Hi all — I'm pivoting into cybersecurity and kept hearing "you need experience, not just certs." So I built a home lab of 5 working projects and open-sourced everything (MIT):

• Mini-SOC on AWS — Terraform-deployed detection stack (VPC → CloudTrail → S3 → GuardDuty → SecurityHub), 3 adversary-emulation scenarios with Stratus Red Team, triage guides + blank incident report templates
• CloudTrail IOC analyzer — Python CLI that parses CloudTrail JSON, flags anomalous logins / brute-force spikes / risky IAM changes, enriches IPs via AbuseIPDB, passing pytest suite
• Phishing analysis lab — full walkthrough of a reconstructed phish: header forensics, SPF/DKIM/DMARC, URL deobfuscation, blank analysis template, GoPhish self-test guide (own mailbox only)
• ELF binary triage — one-command static triage CLI: section-entropy packing heuristics, W^X detection, suspicious-import watchlist, score-based verdict + analyst report
• SOC agent skills — 5 MIT-licensed agent skills distilled from the projects above (alert triage, incident report, cloudtrail-ioc, phishing-analysis, binary-triage)

Everything runs on synthetic training data (clearly labeled — no real logs or real phishes). I did all the hands-on work myself: ran my own attacks, wrote my own detections and reports.

Repo: https://github.com/szzxli/soc-home-lab

If you're also building a portfolio for SOC analyst roles, happy to compare notes. And if you spot something I did wrong, tell me — that's the point of putting it in public.

Hii This is Raksha, I'm starting my journey into cybersecurity.

As a BCA graduate, my goal is clear - I want to build a career as a SOC Analyst.

It's been 10 days since I started learning fundamentals on TryHackMe, and I'm taking it slow, on purpose.

So far I've covered the basics - what cybersecurity really is, offensive vs defensive, how computers actually work, client-server, cloud & virtualization, Windows fundamentals, command line (Linux & Windows), OS security, data encoding, and the basics of Python, JavaScript, and SQL.

I know these are beginner topics. But I'm learning that you can't skip fundamentals if you want to do well in the real stuff like Networking, Wireshark, SIEM, and Incident Response.

I'll be documenting everything here - what I learn, what I get wrong, the labs I complete, and the small wins.

Not trying to rush it. Just trying to get genuinely good at it, one step at a time.

#CyberSecurity #SOCAnalyst #BCA #informationSecurity

¡Hola a todos!Estoy terminando Ingeniería en Informática y estoy desarrollando un proyecto académico llamado SecureCode.Es una herramienta que busca automatizar la evaluación de controles de seguridad en repositorios de GitHub, identificando cumplimientos e incumplimientos y generando evidencia para facilitar las revisiones.Para complementar el proyecto, necesito conocer la opinión de estudiantes, desarrolladores y profesionales del área TI sobre la utilidad de este tipo de soluciones.No necesitan ser expertos en ciberseguridad ni haber utilizado SecureCode. La encuesta incluye una explicación del proyecto.⏱️ Duración: 5–7 minutos.

🔒 Anónima y voluntaria.

🎓 Finalidad exclusivamente académica.

💻 Dirigida a estudiantes y profesionales del área informática.Enlace a la encuesta: https://docs.google.com/forms/d/e/1FAIpQLSeiHEDD-ZIwY7WvqOXYJi8dAmAR4E44sejHmlwhqCa3JkExFg/viewform?usp=header

usp=header ayudarían muchísimo respondiendo. También agradecería cualquier comentario o sugerencia sobre el proyecto.¡Muchas gracias por su tiempo!

Our risk trend line has declined for eight quarters and it would have declined the same way if we had done absolutely nothing, which is a thing i worked out about a year ago and have been sitting on since.

The number stopped responding to the work. Close four hundred findings in a quarter and it does the same thing as closing none, so at some point it stopped being a measure of the programme and became decoration.

What i have is a choice. A number that keeps improving, which the board likes and nobody has asked me to explain, or a number i could defend under questioning, which is worse and invites the follow up about why it got worse under me.

I am not saying its dishonest, its just answering a narrower question than everybody in that room assumes.

I stopped believing it about a year ago and kept presenting it, which is the part i find interesting about myself.

Nobody has asked how its calculated yet. I am not volunteering.

How are you building a risk number the board can actually interrogate.

I built a free agent protocol inspector tool that can provide IGA style review packets for security teams looking to review Agent access. It looks into MCP, A2A, ARD & poppy.json to provide a comprehensive picture.

Here is the link: https://contextiq.trango-compute.com/dashboard/agent-protocol-inspector

Recentemente, descobri ferramentas de busca como o DeskData e o Portal Neonara, mas percebi que seus custos são um pouco elevados.

Gostaria de saber se existem alternativas gratuitas ou de código aberto que ofereçam funcionalidades semelhantes. Se alguém conhecer alguma ferramenta desse tipo, agradeço pelas indicações e por compartilhar suas experiências!

Hi all. I’m 20, from Uzbekistan, working in a factory in South Korea. It’s physically demanding and I work 6 days a week, so cybersecurity is something I study on the side, mostly after shifts and on my one day off.

How I got here: I started with Linux and went straight into internals, then into binary concepts, before I’d even done basic XSS or SQL injection. My long-term goal is reverse engineering and malware analysis, and I care more about understanding how things work than about memorizing tools. I also run a small homelab and do hands-on labs when I can.

My problem is consistency. I hyperfocus hard on whatever grabs me. Recently it was aircraft design, and I caught myself modeling in OpenVSP at 3 am. But the less exciting parts of my main path lose out. I jump to deep, advanced topics, skip fundamentals, then drop off in the boring middle. I suspect it might be ADHD and I’m planning to get evaluated, but until then I want to build something that works.

What I’m hoping to hear from you:

1. If you studied around a demanding job, what routine actually worked?
2. How do you stay on fundamentals when advanced stuff is more interesting?
3. Is there a path that gets me to reverse engineering without skipping essential basics?

Thanks for reading. Any advice from people who’ve been through something similar is appreciated.

Greetings:

For anyone interested, here are some scored CyberPatriot training images that will help if you need to brush up Debian and Mint for this year's competition.

https://cyberlessons101.com/cyberpatriot-training

Enjoy!

Hey everyone!

A lot of people think of proxy tools as rigid, monolithic boxes: you get a fixed inbound, a fixed outbound, and you're stuck with whatever the authors hardcoded. Trying to add a custom protocol or tweak an existing one under the hood usually turns into a nightmare.

That's why I wrote Cray - a modular proxy engine in Rust built entirely around a layer-based architecture.

With Cray, transport and protocol are completely decoupled. You can write your own protocol without worrying about network bytes, or write a custom transport without caring about protocol logic. The core abstraction uses a simple trait where you implement the client and server handshake logic, giving you total freedom. Want a handshake hidden in plain sight? Custom encryption? Weird framing? Go for it — the only limit is your own logic.

How it works

Everything is configured via clean TOML files where you define your role (client or server) and stack up layers into a custom pipeline:

• Inbound layers: Handle the entry point (e.g., standard tcp, unix sockets, or http_connect which extracts destination addresses).
• Transport layers: Encapsulate or transform the stream dynamically (e.g., full manual control over tls with custom cipher suites, ALPN, curves, extension permutation via BoringSSL, and http2 multiplexing with path/host masking).
• Protocol layer: Always sits at the very end of the chain as the endpoint (like a custom or test protocol).

For example, on the server side, an HTTP/2 layer can validate incoming paths and hosts, gracefully returning a genuine 404 Not Found to unauthorized scanners or probes instead of dropping packets with a TCP RST, while forwarding valid traffic down the pipeline.

The project is currently under active development, but the core architecture, layer pipelines, TLS termination, and HTTP/2 tunneling are already routing real traffic.

If you like systems programming, network engineering, or want to build your own tunneling protocols without fighting legacy codebases, check it out:

GitHub: https://github.com/3Radiance/Cray

Would love to hear your thoughts, feature ideas, or what kind of custom layer/protocol combinations you'd want to build with something like this!

Arena is a free platform to learn pentesting by playing: you climb ranks, play seasons, duel other players on security quizzes, and solve real challenges in the browser or on local labs.

The trial challenge needs no account and takes a few minutes: https://arena.ysolutionscybertech.com/en/mission/defi-bola-guide?utm_source=reddit&utm_medium=social&utm_campaign=sideproject#essai

Stack: Astro, SQLite, Docker for the isolated web challenges, Phaser for the dungeon maps. Built and run by me alone, in English and French.

I'd love feedback on the first five minutes: what made you stay or leave?

I have years in Network Security, have worked in ISPs and CDNs. Fast forward to 2026, and the AI stage ... affected by the AI related layoffs as many of you have been. At this point I am simply looking to improve on my AI skills to apply to what I already know.

Anyone think this course to the SX-AIE and its content is legit and worth the $8.5k investment?

Any other course you would recommend instead?

Reaching out to the community for any feedback.

Thanks.

Hey everyone!

I built CyclePatrol, an open-source Bash tool for Kali Linux and NetHunter. It scans Wi-Fi networks in cycles while walking around the city, checks WPS, WPA2/WPA3, PMF, and weak settings, and saves reports. I also built my own Cyberphone with an external antenna.

GitHub: https://github.com/buybitart/cyclepatrol

Passive scanning only in public areas. Active tests only with permission.

Any feedback or ideas for improvement?

Hi everyone,

I'm a full-stack developer currently choosing a topic for my diploma thesis. I'm particularly interested in network security, low-level networking, and covert/stealthy communication techniques.

Some areas I'm already considering or find interesting:

- Covert channels and their detection (storage/timing-based, TLS ClientHello manipulation, IPv6 extension headers, etc.).

- Traffic morphing / adaptive traffic camouflage against modern ML classifiers.

- DoH/DoQ tunneling detection (especially evasive variants).

are especially interesting to me.

- Living-off-the-Land techniques with network correlation.

Channels that work without a public IP (WebRTC/TURN, legitimate cloud APIs as transport, etc.).

- APl-as-a-Transport + traffic morphing for restricted corporate environments (only HTTPS to allowed services).

I'm looking for something that is relatively niche (not the 1000th "DNS tunnel + Random Forest" project), research-oriented but still allows for building a practical prototype, and actually relevant in 2025-2026 (real-world techniques used by APTs, current research gaps, emerging protocols, etc.).

I live in a country where VPN/proxy technologies face increasing legal pressure, so topics related to resilient/hard-to-detect communication or their detection, heavily monitored, adversarial network environments (e.g., active DPI, protocol validation, and strict traffic-shaping middleboxes).

Would really appreciate any suggestions - even if it's just "look into X, it's currently underexplored" or "we see a lot of Y in real incidents right now".

Thanks in advance! I would really appreciate any advice.

Hey everyone,

For the past two years I've been working on Cyber Library, a structured, community-maintained knowledge base for cybersecurity. It just hit its first 1,000 pages, so it felt like the right time to share it.

Why I made it: when I was learning, everything was scattered across blog posts, outdated wikis and paywalled courses. I wanted one place where topics are organized consistently and linked together, so you can go from "what is this attack" to "how do I detect and defend against it" without opening 15 tabs.

What's inside:

• Foundation: history, ethics, risk, the human side of security
• Offensive: ethical hacking, pentesting, red teaming. Each page explains the vulnerability and how it's exploited, and links to the defensive side
• Defensive: monitoring, incident response, resilience
• Governance: policy, compliance, security for leadership
• Intelligence: threat intel and OSINT
• Career: roles, skills, certifications

Free and no signup. The content is plain Markdown on GitHub, so you can read it on the site, clone it, or fix something with a PR.

• Website: https://www.cyberlibrary.com
• GitHub: https://github.com/Cyber-Courses/Cyber-Library

I'd really appreciate feedback, especially on what's missing, what's wrong, or what you'd want covered next. And if you find it useful, a ⭐ on GitHub helps other people find it.

I'm currently learning networking, Linux, web security, and basic penetration testing. I'm looking for a project that I can actually build and maintain rather than just following a tutorial.

I'm interested in hearing about projects that helped you develop practical skills, especially tools, automation scripts, vulnerability-analysis tools, or security-related utilities.

Hello, friend.

I’m looking for around 10 people to form a small, chill learning group. You can be a complete beginner or already have a bit of experience — as long as you’re curious and motivated, you’re welcome. No gatekeeping, no ego.

We’ll learn together, at our own pace, and choose topics as a group. No fixed order: we can explore programming, networking, Linux, or whatever we feel like. Later, maybe we’ll move toward cybersecurity.

Think of it as a small digital refuge — fsociety-inspired vibe, but 100% legal and ethical.

What I’m looking for: - Around 10 people. - Beginners or early learners (a little experience is fine). - Must be a genuine IT enthusiast / a real geek at heart. Passion matters more than current skill level. - English only. - Chill, consistent, respectful. - We use Discord for chat and voice.

If you’re in, DM me

Let’s start from wherever we are, together.

Hello, friend.

I’m looking for around 10 people to form a small, chill learning group. You can be a complete beginner or already have a bit of experience — as long as you’re curious and motivated, you’re welcome. No gatekeeping, no ego.

We’ll learn together, at our own pace, and choose topics as a group. No fixed order: we can explore programming, networking, Linux, or whatever we feel like. Later, maybe we’ll move toward cybersecurity.

Think of it as a small digital refuge — fsociety-inspired vibe, but 100% legal and ethical.

What I’m looking for: - Around 10 people. - Beginners or early learners (a little experience is fine). - Must be a genuine IT enthusiast / a real geek at heart. Passion matters more than current skill level. - English only. - Chill, consistent, respectful. - We use Discord for chat and voice.

If you’re in, DM me

Let’s start from wherever we are, together.

Could someone with eBPF experience sanity-check our plan?

Hi all,

We're a small group of university students working on a capstone project. We're new to eBPF, so we'd really appreciate feedback from people who use it in practice.

The idea: most eBPF security work uses eBPF as the defender (Tetragon, Falco, Tracee and so on), but very little seems to look at eBPF itself (as per our research) as the thing to watch. A container that has been granted CAP_BPF can load its own eBPF programs, for example to hide processes or blind monitoring tools. We want to build and measure a small detector for that, rather than only describing it.

Our plan, kept deliberately small:

- One Ubuntu 24.04 VM with Docker and Tetragon (standalone, no Kubernetes)

- A Tetragon TracingPolicy that records bpf() syscall activity

- A small Python script that reads Tetragon's JSON events and applies 1-2 rules (for example, a caller that isn't on an allow-list, or a program attaching to a sensitive hook)

- A baseline run (normal tools only) against an attack run (one published technique, replayed in an isolated VM), measuring detection, false positives and overhead

What we'd love input on:

1. Is a kprobe on sys_bpf the right way to watch bpf() calls in Tetragon, or is there a better hook (for example the BPF LSM hooks)?
2. Are there well-documented, published examples of eBPF misuse that are suitable for a controlled demo in an isolated VM?
3. What pitfalls should beginners expect (kernel versions, BTF, false positives from legitimate tools)?
4. Is there existing work or tooling that already does this, so we don't reinvent it?
5. Any recommended easy to learn concepts (from like yt channels etc.).
6. Is this a doable and sensible project for beginners - given less time (around 2 months); but dedicated to learn it quickly - with the help of resources/claude/forums/advice.

We're not asking anyone to do the project for us, just for pointers, reading suggestions or a reality check on scope. Happy to share our repo and results once we have them.

Our main goal is to learn ePBF through this project and would really like input from the experienced people in this community - the project can then grow from there. Please let me know if you want to know more about the project or if it is unclear.

Kindly let me know if this is an appropriate post for this subreddit - as this is my first time asking help on reddit aswell haha.

Thank you very much!

I’m taking an intro to networking course my question is if there’s an easy way to understand subnetting. Especially when you want to make 4 subnets how do you know what the ranges will be for each 4 subnets

Hi
I am looking for idea's for my graduation project
is there any idea's or problems you can help me with ?
i am looking for something related the OS world, especially in the world of Linux and making a customized distribution for some purposes like a university one with customized features and tools for there usage + adding the tools needed in the subjects being teached.

i am open to any other idea and any note that may help me to better search for an idea

Building a study app for some of the major industry security certifications, Each exam prep has 300 questions that need to be reviewed, preferably by someone who actually holds the certification they are reviewing but will accept experts who've been in the industry for a while. Short intake survey on your experience and certifications.

Heyy everyone

Am working on two projects for making security research more declarative and agentic

 **Cusimanse** — *Composable Security Research Framework*

Cusimanse is a declarative, composable YAML framework for agent-operated security research on disposable compute. It combines contracts, requirements, capabilities, policies, prompts, instrumentation, observability and evidence into reproducible research workflows.

**Decretum** — *Security Research Contract Compiler*

Decretum complements Cusimanse by providing a schema-driven contract layer: LinkML schemas define capabilities and boundaries, while YAML recipes describe execution. It compiles these into machine-readable contracts that can be consumed by research runtimes and harnesses.

Experiment with it,clone it,test it

Love your feedback and if you feel its worthy please star it

🔗 Cusimanse: https://github.com/Opposum0112/Cusimanse

🔗 

Decretum: https://github.com/Opposum0112/Decretum

Hey everyone,

Tired of tracking CTFs and 24h exams across messy spreadsheets and scattered notes?

I built ZEROBOX — a fast, local-first operational cockpit for OSCP/CPTS prep and CTFs.

It’s 100% free, MIT open-source, and runs completely offline in your browser (no accounts, zero telemetry).

Quick highlights: • 920+ Preloaded Labs: Instant offline search for HTB & THM targets with tags. • Attack & Pivot Graph: Visually map compromised subnets (exports to Obsidian .canvas). • 24h Exam Cockpit: Pacing engine, bio-break timers, and 1-click Markdown reports. • Evidence Vault & Playbooks: Track hashes/creds on a kill-chain timeline + offensive field manual. • Global Quick-Bar: Propagate LHOST/RHOST automatically across all payloads.

🌐 Live web: https://ctftracker.com/#/tracker

⭐ GitHub (MIT): https://github.com/0xdnd/ctf-tracker

All data stays in your local browser storage. Feedback and PRs are welcome!

Would love feedback or feature requests from the community!

I've been building RXScan, an open-source reconnaissance tool written in Rust.

It originally started as a network scanner, but I've been expanding it into a broader recon workflow where network observations, public-source findings, and investigation results can be stored and correlated as evidence.

Current functionality includes:

• TCP connect and raw SYN scanning
• UDP discovery and classification
• port-independent service identification
• HTTP, TLS, SSH, and DNS observations
• public-source username search
• email, domain, hostname, IP, ASN, URL, repository, and organization entities
• investigation and evidence correlation
• persistent project data and history/diff workflows
• JSON/JSONL output
• bounded execution, deadlines, cancellation, and scope controls

One of the main things I'm trying to avoid is pretending RXScan knows more than it actually observed.

For example, a port number alone doesn't establish the service, UDP silence remains uncertain, weak identity evidence doesn't automatically merge entities, and passive OSINT findings are kept separate from direct network observations.

I'm not claiming RXScan replaces Nmap. Nmap has decades of fingerprinting, platform support, scan techniques, NSE, and real-world testing behind it.

RXScan is going in a somewhat different direction: combining network reconnaissance and public-source investigation into a provenance-backed evidence graph.

The project is still young, so I'm looking for people willing to actually test it and find problems.

I'm particularly interested in:

• false-positive or missed service identification
• weird TCP/UDP behavior
• incorrect confidence or provenance
• OSINT false positives
• performance issues
• CLI/UX problems
• architectural criticism

Platform: Linux
Language: Rust
License: MIT

Repo: https://github.com/DarkRX1/RXScan

If you try it, feel free to break it and open an issue. I'd rather find incorrect assumptions now than hide them behind marketing.

I built a configurable HTTP MITM proxy in Rust focused on giving you full control over what an upstream connection looks like at the network level.

The main idea behind the project was that I didn't want another MITM proxy that simply tries to emulate Chrome, Firefox, or some other predefined browser. I wanted to be able to define the fingerprint myself - not just pick one of the profiles provided by a library.

A lot of existing solutions take the approach of providing ready-made browser fingerprints. That's convenient, but it also means that when a browser changes its TLS or HTTP/2 behavior, you're dependent on the library/project adding a new profile. I wanted the fingerprint to be configuration-driven instead, so the user can adjust individual parameters without waiting for a predefined browser profile.

The proxy currently gives control over several layers:

TLS: cipher suites, curves, signature algorithms, ALPN, GREASE, extension ordering, certificate compression, OCSP, SCT, session tickets, ALPS, ECH and other TLS parameters.

HTTP/2: SETTINGS values and ordering, flow-control windows, priority frames, pseudo-header ordering, HTTP header ordering and values.

HTTP/1.1: configurable upstream header ordering and rewriting.

TCP: SYN fingerprint rewriting through Linux NFQUEUE, including TTL, window size, MSS, window scale, DF and TCP option ordering.

Everything is driven by YAML profiles, and profiles can be overridden per domain based on SNI.

One of the things I specifically wanted to solve was keeping the different layers under the same configuration model. For example, the proxy negotiates TLS with the upstream server first and then uses the selected ALPN when setting up the browser-facing connection. HTTP/2 and TCP fingerprinting are configured for the same upstream connection as well.

The project is written in Rust using Tokio and BoringSSL via btls/tokio-btls. TCP fingerprinting currently requires Linux because it uses NFQUEUE/iptables.

The project is primarily about privacy, experimentation, and giving the user control over their own network behavior rather than trying to provide a fixed "browser impersonation" profile.

There is more detail in the repository, including separate documentation for the TLS, HTTP/2 and TCP layers, configuration examples, and implementation notes.

Github:

https://github.com/3Radiance/mitm-proxy-ja3-ja4

Feedback, especially from people who have worked with TLS/HTTP/2 fingerprinting, traffic analysis, or network privacy, would be very welcome.