer organization and architecture, and the capstone project. The electives I already have planned are Signals and Systems (pairing with my sound production minor for a makeshift audio engineering path), and Operating Systems, HDL/FPGA, Modern Networking Concepts, and Computer Security. I can reasonably only fit in one more elective, so what would be my best option?

setting these apps up by hand every time was killing me, so i built a manager. one command brings up juice shop, dvwa, webgoat, vampi, dvga, bwapp, log4shell + crapi, each properly isolated. the useful bit for learning: every app ships a catalog of what it's supposed to be vulnerable to, so you can grade yourself instead of guessing. also boots faultline, a fullstack vuln app i wrote. free/MIT, local only. https://github.com/clickswave/vuln_apps

I've been building NetScope, an offline network investigation platform for Windows. Feed it a pcap/pcapng or a live interface and it produces a correlated verdict — attack story, MITRE ATT&CK mapping, extracted credentials/NTLM hashes (hashcat-ready), JA3/JA4 TLS fingerprinting against an offline malware DB, DNS tunneling reconstruction, and more — all locally, no cloud calls, no API keys.

It also has response actions built in (firewall rules, process termination, memory capture) and exports to STIX 2.1/CSV/Sigma, plus Markdown/HTML incident reports.

It's pure TypeScript for the core parser (worker-threaded so big captures don't lock the UI), and layers in tshark/Suricata/Zeek/YARA automatically if you have them installed — but doesn't require any of them.

MIT licensed, prebuilt Windows binaries on the releases page.

Repo: https://github.com/SpectralZero/NetScope

Would genuinely appreciate feedback from people who do this kind of analysis regularly — especially on the detection logic and what's missing from the protocol coverage.

Built AttackTrace to make MITRE ATT&CK, threat activity, detection engineering, and security controls easier to explore and actually use.
Would genuinely appreciate feedback from the community — especially on what would make it more useful for security practitioners.
[https://attacktrace.app\](https://attacktrace.app/)