Here we are with the new content; walkthrough of Bounty Hacker room from TryHackMe! Ready? I deployed the machine and of course started with an "nmap" scan. We got 3 ports from the nmap scan being ...

TRYHACKME - BOUNTY HACKER WALKTHROUGH

Resources like TryHackMe have emerged as invaluable platforms for aspiring cybersecurity enthusiasts to acquire essential skills and knowledge. This essay delves into the reasons why resources ...

TryHackMe, the best place to start

If your answer is yes, then you're in the right place. ( https://tryhackme.com), with its new Security Engineer learning path, is here to equip you with the skills and knowledge needed to embark ...

Unlocking a Cybersecurity Career with TryHackMe Security Engineer Learning Path

TryHackMe, a leading platform for hands-on cybersecurity learning, has recently unveiled its brand-new Security Engineer Learning Path. In this blog post, we'll delve into what this learning path ...

Becoming a Cybersecurity Defender: TryHackMe's New Security Engineer Learning Path

Fortunately, TryHackMe has launched a brand-new Security Engineer learning path that can set you on the path to a rewarding career in cybersecurity. ### Dive into TryHackMe's Security Engineer ...

Unlocking Your Cybersecurity Career with TryHackMe's New Security Engineer Learning Path

For those passionate about cybersecurity or looking to venture into this domain, I'd like to introduce you to TryHackMe. What is TryHackMe? It's an online platform designed to help individuals ...

Discovering TryHackMe & Their Exciting New Learning Path: Security Engineer

Well, you’re in luck! TryHackMe, the renowned platform for hands-on cybersecurity training, has just launched an exciting new learning path designed to guide aspiring security engineers on their ...

🔐Unlocking a Thriving Career in Cyber Security with TryHackMe’s New Security Engineer Learning Path 💻🛡️

Today's walkthrough subject is "Brooklyn Nine Nine" from TryHackMe. There are only two answers we need. Firstly, we deploy the machine. So let's begin! We will try to gather information about the ...

TRYHACKME - BROOKLYN NINE NINE WALKTHROUGH

Basic Pen testing - TryHackMe Aug 25, 2023 Safeguarding the Revolution: Cybersecurity for IoT, Industrial Control Systems, and the Vital Role of Testing

Pickle Rick - TryHackMe

In the "Basic Pentesting" Machine on TryHackMe, participants acquire key skills: Brute Forcing: Learning systematic password guessing. Hash Cracking: Decrypting hashed passwords. Service ...

Basic Pen testing - TryHackMe

TryHackMe

tryhackme

As developers, we are constantly seeking for methods to demonstrate our abilities and accomplishments. TryHackMe provides an excellent forum for cybersecurity enthusiasts to learn and demonstrate their expertise. However, manually upgrading your TryHackMe badges can be tedious. That’s why I created the TryHackMe Badge Action Workflow, a GitHub Action that automates the process of displaying your TryHackMe achievements within your GitHub profile or repository. In this blog article, I’ll explain why I created this action, how it works, and how you may use it in your own markdown files in github. Motivation: Automating the Display of Achievements TryHackMe is a tool that many people in the cybersecurity field use to sharpen their abilities. However, manually updating badges or tracking your progress might be time-consuming, especially if you want to share this information on your GitHub page. I thought of a solution that would automate this process, allowing anyone to demonstrate their TryHackMe achievements with no effort. What Is the TryHackMe Badge Action Workflow? The TryHackMe Badge Action Workflow is a custom GitHub Action that refreshes and displays your TryHackMe badge on your GitHub profile or repository README page. This action allows you to maintain your achievements up to date without having to manually download, update, or commit your badge picture each time you acquire a new one. How It Works This action updates your GitHub profile or repository README with the new image and retrieves your most recent TryHackMe badge. This is a summary of the workflow’s functions: Image Fetching: The procedure begins with obtaining your TryHackMe badge’s most recent version from a given URL.
Commit Changes: The downloaded image is then committed to your repository, guaranteeing that the most recent badge is always visible.
README Update: Lastly, the action adds the updated badge image to your README file, allowing you to view your TryHackMe accomplishments in real time. Usage Add the below script to your GitHub repository as a .yml file (e.g., update-tryhackme-badge.yml).


Configure the action with the following inputs:


GITHUB_TOKEN: Your GitHub Personal Access Token (required, set as a secret).


image_path: The path to store the downloaded badge image (defaults to ./assets/tryhackme-badge.png).


username: Your TryHackMe username (defaults to the value in a secret named THM_USERNAME).


user_id: Your TryHackMe user ID (defaults to the value in a secret named THM_USER_ID). name: Update TryHackMe Badge

on:
  schedule:
    - cron: '0 0 * * *' # Runs every day at midnight
  workflow_dispatch: # Allows manual triggering

jobs:
  update-badge:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Fetch TryHackMe Badge
      uses: DhanushNehru/tryhackme-badge-action-workflow@v1.0
      with:
        image_path: './assets/tryhackme-badge.png'
        username: 'your_tryhackme_username'
        user_id: 'your_tryhackme_user_id'
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} An easy-to-use yet effective solution for automating the display of your security accomplishments is the TryHackMe Badge Action Workflow. If you liked the project as a source of encouragement and support please give it a star ⭐️👇 https://github.com/marketplace/actions/tryhackme-badge-action-workflow?embedable=true I have used this in my Github README.md so feel free to check it out Thanks for reading, please give a like as a sort of encouragement and also share this post in socials to show your extended support. Connect ⬇️ X / Instagram / Github / Youtube / Newsletter / Discord As developers, we are constantly seeking for methods to demonstrate our abilities and accomplishments. TryHackMe provides an excellent forum for cybersecurity enthusiasts to learn and demonstrate their expertise. However, manually upgrading your TryHackMe badges can be tedious. That’s why I created the TryHackMe Badge Action Workflow, a GitHub Action that automates the process of displaying your TryHackMe achievements within your GitHub profile or repository. In this blog article, I’ll explain why I created this action, how it works, and how you may use it in your own markdown files in github. Motivation: Automating the Display of Achievements TryHackMe is a tool that many people in the cybersecurity field use to sharpen their abilities. However, manually updating badges or tracking your progress might be time-consuming, especially if you want to share this information on your GitHub page. I thought of a solution that would automate this process, allowing anyone to demonstrate their TryHackMe achievements with no effort. What Is the TryHackMe Badge Action Workflow? The TryHackMe Badge Action Workflow is a custom GitHub Action that refreshes and displays your TryHackMe badge on your GitHub profile or repository README page. This action allows you to maintain your achievements up to date without having to manually download, update, or commit your badge picture each time you acquire a new one. How It Works This action updates your GitHub profile or repository README with the new image and retrieves your most recent TryHackMe badge. This is a summary of the workflow’s functions: Image Fetching: The procedure begins with obtaining your TryHackMe badge’s most recent version from a given URL. Commit Changes: The downloaded image is then committed to your repository, guaranteeing that the most recent badge is always visible. README Update: Lastly, the action adds the updated badge image to your README file, allowing you to view your TryHackMe accomplishments in real time. Image Fetching: The procedure begins with obtaining your TryHackMe badge’s most recent version from a given URL. Commit Changes: The downloaded image is then committed to your repository, guaranteeing that the most recent badge is always visible. README Update: Lastly, the action adds the updated badge image to your README file, allowing you to view your TryHackMe accomplishments in real time. Usage Add the below script to your GitHub repository as a .yml file (e.g., update-tryhackme-badge.yml). Configure the action with the following inputs: GITHUB_TOKEN: Your GitHub Personal Access Token (required, set as a secret). image_path: The path to store the downloaded badge image (defaults to ./assets/tryhackme-badge.png). username: Your TryHackMe username (defaults to the value in a secret named THM_USERNAME). user_id: Your TryHackMe user ID (defaults to the value in a secret named THM_USER_ID). Add the below script to your GitHub repository as a .yml file (e.g., update-tryhackme-badge.yml). Add the below script to your GitHub repository as a .yml file (e.g., update-tryhackme-badge.yml). Configure the action with the following inputs: Configure the action with the following inputs: GITHUB_TOKEN: Your GitHub Personal Access Token (required, set as a secret). GITHUB_TOKEN: Your GitHub Personal Access Token (required, set as a secret). image_path: The path to store the downloaded badge image (defaults to ./assets/tryhackme-badge.png). image_path: The path to store the downloaded badge image (defaults to ./assets/tryhackme-badge.png). username: Your TryHackMe username (defaults to the value in a secret named THM_USERNAME). username: Your TryHackMe username (defaults to the value in a secret named THM_USERNAME). user_id: Your TryHackMe user ID (defaults to the value in a secret named THM_USER_ID). user_id: Your TryHackMe user ID (defaults to the value in a secret named THM_USER_ID). name: Update TryHackMe Badge

on:
  schedule:
    - cron: '0 0 * * *' # Runs every day at midnight
  workflow_dispatch: # Allows manual triggering

jobs:
  update-badge:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Fetch TryHackMe Badge
      uses: DhanushNehru/tryhackme-badge-action-workflow@v1.0
      with:
        image_path: './assets/tryhackme-badge.png'
        username: 'your_tryhackme_username'
        user_id: 'your_tryhackme_user_id'
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} name: Update TryHackMe Badge

on:
  schedule:
    - cron: '0 0 * * *' # Runs every day at midnight
  workflow_dispatch: # Allows manual triggering

jobs:
  update-badge:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Fetch TryHackMe Badge
      uses: DhanushNehru/tryhackme-badge-action-workflow@v1.0
      with:
        image_path: './assets/tryhackme-badge.png'
        username: 'your_tryhackme_username'
        user_id: 'your_tryhackme_user_id'
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} An easy-to-use yet effective solution for automating the display of your security accomplishments is the TryHackMe Badge Action Workflow. If you liked the project as a source of encouragement and support please give it a star ⭐️👇 https://github.com/marketplace/actions/tryhackme-badge-action-workflow?embedable=true https://github.com/marketplace/actions/tryhackme-badge-action-workflow?embedable=true I have used this in my Github README.md so feel free to check it out Github README.md Thanks for reading, please give a like as a sort of encouragement and also share this post in socials to show your extended support. Thanks for reading, please give a like as a sort of encouragement and also share this post in socials to show your extended support. Connect ⬇️ Connect ⬇️ X / Instagram / Github / Youtube / Newsletter / Discord X Instagram Github Youtube Newsletter Discord

Introducing the TryHackMe Badge Action Workflow: Automate Your Security Achievements Display

15 High-income skills worth learning if you wanna build passive income

Joining the cybersecurity field as an outsider without a technical background was a transformative journey for me. What immediately captivated me about the industry was its relentless pace and the exhilarating challenge it constantly presented. Interacting with professionals in the field, I was heartened by their overwhelming support for newcomers who genuinely exhibited the will to learn. However, I quickly found a prevailing sentiment: there's a general expectation for newcomers to be independent self-learners. This could be a daunting expectation, especially considering that many potential beginners in aren't inherently self-learners. While innate curiosity is undoubtedly a valuable trait, it's essential to recognize that many individuals, even those with immense potential, need a structured framework to move their initial steps into this vast domain. cybersecurity In the last few years, significant progress has been made in filling the talent gap in the industry. However, as of 2023, according to the , there were 440,000 new jobs created in cybersecurity globally (an 8.7% increase year over year), but a staggering 4 million positions remained unfilled (a 12.6% increase year over year). This enormous gap results from the disconnect between employers' needs for experienced professionals and the real-world shortage of such expertise ISC2 Cybersecurity Workforce Study The solution to this talent crunch lies in focusing on the early stages of potential cybersecurity professionals' careers, particularly young students. As a community, it's imperative that we equip the youth with the tools they need to explore cybersecurity as a viable career option. The key is to offer structured, practical, and accessible learning paths. Below are some steps and examples of how to do so. Study Frameworks Like NIST-NICE The NIST-NICE framework categorizes cybersecurity work into seven high-level categories: Analyze, Collect and Operate, Investigate, Operate and Maintain, Oversee and Govern, Protect and Defend, and Securely Provision. Each category is further divided into specialty areas and work roles, providing a comprehensive roadmap for career progression. Table 1: NICE Framework Work Role Categories Category Description Number of Work Roles Securely Provision (SP) Conceptualizes, designs, procures, and/or builds secure IT systems. Responsible for aspects of system and/or network development. 11 Operate and Maintain (OM) Provides the support, administration, and maintenance necessary to ensure effective and efficient IT system performance and security. 7 Oversee and Govern (OV) Provides leadership, management, direction, or development and advocacy so the organization may effectively conduct cybersecurity work. 14 Protect and Defend (PR) Identifies, analyzes, and mitigates threats to internal IT systems and/or networks. 4 Investigate (IN) Investigates cybersecurity events or crimes related to IT systems, networks, and digital evidence. 3 Analyze (AN) Performs highly-specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence. 7 Collect and Operate (CO) Provides specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence. 6 This table showcases the broad spectrum of roles within the cybersecurity landscape. By understanding these categories, beginners can better position themselves for a more tailored and informed career trajectory. For a comprehensive understanding of the NIST-NICE framework and to access a myriad of resources tailored for beginners, one can visit the . NICE's Getting Started Resource Center The goal is to explore various facets of cybersecurity and determine where passion intersects with proficiency. Since cybersecurity is a dynamic field, there's always room for an individual to pivot, learn, and evolve. Become Friends with Real Hackers The cybersecurity community is exceptionally supportive of newcomers. Even seasoned professionals are often open to sharing tips and advice and are incredibly accessible to beginners. The secret to meeting these people is to attend live events. Real-time interactions at in-person events offer spontaneous questions, discussions, and the possibility for deeper understanding. It’s not just about soaking in knowledge; it's also about networking. These venues are prime opportunities for establishing meaningful connections, potentially leading to mentorships, job placements, or even collaborative projects. Furthermore, many such gatherings have live challenges or hands-on workshops where attendees can put theory into practice, often under the guidance of an expert. Here's why attending in-person events can be so beneficial for a cybersecurity enthusiast: Directly engage in challenges or workshops, honing skills in real time. Skill Demonstrations: Cybersecurity is ever-evolving. Engage in fresh, cutting-edge discussions that might not have reached the wider online community yet. Staying Updated: Share experiences and challenges with peers. It's comforting and motivating to know others face similar challenges. Moral Support: When it comes to venues, some platforms and organizations stand out: (Open Web Application Security Project): Renowned for its insights into web vulnerabilities, its global chapters regularly hold meetings and workshops. OWASP : These community-driven events offer a cozier, more intimate setting for discussions and learning. BSides : One of the hacker conventions, it is an excellent place for someone keen on diving deep into hacking and cybersecurity. DEF CON When planning to attend, here are a few tips: Don't just be a passive participant. Engage, ask, discuss! Engage Actively: Go through the event's schedule, note down sessions of interest, and research the speakers. Prepare: Did you connect with someone interesting? Drop them a thank-you note or a simple message post-event. It could be the start of a valuable relationship. Follow-up: So, if you're aiming to deepen your cybersecurity knowledge and network, attending such events could be the stepping stones to your next big opportunity. Participate in CTF Challenges and Hackathons Capture The Flag (CTF) challenges are competitions where participants solve cybersecurity puzzles ranging from cryptography to web application vulnerabilities. These challenges offer beginners a practical, hands-on experience in solving . For example, the DEF CON CTF event annually attracts a global audience and has puzzles suitable for all skill levels. real-world cybersecurity problems Engaging in CTF challenges directly correlates with several areas outlined in the NIST-NICE framework: Analyze (AN): Deciphering cryptographic puzzles in CTFs sharpens skills pertinent to the Analyze category, where one evaluates incoming cybersecurity information. Protect and Defend (PR): Addressing vulnerabilities during a CTF strengthens a participant's capabilities in identifying, analyzing, and mitigating threats to IT systems, aligning closely with the Protect and Defend category. Investigate (IN): Some CTFs involve forensic challenges, aligning with the Investigate category, where one examines cybersecurity events or crimes related to IT systems. Securely Provision (SP): Tackling challenges where participants must secure or harden systems mirrors the Securely Provision category, emphasizing the design and creation of secure IT systems. By immersing oneself in CTFs, beginners not only gain valuable hands-on experience but also better understand the different roles and areas they might be interested in as per the NICE framework. It provides a tangible, engaging way to explore and deepen specific cybersecurity competencies. Join Bug Bounty Campaigns In a bug bounty campaign, companies incentivize ethical hackers to find and report vulnerabilities in their systems. This practice is becoming increasingly prevalent among leading technology companies, realizing the value of the global pool of independent security researchers. For instance, tech giants like Google, Facebook, Apple, Microsoft, and Twitter have all rolled out their own bug bounty programs, encouraging ethical hackers to identify and responsibly disclose potential security flaws in their platforms. By offering these campaigns, these organizations not only enhance the security of their systems but also foster a symbiotic relationship with the cybersecurity community. For example: Google's Vulnerability Reward Program (VRP) rewards researchers who uncover security vulnerabilities in Google's products and services. Their reward amounts can range from $100 to over $30,000, depending on the severity of the flaw and the product affected. In some exceptional cases, even higher rewards have been granted. Google's VRP has been instrumental in ensuring the security of products such as Google Chrome, Android, and Google Cloud Platform. Apple's Security Bounty Program invites security researchers to find vulnerabilities across iOS, macOS, and other Apple software. The payouts can be quite substantial, with rewards for the most critical issues reaching up to $1 million. This reflects Apple's commitment to user privacy and security. Platforms like Bugcrowd, Hackerone, and Intigrity have also streamlined the process, acting as intermediaries connecting ethical hackers with organizations, including those that might not have independent programs like Google or Apple. Once a vulnerability is identified and reported through these platforms or directly to the companies with established programs, it undergoes a verification process. If validated, the researcher could receive a financial reward, recognition, or both. Focus on Practical-led Training For beginners, there are web browser-based labs. These labs allow users to practice in a controlled environment directly within their browsers. While convenient and easy to access, these platforms might not fully replicate the complexities and intricacies of real-world systems. They are good introductory tools, but as users progress in their cybersecurity journey, they might find them less challenging. On the other hand, there are virtualized environments that require VPN access. These platforms offer environments that are almost identical to actual company infrastructures. The virtualized scenarios are meticulously crafted to emulate real-world networks, servers, and workstations. As users connect via VPN, they feel as if they are truly inside an operational network, providing a level of authenticity that web browser-based labs might lack. This type of environment allows for a deeper exploration of tools, tactics, and procedures, effectively training the participant to tackle genuine cybersecurity threats. The rigorous training in these environments ensures that participants are job-ready and fully prepared to address the multifaceted challenges they might face in their cybersecurity careers. By experiencing both types of training, candidates can appreciate the gradient of complexity in cybersecurity challenges and better hone their skills to be effective professionals. Here is a list of free or affordable practical cybersecurity training resources for beginners: : Provides a series of war games designed to teach the principles of security from the basics to advanced concepts. It's a great starting point for beginners wanting to learn Linux commands and simple penetration testing techniques. OverTheWire : This platform offers more than 300 challenges across different domains to help users improve their hacking skills. It provides a hands-on approach to learning about network security, web application security, and more. Root Me : Developed by the creators of the Burp Suite, this academy offers free hands-on web security training. It covers a wide array of topics from basic to advanced web vulnerabilities. PortSwigger Academy : Provides a beginners-friendly courses paired with VPN-based real-world training experience, emulating genuine cybersecurity scenarios. PWNX.io : A platform designed primarily for students to learn about cybersecurity. It offers educational modules tailored to different skill levels. PWN.college : An online platform that aids learning in cybersecurity through hands-on virtual labs. Its gamified challenges range from the very basics to more advanced, catering to users of all skill levels. TryHackMe A platform that provides various cybersecurity labs and challenges. While it does cater to users of all skill levels, some of the challenges can be very advanced, making it ideal for those looking to progress beyond the basics. Hack The Box: TCM Security offers self-paced cybersecurity courses that cover topics such as penetration testing, security training, and compliance. Additionally, they provide certifications that are increasingly gaining reputation in the industry. TCM Security: The resources mentioned above represent just a snapshot of the many tools and platforms that have gained attention and appreciation within the cybersecurity community. The realm of cybersecurity training is vast, and the list of valuable resources extends far beyond what's provided here. Additionally, there are numerous open-source projects and other content available online that can be instrumental in enhancing one's learning journey. Specialized forums and websites, which I will detail in the next paragraph, can be invaluable in discovering reviews or feedback from other community members. This feedback provides insights into the quality of new resources that are constantly being released. Leverage Social Media and Forums to Find a Mentor In the vast realm of cybersecurity, guidance from someone experienced can make all the difference. Platforms like LinkedIn can be particularly beneficial, not just for networking, but also for identifying potential mentors. By carefully reviewing profiles, joining relevant groups, and actively participating in discussions, you can showcase your eagerness and catch the attention of experienced professionals willing to guide newcomers. Discord, a platform initially created for gamers, has burgeoned into a hub for various professional communities. Specialized forums and websites further amplify the opportunity: Reddit’s Cybersecurity Communities: Platforms like and subreddits are teeming with professionals and enthusiasts discussing the latest in security trends, challenges, and solutions. The subreddit is particularly designed for students and beginners, fostering a nurturing space for queries and guidance. Reddit's Cybersecurity Netsec Netsecstudents Wilders Security Forums: Dive deep into discussions about online privacy, security, and data protection on . The vast range of threads and posts signifies a dedicated community, making it an invaluable resource for all cybersecurity-related topics. Wilders Security Forums MalwareTips and Antionline Forums: Websites like and are vibrant communities where one can engage in in-depth discussions on various facets of security, from malware threats to network safety. MalwareTips Antionline Bleeping Computer and Spiceworks Community: Forums such as and the are dedicated to comprehensive security-related discussions, from firewalls and VPNs to password managers and malware attacks. Bleeping Computer Spiceworks Security Forum Hacklido: A unique platform, is where the brightest hackers come together to share knowledge, experiences, and guidance. It's a rich source of practical insights and real-world examples. Hacklido By actively engaging in these forums and communities, not only can one expand their knowledge but also build meaningful connections. As you participate and contribute, the chances of meeting potential mentors who recognize your passion and dedication increase significantly. Remember, mentorship in cybersecurity is not just about learning the ropes; it's about guidance, feedback, and understanding the nuances of the rapidly evolving world of digital protection. Make Use of Free Tools As you embark on your cybersecurity journey, it's essential to familiarize yourself with the plethora of free tools available. These tools, widely recognized and utilized by professionals in the field, can significantly augment your learning experience: Wireshark: An open-source packet analyzer, Wireshark allows users to see what's happening on their network at a microscopic level. It's widely used for network troubleshooting, analysis, software, and communications protocol development, and education. Description: The tool comes with a range of to help newcomers grasp its functionalities. Resource: official documentation and guides OWASP ZAP (Zed Attack Proxy): Developed by OWASP (Open Web Application Security Project), ZAP is a free, open-source web application security scanner. It helps find security vulnerabilities in web applications while you are developing and testing them. Description: New users can benefit from the tool's and various community-contributed guides. Resource: official documentation Metasploit Community Edition: Part of the Metasploit Project, this edition is a free-of-charge penetration testing tool that helps verify vulnerabilities and manage security assessments. It aids in the discovery, analysis, and exploitation of vulnerabilities. Description: Metasploit provides a plethora of for various functionalities. Resource: tutorials and user guides Snort: As an open-source network intrusion prevention system (NIPS) and intrusion detection system (IDS), Snort is adept at performing real-time traffic analysis and packet logging. Description: Beginners can find extensive documentation and a community of users on the . Resource: Snort official website OpenVAS (Open Vulnerability Assessment System): OpenVAS is a full-featured vulnerability scanner that comes with numerous tests and offers updates for the latest vulnerabilities. It assists in identifying issues in systems and applications. Description: The OpenVAS community provides a to support new users in understanding and maximizing the tool's capabilities. Resource: comprehensive set of documentation Kali Linux: Kali Linux is a Debian-based Linux distribution that's geared towards advanced penetration testing and security auditing. It comes pre-installed with hundreds of integrated security tools, making it a staple in the cybersecurity community. Description: For those new to Kali, the offers comprehensive guidance, ranging from installation to utilizing its vast array of tools. Resource: official documentation Harnessing the capabilities of these tools not only gives beginners a practical understanding of various cybersecurity domains but also provides a hands-on approach to combating potential threats. Remember to explore the associated documentation and tutorials for each tool, as they often hold a wealth of knowledge and best practices. Untapped Potential and the Need for Guidance While there are self-learners who manage to connect the dots on their own, a vast number of budding talents are not yet part of the , mainly because they lack initial guidance. By providing targeted and practical guidance, we can help pave the way for a new generation of cybersecurity professionals ready to take on the challenges and opportunities that this rapidly evolving field has to offer. cybersecurity ecosystem Structured learning can be achieved in various ways, and this guide aims to offer an alternative perspective, coming from a non-traditional cybersecurity professional who had the unique opportunity to learn from genuine hackers.

You are Not Learning Alone: a Structured Guide for Cybersecurity Beginners

আপনি একা শিখছেন না: সাইবার সিকিউরিটি নতুনদের জন্য একটি স্ট্রাকচার্ড গাইড

Sie lernen nicht alleine: ein strukturierter Leitfaden für Einsteiger in die Cybersicherheit

No está aprendiendo solo: una guía estructurada para principiantes en ciberseguridad

Vous n'apprenez pas seul : un guide structuré pour les débutants en cybersécurité

आप अकेले नहीं सीख रहे हैं: साइबर सुरक्षा के शुरुआती लोगों के लिए एक संरचित मार्गदर्शिका

あなたは一人で学んでいるわけではありません: サイバーセキュリティ初心者のための構造化ガイド

혼자 배우는 것이 아닙니다: 사이버 보안 초보자를 위한 체계적인 가이드

Você não está aprendendo sozinho: um guia estruturado para iniciantes em segurança cibernética

Вы не учитесь в одиночку: структурированное руководство для новичков в области кибербезопасности

Yalnız Öğrenmiyorsunuz: Siber Güvenliğe Yeni Başlayanlar İçin Yapılandırılmış Kılavuz

Bạn không học một mình: Hướng dẫn có cấu trúc dành cho người mới bắt đầu về an ninh mạng

你不是一个人学习：网络安全初学者的结构化指南

Working in cybersecurity can be a very fulfilling career, but most jobs require some amount of experience or formal training. While there are many great courses and certifications for learning pen-testing out there, it might be the case that they are simply above your budget. But that is totally fine. I think it is still possible to get job-ready knowledge about and pen-testing from free resources. cybersecurity A little warning: While I feel like it is possible to spend no money on your way to the first pen-testing job, it is the case that some paid resources provide knowledge in a condensed and easy-to-digest form. Having access to those resources might accelerate your learning journey. So I will provide some recommendations on which of them are worth it and which are not. I also created a GitHub repo with free cybersecurity resources. Check it out, and feel free to add some: https://github.com/her0marodeur/awesome-free-cybersecurity A few words about my own career I got really lucky in terms of getting a job. My first contact with cybersecurity was back in my teenage years when I Googled “ .” That was back when there were no such resources as HackTheBox and TryHackme. So, a lot of the learning was more theoretical and, in general, kinda slow. How to become a hacker After I finished school, it was time to look for a job. I started out with a student job for a big software company. There, I had the opportunity to work with different security teams. During this time, I did my eJPT certification and got in contact with the internal pen-testing team. They provided me with the opportunity to do an internship and paid for my OSCP. After I finished my Bachelor’s degree, I got offered a full-time job as a pentester. As I mentioned, I got lucky, but I think there are a couple of takeaways from my own story: The demand for pen-testers is currently very high, so many companies are willing to train existing employees. So if you are already working for a company, see if they have an internal pen-testing or security team. The most important characteristics of a pentester (hacker) are willingness to learn and curiosity. Getting them does not cost a penny. One of the mistakes I made was focusing too much on the theory and not getting enough hands-on experience. This is really important, and you should try to get as much practice as possible. The role of certifications and degrees I know you probably want to get into learning right away, but I think we should have a brief discussion about this topic. There is a decade-long ongoing discussion about the difference between and which is better and a lot more. I don’t want to dive into all that stuff. certifications and degrees Generally speaking, a degree or a certification is a verifiable and easy way for employers to assess the skills of an applicant. The OSCP or a computer science degree does show that the candidate has skills and knowledge in a certain area. If you have to filter through hundreds of applications, they give a good orientation. But there are two big things to take into consideration: There are other ways of getting experience and knowledge. I have friends who have maintained Minecraft servers since they were twelve years old, and they have extremely good programming skills, even without having a degree. And their salaries are comparable to some seniors in the industry. Even tho there has been a huge interest in pen-testing in the last couple of years, the demand has skyrocketed as well. That means employers are not getting hundreds of applications. Many times, it is actually the case that pen-testers are getting many job offers just because they have a LinkedIn profile. Paid Certifications to avoid: For some reason, this is still seen as a good certification, but from everything I have heard, they provide a really dry course, and the exam requires you to memorize a lot of stuff. So you can save your money. Certified Ethical Hacker (C|EH): I did this one myself, and it was fun; the exam was really hands-on and enjoyable. The reason I don’t recommend it is that I don’t think it is really beneficial in terms of getting a job because I don’t feel like employers are valuing it. eLearning Security Junior Penetration Tester (eJPT): Paid Certifications you can do (if you have the money): I don’t hold this certification myself, but I did Heath Adams courses back in the day. The content is just great and really well explained. It covers a lot of topics. The exam is more relaxed than the OSCP, and it has industry recognition at the lowest price. Practical Network Penetration Tester (PNPT): The OSCP has its pros and cons, and I wouldn’t recommend that you take a loan to do it or bust your bank account. But in a situation where you can really afford to do it (considering money AND time), I have to admit it has a great course, and it is basically a job guarantee. If you want to learn more about it, check out my blog here: Offensive Security Certified Professional (OSCP): https://infosecwriteups.com/methodology-and-mindset-for-passing-the-oscp-d609592a7dcb Getting the knowledge To know where you should start, you have to know where you stand. It is a big difference if you already have fundamental IT knowledge or if you are coming from a different profession because it is absolutely necessary to understand basic computer science concepts like networking and how programs, web pages, and computers are built and running. Since I suspect that many readers of this article will have this knowledge, I will not talk too much about learning all that stuff. has some really cool courses to learn the basics, and I think installing your own web server and learning the basics of Python really helps a lot. There are also basic computer science courses on sites like . TryHackMe Coursera TryHackMe and HackTheBox As well as for basic knowledge, I think you should really start with for learning the basics of pen-testing; they have some really good paths for this. Sadly, some of them might be only accessible via a paid membership. I think the paid membership is really one of the best investments you can make because it is quite cheap and provides access to a lot of knowledge. TryHackMe If you are thinking about what kind of pen-testing (mobile, web, network, Red Teaming, etc…) to learn first, I suggest you go with web pen-testing because there are many resources about it, and when we talk about Bug Bounty later, most of the targets are available in this area. But if you feel like doing something else, do it; all of this is just my opinion. Additionally, to do the learning path, you should also do some of their boxes that don’t give you any hints about how to solve them. Also, check out for this; they also have some great boxes, but beware of their rating system. I recommend you really start with easy boxes. HackTheBox When solving boxes, I recommend you give yourself a time limit. I recommend something like this: If you don’t have the initial foothold after 30 minutes, you should check a writeup. Afterward, you try 30 mins for privilege escalation, and if you don’t get it, check the writeup again. It might be true that there is no writeup in a real pentest, but doing boxes is about getting as much knowledge as possible. Also, start pushing yourself as soon as possible and increase the difficulty. It may mean that you might need a write-up for almost every step, but it also means you learn something new with every box. Free certifications: This one is a must-have. It is just the right mix between great course content and realistic and challenging exercises. APISec University: This one is not really about pen-testing but covers a lot of the basics of cybersecurity. But these topics are important for pen-testers as well because they always have to see the bigger picture of cybersecurity. The course and exam are free, but it requires an annual maintenance fee. ISC2 Certified in Cybersecurity (CC): : Another one that is not directly about pen-testing. It explains one of the essential policies of cybersecurity, and employers would like knowledge about this one. Skillfront ISO/IEC 27001 Information Security Associate™ If you love certifications as I do and want some more for free, please check out my GitHub Repo over here: https://github.com/her0marodeur/awesome-free-cybersecurity Getting the experience By now, you already hacked some machines and websites, but all of them were in a simulated environment and left vulnerable by design. While this provides valuable experience and gives you the ability to learn how to exploit vulnerabilities, it is not necessarily the experience employers are looking for. Therefore, I recommend you try your skills against some real-world targets (in a legal way). Luckily, Bug Bounty platforms allow you to do this and maybe earn some money. Bug Bounty Platforms You can check out the following platforms: https://www.bugcrowd.com/ https://www.hackerone.com/ https://www.intigriti.com/ https://yeswehack.com/ Look at their programs and get familiar with the general topic of Bug Bounty (try to avoid the Twitter and Medium hustler bubble; there is some really bad stuff out there). I suggest you start by looking at Katie Paxton-Fear’s stuff ( ). She has some great videos that are really for beginners. But don’t stress too much about all of it; sign up for a platform, pick a program, and hunt. This is what life as a pentester is going to be like. Also, be careful and don’t bother too much about all of the tools, oneliners, and scanners. Learn about the recon fundamentals ( ) and start hunting. https://insiderphd.dev/ https://www.youtube.com/watch?v=krCsMZfbuB4 If you get one or the other bug, it is great for your CV because it shows you know how to apply your pen-testing knowledge to real-world targets. Synack Red Team https://www.synack.com/red-team/ This one really depends on how much time you want to spend before getting a job as a pentester. I am not part of it, but I heard really good stuff about it. It basically is a closed Bug Bounty platform, but they additionally offer some fixed pay jobs like checking default credentials or OWASP Top 10. However, you have to apply to them, and this process can take a while. But it gives you the chance to have some experience with a real-world job application. It offers great hands-on experience and looks good on your CV. So check it out and see if it is for you. Getting the job If you are following this blog (btw. please read more resources than just this one; there is a lot of great career advice out there), I hope you don’t think of it as something that has to be done in chronological order. You can skip things and do them in parallel, or however it feels right for you. Writing a CV Before you go out and look for a job, you should write a CV. This really should focus on showcasing skills that you can apply to your pen-testing job. So if you have worked in another job, think about how you can translate the skills you gained to pen-testing. If you are a programmer, tell them you have a deep understanding of technology and for sure you had to implement security measures in your code, and probably you know how developers think and fail. If you have worked as an executive assistant, you have probably done a lot of writing and have clear communication skills, which is also really beneficial for pen-testing. By now, you have done at least some certifications and courses, but be careful what you include in your CV. I think, if you have done the three free certs I mentioned, you should include all of them, as they really showcase skills and knowledge needed for your job. But you want to be careful not to include every little thing. Rather than including the certificate of completion for every TryHackMe track you did, you should just include your TryHackMe profile. And for bug bounty profiles, you only want to mention the sites where you have at least one accepted submission. If you put too much basic stuff in there, it probably seems desperate. For writing the actual CV, you should not get too creative. It is best to either download a Word template and fill it in with your experience and skills or use one of the online generators (consider privacy implications). Be aware that your CV is often times read by machines, so make it “machine-readable.” Getting yourself out there Being visible can be really helpful if you want to get a job. I think having a is crucial. So create one, put a nice photo and some experience on it, and maybe include “aspiring pentester” in your bio to make yourself visible when recruiters search for possible candidates in this area. well-maintained LinkedIn profile You can also do a little bit more to increase visibility. A nice thing to do is to start a blog. Like this one, you are just reading. Even tho you might not have a lot of expert knowledge; you can talk about your journey and experiences or write a tutorial for a tool or a writeup for a box you did. But please don’t go down 1337 Hacker Road. I don’t think that blogs like “Hack a webcam with only three steps,” “Hacking Instagram password,” and other clickbait help find employment. Other things you can do are contribute to GitHub projects (for example, Nuclei and Spiderfoot allow you to contribute new rules and templates), create your own tools, or speak at a conference. All of these things will increase your network and look great on a CV. Applying for jobs Go for quality over quantity. The job has to be a match for you as much as you have to be a match for the job. So, really try to find jobs that match your expectations. While I say that, it is also true that it is probably easier to pivot from one pen-testing job to another than getting into the industry, but I feel bad advising anyone to take a job they don’t enjoy. I highly recommend you reach out to recruiters/headhunters. You can easily find them on LinkedIn, add them to your network, and ask if they have a role that fits your profile. It will not cost you a penny because the employers are paying them. They will also be a big help with streamlining a lot of the process. They know their clients and where you have a good chance of getting hired and, most of the time, allow you to skip steps like writing a cover letter. Even if they are not able to offer you something right away, they will add you to their contact list and reach out in the future. Interviews There are just better resources than I am, so I will link to them: The Cyber Mentor- Mock Job Interview: https://www.youtube.com/watch?v=IDpjaS6OYPU The Cyber Mentor — What to Expect in an Ethical Hacking Job Interview: https://www.youtube.com/watch?v=nrewE1mLlaU Security Interview Questions: https://github.com/justinltodd/security-interview-questions Conclusion While it should be entirely possible to get a pen-testing job without spending a dollar, it will still require a lot of work. Spending at least some money can make the process if you spend it right. I also have to mention that all of this is just my personal experience and perspective. Your mileage may vary. If you liked this blog post, you can follow me on Twitter @Secbyaccident or read my other stuff over at . https://security-by-accident.com/ And if you have read this far, I want to offer you a little Thank You. My DMs on Twitter are open, and you can reach out to me if you want me to review your CV, help you with some studying, or set you up with some recruiters. I will do all of this for free, but expect a little delay in response time. Also published here.

Cybersecurity Job Hunting, Pen-Testing Study Plans, and Certifications on a Budget

1. What do you currently do, and what’s your favorite part about it? I run the Investigator 515 blog, which posts educational and analysis content. In the background, we are also developing a scam-busting website that’s designed to put search and tracking tools into the hands of the people that need them at a reasonable price. And, because I love being busy, I also have an ongoing development of AV, an embedded platform that’s designed from the ground up to perform electronic counter surveillance as well as detect and classify devices of interest. I should probably mention here that I’m a career investigator who’s spent my life before this working in the field. I love working in tech because there are so many smart brains working on many different things. It’s fascinating to see projects coming to life and people troubleshooting development issues to achieve their success. 2. How did you get started with your Tech Career? I left college before completing my Electrical Engineering degree because even though I enjoyed what I did, I didn‘t feel the spark or passion toward it that made me think I’d enjoy it after graduation. After facing a life crisis, I decided to put my Open Source Intelligence skills on steroids as a distraction. During this time, I came across the TryHackMe website and found myself on a road into Bug Bounty programs, and the rest is history. By the way, I probably should blame a huge chunk of this on amateur radio. Using Raspberry Pi and Beaglebone boards gave me my introduction to Linux, APRS on an old router was my first general introduction to hardware hacking, and SDR/Spectrum Analysis showed me how to detect and identify signals of interest around me. It’s not all you need, but it sure is a good start. 3. If Utopia were a color what color do you think it’d be and why? Blue. Because the ocean is blue, and that’s as close as we’ll get to utopia on Earth as far as I’m concerned. 4. If everything about HackerNoon changed drastically, what is one detail you’d like to keep exactly the same?  OR What’s your favorite thing to do with HackerNoon and why? Browsing user-developed and submitted content. I like reading submitted pieces for the writing competitions and learning about new tools and developments. There are a lot of smart contributors writing articles for HackerNoon, and it’s a great place to find both info about technology and the latest up-and-coming hackers and creators. It also never ceases to amaze me, the ingenuity of the hacking community. There’s a niche for everyone if you’re that way inclined. 5. Tell us more about the things you write/make/manage/build! We write about open-source intelligence, investigative tools, and also provide training content that pairs with our search website. We also love showing others how to use the terminal and command line effectively, so much so we are writing another book about it! And we also spoke before about AV, our electronic counter surveillance toy we are developing. He’s been nicknamed “Snoopy” because he has the ability to see the unseen. Snoopy can be used to detect tracking devices and optical surveillance devices quickly, easily, and without fuss. As you can see, I like to be busy and working on things that interest me, and I’m not scared of being busy. We also appreciate and draw inspiration from the work of groups like Bellingcat and share similar goals in wanting to educate and enlighten people on how to follow where the facts go rather than pushing an agenda. 6. What’s your favorite thing about the internet? The fact that, as an OSINT investigator, I don’t need to know it all; I just need to know where to look for information. I love that I can post a picture of an unknown device and receive a breakdown of what it is and how it works. Or that if I simply have to have an answer for that fact, I can ask a history expert or make a community post. Or maybe I’m troubleshooting a device and need some assistance. And don’t even get me started talking about the impacts of AI and Machine Learning changing the way we view productivity and technology. Lastly, the internet is unique in the way it can both bring people together and divide them all at the same time. 7. It’s an apocalypse of ‘walking dead’ proportions and you can only own a singular piece of technology, what would it be? Solar Powered CyberDeck, of course. Something rugged and reliable with an offline copy of Wikipedia. And possibly all seasons of Walking Dead as my media for…survival tips. And some games because there is no life without games. 8. What is your least favorite thing about the internet? Sockpuppets and Propaganda. We get it, it’s as old as time itself, and the cyber realm is a cheap, effective way to push soft power if you’re that way inclined. Personally, we’d like the internet a lot more if people fact-checked things before they took them as true. 9. If you were given $10 million to invest in something today what would you invest in and why? Cryptocurrency and AI development. Both are much-needed tools for humanity. Crypto for a decentralized way of trading and using currency that isn’t linked to a traditional bank and has less of an ability to be controlled by a single person or entity. And AI because the impact this new tech will have on humanity at large is as yet undetermined. In the right hands, AI and LLM have the power to change humanity and how we engage with the world around us. 10. What’s something you’re currently learning or excited to learn? Without a doubt, AI. It’s exciting to watch AI tech be miniaturized and achieve the capacity to be run locally in a system similar to GPT that has legitimate network connectivity. The effect this will have on everything from web development to pen testing/bug bounty right through to military power I think is not yet fully understood, but the ramifications of it being in the everyday world will be huge. Cyber research and signals identification also get a nod; they are such broad fields that you could study them for years and never stop learning. 11. Would you rather travel 10 years into the past or 10 years into the future? Give reasons for your answer. 10 years into the past for sure. I think having future knowledge in 2013 would have been a wild ride. With everything that’s happened, I think anyone with that insight would have been amazed at what’s to come. Besides, bitcoin prices were good back then; I could have done with that knowledge sooner and kept mining. 12. Tell us a little about your website project. The website project came together after looking at two things. The seriously useful range of tools and software available, as well as a noticeable increase in generalized scams in the post covid era. Hiring an actual investigator can be a costly leap for some people, and we didn’t want people to have to accept a lower level of security because of that. So, Catfisher is under development. It’ll provide usable point and investigative tools streamlined for use, along with tutorials to use them where needed with the hopes it safeguards people against online scams and catfishing. We’d like people to have the option to do things themselves so they can make their own choices rather than having to hire someone, and Catfisher is the first step for us in providing the resources to make that happen.

Investigator515 - An Introduction

Over the years and regardless of their specialization, I have met only a couple of people that didn’t like offensive security operations. But most people, have no idea how such an engagement happens. N.B: In this article (and the subsequent ones in the series) we are only talking about legal engagements, where you have permission to attack a system (or for fun, in your own local vulnerable VMs). Don’t forget that you can be prosecuted if acted against those common sense guidelines. What Is an Offensive Security Engineer? An offensive security engineer is a professional who is responsible for identifying and exploiting vulnerabilities in networks, systems, and applications. They conduct penetration testing and other security assessments to find weaknesses in a company’s defenses and provide recommendations for improvement. Also, offensive security engineers work on “ethical hacking projects”, performing simulated attacks to test the security of a company’s systems and networks. They use their skills and knowledge to mimic the actions of real-world attackers and identify potential entry points that could be exploited by malicious actors. High-level Engagement Steps A team of offensive engineers (usually called red team), use a set of steps like the ones below, to perform their engagement. : Determine the scope of the engagement, including what systems and networks are in scope and what types of attacks will be simulated. Scope : Conduct reconnaissance to gather information about the target systems and networks, such as IP addresses, network topology, and software versions. Reconnaissance can be either passive or active. Gather information By passive we mean, searching public information or semi-private ones like social media. Two known tools in the passive recon realm are the Shodan search engine and theHarvester. By active we mean directly probing a system with tools like Nmap or Amass. : Use tools and techniques to identify vulnerabilities in the target systems and networks. This can include scanning for open ports, testing for weak passwords, and looking for unpatched software. Known tools here are Nessus and OpenVAS. Identify vulnerabilities : Attempt to exploit the identified vulnerabilities to gain access to the target systems and networks. Metasploit anyone? Exploit vulnerabilities : Record all findings, including vulnerabilities that were successfully exploited and those that were not, as well as any recommendations for remediating the issue. You thought you will only break machines and go home? 🙂 Document findings and report Who Decides the Minutiae? A company might have an internal or an external red team. An engagement process is usually proposed by cybersecurity organizations like and might be adapted to the team’s needs. An internal team might be affected more by the decision of senior leadership (e.g., the ) than an external team. MITRE CISO Regardless of whether the red team is internal or external, the engagement process should be well-defined and documented to ensure that all parties understand the scope and objectives of the engagement. How Do You Become a Red Team Member? I think the right question is, how to increase your offensive engineering mindset. Becoming a red team member is a by-product of that. In my humble opinion, even though there is a shortage of people with proper cybersecurity skills, the red team area is a bit congested. To start building your offensive mindset, I would suggest the following process: . Yeah, there is no shortcut to that. A good starting point is Coursera’s on the fundamentals of cybersecurity. Learn about cybersecurity foundations course Confidence with programming. Not a deal breaker, but you will need to write your exploit or automate a process, sooner rather than later. . Same as above, not a deal breaker, it will level up your game faster if you do. Confidence with networking . You need to be able to construct an attack route, given a vulnerability. Most of the time, you will have seen something similar before, but sometimes not. And this is where you truly need that skill. Analytical thinking . No escape here either. You can use platforms like and or build your own lab with vulnerable images like Practice, practice, practice tryhackme hackthebox vulnhub . Attend , read industry , and participate in online communities to stay informed. Stay up-to-date conferences publications Conclusion Becoming an offensive security engineer is a challenging but rewarding career path. It requires a combination of education, work experience, certifications, and ongoing learning to stay up to date with the latest security tools and techniques. With the right skills, knowledge, and experience, offensive security engineers play a critical role in protecting organizations from cyber and helping them stay one step of attackers. threats ahead

How to Join the Offensive Security Highs (Part 1 of the Journey)

The security operation center analyst, often called the SOC analyst, is a lesser-known profession in IT. I didn’t know that it’s a career of its own until I spoke with someone who just made the transition to tech, and this was the path they followed. Let’s see what this career has to offer. Interview with an expert Today we have sharing insight from her very recent transition to the field. Sara Bazán Izquierdo What was your background before switching to IT? I studied business and tourism, so I didn’t have any knowledge of programming or IT. It was all new to me. What was your path to get into security? In the beginning, I used mostly free and affordable online courses. I started with , and then I did on Coursera, and, for security, I used . After that, I enrolled in a cybersecurity boot camp. The boot camp provided the basic knowledge for getting a position as a junior SOC analyst, plus tips on how to job search while changing careers. CS50 a Google course about IT TryHackMe What was your motivation to change your career? I wanted to find something more exciting than what I was doing previously. And security was a very interesting and fun topic. Also, I wanted a job I could do remotely. Of course, there are other benefits connected to the job that are also good motivators. How did it work out for you? After the boot camp, it took me three months to find my first job doing what I was aiming for and that allowed me to keep growing and learning. So, I was pretty happy. And after four months in that job, I was recruited by a different company with better benefits. How did your background impact your job search? The most valuable “skill” I had was knowing English. Other skills like customer service (in security, you often need to speak with clients) and adaptability can also help. It is important to check which of the skills you already have can be transferred. There are probably more than you think. What exactly do you do in your job? I analyze the different alerts that are triggered in a client’s environment and decide how to handle them. What do you like the most and the least in your current role? I like the cool alerts where you get to use different tools to investigate. You feel like a detective. I don’t like how it can get repetitive. Some alerts are triggered often and it can be a bit boring when you do the same over and over. How can one know if security analyst is a job for them? Often it is a 24/7 job, at least when you are a junior, so you need to decide if that works for you. Each day is different. Maybe one day, you have very little work, and the next one, alerts are raining down on you. You need to know a bit of everything. So, you will probably enjoy it more if you are curious about IT roles that are a bit different. What new opportunities have you seen open up for you due to experience in security? Security opens up a lot of doors if you keep learning. It’s a huge field in IT with many different positions. It will depend on what you choose to learn. At the moment, I’m more focused on my current job, so I haven’t done much research on my next move. What is the best way to start? I suggest trying free or affordable resources. There are websites like or TryHackMe that I found very useful. If you like it, then you can decide the best way for you to gain more knowledge and maybe invest in a more expensive path. Cybrary Non-development jobs in the tech Today, thanks to Sara, we’ve learned a lot about SOC analyst jobs. IT as a sector has grown tremendously, and with its size, so too has the variety of different specializations inside it. Even as an insider, you often don’t know what work profiles are needed in companies of different sizes or in other domains. I’ve already covered some ways of getting your foot in the door of IT with non-development jobs: , Software Testing and How You Can Use it as a Tech Entry Job How You Can Expand Your Content Skills to Get Closer to Tech There are some other profiles worth exploring: product owners, UX designer, technical writers, and UX writers, to name a few. Let me know in the comments if you are interested in learning more about non-programming jobs in tech. Also Published Here

A Day in the Life of a Security Operations Center Analyst and How to Get Such a Job

This story is a part of Hacker Noon’s ** **initiative. The series is intended for tech professionals in any field to share their experience of building a career in tech and help bust the common myths beginner techies are facing. How to get a job in tech If you too would like to share your experience, . you can do so here What is your current position? Running my own company doing bits of consultancy, bits of training and teaching, bits of speaking, bits of writing, a lot of learning. These days it’s hard to define under one label as it’s the overlap between whatever I find interesting and whatever provides value to clients. It certainly brings challenges when people ask me what it is I do. How long have you been working in tech? Over two decades now, so it’s been a while. Up until the last couple of years it was always as an employee, until I sensibly went independent shortly after lockdown came in through the UK. Just as a note, I would not recommend voluntarily leaving stable, secure, and enjoyable employment in the middle of a global crisis to try taking over and running your own business. It worked for me, but I’ve had plenty of anxious nights thinking what could go wrong. Over the time I’ve been in tech, I’ve done tech support, field laptop repair, development, architecture, SOC monitoring, engineering, management, risk, compliance, and a number of other things. There’s been no career plan or carefully plotted path, simply eagerly grabbing onto the next opportunity when I felt the time was right - even if it meant I had to sprint to catch up. What is your educational background and how did you end up in cyber security? University dropout originally, with a smattering of A-levels. I did end up going back to university to earn a masters in 2017, but for most of my career my education was more based around professional certificates and self-education - or support from people I’d count as mentors. My journey into security is really difficult to judge. Arguably I was involved in it way back at the start of my career, managing school networks shortly after the second UK Data Protection Act had come in - so information security was fresh in everyone’s minds. At that point, information security was still the new buzzword and cyber was a long way over the horizon. Nowadays I usually say that I’m in security, not narrowing it down to a specific domain like information or cyber, but up until a few years ago I still described myself as in cyber security. Pointing to a specific point where that happened is more of a challenge. It’s one thing I strongly suggest now to those trying to get into security, it’s easier to break in by accident than on purpose. If you’re in something even peripherally related and can get involved with the security team in an organisation you can find yourself in the field before you even know it. We’d love to know a bit more about the mentors, was it a format arrangement? Very much not formal - the best mentor/mentee relationships often aren’t. There are two people I’d point to as mentors throughout my career though, and working with them corresponds to my two longest tenures in roles. The first was in one of my earliest roles, a guy who saw potential in me to do more than sit on the helpdesk and brought me in to help with architecture and virtualisation, which gave me a huge boost at the beginning. The second was much later, a few years before going independent, and really filled in the missing pieces. She had worked with my employer at the time for 17 years, and her guidance on how to operate through organisations, juggle with the politics, and engage people’s self-interest where needed has been hugely effective ever since. What was the best piece of advice you got over the course of your career? “Remember it's only a model." There's various forms of this, but it's been vital through the years. Far too often in this field we slip into the trap of thinking we have the answers because we've decided one model or another is the 'truth'. This soundbite is a reminder that no matter what model we're using we shouldn't get too attached - it's only a guide to thinking and understanding, not a rulebook. I’ve come across people far too often who’ve latched onto one idea as the and cannot let go of it. Whether that’s the CIA triad, out of date password advice, particular risk models, approaches to testing, or anything else it is vitally important to be able to let go and rethink things through a different lens. truth One thing I keep telling my own students, to the point where it’s become an in-joke (although nowadays there’s enough of them it’s not really in so much as just a joke) is that there are no right answers, just ones that are less wrong. It’s flippant, but in security it’s true, there is no end goal or perfect answer - we work on a mix of aiming for and continuous improvement. Stopping and deciding any one answer is is where problems start. good enough right The Importance of Self-Learning in Cybersecurity Mixed. I’ve gone through professional training, academic training, and a lot of self-learning. I wouldn’t say any one of those was more or less important than the others, it’s the blend that’s been valuable and got me to where I am. Mix and match, don’t devote yourself to one way of learning. You will get a lot of advice about platforms like and , and they are incredibly useful . Where this goes wrong is that penetration testing is a tiny subset of the cybersecurity field, and it’s one of the most competitive to get into since it’s seen as the ‘sexy’ pathway. Going down those paths to the exclusion of all else will not help you with GRC (Governance, Risk, and Compliance), security architecture, cryptography, architecture, forensics, or any of the other dozens of options that are available to you. HacktheBox TryHackMe if you want to get into penetration testing and are two organisations who provide a measure of blue team self-training materials, and there are plenty of YouTube videos available on technical areas such as incident response and forensics that you can find. Security Blue Team Immersive Labs It’s when you step outside the technical that things can become challenging, and the best advice here is to turn to books and advice from those already in the field. Given the vast range, I’m not going to provide a complete list of books I’d recommend (it would be far too long, maybe another article), but many of us in the industry are always happy to talk to those looking to break in and provide some recommendations. I will provide a few I always suggest though. by Cliff Stoll The Cuckoo’s Egg One of the earliest narratives of cyber espionage, this tracks an investigation and illustrates the foundations of modern digital forensics and investigations. by Eliyaho M. Goldratt The Goal While nowadays The Phoenix Project may be better known, The Goal is the work it is based on and there is something about the much more concrete examples of manufacturing that I find make it more relatable and grokky. by Robert Cialdini Influence Often recommended by social engineers, Cialdini’s work is worth reading for everyone as you will come across many situations in your career where it’s relevant - it’s also a great work for recognising the principles being used against you. by Stephen R. Covey The 7 Habits of Highly Effective People One of those books that people can be a little cynical about, 7 Habits is a classic for a reason and still has a lot to add. Definitely worth a read. by James V Stone Information Theory: A Tutorial Introduction While everyone knows a little about cryptography, Shannon’s work on information theory is often overlooked. While most people in security will never use it directly, taking some time to understand it can give you a completely different view on things that will make a difference throughout your career. Knowing what you do now, where do you think one should start learning if they want to work in your position one day? Wherever you can. Having said that, I still say that schools are a great place to start - not studying, but managing systems. Schools are often under-funded, have a huge range of technologies, take security seriously at a management level, and are a brilliant way to dive into the deep end and learn really fast. Certificates are a difficult topic - there’s a lot of marketing and snake oil around them, and many are ultimately only assessed by multiple choice tests which makes them less-than-useful as a way of measuring ability, and far too easy for people to abuse. Some have useful knowledge in their curriculum, but you don’t need the certificate for that, so it’s often best to treat them as keys to unlock roles where they’re required - but not go credential-chasing unless you have to (ideally once you’re in and a company is paying for your training and exam). A few things I would suggest are trying to learn to let go of pride - that took me a good few years and cost me plenty in that time - and always reserve the right to be completely wrong about things. Also be ready and willing to fail, learn, and try something different - don’t hold on to failing situations, it’s perfectly fine to give up when something isn’t working. What is the work-related achievement you’re the most proud of? That the family company I took over is still going from strength to strength after two years of me running it. It's even growing, despite (or possibly due to) our rather unique way of working. Just keeping it going would have been a triumph, but the way we’ve developed since I took over is something I’m truly proud of. What do you think is the biggest myth about starting a career in cybersecurity? That application forms are the way to go. While the whole idea of the ATS system that looks at keywords is a bit of a myth, the sheer number of applications you’re going up against for the advertised entry level roles puts you at bad odds. It’s far better to network and bypass the system by getting dropped in with a personal word for someone. On a less serious note: What do you listen to while working? It’s fairly eclectic - a lot of instrumental stuff when I’m doing anything that requires a lot of thinking as I find that vocals distract me. Otherwise it ranges through country, jazz, trance, and whatever else pops up. Thanks so much for taking the time to tell us more about your career path. Any words of wisdom for aspiring techies? Forget following your passion. When most people talk about following your passion in a career, they’re looking at it backwards. The passions you have at the start will not be the same as later on, they are changeable whims and trying to strictly adhere to one - or worse, believing there is something wrong if you don’t have one - is a good way to kill them dead, fast. Instead, indulge your curiosity. Follow what interests you, and don’t hold yourself bound to those interests as and when they change. True passion follows curiosity and effort to satisfy it, not the other way around.

How to Get a Job in Cybersecurity 

Cómo conseguir un trabajo en ciberseguridad

Comment obtenir un emploi en cybersécurité

साइबर सुरक्षा में नौकरी कैसे प्राप्त करें

サイバーセキュリティで仕事を得る方法

Como conseguir um emprego em segurança cibernética

Làm thế nào để có được một công việc trong an ninh mạng

如何在网络安全领域找到工作

Created a Github page with useful materials for those who want to start to learn pentesting/hacking. GitHub - creotiv/start-learn-pentesting-red-team !!! Always do all work from VM or dedicated machine for that, remember that all tools that you install may have some malware(mostly not but the risk exists). 
So you should prevent access to your real machine. Also dont forget to use VPN, even when using training VM from hackthebox (because you will be sharing same network with many people) BOOKS & ARTICLES — Course for beginners https://www.youtube.com/watch?v=WnN6dbos5u8&ab_channel=TheCyberMentor Staring Point course from https://www.hackthebox.com/ — How to pawn Juice Shop guide https://pwning.owasp-juice.shop/ — many tutorials and howtos https://book.hacktricks.xyz/ — exsploits & reverse engineering course https://guyinatuxedo.github.io/index.html — buffer overflow for beginers https://medium.com/purple-team/buffer-overflow-c36dd9f2be6f — buffer overflow, how to pass ASLR & PIE & NO-STACK-EXECUTION protection https://medium.com/cyber-unbound/buffer-overflows-ret2libc-ret2plt-and-rop-e2695c103c4c — OWASP testing checklist. Help to not forget something https://github.com/tanprathan/OWASP-Testing-Checklist — OWASP testing guide for checklist above ^ https://owasp.org/www-project-web-security-testing-guide/v41/ TOOLS — VM player to run Kali https://www.vmware.com/products/workstation-player.html — Kali linux for pentesters. Base Tool https://www.kali.org/ — web site vulnerability scanner. https://github.com/sullo/nikto — wordpress vulnrability scanner. https://wpscan.com/wordpress-security-scanner — NMAP port, script, vulnerability scanner. Base tool https://www.kali.org/tools/nmap/ — Login cracker for different protocols https://www.kali.org/tools/hydra/ — Dir,Subdomains enumerator for websites https://www.kali.org/tools/gobuster/ — Pentesting framework. Base Tool https://www.metasploit.com/ — Privilege escalation for Win. Base Tool https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS — Privilege escalation for Linux. Base Tool https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS — console debugger https://www.kali.org/tools/gdb/ — edb debugger with ui https://www.kali.org/tools/edb-debugger/ SERVICES Data arvesting — find emails on domain https://hunter.io/ — find if email was leaked https://haveibeenpwned.com/ — subdomain search https://crt.sh/ — technology stack info https://builtwith.com/ — servers search engine https://search.censys.io/ — servers search engine https://www.shodan.io/ DATA LEAKS — how passwords changes with time + 1.4B email:pass https://github.com/philipperemy/tensorflow-1.4-billion-password-analysis TRAINING — Platform with VMs that you can try to hack https://www.hackthebox.com/ — training site https://tryhackme.com/ — Training app for web pentesters https://github.com/juice-shop/juice-shop — excercices for hackers (not free) https://pentesterlab.com/ EXPLOIT DBs https://exploit-db.com https://www.seebug.org/ WORDLISTS — many different https://github.com/danielmiessler/SecLists/ — SQL inj payloads https://github.com/payloadbox/sql-injection-payload-list — web payloads https://github.com/foospidy/payloads

Learn Pentesting/Hacking - The Red Team

Photo by on Nahel Abdul Hadi Unsplash When you hear the word 'hacking', the first thing that pops in your head is how cool they look in the movies—I mean, they are cool in real life as well, but it is not the same. Hackers are not only there to break into your websites or accounts; they are there to provide security and improve it as well. They do it by finding different ways to break into an application—these are called vulnerabilities, and they report them to the company that owns the application. The company then sees to it that it does not happen again by improving their security. In this blog, I am going to be sharing the roadmap and the resources that you can use to become an ethical hacker. RESOURCES: Programming : Python https://www.youtube.com/watch?v=0NQ2aMxBYNE Database: : SQL https://www.youtube.com/watch?v=2nXOxLpeu80 Terminal: : CLI, Bash terminal https://www.youtube.com/watch?v=kGVHUBGZm3E Networking: https://www.youtube.com/watch?v=3Kq1MIfTWCE https://www.youtube.com/watch?v=X4eRbHgRawI Useful Links: https://www.youtube.com/watch?v=3Kq1MIfTWCE&list=PLWKjhJtqVAbnklGh3FNRLECx_2D_vK3mu https://www.udemy.com/course/complete-ethical-hacking-bootcamp-zero-to-mastery/ https://www.udemy.com/user/zaidsabih/ https://www.udemy.com/user/nathan-house/ https://www.coursera.org/specializations/intro-cyber-security https://www.youtube.com/watch?v=fNzpcB7ODxQ https://www.youtube.com/channel/UC1szFCBUWXY3ESff8dJjjzw https://www.youtube.com/c/InsiderPhD/videos https://www.youtube.com/c/STOKfredrik/videos https://owasp.org/www-project-web-security-testing-guide/latest/ https://null-byte.wonderhowto.com https://www.hackingloops.com http://www.securitytube.net https://www.hackthissite.org http://www.enigmagroup.org Other useful websites for free and paid courses: https://www.guvi.in/mlp/master-cyber-security https://intellipaat.com/cyber-security-course-certification/ https://portswigger.net/web-security https://pentesterlab.com https://www.pentesteracademy.com (best) https://www.cybrary.it https://www.udacity.com/school-of-cybersecurity https://cyberstart.com https://www.offensive-security.com https://www.hackthebox.com (bug bounty) https://www.hackerone.com https://tryhackme.com https://my.ine.com/learning-paths https://www.virtualhackinglabs.com https://hackersacademy.com If I missed any topics, please include them in a comment below. If you know any other resources please share them. It will be very helpful for others who want to learn. Follow me on if you liked what you’ve read. LinkedIn Also published here

Stories, News & Mentions about TRYHACKME

Tryhackme’s Stories on HackerNoon

Tryhackme's News & Mentions