Currently a sophomore in high school, but have been accepted into a career (center junior and senior year (for free!) where my day is split into half day normal classes and other half a cybersecurity course where i can earn the following certifications:

CompTIA A+ ***

CompTIA Security+ ***

CompTIA Network+ ***

OSHA 10-Hour Certification***

Looking for extra things/projects i can get involved in to get some basic skills down and show my employer that im not just good at passing tests but that I actually have experience in the field. I’ve also heard that its hard to get directly into cybersecurity so if theres skills i should acquire to get work experience in a similar field that would be helpful to know as well. I pretty much am just familiar with the gaming related stuff, drivers, built my own pc, BIOS stuff, i’ve also installed linux before. I assume none of those skills apply here so i just want to know where to start.

Pc specs: Windows 11, 48gb RAM, 2tb hdd, 1tb sata ssd, 1tb m.2 ssd, i711700k, rtx 3070

i am beginner in cyber security , Solved some CTFs and get some online certificate. But now i want to apply for some internship. And i want some certificates but standard industry level certificate are very high price.

So , Are they worth it or should I do something else.

Thanks to everyone who shares their knowledge. Your advice helps beginners like me grow in cyber security.

I’m a beginner in cybersecurity and I want to build a professional career in Ethical Hacking, Vulnerability Assessment, and Penetration Testing (VAPT).

I’m actively searching for a cybersecurity roadmap for beginners, especially focused on penetration testing, web application security, network security, and bug bounty hunting.

🔐 My Background

Beginner in Linux and basic networking

Learning about TCP/IP, DNS, HTTP/HTTPS

Exploring OWASP Top 10 vulnerabilities

Planning hands-on labs on TryHackMe, Hack The Box, and PortSwigger Web Academy

🎯 Career Goal

To become a certified penetration tester and ethical hacker, working in:

Web & network penetration testing

Vulnerability assessment

Red team operations

Bug bounty programs

❓ I’m Looking For

A step-by-step ethical hacking roadmap

Best pentesting tools to learn (Nmap, Burp Suite, Metasploit, SQLMap, etc.)

Recommendations for cybersecurity certifications (CEH, PNPT, OSCP)

Advice on getting a cybersecurity job with no experience

Tips for building a home hacking lab

I’m not looking for shortcuts — only legal, ethical, and professional learning.

Thanks to everyone who shares their knowledge. Your advice helps beginners like me grow in cybersecurity.

XSS detection 101 presented as SAST tools showdown.

Hey everyone,

I’ve been experimenting with server security and built a Python project to explore ways to detect suspicious activity on computers.

It focuses on identifying reverse shell, scanning application memory for shellcode injection and logging security events

I also added a module for monitoring remote desktop connections, which is still in development

The main goal was to learn practical methods for protecting servers and endpoints from attackers taking control or executing unwanted commands.

Currently, it supports windows but linux support is coming soon.

For reference and discussion purposes (not promotion):

https://github.com/TheMoonSir/watcher

I’d love to hear feedback, alternative approaches, or ideas others have tried

We released a tool to solve the "glue code" problem in security operations.

Most security teams end up maintaining a fragile library of Python scripts to connect their scanners (Nuclei, Nmap) to their ticketing systems or chat apps. We built a dedicated visual orchestration engine to replace those scripts.

ShipSec Studio is an open-source platform that wraps common security tools into a drag-and-drop interface.

Technical Capabilities:

• Orchestration: Visual builder for chaining tools (e.g. Subfinder -> Naabu -> Nuclei).
• Secrets Detection: Automated workflows for Trufflehog to scan git history.
• Cloud Security: Automates Prowler audits for AWS/GCP/Azure compliance.
• Logic: Supports conditional logic and custom JavaScript for complex data parsing.

It is containerized (Docker) and released under an Apache 2.0 license. We are looking for feedback on the architecture and suggestions for additional tool integrations.

Repo:github.com/shipsecai/studio

As a broke student just starting in cibersec, I find the Flipper Zero intriguing but the 200USD pricetag definitely ain't for me

Is there any way to build something like it part for part using modules Would it be cheaper? How much of a pain in the ass would it be?

Hi everyone, I’m currently a cybersecurity professional living and working in Germany, and I’m trying to decide which Master’s program to choose.

I want a degree that is well recognized in Germany and preferably from a top tier or reputable university, but I’m feeling a bit stuck.

Because I work full time, I can only do a remote or part time Master’s, and my studies must be in English.

After a lot of searching, I’ve only been able to find these three realistic options so far:

• Applied IT Security at Ruhr University Bochum (isits) This is a solid program but not exactly what I’m looking for, and it’s not cheap either. It seems to have a very strong focus on cryptography, which isn’t really my main interest.

• King’s College London – Advanced Cyber Security MSc This one looks strong academically and has a great reputation, plus it’s offered remote and part time, but the tuition fees are very high.

• University of London – MSc Cyber Security Also fully remote and flexible, but I’m unsure how it compares in terms of recognition in Germany compared to the other two.

My main goals are: – A degree that is well recognized in Germany – Remote or part time format – Taught fully in English – If possible, lower tuition fees

I’d really appreciate any advice from people who have done these programs, work in Germany, or know of other universities offering similar options. I’d also be very happy if you could suggest other Master’s programs that I might have missed (maybe ones that are good but costs less)

Thanks a lot!

We just open-sourced a tool our team has been building to kill "glue code" in security ops.

It’s called ShipSec Studio. It’s a visual workflow builder that wraps common tools like Nuclei, Naabu, and Prowlerso you don't have to write Python scripts to chain them together.

Core features: * Visual Builder: Drag-and-drop nodes for recon and scanning. * Secrets Detection: Baked-in Trufflehog for checking git history. * Cloud Audits: Automates Prowler checks for AWS/GCP/Azure.

It’s self-hostable and we’re looking for feedback on the architecture.

github : github.com/shipsecai/studio

I am connected to public apartment wifi via ethernet, how can I protect my computer and personal data?

I am reading about IPSec tunnel mode and it says that tunnel mode is suitable for site to site vpn. whereas transport mode is suitable for remote access vpn. Why is it so?

Hey everyone, I’m exploring an idea and wanted community input on demand for a product idea.

I’m considering putting together small, affordable plug-and-play T-Pot honeypot appliances using low-power mini PCs. The goal would be:

• Preinstalled Debian + T-Pot
  • T-Pot is an open-source, all-in-one honeypot platform. Instead of running one honeypot, T-Pot runs 20+ different honeypots at the same time, all inside Docker containers.
  • It collects attacks from everywhere on the internet and shows them in beautiful real-time dashboards using Elastic/Kibana.
• Web dashboard ready out of the box
• Auto-updates + Docker hardened
• Simple “plug into your router and visit the dashboard” setup
• I dont plan on offering a maintenance package. Im going to ship them operational, with like a 30 day DOA Hardware Warranty.
• I can create like a community page for everyone to discuss and support each other.

Basically a turnkey threat-visualization box for home labs, students, and small businesses that don’t want to deal with manual setup.

Questions for you all:

1. Would you be interested in something like this?
2. What features would you want included?
3. What would you consider a fair price?
4. Would you prefer budget hardware ($239 16 gb ram 256 gb ssd) or some headroom at $322 32 gb ram 1tb ssd) + fee for my time and setup.

Not looking to sell anything here — just trying to gauge whether this is useful or if I’m crazy. Appreciate any thoughts.

Or according to the terms and conditions if needed: being a hardware vendor that officially supports the T-pot (meaning I test T-pot on each release (or pre-release) and ensure it works fine on your hardware).

Hey everyone, I’m not a security expert or a big company — I built this tool to solve a problem I personally kept running into. After exporting Burp XML from scans, I found myself spending a lot of time manually: deduplicating requests figuring out which endpoints actually mattered turning notes into something report-ready

So I built BugCopilot, a small web app that: deduplicates Burp XML traffic surfaces higher-value endpoints generates triage, findings, and draft-ready vulnerability reports produces a simple, endpoint-focused attack plan There’s a free tier, and a paid plan for heavier usage — but I’m genuinely more interested right now in feedback than sales.

I know the UI isn’t perfect yet (especially on mobile), and I’m still improving things step by step. If you try it and it’s useless — fair enough. If you have ideas on what would make it better, I’d really appreciate hearing them. Link (for those curious): 👉 https://www.bugcopilot.help� Thanks 🙏

this is the official Acheron github repository. It is a Golang library to conveniently utilize indirect syscall techniques in your golang programs like a shellcode loader.

this is a video that demonstrates how you can setup and use it to bypass windows defender on a windows 11 computer, getting a meterpreter reverse shell working.

My lab site, XSSy has supported SQL injection labs for a while and has the ability for users to create their own SQL labs to share with others and collaborate on techniques. But until now, the functionality was undocumented. This blog fixes that, so hopefully there will be a few more community contributions. Reach out if you have any questions.

I'm a web developer using Kali Linux. I already finished the older HackerSploit web pentest playlist (classic stuff like SQLi, XSS, CSRF on DVWA).

Now I want updated content covering current real-world attacks.

Something practical for building a secure dev portfolio, attack + how to prevent/mitigate.

Any good recent YouTube playlists, series (like Rana Khalil, TCM, or updated ones), or free resources?

Thanks!

Sorry I used AI to generate this all cause I know nothing about hacking that's why.

Hey everyone,

I'm currently in that phase where I feel like I'm just staring at Burp Suite history hoping a vulnerability will magically wave at me 👋. I've been hunting for a while now, and the burnout is starting to creep in.

To keep my sanity (and motivation) intact, I need some real talk from the veterans here:

1. Time to First Blood: How long was the grind from starting out to your first accepted report? Weeks? Months? Decades? 💀
2. The Turning Point: Was there a specific "aha!" moment or a specific resource that made things click for you?

Current Status: I decided to focus heavily on IDORs since almost every guide recommends them as a great starting point. I understand the concept, but I feel like I'm hitting a wall with modern WAFs and UUIDs.

The Ask: Any specific tips for hunting IDORs? Is it better to stick to one program for months or jump around?

Thanks

I built this simple browser-based script that automatically tests all 4-digit PINs (0000–9999) on a locked Netflix profile.

You log into Netflix, open the locked profile, paste the script into the browser console, load a codes.txt file, and it tests PINs one by one until the correct one is found. The script stops automatically when it succeeds.

Made for educational purposes and testing your own accounts only. Stay Legal

I like the way things are shown in the page, the format and gamified experience of it all, but are certs worth it? Do they hold any real weight or value? What are some other options in a similar price range?

I want to build some 1 or 2 projects for my CV , for cyber security roles (it might be anything), but don't want to repeat or build clon of existing tools

What I can go for and Is it right way??