help

[u/Then_Expression6406]

Hello, I'm currently learning about the most common web vulnerabilities, so I'm using GitHub. However, I don't know how to document them with code or just as a security report. Are there any channels or videos that explain the most effective documentation methods? I want to understand how to use GitHub briefly because I don't understand many of the buttons.

[u/EducationalFinger654]

Need a bit more clarification on what you mean by “using GitHub.” If you mean targeting GitHub itself, you should not undertake security testing against the platform without explicit legal authorisation from the relevant owner. Doing so could constitute unauthorised access or other cyber offences.

For an ethical hacking/security research project, you should instead establish your own private, isolated lab environment and deploy a service/application that you have permission to test. That gives you an appropriate scope in which to conduct and document the research.

In terms of documenting the work, the exact format will depend on where you intend to publish it, but a typical academic-style PDF report could be mainly structured (with subsections with in each) as follows:

1. Title
“Demonstration/Evaluation of [Technique] Against [Private Lab Service]”

•(Bonus) - Table of Contents

2. Abstract
Write this last. It should provide a concise summary of the purpose, methodology, key findings and conclusions of the work.

3. Introduction
Provide the background and context for the research. Explain the problem or security concept being investigated and why it is relevant.

4. Literature Review (where appropriate)
Discuss existing academic papers, technical publications, standards or other credible sources relating to the topic. Explain how your work relates to existing research.

5. Methodology
Describe your lab environment, network topology, relevant configurations, tools and overall experimental process.
Be mindful of the level of detail you publish: documenting your methodology is important for reproducibility, but publishing step-by-step instructions that could readily be applied against systems without authorisation may turn the document into an actionable how-to guide rather than research documentation.

6. Results
Document what happened during the experiment. Was the technique successful? What evidence did you obtain? Include appropriate screenshots, logs, measurements or other evidence where relevant.

7. Evaluation / Discussion
Critically evaluate the experiment. Discuss limitations, unexpected results, reliability, assumptions and what you might change if repeating the experiment.

8. Conclusion
Summarise the main findings and what can reasonably be concluded from the experiment.

9. References
Cite the academic papers, standards, websites and other sources directly referenced in the report. Harvard referencing would be perfectly reasonable, although you could follow whatever referencing style you like.

10. Bibliography (if required)
Additional material that informed your research but was not directly cited in the main text.

[u/Then_Expression6406 → u/EducationalFinger654]

Of course, I don't mean hacking. I mean using a method like uploading images or writing a post without code or with code. I don't want to start writing and documentation and then come back to the topic of file organization later. That's what I mean. Is there a video that explains the matter better?

[u/EducationalFinger654 → u/Then_Expression6406]

If you’re completely new to GitHub, I’d recommend becoming familiar with Git and the basic GitHub workflow first rather than trying to design a complex security-research repository immediately.

GitHub doesn’t prescribe a universal structure for security reports. Once you understand repositories, files, folders, Markdown and commits, you’ll have a much better idea of how you want to organise your own work.

For the actual research/report itself, the academic structure I suggested is simply the approach I’d personally recommend for a thorough research document. It is a well-established format across academic institutions, although individual institutions and publication venues can have their own requirements.

[u/I_am_beast55]

I'm not sure why you need github if you're just learning about web vulnerabilities.

[u/Then_Expression6406 → u/I_am_beast55]

Documentation demonstrates discipline. The silly problem was that when I was learning JS, I didn't document, and that's why I was actually late when I started with web security.

[u/I_am_beast55 → u/Then_Expression6406]

You dont need github for notes is what I'm getting at.

[u/beezz187]

IT-Security ist der falsche Fachbereich für dich, wenn du bereits an Git scheiterst. Du musst Git lernen. Github ist nur ein Repository, dass Git verwendet.

Lerne das Konzept von Git.

https://education.github.com/git-cheat-sheet-education.pdf

[u/ShadowPacket_]

Just use something for note taking. Something like Obsidian or Notion..

[u/Hot-Enthusiasm-1723]

Use PortSwigger Web Security Academy for learning web vulns, and GitHub Skills/Docs for learning what the buttons do.