I’ve always been fascinated by hacking, but I honestly don’t know where to start. I want to learn ethical hacking and cybersecurity from scratch. If you’re experienced in this field, I’d love to hear how you got started and any advice you can share. Feel free to DM me!

I'm Kai from KSEC, UK/EU distributor for Hak5, SPARROWS, Pro Pick, Electronic Cats and other manufactures of cyber tools. My LinkedIn: https://www.linkedin.com/in/kai-c-724034b0/

A question I get a lot is where to start if you are more into hardware than code. This is the order I would suggest:

1. Locks first. Cheap, safe and it teaches you to think about how security fails mechanically. A clear practice lock and a basic pick set are enough.
2. RFID and access control. Learn how badges and readers talk to each other, then what a Proxmark can and cannot read.
3. USB and Wi-Fi tools. Keystroke injection and Wi-Fi auditing show you why physical access matters so much.
4. IoT and hardware. UART, SPI, sniffing and basic fault injection.

Good free resources for each: LockPickingLawyer and Lock Noob on YouTube for locks, the Iceman Proxmark3 wiki on GitHub for RFID.

We're also building free learning paths on onlysecurity.com that follow this order, with certificates: https://onlysecurity.com/learning-paths/ (free account needed).

I am a systems integrator going on 5 years of experience. My duties include programming and commissioning control systems, and setting up secure remote access for SCADA systems, and building the SCADA systems themselves for critical infrastructure. I frequently configure managed switches and the occasional firewall, but deal with networking every day even though its not the main focus of my job. I wear many hats and have learned a lot in my position.

I am considering attempting a career jump to something security related since the pay seems better based on what I see online. Would anyone be able to recommend a good starting point for me? The typical "Start at the help desk" advice is not overly useful in my case and I wouldnt be willing to take that pay cut anyways. Do you think I would even have any success coming to cybersecurity from this background? Obviously I consulted AI and its built to just glaze you, so I took its response with a cubic meter of salt. Any recommendations for certs coming from this direction or roles I should target? I would even take an entry level role on nights alongside my current so I can learn some things before fully transitioning

Thanks for any help

A lot of businesses invest in website design, animations, and features. But one important question often gets ignored:

How secure is your website?

A website can look perfect on the outside and still have security weaknesses behind the scenes.

Here are 5 things every business owner should pay attention to:

- HTTPS & SSL: Protect data exchanged between visitors and your website.

- Authentication: Make sure only authorized users can access admin features.

- Database security: Restrict access to sensitive information and configure permissions properly.

- Input validation: Protect against common attacks involving malicious or unexpected inputs.

- Regular security checks: Review vulnerabilities, access controls, and error handling regularly.

One important thing to understand: having HTTPS does not mean your entire website is secure. Security requires multiple layers of protection and ongoing maintenance.

At Shakuntala AI Agency, we believe websites should be built for more than appearance. They should prioritize security, performance, reliability, and user trust.

I'm interested in hearing from developers and business owners:

What's one website security mistake you see businesses making most often?

Let's share knowledge and help more businesses build safer websites.

Please Helpme with this. Any resources for this ?

Hello everyone, I'm about to give an interview for an application security profile. The next round will be related to threat modelling and security design. I need help to prepare. Threat modelling is not something that I was doing in my previous experience. I was mostly involved in pen testing of web, mobile, and APIs, so I'm really looking for guidance on how to prepare for it. I only have 2 days to prepare. Thanks and ya this will be the first time I'll be doing threat modelling in an interview.

Hello everyone,

We're introducing Lynnect, an early stage project focused on three areas of cybersecurity: learning, intelligence, and research.

The idea is to bring these areas closer together in a useful and responsible way.

We're still developing the project, so we don't want to make claims about things that aren't ready. At this stage, we're interested in understanding the challenges people face and what resources would genuinely help.

For those learning cybersecurity or working in the field, we'd love to hear your perspective.

What do you think is missing today? A clearer learning path, more hands on practice, better access to threat intelligence, research opportunities, or something else?

We appreciate thoughtful feedback from the community.

Thank you for sharing your perspective.

I've been doing external audits for small businesses in Spain (clinics, workshops, local shops). Most of them don't have a security budget, so manual pentesting is off the table.

I've built a scanner that runs 60 modules: ports, subdomains, headers, SSL, cookies, offensive analysis (SQLi, XSS, SSRF, XXE, subdomain takeover, JWT, API discovery, etc.). It covers more than enough external surface for any SMB.

Now I want to take it to the next level. For those of you doing this kind of work:

→ What would you add to a scanner like this to make it unbeatable?

→ Which attack vectors are still the hardest to automate?

→ Any module you consider essential that almost nobody implements?

Not selling anything, just want to build the best tool possible.

Thanks in advance.

#diddat hi im a newbie js tryna network

I'm currently studying Cisco Cybersecurity Essentials and have always enjoyed working with computers. I recently came across a post about different ways to gain experience in cybersecurity, and it got me curious.

I'd love to hear from other cybersecurity students and professionals about how you got started and what helped you learn the most.

What would you recommend someone like me focus on first? Networking, hands-on labs, certifications, TryHackMe, or something else?

I'm just looking to learn from your experiences and hopefully get pointed in the right direction.

Thanks in advance for any advice!

I am a first year student and I want to build my career in cybersecurity and for that I need guidance as I am going from scratch so I need guidance from the people who are learning about this niche or have already built a career in this.

Dear Everyone,

I am conducting this survey as part of my university thesis on cryptography, internet security, and the protection of personal information online.

The purpose of this questionnaire is to explore how people understand online privacy and security, and how they protect their personal information while browsing the internet. The questions focus on everyday activities, such as accepting cookies on websites, managing privacy settings, understanding encryption, and making decisions about sharing personal data online.

Survey Information:

• Duration: Approximately 7–9 minutes.
• Eligibility: Participants must be 18 years or older.
• Participation: Completely voluntary.
• Privacy: The survey does not ask for your name or email address. Responses will be used exclusively for academic research and presented in summarized form.
• Technical knowledge: No prior knowledge of cryptography or cybersecurity is required.

There are no right or wrong answers to questions about your opinions and personal habits. Please answer honestly based on your own experiences.

Thank you for taking the time to participate in my research. Your contribution is greatly appreciated!

Survey Link: https://forms.gle/ptG8GoAynhyMZRiK6

I am a Network Engineer switching to Cyber. I would really appreciate if I could get some pointers on what is wrong. Is there something I am missing or doing wrong?

If this breaks rule 5 I apologize, but has anyone gotten a text like this before. I know for a fact this is my coworker's number but it's just an odd thing to receive out of nowhere. Obviously I am not clicking the link.

Hi everyone! I recently completed my Bachelor’s degree in Business IT (Informatique de Gestion) and just started my Master 1 in Cybersecurity (SSI). My background covers software development, databases, and IT management (Java, C++, SQL, Oracle, UML, ERP), but I lack deep technical foundations in low-level networking, Linux administration, and system security. My goal is to apply for a Master 2 under an Alternance (Work-Study) program abroad next year. To make my profile competitive for both university admissions and corporate technical interviews, what core technical skills, tools, or home lab projects (e.g., Active Directory, Wireshark, Linux, pfSense, TryHackMe) should I master on my own this year? Any study roadmap or resource recommendations would be greatly appreciated!

Today, we use the internet for almost everything, including studying, shopping, banking, and communicating. But have you ever thought about how safe your personal information is online?

Cybersecurity is the practice of protecting computers, mobile devices, networks, and personal information from cyber threats.

Some common online threats include:

🔹 Phishing: Fake emails and messages designed to steal personal information.

🔹 Malware: Harmful software that can damage devices or steal data.

🔹 Ransomware: Malware that locks files and may demand money to restore access.

🔹 Password Attacks: Attempts to steal or guess passwords to access accounts.

The good news is that everyone can take simple steps to stay safer online. Using strong passwords, enabling two-factor authentication, updating software, and avoiding suspicious links can help protect your information.

You don't need to be a cybersecurity expert to start learning about online safety!

📚 Want to learn more?

Read my beginner-friendly article on CyberNexa:

https://learncybernexa.blogspot.com/2026/10/what-is-cybersecurity.html

#Cybersecurity #OnlineSafety #CybersecurityForBeginners #CyberNexa

¡Hola a todos!Estoy terminando Ingeniería en Informática y estoy desarrollando un proyecto académico llamado SecureCode.Es una herramienta que busca automatizar la evaluación de controles de seguridad en repositorios de GitHub, identificando cumplimientos e incumplimientos y generando evidencia para facilitar las revisiones.Para complementar el proyecto, necesito conocer la opinión de estudiantes, desarrolladores y profesionales del área TI sobre la utilidad de este tipo de soluciones.No necesitan ser expertos en ciberseguridad ni haber utilizado SecureCode. La encuesta incluye una explicación del proyecto.⏱️ Duración: 5–7 minutos.

🔒 Anónima y voluntaria.

🎓 Finalidad exclusivamente académica.

💻 Dirigida a estudiantes y profesionales del área informática.Enlace a la encuesta:

https://docs.google.com/forms/d/e/1FAIpQLSeiHEDD-ZIwY7WvqOXYJi8dAmAR4E44sejHmlwhqCa3JkExFg/viewform?usp=header

Me ayudarían muchísimo respondiendo. También agradecería cualquier comentario o sugerencia sobre el proyecto.¡Muchas gracias por su tiempo!

Throw away account.

I feel hopeless and I don't know what to do.

Back in 2020 I was swatted. No idea who did it or why. I'm a nobody from nowhere and I'm not a gamer or streamer.

In 2025 I was doxxed. Someone took a screenshot of a post on my private Instagram account and sent it to someone who blew it up all over the country on all platforms. They included my workplace and people commented my phone, address, family member names...ect.

I tried for months to get the posts taken down because I am concerned someone is targeting me. The platforms didn't care, in fact when I reported that my personal phone number had been posted without my permission- x told me they didn't see any personal information in the comment I reported even though it was my personal number and that counts per their own policy as personal information.

I gave up for a while because I just didn't know what else to do.

Now, recently, I guess a bunch of my log in and passwords were exposed online, then yesterday I received an email that someone was trying to log in to my deactivated Facebook account (I dont have social media anymore after being doxxed).

I am genuinely terrified, I am scared someone is targeting me because I'm not famous, I'm not chronically online...someone just doesn't like me (or i am just extremely unlucky and the swatting and doxxing are completely unrelated) but it seems like there isn't anything I can do about it.

I reached out to a bunch of lawyers after the doxxing incident but not a single one got back to me.

The doxxing incident was reported to the police when it occurred.

Does anyone have any advice or tips? I am about to give up and just accept that I'll probably be a victim of some sort of harm and there isn't anything I can do about it.

Tengo 18 años, ultimo año de escuela técnica con orientación en programación. Estoy pre-inscripto en computer science en la fceia-unr, pero no estoy seguro si es lo que quiero, me interesa mucho la ciberseguridad pero no encuentro ningun lugar para estudiarlo, me interesa algo serio y enfocado en seguridad ofensiva, pentesting, red team, etc. Siempre recomiendan ser autodidactas pero no me convence del todo ese metodo pq siempre prefiero tener a alguien que me instruya en el proceso sin depender de andar buscando 600 tutoriales en yt o cursos de udemy, soy fan de la ia y la ciberseguridad asi que me gustaria poder encontrar una disciplina que las combine, y en cuyo caso q no se pueda me da igual, quiero aprender seguridad ofensiva, pero me pone en duda pq tmb me gusta el desarrollo(actualmente soy pasante programador). Busco metodos para darme cuenta que enfoque realmente quiero seguir pq ambos me gustan, y en donde poder estudiar ciberseguridad en argentina, ya sea a modo de carrera o tecnicatura, investigue en algunos lugares pero suelen ofrecer cuotas muy caras para la inscripcion y hace practicamente un año estoy buscando y no encuentro nada. Que tecnicatura/universidad/carrera recomiendan para encontrar una solucion?

I'm a final year student and am currently looking into quantum-safe migration. I'm looking at the challenges of migration, especially in light of other priorities.

I just have a short survey of 10 quick questions - if you're able to spare me with 5 minutes of your time I'd be really grateful - all the good karma to you!!

Thanks in advance!

So basically my name is zaid Mahmood and write now I am in grade 11 I was wondering if u can give me tips to learn cybersecurity analyst so in college I can get a head start.

A threat intelligence researcher (@TheM3gatr0n) found an active, custom-built attack platform called Cairn on a Hong Kong-registered VPS. It is not a simple script or toolkit — it is a full autonomous orchestration system driven by an LLM (DeepSeek v4.1-flash).
The operator supplies a target and a goal (e.g., obtain a webshell or RCE). The AI then handles the rest: it spins up a dedicated Kali Linux Docker container per victim, reviews a fact-graph of prior attempts, selects the next action, executes it, records the outcome, and continues across sessions with almost no human involvement.
Over roughly 13 days it logged \\\~230,000 AI-dispatched events and \\\~18,000 active exploitation attempts against 85+ targets. It heavily focused on Magento/e-commerce systems and demonstrated adaptive behavior by tracking failures and writing structured summaries of what worked or was blocked. Access to the model was maintained via a subscription rotation service.
This is one of the clearer public examples of an LLM being used for real, ongoing autonomous offensive operations rather than one-off experiments.

https://x.com/them3gatr0n/status/2110406318976848132?s=46&t=oXrX4\\\\\\_YhCRl53cYhwA-HsA

Got interested in cybersecurity recently and have been binging it but I am not really doing anything practical at the moment rather it's mostly if not entirely theoretical. So I was wondering from where I could do practical work for free

Thanks!

Hey hola pequeños desconocidos, como bien dice el bello título estoy desarrollando una distro de Linux enfocada en la ciberseguridad pero esto no será ni de cerca como PHLAK, Backtrack, Katana o Kali. Llevaré mi juguetote más allá: La idea general es que toda información heterogenea (red team/blue team/osint/malware research/network deception /blockchain) convertirla en información homogénea y en base a eso poder ejecutar de forma automática o manual cualquier medida.

Esta cosa está planeada para no tener una, sino 3 LLM trabajando en conjunto en diferentes capas del sistema.

Adicional ya cuenta con 3 cores de evidencia, correlación y uno que evalúa la calidad de ambos.

Adicional va a tener 3 engines de auditoría para que cualquier futura herramienta o integración sean verificadas de forma automática e integradas de forma correcta sin romper nada.

Actualmente estoy en la parte de crear e integrar Oracle y Nexus para las posteriores integraciones de las LLM y después de ello terminar de pulir todos los módulos. (El de mayor avance es red team)

Aún no está disponible en github hasta no tener la versión 1.0 de todo el sistema y que pasen mis auditorías de calidad y los laboratorios y exámenes de estrés de simulación de ataques, verificación de código, vulnerabilidades y demás.

Lo estoy creando todo desde un móvil Termux usando Python. La idea es que el runtime sea ejecutable en todos los formatos posibles, desde Termux, VM, Bootearlo desde un usb como Tails y desde una propia máquina Linux..

Si tienen algún consejo o idea (por qué según mi Road map me tardaré aprox 1año en terminar por el trabajo, la novia y demás) será bienvenido

Les dejo unas capturas de como se ve. Es algo rústico pero para llevar un mes en esto no está tan del asco.

Atte: Ø

As the title suggests , need some project ideas with mid level difficulty ( pls no block chain)

Both offensive and defensive are ok

any suggestions are appreciated.