A modified resource dump: By Ryan
Inspired by y5's teachyourselfinfosec.com
Disclaimer: I still have a long way to go, and I do not know everything, and I never will know everything, but if you want to get really good at things quickly, there are resources out there for you. This document will be long, but it's all good stuff.
Note that I am definitely biased with what resources I have, and I wish this list was a bit more balanced. If you have any resources you would like to see, please let me know, definitely some "TODOs" lying around in this PDF. You could also google for "awesome security resources list" on GitHub and probably find even bigger lists, but this is mostly resources that have worked for me or stuff I know works for others.
Stolen from DFIRmadness
Quote DFIRmadness:
"Mastering the basics will make you exceptional."
Master the basics and then specialize to be an invaluable asset to your team.
To start, or level up, a career in Information Security (aka Cyber) Security you need to be proficient in five key areas of technical skills. You don't have to master each one of them, but you need to have a good understanding of them. Whether you want to go offense or defense you will need to be functional in these five areas: General computing, Networking, Scripting/Programming, Linux/MacOS, Windows.
To do security, you have to know what you're securing and how it works, simple as that. No one's expecting you to do a Computer Science degree overnight, but trying to gain a fundamental understanding of these five categories (basically completing most of your 200-300 level classes in your major) is pretty important. Again, no one's expecting you to know everything.
I encourage you to read through the original post, and I won't cover everything here, but here is an outline of resources/classes that are relevant.
- General Computing
- Don't worry too much about this one, college does a decent job at teaching these things
- Classes
- Intro to Computer Science
- Computer Organization and/or Operating Systems
- Resources
- Networking
- Classes
- Intro to Networks
- Lewis offers two more classes in that series, "Switching, Routing, and Wireless" and "Network Security", both of which are very good if you want to up your networking game. Note that they go pretty deep into networking, which can be very different from competitions, other classes, etc.
- Resources
- Programming
- Classes
- Bascially 25-50% of your degree if you're CS or Cybersecurity
- Resources
- freeCodeCamp.org - Literally teaches the basics of any language your heart could desire
- Harvard CS50 - You will know most of this stuff from Intro to CS, but the C stuff is what matters
- There's no need to become the Rosetta stone of languages. Python and JavaScript seem to rule the world these days, and the rest depends on what you focus on. Learn languages as you need them, don't learn it for the sake of saying "I know how to program in QBasic".
- Cool languages that might be interesting to look at though if you're bored: C/C++, Rust, C#, Golang, JavaScript, Powershell, Ruby
- Code Wars - more leetcode style problems, but definitely small, neat challenges that can help get you some practice with a new language if you don't have time for a full project
- Linux
- Classes
- Intro to Unix (Cybersecurity majors are forced to take this. CS majors can choose to do it as an elective, or you could literally learn this one on your own, up to you)
- Resources
- Over the Wire: Bandit - An online game where you have to run specific linux commands to find the next part. Excellent resource to get familiar with the Linux command line.
- TryHackMe: Linux Fundamentals - They just teach you the commands in an interactive way
- The Taggart Institute - A pay-what-you-can platform offering text-based courses on regular expressions, vim, the Linux command line, etc.
- Windows
- Classes
- Operating Systems
- Computer Security 1
- I actually have no clue if there's a class that just focuses on Windows
- Resources
Once again, I encourage you to check out DFIRMadness for the wonderful document they put together to highlight this. Now, time for the main show.
Ok, so there are a LOT of different areas of infosec, so to keep things simple, I will provide resources under general headings.
Please note, you do not need to be an expert in all of these domains, and there is no need to feel obligated to stick yourself into a single hole. Generally, people will develop a specialization in 1-3 domains as they progress in their careers, but just do what makes you feel like you're progressing and you'll find your way.
- Install VirtualBox and the extension pack.
- A lot of security work is done in Virtual Machines (VM's) so we make sure we isolate our test environments from our personal data
- Use VirtualBox to install Kali Linux, which comes prebuilt with a lot of hacking/security audit tools
- With time, you will become more proficient with virtualization and distributions where you get to the point where you want things done a certain way, but for now, Kali is good enough.
- Official Guide: link
- Get yourself a code development environment like Visual Studio Code
- When you take classes with professors, each one will probably tell you to use a different environment (e.g. PyCharm, IDLE, Eclipse, Notepad++). It's more important that you know your tool well, instead of copying what a teacher does on a program and then never using it again. TL;DR: Use whatever you want I'm not your mom
- Install Git, you should learn it.
- Network Engineering and Homelabbing could be a whole document on their own, so I highly recommend finding someone who does this as a hobby and just asking them
- The Taggart Institute has a collection of VODs where they build up a homelab live on Twitch
- Ben Heater has a lot of stuff on his blog about building up a homelab and learning about networks so that's probably the most useful other thing I have
- Lab Ideas
- GOAD and BadBlood can both be used to set up or inspire Active Directory designs
- Set up a Web Server, Git Server, and get some CI/CD going, automate all the things
- Literally anything that you would find useful in your day to day. You don't always need to create a full network, maybe you just have one server at home that's useful to keep as a media storage server or something else.
- TryHackMe is an online platform that will teach you how to hack from the ground up. It's how I got my start, and I am indebted to it. 80% of the content is free, and the subscription is only
$8 a month $11.20 a month with the student discount.
- picoctf is an introductory CTF (capture the flag) that gives you some puzzles to solve. They're not all pentesting related, but I didn't have a better place to put this, so here we are.
- That said, some of their newer challenges even cover topics like Browser Exploitation, so I wouldn't neglect this even if your
- HackTheBox is where you put your pentesting skills to the test. It's a very "Try Harder" attitude, meaning I would NOT recommend it for beginners. However, if you want to put your CTF skills to the test, go for it.
- If you are willing to spend $8 a month (student subscription), HTB Academy gives you access to their entire penetration tester path (CPTS) for their certification. Whether or not you do the cert is up to you, but the course material is about as good as OSCP, a cert that is almost essential to break into the offensive security job market.
- VulnHub is where you can download vulnerable virtual machines to hack. (Edit 9/22: VulnHub doesn't seem to be getting much love these days, seems they've been taken over by OffSec Proving Grounds but I'm not totally sure)
- Blue Team Labs Online is a gamified learning platform for defenders to practice their incident response and forensics skills
- letsdefend.io is another platform that has some free content to help build SOC related skills
- Cyberdefenders hosts a variety of new and old forensics challenges that are helpful to work through investigations
- Tracelabs is crowdsourced OSINT (open-source intelligence) to find missing people, but they also have a lot of good investigative stuff to learn about.
- 13Cubed's Forensics Youtube highlights a number of tools and techniques to make the most of whatever forensic artifacts you have, and has very good nuggets of information
- Boss of the SOC is a team-based CTF where you use Splunk (google it) to conduct investigations
- OverTheWire: Natas is like Bandit, but now you learn about some basic web vulnerabilities
- OWASP Top 10 represents the most common web app vulnerabilities and is a standard for web app security. You can practice these attacks in OWASP Juice Shop, which is the TryHackMe version where you can deploy an instance to work with.
- PortSwigger Web Security Academy is a free set of web application security labs made by the same people who made BurpSuite, which is the de facto tool when dealing with the web.
- HTB CBBH Course is a course that builds up to a certification from HackTheBox that means nothing. However, the course content is put together very well and focuses a lot on bug bounty (mitigations are mentioned, though), and with a student email, only costs you $8 a month to get full access to (very good deal!!!!).
- Get a Raspberry Pi and build your own web server. Plenty of resources and tutorials on Github and Youtube for that. One of the best ways to learn how to secure something is to build and maintain your own infrastructure. (Or you could just build the webapp locally but homelab is cooler)
There are certainly more resources out there, I just need to find them
- I know Wireless Security (the class) teaches some mobile and wireless stuff
- ippsec has a video on how to set up Android emulation so you can dynamically analyze an Android app
- HackTheBox's blog has an article explaining some basics
- HackTricks has a fairly lengthy compiled list of things
- TODO: More mobile stuff
¶ Reverse Engineering and Binary Exploitation
You can tell where my biases are
- Malware Unicorn has a few free workshops to go over some basics and advanced techniques related to reverse engineering and malware analysis
- ost2.fyi also has a good amount of assembly/debugging courses, but I haven't done any of them (I've heard good things)
- Pwn.college is an online course (run by Arizona State University) that takes students through program functionality, Assembly, debugging and reverse engineering. Each module has videos and practice problems.
- Nightmare is an online course focused around CTF challenges to teach different RE concepts. Each challenge has a writeup and can be 'solved' using open-source (free) tools.
- ROP Emporium is a set of 8 challenges to teach you advanced techniques in stack-based buffer overflows.
- HeapLAB is a paid course on Udemy taught by the creator of this website to teach heap exploitation. If you really liked learning about buffer overflows and want to continue this path, highly recommend picking this one up.
- LiveOverflow's Binary Exploitation are video walkthroughs from learning C to doing heap exploits.
- CryptoCat's Intro to BinExp series covers basic stack based buffer overflow stuff that you might find in a CTF. I think it could be a little more technical (would not recommend if you know nothing about C/assembly), but the later videos are great explanations of some more
- ir0nstone notes are good bite-sized reminders of certain concepts
- Also Computer Security 2 teaches the basics of this
- Practical Malware Analysis is a book that we have access to from O'Reilly, highly recommend to learn some of the basic techniques. Some of the tool info is outdated, but the principles and methodology apply
- Practical Malware Analysis and Triage is a course taught by HuskyHacks and is the best introduction to malware analysis. It is well worth the $30 for the course.
- UPDATE 7/1/23: TCM Security has now moved to a subscription model which is $30 a month, which can kind of be a steep price if you don't finish it in a month.
- The first half of the course is available on YouTube here: youtube.com/@HuskyHacks
- OA Labs has a lot of high quality reverse engineering guides/lessons, primarily focused on malware analysis
- Take Encryption at Lewis
- Serious Cryptography is the book used in that class and its pretty good, you have access to this via Lewis (O'Reilly)
- CryptoHack is a gamified platform exclusively for cryptography and cryptanalysis. Very, very smart people over in their Discord - 100% recommend this.
- CryptoPals is a collection of cryptography exercises which are very programming-oriented (e.g. making you write your own frequency analysis, writing a padding oracle attack)
- MysteryTwisterC3 focuses more on crypto design and didactical aspects (like a tutorial in differential cryptanalysis) and it includes many challenges with historic or "obscure" procedures and machines (like HandyCipher or Sigaba).
- Dan Boneh's Cryptography Course is another resource to learn the subject
- Books - if you want to dig deep
¶ Law and Policy
TODO sorry!
- As a Lewis student, part of your tuition is going to an O'Reilly Subscription - USE THIS
- One series of books that's good is the entire No Starch Press line, they publish great books on a wide variety of security topics
- There's also some instructional and cert prep books outside of it that are definitely worth looking into. Some suck, others are great.
- TODO
There's plenty out there, but I will list my favorites here (warning, heavily biased towards my own interests):
- John Hammond is currently a Senior Security Researcher at Huntress Labs who makes content on YouTube on the side. Whether it's a CTF writeup, mini-documentary series, or just a livestream VOD, John is very friendly and explains concepts well, both hacking and forensics. He also just knows a LOT.
- LiveOverflow is just a gold mine of information. His specialty is the binary exploit and hardware side of things, but he has videos on all areas of hacking, and more specifically, exploit development research. He also attends probably the biggest hacking events, so that's interesting to watch.
- ippsec and 0xdf are architects over at HackTheBox that develop lab content and also do writeups for the boxes on the platform. Although it's more CTF/Hacking content, both do an excellent job of diving deeper into the root cause of the security issues they find, which is helpful from the defender's POV.
- mttaggart - A great instructor on both the defensive and offensive stuff, streams regularly on Twitch, and has an excellent series of VODs on setting up a homelab.
- LaurieWired is a reverse engineer that tends to focus more on mobile, but still produces high quality walkthrough videos on YouTube
- Alh4zr3d is a red teamer in the field who streams on the side, and I've really liked his stuff lately. Take the energy of a popular streamer, make him a hacker, and now you have Alh4zr3d.
- Malware Unicorn has a bunch of amazing reverse engineering and malware analysis content on her site, Twitter, and Github, including a bunch of mini-workshops that are just free to go over.
- Marcus Hutchins - Former black hat who stopped wannacry and now does consulting and writes good blogs on his website related to red team tactics
- VX-Underground is a non-profit organization that has a large vault of malware and also posts security news on their twitter about new developments and leaks.
Other ones that I know are good but don't want to dedicate a whole paragraph to.
- Azeria aka Fox010 - Mac OS and ARM architecture is an area that can definitely slip past your radar, but Azeria has produced so much work on the internals and reverse engineering of this stuff
- Vickie Li - Awesome blog, application/web security focused (doesn't post that much as of 1/10/24)
- CryptoCat - Very good CTF writeups, also has a good voice, has recently pivoted into video game hacking
- chompie1337 is an exploit dev researcher with a fire Twitter. Tell me this tweet isn't funny. But also very, very proficient with low level stuffs.
- HuskyHacks - Red teamer who teaches a malware analysis and responsible red teaming course, also cool person.
- c3rb3ru5d3d53c - Malware analyst that streams a lot of her work and regularly publishes tooling to GitHub
- Darknet Diaries - THE infosec podcast that everyone talks about
Hopefully I can grow this list a little bit more over time (I'd like to make it more diverse but it's hard to find people who are producing stuff consistently), so let me know if there's anything you think I should add to this list!
What were once IRC chats have now manifested in many, many discords. If you want to chat with professionals or other people in your position, I highly recommend checking out some infosec discords.
Don't try and join every single one possible. It's much more beneficial to eventually try and find what community feels best for you.
I hope this wasn't too overwhelming, I know it's a lot. But, now that you have a baseline of where to start from, just go for it! Start with TryHackMe for sure, but branch out in whatever way you feel like. You get out what you put in.
Good luck out there! You'll do great!
Happy hacking (or defending)! o7