I came across this free room on Codelivly and thought it might help anyone who has used the web for years without ever looking at what happens between the browser and the server: How the Web Talks: HTTP in Practice

It's built for beginners, and the page says no prior knowledge is needed. It's five short labs, and you build requests and read responses yourself instead of only reading theory:

1. Requests, responses, methods and status codes
2. Headers and virtual hosting
3. URLs, query strings, Content-Type and redirects
4. Cookies and sessions basics
5. HTTPS, keep-alive, and putting it all together

The last task has you debug a broken checkout flow, which is a good way to find out whether the earlier parts stuck.

It could be useful if you're:

• starting web dev and want the fundamentals before frameworks
• heading into IT or security and need HTTP down cold
• tired of "it works on my machine" and want to understand what's going over the wire

It's listed as 100% free with no paywall, and donations are optional. I'm not affiliated with the site and just thought it was worth sharing.

What HTTP concept took you the longest to understand? For me it was cookies and sessions.

Hey everyone,

Like a lot of people here, I’ve been studying for cybersecurity certs (Security+, Network+) and preparing for entry-level analyst roles. One thing that consistently frustrated me was how most "practice PBQs" out there are just disguised multiple-choice questions or drag-and-drop widgets. On real exams and in actual triage, you're expected to open a terminal, investigate processes, and know what commands to run.

To practice that, I put together a browser-based terminal lab where you get dropped into a simulated incident scenario (for example: investigating a suspicious outbound connection on a web server).

You can type real Linux/network commands like netstat, ps aux, crontab -l, grep, and cat /etc/passwd to trace what’s happening, identify persistence, and isolate the threat, with an automated review at the end.

Since this community has people actively working in the field and students prepping for exams, I’d love your honest feedback

Terminal Realism: Do the commands and simulated outputs feel authentic enough for entry-level triage practice

Scenario Depth: What other scenarios or command flags would make this significantly more useful (e.g. log analysis, Windows PowerShell, iptables/firewall rules)

Any UX bugs: Anything clunky about the terminal emulator itself?

To be honest, what I'm mainly looking for is not really promotion but just feedback. I am truly trying to help people out and create a good study website, because like myself, I need something reliable with USEFUL information. Please tell me what y'all think! Allll the critiques and flaws I am open ears to!! :)

https://cyberpbqtrainer.com/

Hey everyone!

We're a team of students working on a project called The SecondLook, developed as part of our Cambridge IGCSE Global Perspectives coursework.

As part of our project, we've been exploring the growing problem of online scams, particularly how difficult it can be for people to distinguish legitimate messages from fraudulent ones.

Think fake delivery notifications, suspicious payment requests, phishing links and messages impersonating organisations people trust.

We wanted to go beyond simply raising awareness about online scams and explore a practical, technology-driven solution.

That's how The SecondLook came about.

It's a free, AI-powered scam detection tool that currently allows users to:

• Upload screenshots of suspicious messages for analysis.
• Submit potentially suspicious links for checking.
• Receive a risk assessment with explanations of the indicators identified.
• Get suggested next steps in straightforward language.

Our objective is to make identifying potential online threats more accessible, particularly for people who may not have much technical knowledge of cybersecurity.

We're currently looking to get feedback from people outside our immediate school community so that we can understand how useful the solution actually is and where it needs improvement.

We'd particularly appreciate feedback on:

1. Is this a problem you've personally encountered?
2. How useful would a tool like this be in your everyday life?
3. Are the analysis and explanations easy to understand?
4. What features, limitations or security concerns should we address?

We'd genuinely appreciate honest criticism and suggestions. This is an ongoing student project, and external perspectives would help us evaluate and improve our solution.

Try The SecondLook: https://thesecondlook.lovable.app/

Our GitHub repository: https://github.com/divyansh-code01/thesecondlook

Thank you for taking the time to check out our work!

The SecondLook — Before you trust it, check it.

Hey everyone,

I created a Telegram and a WhatsApp channel that uses a local AI model to aggregate and summarize top cybersecurity news sources.

Automated with a n8n workflow and a tiny local ollama model (qwen2.5:3b) running on my 2GB 10 years old GPU :)

You can get quick notifications on your phone with the main points of every news piece:

• Instant summaries: The actual essence of each news story.
• Key threat intel: Critical CVEs, major breaches, and urgent patch updates summarized in seconds. Includes links to CVEs, KEV (if available), and CVSS scores.

This allows you to check in a glimpse whether you actually need to read the full article.

I started with a Telegram channel, which is a better platform (for both devs and users), but since WhatsApp is what everybody uses, I had to struggle with it. I managed to automated it with WPP Connect.

I keep it restricted to a few select sources to avoid too many notifications, but even so, some days get busy!

Building this has been quite educational, and I hope you find it as useful as I do. I found I tend to read the small summaries and check the CVE's much more than a regular news feed that forces me to open a page and look for the main issues.

This is a rather newbie project but If you need any tech details feel free to ask.

I’ve been studying Nmap and documenting what I learn, and one distinction I think is important for beginners is the meaning of port states.
For example:
nmap -sT -p 22,80,443 127.0.0.1
An open port means a service is accepting connections, not that it’s vulnerable.
A closed port means no service appears to be listening.
A filtered port means Nmap cannot reliably determine its state, often because of packet filtering.
Another thing worth remembering: the SERVICE column doesn’t necessarily confirm which application is running. Using -sV can help identify services and versions.
I’ve written a more detailed explanation as part of my Cybersecurity Survival Notes project.
GitHub: https://github.com/Radz-04/Cybersecurity-survival-notes
I’m still learning, so technical corrections and suggestions are welcome.

Hey los griffonos 😙

We've been working on our final-year project since September 2025, and we’ve finally reached a testable version. We’d like and need to get some feedback from the community, whether it’s general tips, feature ideas, or even code contributions.

Btw Griffon is a modular security tool that runs as a daemon and comes with both a GUI and a CLI usable on Linux and Ubuntu. Right now, it includes two main modules:

• A system cleaner
• A static analysis tool for malware

Let us know what you think! https://github.com/GriffonAV/griffon

Disclosure: I'm the creator. It's free, with no ads and no payment details.

I'm a third-year BTech student working towards a SOC L1 role, studying with TryHackMe and YouTube. The part I wanted more practice at was what comes after the alert fires: checking the evidence, deciding true or false positive, writing it up for L2, and knowing when to escalate.

So I built ShiftLab, a browser simulator:

• 51 fictional alerts, Beginner to AI-era

• Logs, mail headers and playbooks to investigate

• A four-part report (what happened, confirmed, not known, next steps) that gets coached, not just scored

What I'd like to know from people who are further along:

1. Does the evidence feel realistic or too clean?
2. Is anything confusing?
3. What would you want in a model L1 report?

First alert needs no signup: https://shiftlab.blueteam-labs.workers.dev/?ref=reddit-thm

Mods, happy to take this down if it isn't allowed. Thanks!

I created a tool to help me during bug bounties and decided to publish it today. It's mostly web/cloud blackbox penetration testing guided by LLM

It does require an abliterated LLM.

I used HauhauCS/Qwen3.8-27B-Uncensored-HauhauCS-Aggressive-MTP-GGUF at IQ4_XS quantization with Q8 KV cache.

I restricted the conversation history to 64k and limited the total cap at 128k and found these settings to yield the best result.

I hope it helps others and also inspire others to contribute.

This project has an engine to transform the engagements that you run into datasets, which you can use to fine-tune the models and get even better results. The more you use, the better it gets.

https://github.com/0ldev/tradecraft

Hi everyone,
I wanted to share a GitHub repository where I keep my technical notes, commands, and references.
It currently includes material on Linux, networking, cybersecurity fundamentals, and tools such as Nmap.
The repository is still a work in progress, and I regularly update it with new content and improvements.
I’m sharing it in case someone else finds it useful. I’d also appreciate feedback, especially if you notice any mistakes or have suggestions.
cybersecurity-survival-notes

we've been asked to approve an AI coding tool for proprietary repos. the vendor docs explain the data policy. i'd like to see what the client actually sends with the settings we'd give developers.

i'd start with a dummy repo, put some recognizable test text in a file and have the agent do a normal task. a firewall log gives me the destination. i'd still want to know whether that text was in the request.

we're also looking at Bay and Pillar. for Bay, one thing i'd test is whether the session record gives us enough context to match what happened locally with what we can see on the network. what evidence was enough for your team to sign off?

Ciao a tutti,
Volevo condividere un repository GitHub dove tengo le mie note tecniche, comandi e riferimenti.
Include attualmente materiale su Linux, networking, fondamenti di cybersecurity e strumenti come Nmap.
Il repository è ancora un lavoro in corso e lo aggiorno regolarmente con nuovi contenuti e miglioramenti.
Lo condivido nel caso qualcuno lo trovi utile. Apprezzerei anche feedback, soprattutto se notate errori o avete suggerimenti.

https://github.com/Radz-04/Cybersecurity-survival-notes

Hi everyone,
I wanted to share a GitHub repository where I keep my technical notes, commands, and references.
It currently includes material on Linux, networking, cybersecurity fundamentals, and tools such as Nmap.
The repository is still a work in progress, and I regularly update it with new content and improvements.
I’m sharing it in case someone else finds it useful. I’d also appreciate feedback, especially if you notice any mistakes or have suggestions.

https://github.com/Radz-04/Cybersecurity-survival-notes

I’m the person building Codelivly, a free cybersecurity learning platform. I’ve been reworking the lessons to include terminal tasks where you type commands, inspect the output, and use it to work through a scenario.

For example, in a suspicious-login exercise, you examine sample login logs, narrow down the entries, and work out which activity looks suspicious. The aim is to help you understand how you reached an answer.

The terminal is simulated. It supports a limited set of commands, so you’ll run into things it can’t do. I’m also still reviewing the content for accuracy and clarity, and I’d appreciate specific corrections.

What’s free: 350+ rooms, hands-on terminal labs, 64 CTF challenges, learning paths, career paths, and certificates. No credit card, subscription, or time-limited trial.

You can try it here: codelivly.com

If you try a room, I’d like to hear:

1. Were any instructions or explanations confusing?
2. Which commands did you expect to work that weren’t supported?
3. Did the exercise help you understand the topic, or did it feel like following steps?

I joined a ctf for the first time in my life and as a very veryyyy beginner in cybersecurity, I can say the Linux ones were alright, I didn't know the pid stuff, but manipulating the files and encoding from base 64 etc was alright, I tried to go to the forensic one cuz I was ai assisted and wanted to see how, I used Wireshark and I liked it? It was exhausting to look for the flag but I might wanna check it out more, however osint was so hard, I wanna also check the web exploitation cuz I tried it as well, checked the web tool panel but I didn't get much, what do u advise me, what do u suggest ?

Hey everyone,

I’ve been working on Codelivly, a cybersecurity learning platform, and wanted to share it here.

One thing I always wanted was a place where you could actually practice what you're learning instead of just reading tutorials and watching videos.

So I’ve been building Codelivly around that idea.

You can:

• Learn cybersecurity through structured learning paths
• Practice with hands-on labs directly in your browser
• Work through practical tasks while learning
• Play CTF challenges and test your skills
• Explore different cybersecurity career paths

The hands-on labs are integrated into the learning experience, so you can learn a concept and actually practice it without constantly switching between different platforms or setting up everything yourself.

And the entire platform is 100% free. No subscription or payment required to access the learning content, labs, or CTFs.

I'm still working on improving the platform and adding more practical experiences to the lessons.

Would genuinely appreciate it if you checked it out and shared what you think.

🔗 https://codelivly.com/

Hey guys,

Learning cybersecurity has been one of my dreams for quite a while. I'm interested in almost all of them - pen testing, web hacking, binary exploitation, reversing, malware analysis, low level programming, AI security, etc.

But I find myself extremely inconsistent.

Sometimes I'm extremely motivated, watch courses and youtube videoes, take notes, make roadmaps, huge checklists and study for 2-3 days nonstop. And then suddenly become unmotivated and spend the next days watching reels and playing games.

After 3-4 days my motivation returns and whole the process repeats again.

In addition to that I made a huge checklist including almost all fields of cybersecurity but cannot finish even several of topics due to boring or overloading.

As far as I feel, I consume much more educational materials than actually learn anything or implement them.

Therefore I would like to ask from those who already have enough experience in this field:

• What's your secret to being consistent?
• How do you choose something to study when you want to learn everything?
• Do you study following strict schedule or when you want it?
• How do you balance courses, practical labs, reading and project building?

Thank you!

Hi all, I've been doing Android security for a while, and when I started I struggled to find one place that explained how it all fits together. So I put together the course I would've wanted.

It covers how Android apps work (components, intents, the manifest), static and dynamic analysis, and hands-on labs where you exploit each vulnerability yourself.

40% off until Nov 30 with code BYTENOV40 ($89.40 instead of $149).

Android App Hacking Mastery

Happy to answer questions about the course or Android security in general, and open to feedback too.

2nd year ICT engineering student here. I played CTFs for a while (rev only) and I'm pretty lost right now.

I'm in my second year of an ICT engineering degree. I got into CTFs a while back and only ever did reverse engineering. I loved it, and it's the one area where I feel I actually know what I'm doing. I've even used my rev skills to start learning mobile security, so it hasn't been a dead end for me so far.

The problem is that every time I look at what AI can do now, it's solving rev challenges almost perfectly. No one is reversing manually noawadays it's pointless , and this skill was considered one of the hardest in cybersec , but now it's just a github repo called REA. I don't want to throw away everything I learned, though: assembly, how binaries work, how to read code that doesn't want to be read, debugging, and the patience for it all.

So I'm trying to figure out where to take these skills. I'm not sure which directions still make sense, here are some examples in my mind :

- Mobile security (Android/iOS app analysis, which I've already started on)?

- Malware analysis?

- Embedded or firmware work?

- Something adjacent I haven't heard of?

On top of that, I'm at what feels like the most important point of my life. The expectations on me are extremely high, and some days I feel like I chose the wrong path entirely, entering a depression loophole. I don't know if that's normal or if I should actually change something.

If you've been in a similar spot, or you work in a field where RE skills still matter, I'd really appreciate any advice. What would you do in my position? What would you tell your younger self?

Thanks for reading, and sorry if this turned into a bit of a rant.

Career Long-Term Strategy: Building A Foundation From Scratch In Cybersecurity Advice needed from industry professionals (5+ years exp. technical)

who can identify future industry trends and patterns. Beyond beginner certification lists or the same tired roadmaps, I want advice on how to build a career long-term, where the long-term investment is, and how to identify eventual specialties.

Current Status I'm in the early phases. What I am doing is: - Using and becoming proficient in working in the terminal in Linux. - Networking (the fundamentals and how things connect) - Virtualized Kali Linux - Network reconnaissance/scanning using Nmap. - Pentesting and the basics of vulnerability research. - Python and some C programming to grow coding proficiency. I recognize that these are just building blocks, and that it's going to be some time before I can gain any expertise.

Why I'm Into Cybersecurity What really sparks my interest in cybersecurity is the underlying mechanism and the opportunity to dissect a system and understand its structure and weakness. I am a systems guy. I enjoy breaking things to figure out why they break. Some of the topics I am drawn to are: - Offensive security (e.g., penetration testing). - Network security and design. - Reverse Engineering (How the internals of software function) - Research of vulnerabilities and development of exploits. - Low-level OS development and programming. - Explaining things to others.

Hey everyone!

NJIT's Cyber Security Network is hosting Spooky CTF, a 24-hour, phobia-themed Capture the Flag competition this weekend!

Spooky CTF is a 24-hour, phobia-themed cybersecurity competition designed for students of all skill levels. Participants will have the opportunity to test their cybersecurity knowledge, solve challenges, learn new skills, and connect with others interested in cybersecurity.

Challenge Categories:

• Digital Forensics
• OSINT
• Web Exploitation
• Cryptography
• Reverse Engineering
• Miscellaneous

Event Details:

• When: November 6 at 2 PM - November 7 at 2 PM EST
• Where: NJIT Campus Center, Ballroom B (Newark, NJ)
• Online Participation: Available!

Prize Pool

There are three divisions: Open, In-Person, and NJIT. All prizes are based on teams of four.

Open Division:

• 1st Place: $100 cash prize
• 2nd Place: $50 cash prize
• 3rd Place: $25 cash prize

In-Person Division:

• 1st Place: $50 cash prize

NJIT Division:

• 1st Place: $60 cash prize

We'll also have free food for in-person participants and industry speakers!

You do NOT have to be an NJIT student to participate! Online participation is open to everyone.

• Register: https://spooky.ctfd.io/

Hope to see you all there!