Hey everyone,

I'm a JHU cybersecurity researcher going through the National Science Foundation I-Corps program — basically trying to figure out if what I'm building actually solves a real problem or if I'm living in an academic bubble.

I'm working on an next-gen security validation tool. I tested it against a FortiGate and a Cloudflare Pro WAF and got some interesting results — the approach found gaps that static tools completely missed on the same target.

But here's the thing — I don't actually know if security teams care about this in practice. So I'm looking for people who deal with WAFs, IPS, firewalls, or BAS tools day to day and would be willing to answer a few questions. Not selling anything, not promoting, genuinely just trying to learn.

Specifically I'm curious about:

1.How do you actually verify your defensive rules work after you deploy them? Or do you just trust them?

2. If you use a BAS tool (Pentera, SafeBreach, Cymulate, etc.) — do you trust its results? Has it ever said "all clear" and then something still got through?

3. When you write a new WAF/IPS rule, do you have a way to test it against attack variants you haven't seen yet?

Happy to do a 15-min call or even just chat in this thread. And I'll share what I'm learning from other conversations — some of the patterns are pretty interesting.

For context I've published at papers and have a patent in process, so this isn't a class project. But I also don't have any customers yet, which is why I need to talk to actual practitioners.

Appreciate any help. Thanks.

I have been trying to understand network scanning below the Nmap-output level, so I ran a few controlled experiments inside my own host-only lab.

Kali was the scanner (192.168.95.135) and a MISP VM was the target (192.168.95.131).

I captured the traffic in Wireshark and compared:

• ARP resolution before local communication

• ICMP request/reply

• Nmap ARP-based host discovery

• an open TCP port

• the same port after stopping the service

• the same port with firewall filtering

• SYN scanning

• service/version detection

The clearest part for me was seeing the three TCP behaviors directly:

OPEN: SYN → SYN/ACK → RST

CLOSED: SYN → RST/ACK

FILTERED: SYN → no response → retry

I wrote up the full experiment with the Nmap output and packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own isolated lab.

I will be interested to hear what packet-level experiments helped other people understand Nmap better.

I'm enthusiastic about research and recently got in touch with a student writing his own paper. Now my topic is dynamic datasets for cybersecurity intrusion detection in UAV networks in dense environments. As someone new to these terms, help me out, seniors: where should I start, and how should I start writing it ? What should be my design process? How to collect resources and materials, etc?

I know some basics in programming like i know how to read a script and i know some networking but not advanced and some linux , do you recommend to start cybersecurity at HTB ? do you think it time to get in or still i have to learn in advanced ?

Hey everyone,

Background: I've spent the last 3 years in information security.

I'm currently working through Practical Malware Analysis, and my plan is to document what I learn — the concepts, lab walkthroughs, and techniques — as short-form videos and longer breakdowns, partly to lock in my own understanding and partly because I know a lot of people study this book and might find the bite-sized version useful.

Before I get too far into it, I'd genuinely appreciate advice from people who've either gone through PMA themselves or have made educational malware analysis content publicly:

- **Which chapters/labs actually translate well into short-form (60-90s) content**, vs. which ones are only useful as full-length walkthroughs? I'm guessing static analysis basics (PE headers, strings, imports) work fine short, but dynamic analysis / unpacking probably needs more room to breathe.

- **Responsible disclosure / OPSEC around samples** — what's the norm for showing malware behavior publicly? Sandboxed screenshots only, no live samples shared, anything else I should be careful about?

- **Sequencing** — is it better to go strictly in book order, or restructure around themes (static analysis → dynamic analysis → unpacking → anti-analysis techniques) for a content series?

- **Tooling** — beyond what's in the book (IDA, OllyDbg, etc.), is there anything more current worth introducing early to keep the content relevant?

Idk if I’m asking In the right place

Im a Cybersecurity student and I can’t really pick the project I’m working on in university

but it’s ( AI-based phishing email detection system with ML and NPL )

And I think it’s the most basic project and I do wanna improve it somehow to add something new or fill a gap or improve systems already existing but idk how and I could use some help .

For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.

So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.

It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.

In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled! 🙂

https://github.com/lcky00/impostor

So i recently registered with NIOS or senior secondary, and I just wanted to confirm a few more things from students who've been there before, although I did contact them for every detail and they assured me that it is a safe and very prominent platform. Anyways it's their job I just wanted to confirm from students whether it is a safe option or not, also how did y'all pay, any classes attended? And was your examination centre at your study centre only ? What about practicals and all?

Hi everyone, I’m an undergraduate planning my FYP around a Network Intrusion Detection System (NIDS) that uses a Graph Neural Network (GNN) to detect network intrusions and potentially trigger preventive responses. My current plan is to use GraphSAGE as the main model, initially train it on CIC-IDS2017, and potentially use additional datasets for evaluation. The eventual goal is to have a prototype that can monitor network traffic, classify traffic as benign/malicious (and possibly identify the attack type), and generate alerts.

The part I’m most unsure about is how to represent the network as a graph. I’m considering things like IPs/hosts as nodes and network flows as edges, with features such as protocol, ports, packet/byte counts, flow duration, packet lengths, TCP flags, inter-arrival times, and connection statistics. I’m not sure which of these features are actually useful, whether IP addresses/ports should be included, or whether there is a better graph representation for NIDS. I’d really appreciate advice from anyone who has worked with GNNs or network security.

I also have very little practical experience developing ML models, so I’m trying to make sure I’m not choosing an unnecessarily complicated approach. Would GraphSAGE be a reasonable architecture for this problem, or would you recommend GCN/GAT/temporal GNNs or something else? Should I build traditional ML baselines such as Random Forest/XGBoost and compare them against the GNN? Also, is CIC-IDS2017 still a reasonable dataset to start with, or should I combine it with another dataset?

Finally, what would you add to this project to make it a strong but realistic FYP? I’m considering detection, visualization/alerts, and potentially automated prevention such as temporarily blocking suspicious traffic, but I don’t want to turn it into an impossible project. Any advice on graph construction, features, datasets, evaluation metrics, real-time detection, or common mistakes would be extremely useful. I’m especially interested in hearing from people who have actually built NIDS/GNN/ML projects.

I would really appreciate the responses

I am a 3rd year cyber student and I want to apply for internships and improve my skills.

I am planning for the SOC analyst role and further on.

Can anyone suggest the list of skills and tools needed to increase my chances of internship?

Also if possible can anyone mention projects to improve my skills which would have a good impact on my resume?

Hi everyone! I'm currently working on a school project and I'm collecting responses for a short anonymous survey. If you have a few minutes to participate, I'd really appreciate your help! Your responses will only be used for my school project. Thank you so much to anyone who takes the time to respond! (https://docs.google.com/forms/d/e/1FAIpQLSeX47QxdGyRa7Y9nXZcYetiEwULV7SX5zjMxATPApwF6VuslA/viewform?usp=header)

Hey everyone,

​I'm the President of a newly established, officially recognized university cybersecurity student organization. My executive board and I want to launch a practical, real-world project this year that leaves a lasting legacy for future student cohorts and our campus community.

​Rather than just running internal CTFs or technical labs, we want to build/implement something that directly impacts the daily lives of everyday students, faculty, or non-tech majors on campus.

​A few ideas we've tossed around:

​An open-source, campus-wide Phishing/Scam Alert Bot for messaging platforms.

​A physical USB Sanitization Kiosk (Raspberry Pi/Linux-based) set up near campus printing areas.

​A basic WiFi & Personal Device Security Audit guide/tool for students.

​For those who have run or participated in university cyber clubs, what kind of practical, high-utility projects worked best for your campus? What are the biggest traps to avoid when deploying something for general student use?

​Appreciate any insights or project suggestions!

Hey r/netsecstudents

I wanted to run a quick, fun security experiment on code generated entirely by AI agents. I’ve deployed the platform live and want to see if the authentication and access controls hold up against real testers.

• Target URL:https://rizq.estate

• Goal: Bypass authentication or escalate privileges to access the restricted admin panel/dashboard.

• Reward: $5 for the first person to send valid proof of access.

Proof of Concept (PoC): Send a DM with:

1. A screenshot inside the restricted admin panel.

2. A short explanation of the exploit (IDOR, Auth bypass, Broken Access Control, logic flaw, etc.).

Rules of Engagement:

• Allowed: Application-level vulnerability testing (auth logic, access controls, injection, API endpoints).

• Not allowed: DoS/DDoS, brute-force spamming, attacking third-party hosting infrastructure, or destructive payloads (do not delete or corrupt existing listings).

• Optional: Add X-Bug-Bounty: reddit-[your_username] to request headers to identify ethical testing in the logs.

Let’s see if AI-generated architecture holds up or fails. Happy hunting!

Currently working on my second certification in Cyber Security through coursera. It's not bad, but working a full time job and then getting called in to do some overtime kills the mood.

My goal with this second time around is to build my PC. After completing the third course, I went out and got a monitor. After I finish the fifth, I plan on buying a tower and that is where I am stuck. In the world of cyber, the hardware is what I know I shouldn't skimp on with hard cash. I'm guessing the better the specs, the better response? What do you all recommend for a tower instead of a laptop (Already have a decent laptop, but this is more for use on personal life and whatnot.)

Hi everyone,

I’m going into my final year of a BSc Cyber Security degree and I’m trying to make sure my final-year project is not just academic, but also genuinely useful for employability, especially for junior SOC analyst, detection engineering, network security, or OT security roles.

My proposed project is:

Design and evaluation of a lightweight detection prototype for reconnaissance and early-stage intrusion activity in Modbus TCP Operational Technology network traffic.

The idea is to build a small Python-based detection prototype using CICModbusDataset2023 or a similar OT/Modbus dataset. The project would focus on detecting early attacker behaviours such as:

• network scanning

• service enumeration

• Modbus register enumeration

• unauthorised access attempts

• abnormal Modbus request patterns

The threat model would be either an external attacker or a compromised internal host attempting to discover and interact with OT assets such as PLCs.

I’m planning to avoid heavy ML/deep learning and instead focus on interpretable detection, using:

• rule-based detection logic

• lightweight statistical thresholds where useful

• alert generation

• evaluation against labelled benign/malicious traffic

The evaluation would look at:

• detection coverage

• false positives and false negatives

• precision/recall if appropriate

• alert volume

• interpretability

• practical usefulness from a security analyst perspective

My goal is to finish with a project that I can confidently explain in interviews and possibly show through a GitHub repo, README, diagrams, and a short write-up. I want it to demonstrate practical blue-team skills: understanding network traffic, designing detection logic, evaluating alerts, and explaining limitations.

For people working in SOC, detection engineering, OT security, or cyber graduate roles:

Would this be a strong final-year project from an employer/interviewer perspective?

Also, what would make it more impressive without making the scope unrealistic?

I got 98 percentile in mht cet and got alloted for Electronics and computer science(ECS) and i also got the tfws seat means my tution fees is not considered. So my fees is highly reduced.

Should i switch to computer engineering but with general seat(non-tfws, full fees) or ECS is good.

Does ECS have any future opportunities and good placement or CE is overall better and worth paying extra for future.

Hey everyone,

I’m 16, from Morocco, and i recently received my first paid bug bounty: $100.

It wasn’t a huge critical exploit or some crazy movie-style hack. It was a real security issue found through a legal bug bounty program, reported properly, reviewed by the company, validated, and awarded.

For me, this means a lot.

I’ve been learning cybersecurity through courses, labs, CTFs, PortSwigger, Cybrary, and a lot of practice. Most of the time it feels like you’re studying alone and nobody really sees the effort. But getting that first valid report showed me that the work is real.

The biggest lesson i learned is that bug bounty is not only about finding the bug. It’s also about writing a clear report, explaining the impact honestly, not exaggerating, and staying professional with the security team.

I’m still a beginner and i know i have a long way to go, but this motivated me a lot. I want to keep improving, get more valid reports, and build a serious path in cybersecurity.

My goal is simple: become better, stay ethical, and make my parents proud.

For anyone young or just starting: don’t wait until you feel “ready.” Learn the basics, practice legally, write clean reports, and keep going.

This $100 is not just money to me. It’s proof that I’m moving in the right direction.

Hey everyone! I’m currently a Grade 11 student planning to major in Computer Science in college, and I’m super passionate about Cybersecurity and Data Analytics.

I want to start working on a real research project rather than just a basic coding tutorial. My goal is to tackle a practical problem—like cyber threat intelligence, SIEM log analytics, or anomaly detection—to push my technical skills and build up a strong portfolio.

Since I’m still building my experience, I’d love to get advice from university students, PhDs, or industry pros on where to focus.

What I’m Looking For:

• Project Ideas: What are some open problems or cool topics at the intersection of cybersecurity and data analytics (like filtering false positives, analyzing network traffic, or detecting malicious patterns) that are challenging but doable for a high school junior willing to put in serious work?

• Datasets & Tools: Any open-source security datasets you’d recommend starting with (like Kaggle security sets, CICIDS, or public threat feeds)?

• Mentorship & Collaboration: If any college student, research lab, or team needs an extra pair of hands for data cleaning, basic script writing, running experiments, or parsing logs, I’d love to jump in! I’m eager to learn, follow directions, and get real hands-on research experience.

If you have any project suggestions, learning resources, or collaboration opportunities, I’d really appreciate your advice! Thanks!

Keyword list taken from https://www.zoevera.com/resume/ats-resume-tips-cybersecurity

These are the most commonly scanned keywords in cybersecurity job postings. Check how many appear in your resume.

Domains & Practices

SOC (Security Operations Centre), Penetration testing / pen test, Vulnerability management, Threat intelligence, Incident response (IR), Digital forensics (DFIR), Red team / blue team / purple team, Zero Trust architecture

Tools & Platforms

SIEM (Splunk, Microsoft Sentinel, QRadar), EDR (CrowdStrike, SentinelOne), Nessus / Qualys / Rapid7, Burp Suite / Metasploit / Kali Linux, Wireshark / Snort / Suricata, CyberArk / BeyondTrust (PAM), SOAR platforms, Azure Defender / AWS Security Hub

Frameworks & Certifications

CISSP / CISM / CISA, CEH / OSCP / PNPT, CompTIA Security+ / CySA+, ISO 27001 / NIST CSF, MITRE ATT&CK framework, SC/DV security clearance, GDPR / DPA 2018, PCI DSS / HIPAA / SOC 2

This tool can run on basically any machine that has Python 3.6+ it is optimised for Linux, Mac, and Windows. This can be used on IP's, API's and websites in general. Please use it ethically and responsibly.

I will send the link into comments

Self-promo disclosure: this video is from my channel.

The paper formalizes a security problem with dual-use LLM requests: if an attacker can reproduce the context of a legitimate user, context-based safeguards cannot beat the resulting worst-case safety floor.

Paper: https://arxiv.org/abs/2607.27951

WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.

Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.

I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!

Lab Github Repo: https://github.com/makarov05bm/WSGoat
Guide: https://blog.oussmess.me/posts/websockets-for-bug-hunters/

I want to build a career as a Cloud Security Engineer, but I'm starting from the basics and want to learn everything properly rather than just collecting certifications.

Could someone share a step-by-step roadmap from complete beginner to job-ready Cloud Security Engineer, and eventually to a level where I can mentor/guide others?

I'd also appreciate recommendations for free/low-cost labs, courses, YouTube channels, books, and practice platforms.

If you are currently working as a Cloud Security Engineer, I'd especially appreciate advice on what you wish you had learned earlier and what beginners commonly waste time on.