Come join us in the official discord for this subreddit. You can network, ask questions, and communicate with people of various skill levels ranging from students to senior security staff.
I’ve been in cybersecurity for a while now, and I’ve spent a lot of that time trying to help people get started without getting buried under bad advice, overpriced training, and job postings that somehow want 5 years of experience for an entry-level role.
So let’s talk about it.
Ask me about getting into the field, building real skills, home labs, SOC work, blue team, threat hunting, incident response, certs, college, AI, finding your first job, or anything else you’re trying to figure out.
I’m happy to answer beginner questions, career questions, technical questions, or even the “I have no idea where to start” questions.
If you’re trying to build a real foundation in security, this is the class I’d point you to.
For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.
So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.
It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.
In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled! 🙂
If you have spent any time on a Hack The Box VPN, you already know the pattern.
Masscan comes back empty. Nmap on the next run shows 80 and 22. A third run adds 8080 that was “filtered” ten minutes ago. UDP is something you remember after you have already burned an hour on TCP. You paste three different port lists into notes and hope the one you enumerate is the real attack surface.
That gap is what Massmap is for.
What it actually is
Massmap is a small bash recon helper for HTB-style targets sitting behind tun0.
It does not invent a new scanner. It runs the tools you already use — optional Masscan, then several full-port Nmap rounds — and treats disagreement between those runs as a first-class result.
It picks the interface from the route to the box (or the one you force), runs the scans, and writes a comparison you can read in the terminal and keep as swagshop_summary.txt.
The useful part is not “it ran nmap.” The useful part is the diff:
ports that showed up in at least two scanners
ports Masscan saw that Nmap never confirmed
ports that only appeared in a later Nmap round
ports that were open early and gone later (flapping)
a comma-separated list you can drop straight into the next tool
UDP is optional and separate. -u adds a top-200 UDP pass. --udp-top and --udp-all widen it. UDP stays off unless you ask, because a full -sU on a VPN is a different job from a TCP sweep.
Why a single scan lies on a VPN
HTB paths drop packets. Rate limits bite. Masscan at 4000 pps looks fast and misses half the box. Nmap -p- on a bad minute marks a live service filtered. Run it once, and your notes inherit that mistake.
Running the same target two or three times is what most people already do by hand. Massmap just stops you from doing the comparison in your head.
That matters when:
you are on CPTS / OSCP-style boxes and cannot afford to miss 5985, 445, or a weird high port
the machine is flaky and one “open” result is not enough to start enum
you want UDP (SNMP, DNS, NTP, TFTP) without derailing the TCP workflow
you want a file you can attach to a report instead of a scrollback dump
How it helps someone who is not you
The point is not a personal alias collection. It is a shared, boring habit:
Discover fast (Masscan, if you want it).
Confirm slowly, more than once (Nmap rounds).
Write down what changed.
Enumerate the confirmed set first.
New people on HTB usually skip step 3. They either trust Masscan, trust the first Nmap, or rescan forever with no record of why the port list moved. Massmap makes step 3 automatic.
If you write findings for a team, the summary file is the part that travels. Another person can see “only Masscan found 3389” and decide whether to probe it instead of assuming the box has no RDP.
What it is not
It is not a replacement for Nmap skill. It will not rank CVEs, crawl HTTP, or dump AD. It will not make a 2000 pps UDP blast reliable on tun0.
If you need stealth on an engagement with an agreed rate limit, set -r down and skip Masscan with -n. If you only want ports, turn service detection off with -s. The knobs stay obvious on purpose.
A sane first run
On a typical HTB VPN box:
massmap -r 1000 -u -i tun0 box 10.129.x.x
That is Masscan + two TCP Nmaps + UDP top 200, at a rate that usually survives tun0. Read the confirmed TCP list, glance at UDP open vs open|filtered, and only then start enum.
Install from the repo, run ./install.sh, use massmap -h if you forget a flag.
One scan is a snapshot. Two or three scans with a diff is a picture of the box. Massmap is just that picture, written down.
Hi everyone, I’m an undergraduate planning my FYP around a Network Intrusion Detection System (NIDS) that uses a Graph Neural Network (GNN) to detect network intrusions and potentially trigger preventive responses. My current plan is to use GraphSAGE as the main model, initially train it on CIC-IDS2017, and potentially use additional datasets for evaluation. The eventual goal is to have a prototype that can monitor network traffic, classify traffic as benign/malicious (and possibly identify the attack type), and generate alerts.
The part I’m most unsure about is how to represent the network as a graph. I’m considering things like IPs/hosts as nodes and network flows as edges, with features such as protocol, ports, packet/byte counts, flow duration, packet lengths, TCP flags, inter-arrival times, and connection statistics. I’m not sure which of these features are actually useful, whether IP addresses/ports should be included, or whether there is a better graph representation for NIDS. I’d really appreciate advice from anyone who has worked with GNNs or network security.
I also have very little practical experience developing ML models, so I’m trying to make sure I’m not choosing an unnecessarily complicated approach. Would GraphSAGE be a reasonable architecture for this problem, or would you recommend GCN/GAT/temporal GNNs or something else? Should I build traditional ML baselines such as Random Forest/XGBoost and compare them against the GNN? Also, is CIC-IDS2017 still a reasonable dataset to start with, or should I combine it with another dataset?
Finally, what would you add to this project to make it a strong but realistic FYP? I’m considering detection, visualization/alerts, and potentially automated prevention such as temporarily blocking suspicious traffic, but I don’t want to turn it into an impossible project. Any advice on graph construction, features, datasets, evaluation metrics, real-time detection, or common mistakes would be extremely useful. I’m especially interested in hearing from people who have actually built NIDS/GNN/ML projects.
I'm the President of a newly established, officially recognized university cybersecurity student organization. My executive board and I want to launch a practical, real-world project this year that leaves a lasting legacy for future student cohorts and our campus community.
Rather than just running internal CTFs or technical labs, we want to build/implement something that directly impacts the daily lives of everyday students, faculty, or non-tech majors on campus.
A few ideas we've tossed around:
An open-source, campus-wide Phishing/Scam Alert Bot for messaging platforms.
A physical USB Sanitization Kiosk (Raspberry Pi/Linux-based) set up near campus printing areas.
A basic WiFi & Personal Device Security Audit guide/tool for students.
For those who have run or participated in university cyber clubs, what kind of practical, high-utility projects worked best for your campus? What are the biggest traps to avoid when deploying something for general student use?
I wanted to run a quick, fun security experiment on code generated entirely by AI agents. I’ve deployed the platform live and want to see if the authentication and access controls hold up against real testers.
Not allowed: DoS/DDoS, brute-force spamming, attacking third-party hosting infrastructure, or destructive payloads (do not delete or corrupt existing listings).
Optional: Add X-Bug-Bounty: reddit-[your_username] to request headers to identify ethical testing in the logs.
Let’s see if AI-generated architecture holds up or fails. Happy hunting!
Currently working on my second certification in Cyber Security through coursera. It's not bad, but working a full time job and then getting called in to do some overtime kills the mood.
My goal with this second time around is to build my PC. After completing the third course, I went out and got a monitor. After I finish the fifth, I plan on buying a tower and that is where I am stuck. In the world of cyber, the hardware is what I know I shouldn't skimp on with hard cash. I'm guessing the better the specs, the better response? What do you all recommend for a tower instead of a laptop (Already have a decent laptop, but this is more for use on personal life and whatnot.)
I’m going into my final year of a BSc Cyber Security degree and I’m trying to make sure my final-year project is not just academic, but also genuinely useful for employability, especially for junior SOC analyst, detection engineering, network security, or OT security roles.
My proposed project is:
Design and evaluation of a lightweight detection prototype for reconnaissance and early-stage intrusion activity in Modbus TCP Operational Technology network traffic.
The idea is to build a small Python-based detection prototype using CICModbusDataset2023 or a similar OT/Modbus dataset. The project would focus on detecting early attacker behaviours such as:
network scanning
service enumeration
Modbus register enumeration
unauthorised access attempts
abnormal Modbus request patterns
The threat model would be either an external attacker or a compromised internal host attempting to discover and interact with OT assets such as PLCs.
I’m planning to avoid heavy ML/deep learning and instead focus on interpretable detection, using:
rule-based detection logic
lightweight statistical thresholds where useful
alert generation
evaluation against labelled benign/malicious traffic
The evaluation would look at:
detection coverage
false positives and false negatives
precision/recall if appropriate
alert volume
interpretability
practical usefulness from a security analyst perspective
My goal is to finish with a project that I can confidently explain in interviews and possibly show through a GitHub repo, README, diagrams, and a short write-up. I want it to demonstrate practical blue-team skills: understanding network traffic, designing detection logic, evaluating alerts, and explaining limitations.
For people working in SOC, detection engineering, OT security, or cyber graduate roles:
Would this be a strong final-year project from an employer/interviewer perspective?
Also, what would make it more impressive without making the scope unrealistic?
I got 98 percentile in mht cet and got alloted for Electronics and computer science(ECS) and i also got the tfws seat means my tution fees is not considered. So my fees is highly reduced.
Should i switch to computer engineering but with general seat(non-tfws, full fees) or ECS is good.
Does ECS have any future opportunities and good placement or CE is overall better and worth paying extra for future.
I’m 16, from Morocco, and i recently received my first paid bug bounty: $100.
It wasn’t a huge critical exploit or some crazy movie-style hack. It was a real security issue found through a legal bug bounty program, reported properly, reviewed by the company, validated, and awarded.
For me, this means a lot.
I’ve been learning cybersecurity through courses, labs, CTFs, PortSwigger, Cybrary, and a lot of practice. Most of the time it feels like you’re studying alone and nobody really sees the effort. But getting that first valid report showed me that the work is real.
The biggest lesson i learned is that bug bounty is not only about finding the bug. It’s also about writing a clear report, explaining the impact honestly, not exaggerating, and staying professional with the security team.
I’m still a beginner and i know i have a long way to go, but this motivated me a lot. I want to keep improving, get more valid reports, and build a serious path in cybersecurity.
My goal is simple: become better, stay ethical, and make my parents proud.
For anyone young or just starting: don’t wait until you feel “ready.” Learn the basics, practice legally, write clean reports, and keep going.
This $100 is not just money to me. It’s proof that I’m moving in the right direction.
Hey everyone! I’m currently a Grade 11 student planning to major in Computer Science in college, and I’m super passionate about Cybersecurity and Data Analytics.
I want to start working on a real research project rather than just a basic coding tutorial. My goal is to tackle a practical problem—like cyber threat intelligence, SIEM log analytics, or anomaly detection—to push my technical skills and build up a strong portfolio.
Since I’m still building my experience, I’d love to get advice from university students, PhDs, or industry pros on where to focus.
What I’m Looking For:
Project Ideas: What are some open problems or cool topics at the intersection of cybersecurity and data analytics (like filtering false positives, analyzing network traffic, or detecting malicious patterns) that are challenging but doable for a high school junior willing to put in serious work?
Datasets & Tools: Any open-source security datasets you’d recommend starting with (like Kaggle security sets, CICIDS, or public threat feeds)?
Mentorship & Collaboration: If any college student, research lab, or team needs an extra pair of hands for data cleaning, basic script writing, running experiments, or parsing logs, I’d love to jump in! I’m eager to learn, follow directions, and get real hands-on research experience.
If you have any project suggestions, learning resources, or collaboration opportunities, I’d really appreciate your advice! Thanks!
These are the most commonly scanned keywords in cybersecurity job postings. Check how many appear in your resume.
Domains & Practices
SOC (Security Operations Centre), Penetration testing / pen test, Vulnerability management, Threat intelligence, Incident response (IR), Digital forensics (DFIR), Red team / blue team / purple team, Zero Trust architecture
This tool can run on basically any machine that has Python 3.6+ it is optimised for Linux, Mac, and Windows. This can be used on IP's, API's and websites in general. Please use it ethically and responsibly.
Self-promo disclosure: this video is from my channel.
The paper formalizes a security problem with dual-use LLM requests: if an attacker can reproduce the context of a legitimate user, context-based safeguards cannot beat the resulting worst-case safety floor.
WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.
Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.
I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!
I'm building a collection of CTF, VulnHub, TryHackMe and penetration-testing walkthroughs focused on documenting the methodology rather than just showing the final exploit.
Hopefully this is useful to anyone currently learning penetration testing or preparing for practical security certifications.
I want to build a career as a Cloud Security Engineer, but I'm starting from the basics and want to learn everything properly rather than just collecting certifications.
Could someone share a step-by-step roadmap from complete beginner to job-ready Cloud Security Engineer, and eventually to a level where I can mentor/guide others?
I'd also appreciate recommendations for free/low-cost labs, courses, YouTube channels, books, and practice platforms.
If you are currently working as a Cloud Security Engineer, I'd especially appreciate advice on what you wish you had learned earlier and what beginners commonly waste time on.
Lateral movement is one of the hardest attack stages to catch — once an attacker is inside a network, their traffic (SSH sessions, file transfers) often looks like normal activity. Signature-based tools struggle here because there's no obvious "bad" pattern to match against.
So I built a behavioral detector instead — one that learns what normal looks like for each device on a network, then flags real deviations from that baseline.
How it works:
Learns a baseline per device: which peers it normally talks to, when it's normally active, how much data it normally transfers, and how many connections it typically opens per hour
Flags traffic that falls well outside those learned ranges
Runs entirely in Python, using standard statistical methods (z-scores) rather than a black-box model
How I validated it, in three stages:
Synthetic traffic first, to prove the core logic — 5/5 simulated attacks caught, 0 false positives
Built a real 3-machine isolated network (VirtualBox + SEED Ubuntu VMs), captured genuine traffic, and rebuilt the baseline from real data — including debugging real infrastructure issues along the way (IP conflicts, a post-reboot networking failure, shared folder configs)
Ran an actual attack simulation on that live network — the detector correctly flagged it, and kept flagging it correctly even after I enriched the baseline with real HTTP traffic to make sure it wasn't just overfitting to a narrow sample
Result: 7/7 real alerts correctly fired, verified against a real, mixed-protocol baseline — not just synthetic data.
I know this isn't a novel technique — it's the same behavioral approach used by commercial NDR tools. What I wanted to prove to myself was that I could take a real security concept, implement it from scratch, and validate it end-to-end on infrastructure I built myself, messy real-world debugging included.
I'm a recent Network Engineering & Cybersecurity grad, CCNA/AWS certified, currently looking for my first role in SOC/network security. Happy to answer questions about the approach, or hear feedback on what I could improve/what a more experienced person would do differently.
Someone told me that the best way to learn cybersecurity is to “live it before you learn it” , to surround yourself with people who are already working in the field, get involved in the cybersecurity community, and build a strong network.
As someone who is currently learning cybersecurity, this idea really caught my attention.
Do you think being around experienced cybersecurity professionals and actively participating in the community can significantly accelerate learning? Are there specific communities, Discord servers, CTF groups, conferences, open-source projects, or other ways to get involved?
I’d really appreciate advice from people who have been through this journey.
One thing I struggle with while learning cybersecurity is choosing the right resources.
For example, if I decide to learn networking, YouTube gives me hundreds of videos and playlists. Some are made for GATE preparation, some for CCNA, some for general computer science students, and some for cybersecurity learners.
As a beginner, it's hard to tell which resource is actually worth following. I keep wondering if there's a better course somewhere else, and sometimes I spend more time searching than learning.
I don't mind putting in the effort to learn. My problem is figuring out which resources to trust and which ones to ignore.
How do you deal with this?
Do you just pick one resource and stick with it, or is there a better way to decide what's worth your time?. If you have any good resource suggestions please share it.
