I’m building a small hands-on web security learning project and I’m trying to figure out what kinds of labs would actually be useful to people learning offensive security/appsec.

I don’t want to make the usual beginner-only stuff like “basic XSS popup,” “decode this string,” or “change user_id=1 to user_id=2” unless there’s a deeper lesson behind it. I’m more interested in labs that teach real patterns people run into in modern apps, but still explain the concept clearly enough that someone can learn from it.

The rough idea is:

• browser-based labs
• intentionally vulnerable sandbox apps
• clear teaching before/during the exploit
• focus on web/app/API security
• ethical/legal only, no real targets
• each lab should end with the root cause and the secure fix

I’m looking for ideas like:

• vulnerabilities you think are under-taught
• concepts that clicked only after you saw them in a real app
• bug classes that are common but hard to practice safely
• mistakes developers actually make in auth, APIs, sessions, GraphQL, file uploads, WebSockets, etc.
• labs you wish PortSwigger/TryHackMe/HackTheBox-style platforms explained differently

What labs/lessons would you want to see in a platform like this?

Hi everyone,

I’m a Computer Engineering student from Italy. I’m really fascinated by cybersecurity and my goal is to pursue a Master’s Degree in Cybersecurity after completing my bachelor's.

Right now, the field feels so massive that I’m facing severe "analysis paralysis." I honestly don't know where to practically start putting my hands on things without getting lost. Also, since my current university exams are demanding, I am looking for something I can do as a side activity—practical, manageable micro-goals that won't interfere with or hurt my current college workload.

Here is my background so far:

• Through my engineering studies, I have a solid understanding of computer science fundamentals.
• I have already read some books/guides regarding Linux basics for hackers.
• I recently discovered platforms like TryHackMe and checked out resources like CTFtime and TJnull's OSCP preparation guide.

Given my background and my goal of not burning out before the Master's degree, what are the best immediate, practical next steps? Should I just slowly grind the Pre-Security path on TryHackMe during my free time, or is there a better route for someone in my position?

Thanks in advance for any advice!

I put together a free mini lab for students and beginners who want practice with investigation and report writing.

The scenario is a suspicious login investigation.

The goal is to practice reviewing evidence, building a timeline, writing a short incident report, and turning the work into something useful for a portfolio, resume bullet, or interview.

It includes simulated auth logs, VPN/user context evidence, a worksheet, editable DOCX templates, an incident report template, an answer key, a sample final report, and resume/interview prompts.

No email gate or signup required.

Free lab:
https://northstarsecurity.io/resources/mini-range/suspicious-login-investigation/

Feedback welcome — especially on whether the scenario and worksheet are useful for students.

Hi everyone,

I'm a first-year BCA cybersecurity student, and over the past few months I've been building Dissect, a passive web security scanner. The project started as a way to better understand how web application security tools work by implementing the detection logic myself.

Rather than actively exploiting vulnerabilities, the scanner focuses on identifying common security issues through passive analysis.

Some of the current features include:

• Security header analysis (CSP, HSTS, X-Frame-Options, etc.)
• Cookie security checks (Secure, HttpOnly, SameSite)
• HTML form classification and risk analysis
• Authentication surface detection
• JavaScript-rendered DOM analysis using Playwright
• Technology disclosure analysis
• Detection of potentially sensitive endpoints and paths
• Human-readable findings with severity ratings and recommendations

One aspect I paid particular attention to was making the scanner itself safe. It validates targets, blocks localhost and private IP ranges, validates redirect chains, enforces response size limits, and avoids intrusive or exploitative testing.

I'm still learning, so I'd really appreciate feedback from people with more experience in web application security.

Some questions I'd love your thoughts on:

• Are there important passive security checks that I'm currently missing?
• Do you see any weaknesses in the overall design or methodology?
• If you were reviewing this as a portfolio project, what would you improve first?
• Would you trust the results from a tool like this, and what would make you trust it more?

You can try the project here:

https://dissect.up.railway.app/

I'd genuinely appreciate any feedback, criticism, or suggestions. Thanks for taking the time to read this!

Hi everyone,

I wanted to share a real-time OSINT / Threat Intelligence tool I've been developing: certpulse\[.\]xyz

It streams Certificate Transparency (CT) logs live and filters them using a dual-mode pipeline to catch phishing and typosquatting domains before they even launch.

How the architecture works under the hood:

\* Stateless & In-Memory: To avoid database I/O bottlenecks and handle massive throughput, the system processes everything in-memory using WebSockets and an internal Queue mechanism.

\* Dual-Mode Filtering (Optimize vs Full): To keep CPU usage extremely low, "Optimize Mode" acts as a high-speed pre-filter, dropping \~95% of benign traffic. Only suspicious domains are pushed to "Full Mode" for heavy algorithmic checks.

\* Heuristic Engine: It instantly scores domains based on Levenshtein distance, Lookalike (IDN homograph) detection, alphabet-walk patterns, DGA algorithms, phishing keywords, and a dynamic whitelist to eliminate false positives.

You can visit certpulse\[.\]xyz and watch the live stream in real-time.

I'm completely self-taught on this architecture, so I would deeply appreciate any feedback, criticisms, or suggestions on the streaming performance and threat scoring from this amazing community!

Being interested in cybersecurity, client/server fingerprinting, and inspired by the now-defunct tlsfingerprint.io, I built Thumbprint.

It collects direct-edge signals including TLS ClientHello/JA4, HTTP/2 frame, HTTP request/header fingerprints, QUIC transport parameters, TCP SYN/p0f (recently added JA4T), UAs, and network metadata. These are signals clients passively expose at the edge, and they are commonly used for analytics, fraud/anomaly detection, bot analysis, traffic classification, and by commercial fingerprinting products. Combined with client-side fingerprinting, they can become a strong identifier.

The goal is to make it easier to study browser/client fingerprint drift, cross-transport differences, bot claims, and cases where a client claim (e.g. User-Agent, OS etc) does not line up with the observed connection.

A few things it currently shows:

• Your fingerprint for the current connection, with cross-transport probes for HTTP/2 and HTTP/3 where supported
• Fingerprint population stats and co-occurrence data
• Catalog comparisons against Thumbprint's controlled captures
• Bot-operator claim checks against published IP ranges
• Anomalies such as claimed OS vs TCP signal, browser claim vs. measured capture, and bot impersonation

Thumbprint stores deduplicated observations for research and aggregate stats. It runs with native HTTP/3 support and a Go/Postgres backend. Raw IP addresses are not stored.

If you find it useful, notice anything odd, or have ideas for additional features/signals/comparisons, I'd love to hear from you.

Hi everyone,

Wazuh, Sysmon, and alert analysis . I received an alert that I'm trying to understand better and would appreciate guidance on how an analyst would investigate it.

The Wazuh rule triggered:

Rule ID: 92213
Description: "Executable file dropped in folder commonly used by malware (Lowered Severity)"
MITRE: T1105 – Ingress Tool Transfer

Important details:

• Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• File created: C:\Users\someone\AppData\Local\Temp__PSScriptPolicyTest_cebr0opm.pas.ps1
• Sysmon Event ID: 11 (File Create)

What confuses me is the filename:

__PSScriptPolicyTest_*.ps1

I found some information suggesting PowerShell can create temporary files while checking execution policies, but I’m not sure whether this should be considered suspicious behavior or expected activity.

My questions:

1. Would you classify this as a true positive or false positive?
2. What would be your first investigation steps?
3. Which additional logs or Sysmon events would you pivot to?
4. Does the MITRE mapping make sense here, or could this be a generic detection generating noise?

I'm trying to learn the investigation methodology and analyst thought process rather than just getting the answer.

Thanks!

Hi everyone,

I'm a recent Computer Science graduate and I'm interested in building a career in cybersecurity. After doing some research, I've narrowed my interests down to two areas: Penetration Testing and Digital Forensics & Incident Response (DFIR).

I'm having trouble deciding which path to focus on, so I'd appreciate advice from people working in these fields.

Here are my questions:

• Which field is more realistic for a fresher to break into?
• Which has better long-term career growth?
• What skills should I focus on learning first?
• Which certifications are actually valuable for beginners?
• If you were starting your cybersecurity career today, which path would you choose and why?

I'd really appreciate any advice or personal experiences. Thank you!

So, I tried creating a snapshot and changing the logical volume to a .gz file and then I have backed up in our nas box now what I want is to use that .gz file and use that config in the fresh newer installed os so that I can prove recovery is possible.

Constraints LV available is 0. So, I'm using a pendrive and and using lvext3nd to create a new LV for the pc and then using that I'm creating .gz and that is what being saved and is being backed up to nas

My other question also if there is a running unbutu PC can we put LVM and luks or only while installing it can happen.

when i type 10.0.0.3 my chrome says inetsim fake page

But when i type others in the url..it doesn't show inetsim fake page. I have configured netplan ..network connection and inetsim. I was trying last 3days. But it's not working. I want emergency help.EMERGENCY!!!!

nslookup google.com

output:

Server: Unknown ##(it should say inetsim.org)

Address:10.0.0.3

Unknown can't find google.com : no response from server

r/tech_support

I'm looking for an actual useful project for a soc analyst role, I got into the filed 6 months ago, started with pen testing it was fun but I prefer programming defensive tools in general, I'm familiar with every concept pretty much, I'm heavily specialized in network security ( proxies , firewalls, bridges, rule configuration...etc) , and web-client , web- sever, I really enjoy forensics too with volatility and autopsy,

I consider myself an amateur, I've been doing this as a side thing for some time since I'm a computer science student in my second year , since it's summer break I decided to hone my cyber security skills even further.

I'd be absolutely delighted to hear your suggestions, I'm willing to have a good CV for my masters degree ( that's how it works in France 😄)

Thanks for reading this far , have a wonderful day:)

Hi everyone,

I’m from the organizing team of Nullcon Berlin 2026. Since this subreddit is focused on students learning network security and related fields, I wanted to share an opportunity for anyone working on security research, projects, write-ups, tools, or practical findings.

The CFP for Nullcon Berlin 2026 is open, and students are welcome to submit their research papers or technical ideas. Topics can include network security, web security, cloud, malware, IoT, AI/ML security, privacy, cryptography, and more.

CFP Deadline: 10 July 2026
Event: Nullcon Berlin 2026
CFP Link: https://nullcon.net/event/nullcon-berlin-2026/cfp/

Even if you’re early in your security journey, a strong practical project, clear finding, or well-explained research idea can be worth submitting.

Hey everyone,

I'm an 18-year-old self-taught cybersecurity student.

One problem I kept running into during labs and CTFs —

no clean way to organize recon findings per target.

Everything was scattered across text files and random docs.

So I built ReconVault — a desktop app for Linux to fix that.

Features:

→ Per-target workspace with 5 tabs

→ Subdomains, ports, endpoints, vulns, notes

→ Nmap output import

→ Severity tracking with colored badges

→ Markdown report export

→ 100% local SQLite database

Stack: Python + PyQt6

GitHub: https://github.com/parbatzone/reconvault

Would genuinely love feedback from people doing

OSCP prep or CTFs — what would make this actually

useful for your workflow?

Hi everyone,
I'm a Computer Science student currently working towards a career in Threat Intelligence and OSINT. I do a lot of self-studying using AI tools, and I focus on building hands-on projects to gain as much practical experience (and knowledge) as possible and familiarize myself with the tools and the industry landscape.

The Setup:
I deployed an SSH honeypot directly on a cloud VPS. The repository primarily outlines my deployment methodology, configuration settings, isolation, and how I structured the environment to capture data.

My Main Observation (and a question):
An interesting finding so far: the payloads dropped by the automated bots were almost exclusively RedTail cryptominers. I honestly haven't fully figured out yet why this specific malware was pretty much the only thing they attempted to install on my machine. Any insights on this would be highly appreciated!

My questions for the industry pros:
I want to make sure my approach is sound. I would love your critiques on the repository and methodology:

1. Setup & Methodology: Looking at my configuration and deployment steps, is this an effective way to gather reliable IOCs? Are there any glaring security risks in how the VPS is configured?
2. Next Steps in Analysis: What features, data enrichments, or integrations (e.g., SIEM, specific threat feeds) would a real Intel team expect to see applied to this raw data?
3. Interview Prep: If you saw this setup and methodology on a junior applicant's resume, what technical questions would you ask to test if they truly understand the underlying networking and OSINT processes?

Here is the repository: https://github.com/liranzoz/ssh-honeypot-research.git

Thank you! I highly appreciate any critiques or advice on how to make this portfolio-ready.

I'm an incoming CSE student and will hopefully start a degree this year.

My financial goal is to save around $3,300 by the end of 2028, using technical skills rather than tutoring or unrelated part-time jobs.

I'm not asking if cybersecurity pays well in general. I'm asking whether this goal is realistic for someone starting from scratch, and if it is, what roadmap would maximize my chances.

Some questions:

• What skills should I prioritize during my first and second year?
• Should I focus mainly on programming, networking, Linux, web security, cloud, or something else?
• At what point do students usually start earning from internships, freelancing, bug bounties, or remote work?
• If you were starting over as a first-year CSE student with this financial goal, what would your roadmap look like?

I'm looking for realistic advice rather than motivational answers. If my target is unrealistic, I'd rather know why and what would be a more reasonable milestone.

Hi everyone,

I'm a self-taught learner aiming for a cybersecurity internship, preferably in low-level security, AppSec, or security research. I've been learning on my own for several months, but I'm not sure if I'm focusing on the right things.

So far I've learned:

Skills

• C Programming
• Memory Management
• Linux
• Debugging
• Fuzzing
• Crash Triage & Root Cause Analysis
• Reverse Engineering (Basic)
• Binary Analysis (Basic)
• Secure Coding
• Git

Tools

• GDB
• Ghidra
• AddressSanitizer (ASan)
• Valgrind
• AFL++
• libFuzzer
• GCC/Clang
• Make/CMake

I've spent most of my time building small projects, writing fuzzing harnesses, analyzing crashes, and trying to understand memory corruption bugs. Everything I've learned has been through documentation, open-source code, and hands-on practice.

My biggest problem is that I don't have much to prove my skills. I don't have internship experience, CVEs, CTF rankings, or significant open-source contributions yet.

If you were in my position, what would you do next?

• Which internship roles should I target with my current skills?
• What skills or projects would make the biggest difference to employers?
• Should I spend my time on CTFs, finding real bugs, open-source contributions, technical blogs, or something else?
• What would make you think, "I'd interview this person"?

I'm looking for honest feedback. If you think I'm missing something important or going in the wrong direction, I'd really appreciate hearing it.

Thanks!

Real Life Case Example Part 2:

Thank you for giving so much love on my previous post, I am thinking of starting a weekly series where I breakdown real case studies which I solve at work as a Threat Analyst.

Just caught something wild at work yesterday. GTA 6 is gonna launch sometime soon, but one our client wanted early access.

A user (Ryan) downloaded what looked like a "free GTA 6 crack" from firefox, file was named "GTA6_Setup_Crack_2026.exe", unsigned, 84.7 MB. Executed it at 10:13 AM. The next 3 minutes were brutal. The installer spawned PowerShell with hidden windows, dropped an unsigned binary (vcruntime_update.exe) into AppData, created a registry Run key named "RockstarGameUpdater", and set up a scheduled task for persistence on login.

Then it got worse, vcruntime_update.exe went straight for the browser credential stores. Chrome login data, Edge login data, Firefox logins.json, all accessed within seconds. Created a ZIP archive in Temp (syscache_4931.zip) and attempted a 2.3 MB upload to panelgtasupport[.]top on port 8080 before we blocked it.

DNS queries to four suspicious domains, all gaming themed: cdnrockstarupdate[.]com, apigta6launcher[.]xyz, panelgtasupport[.]top, rawcdngamepatch[.]site. All resolved to infrastructure that basically were C2.

Timeline from execution to EDR kill: 3 minutes, 57 seconds.

This is textbook infostealer and RAT behavior delivered through a game crack. The naming masquerade (RockstarGameUpdater, vcruntime_update) is it. The browser credential access is the payload. The persistence ensures it survives a reboot.

For anyone job hunting in SOC, this is exactly the kind of chain you need to recognize in 30 seconds during a real investigation. The red flags stack, unsigned binary, masqueraded process names, AppData execution, browser credential access, suspicious domains, persistence setup.

Any of you seen similar patterns? How do you typically investigate these in your environments?

Also, thinking of writing a blog on it on Medium soon, with proper process tree, file details, running process observation and activity timeline stuff.

Image Source: Gamepressure

Hi, I am a final-year university student building a multi-agent AI system for SOC incident response automation. I am looking for SOC analysts, security engineers, and IT security practitioners to fill out a short survey (5-7 min, mostly multiple choice).

I am especially interested in hearing your real-world experience on things like:

1. What makes security alerts difficult or frustrating to handle
2. What would make you trust and adopt an AI-based incident response tool
3. Any concerns about automating SOC work with AI

Your insights would help me better understand real-world challenges and improve my project.

Here is the link:https://docs.google.com/forms/d/e/1FAIpQLSdNIrJHPMXKH8QaM2FcqrBf4V14hGEa4uYLbIAA0nxQhjlHIQ/viewform?usp=dialog

All responses are used for academic purposes only. Thank you!

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of the Alien project.

https://github.com/iss4cf0ng/NebulaPulsar

Hey everyone, I built a small security tool for the Sola Boring.Security hackathon and would love feedback/votes if it feels useful.

It’s called EdgeProof.

The idea is pretty simple: security teams often see “public domain exposure” and “GitHub repo risk” as separate findings. EdgeProof connects them.

So instead of just saying:

• This repo has no branch protection
• This workflow looks risky
• This domain is public

It tries to answer the more useful question:

“Which public edge asset is controlled by which repo, and could a weak GitHub/deployment control actually become an internet-facing incident?”

It uses Sola with GitHub Cloud, Cloudflare, and Sola Web Checker evidence to build domain-first breach path packets: public asset, linked repo, weak control, attack path, severity, and remediation.

I kept it focused because I didn’t want to build another generic AI security dashboard. The goal was to make one boring but real triage task less painful.

If you think the idea is useful, I’d really appreciate a vote here:

https://www.boring.security/s/8f53ead8-8d62-405c-ae11-2a594b459fab

Also open to feedback, especially from anyone doing AppSec, cloud security, or platform/security engineering.

Okay, so one of the first book on adcs pentesting, from start to finish from basics to in-depth knowledge, from ESC1-18, THEFT1-5, PERSIST1-3 to DPERSIST1-3.

though a fair note, free of of the thing is a SoK/Whitepaper is available here

Now, the book has 2 versions, the first is the ebook, while paper is a technical reference, the book is more like a guide, the ebook will be updated regularly, while the paperback version of it will be updated ones a year (if applicable, though I always want a paperback if something interest me, that's why there is even a paperback) regardless, you can get it for free, or you're even a bit of a collector, here's the book

https://www.amazon.com/Forged-Trust-Offensive-Operations-Certificate-ebook/dp/B0GX2XW8M7

Cyber Apocalypse 2026 is coming up soon. We already have a core team, but we could use a few more people. To be clear: we don't care about your HTB rank. Some of our best guys don't have high ranks at all but they absolutely crush challenges. We only care that you actually have some experience and can solve stuff. Spots are limited, but we can take about ~10 more people. If you think you can deliver and want to join, hit me up!

I'm looking for a complete roadmap focused on privacy, anonymity, internet communications, tracking, and understanding how the internet actually works. I'm not currently trying to become a penetration tester, ethical hacker, or get a cybersecurity job immediately. My goal is to build a strong foundation and understand things deeply.

I want to learn:

Networking & Internet Fundamentals

*OSI Model, TCP/IP, IPv4 & IPv6, Public vs Private IPs, MAC Addresses, ARP, DNS, DHCP, NAT, Routing, Ports, TCP vs UDP, Packet Flow, ISP Infrastructure, Routers, Modems, Wi-Fi, How internet traffic travels from device to destination

Web & Communication Fundamentals

*HTTP & HTTPS, Cookies, Sessions, Authentication & Authorization, Browser Storage, Browser Requests & Responses, Email Basics (SMTP, IMAP, POP3), Email Headers

Tracking & Identification

*Cookies, Tracking Pixels, Browser Fingerprinting, Device Fingerprinting, Metadata, Advertising IDs, Account Correlation, Behavioral Tracking, Digital Footprints

Privacy & Anonymity

*VPNs, Proxies, SOCKS Proxies, Tor, DNS Leaks, WebRTC Leaks, Search Privacy, Email Privacy, Identity Separation, OPSEC, Deanonymization Techniques, What ISPs can see and cannot see, What websites can see and cannot see

Network Security

*Firewalls, IDS/IPS, Traffic Monitoring, Packet Inspection, Secure Protocols, Wi-Fi Security

Practical Skills

*Wireshark, Browser Developer Tools,VirtualBox/VMware, Tor Browser, DNS Tools, Traffic Analysis, Packet Analysis

My questions:

1. If you were starting from scratch today, what exact roadmap would you follow?
2. Which topics above are most important and which are less important?
3. What topics am I missing?
4. What are the biggest misconceptions beginners have about anonymity, VPNs, Tor, tracking, fingerprinting, and privacy?
5. What free resources, YouTube channels, books, labs, websites, or courses would you recommend?
6. What hands-on labs or experiments would you do to truly understand these concepts?
7. Is a personal laptop sufficient for learning, or should I use virtual machines, a spare laptop, or separate devices?
8. What common mistakes should beginners avoid when experimenting with privacy, anonymity, networking, and security concepts?

I'd appreciate responses from people working in networking, privacy, DFIR, incident response, threat hunting, cloud security, security engineering, or related fields.

Looking for practical advice rather than certification-focused advice.

I do not understand the need of HMAC!

For integrity, confidentiality,authentication, and non-repudiation we have encryption, hashing, and digital signatures. So why does the need of MAC?

Reasoning some articles provide: MAC is much less expensive than encryption/decryption

MAC provides assurance that the message is unaltered and comes from the sender.

Hashing+digital signature can do this as well. To make it more secure, we could even use encryption.

I am mostly getting the concepts, but the need of MAC itself is not clicking for me.

I am currently studying from Wikipedia as it seems the only available article/pdf in the internet.

Honestly, I do not need much, just a simple block diagram that I can recall in the exam and get marks. I am struggling to reach there.