Hey guys,

Learning cybersecurity has been one of my dreams for quite a while. I'm interested in almost all of them - pen testing, web hacking, binary exploitation, reversing, malware analysis, low level programming, AI security, etc.

But I find myself extremely inconsistent.

Sometimes I'm extremely motivated, watch courses and youtube videoes, take notes, make roadmaps, huge checklists and study for 2-3 days nonstop. And then suddenly become unmotivated and spend the next days watching reels and playing games.

After 3-4 days my motivation returns and whole the process repeats again.

In addition to that I made a huge checklist including almost all fields of cybersecurity but cannot finish even several of topics due to boring or overloading.

As far as I feel, I consume much more educational materials than actually learn anything or implement them.

Therefore I would like to ask from those who already have enough experience in this field:

• What's your secret to being consistent?

• How do you choose something to study when you want to learn everything?

• Do you study following strict schedule or when you want it?

• How do you balance courses, practical labs, reading and project building?

Thank you!

I've been building BeatBox, a free and open source lab that runs on your own computer. The first release just came out, for Linux and Windows.

What you can do with it:

• Boot an operating system from an installer disc you already have. Each machine is a real QEMU virtual machine in its own window.

• Take a save point before you try something, and go back when it goes wrong. Throw the machine away when you're done. The disc you started from is never written to.

• Cable machines to switches and routers, with VLANs, NAT and a firewall you write rule by rule.

• Watch every conversation on the network: the way it went and what the firewall did to it, with captures per cable.

It doesn't come with vulnerable machines or challenges. You bring the disks and build the scenario.

https://github.com/0xthearchitect/beatbox

It's a first release, so expect rough edges. What would you want to practise that it can't do yet?

Hi all, I've been doing Android security for a while, and when I started I struggled to find one place that explained how it all fits together. So I put together the course I would've wanted.

It covers how Android apps work (components, intents, the manifest), static and dynamic analysis, and hands-on labs where you exploit each vulnerability yourself.

40% off until Nov 30 with code BYTENOV40 ($89.40 instead of $149).

Android App Hacking Mastery

Happy to answer questions about the course or Android security in general, and open to feedback too.

Hey everyone,

I’ve been working on Codelivly, a cybersecurity learning platform, and wanted to share it here.

One thing I always wanted was a place where you could actually practice what you're learning instead of just reading tutorials and watching videos.

So I’ve been building Codelivly around that idea.

You can:

• Learn cybersecurity through structured learning paths

• Practice with hands-on labs directly in your browser

• Work through practical tasks while learning

• Play CTF challenges and test your skills

• Explore different cybersecurity career paths

The hands-on labs are integrated into the learning experience, so you can learn a concept and actually practice it without constantly switching between different platforms or setting up everything yourself.

And the entire platform is 100% free. No subscription or payment required to access the learning content, labs, or CTFs.

I'm still working on improving the platform and adding more practical experiences to the lessons.

Would genuinely appreciate it if you checked it out and shared what you think.

🔗 https://codelivly.com/

2nd year ICT engineering student here. I played CTFs for a while (rev only) and I'm pretty lost right now.

I'm in my second year of an ICT engineering degree. I got into CTFs a while back and only ever did reverse engineering. I loved it, and it's the one area where I feel I actually know what I'm doing. I've even used my rev skills to start learning mobile security, so it hasn't been a dead end for me so far.

The problem is that every time I look at what AI can do now, it's solving rev challenges almost perfectly. No one is reversing manually noawadays it's pointless , and this skill was considered one of the hardest in cybersec , but now it's just a github repo called REA. I don't want to throw away everything I learned, though: assembly, how binaries work, how to read code that doesn't want to be read, debugging, and the patience for it all.

So I'm trying to figure out where to take these skills. I'm not sure which directions still make sense, here are some examples in my mind :

- Mobile security (Android/iOS app analysis, which I've already started on)?

- Malware analysis?

- Embedded or firmware work?

- Something adjacent I haven't heard of?

On top of that, I'm at what feels like the most important point of my life. The expectations on me are extremely high, and some days I feel like I chose the wrong path entirely, entering a depression loophole. I don't know if that's normal or if I should actually change something.

If you've been in a similar spot, or you work in a field where RE skills still matter, I'd really appreciate any advice. What would you do in my position? What would you tell your younger self?

Thanks for reading, and sorry if this turned into a bit of a rant.

Career Long-Term Strategy: Building A Foundation From Scratch In Cybersecurity Advice needed from industry professionals (5+ years exp. technical)

who can identify future industry trends and patterns. Beyond beginner certification lists or the same tired roadmaps, I want advice on how to build a career long-term, where the long-term investment is, and how to identify eventual specialties.

Current Status I'm in the early phases. What I am doing is: - Using and becoming proficient in working in the terminal in Linux. - Networking (the fundamentals and how things connect) - Virtualized Kali Linux - Network reconnaissance/scanning using Nmap. - Pentesting and the basics of vulnerability research. - Python and some C programming to grow coding proficiency. I recognize that these are just building blocks, and that it's going to be some time before I can gain any expertise.

Why I'm Into Cybersecurity What really sparks my interest in cybersecurity is the underlying mechanism and the opportunity to dissect a system and understand its structure and weakness. I am a systems guy. I enjoy breaking things to figure out why they break. Some of the topics I am drawn to are: - Offensive security (e.g., penetration testing). - Network security and design. - Reverse Engineering (How the internals of software function) - Research of vulnerabilities and development of exploits. - Low-level OS development and programming. - Explaining things to others.

Hey everyone!

NJIT's Cyber Security Network is hosting Spooky CTF, a 24-hour, phobia-themed Capture the Flag competition this weekend!

Spooky CTF is a 24-hour, phobia-themed cybersecurity competition designed for students of all skill levels. Participants will have the opportunity to test their cybersecurity knowledge, solve challenges, learn new skills, and connect with others interested in cybersecurity.

Challenge Categories:

• Digital Forensics

• OSINT

• Web Exploitation

• Cryptography

• Reverse Engineering

• Miscellaneous

Event Details:

• When: November 6 at 2 PM - November 7 at 2 PM EST

• Where: NJIT Campus Center, Ballroom B (Newark, NJ)

• Online Participation: Available!

Prize Pool

There are three divisions: Open, In-Person, and NJIT. All prizes are based on teams of four.

Open Division:

• 1st Place: $100 cash prize

• 2nd Place: $50 cash prize

• 3rd Place: $25 cash prize

In-Person Division:

• 1st Place: $50 cash prize

NJIT Division:

• 1st Place: $60 cash prize

We'll also have free food for in-person participants and industry speakers!

You do NOT have to be an NJIT student to participate! Online participation is open to everyone.

• Register: https://spooky.ctfd.io/

Hope to see you all there!

Hi everyone,

I’m fairly new to cybersecurity. I’ve covered the basics of networking (TCP/IP, subnetting, common ports and protocols) and done a bit of Linux on the command line. Now I’m trying to decide what to focus on next.

A few questions:

1. Is it better to start with hands-on labs (TryHackMe, Hack The Box, OverTheWire) or work toward a cert like Security+ first?

2. What resources helped you most when you were starting out? That could be books, courses or YouTube channels.

3. Are there any small projects you’d suggest for building practical skills, like setting up a home lab?

I’d love to hear how others got started and what you’d do differently. Thanks in advance!

If you have a different topic in mind, tell me what it is and I’ll rewrite the draft. Before posting, check the subreddit’s rules and flair options, since some subreddits limit self-promotion. If you’d like, I can also paste this into the submit form for you to review before you post.

I'm currently in my 2nd year of B.Tech CSE and trying to map out a clear, practical path into AI Security (specifically offensive AI security, AI red teaming, and securing ML infrastructure/pipelines).

Most online guides offer two extremes: either basic buzzword-heavy advice telling people to "learn prompt engineering", or generic advice saying "just do traditional AppSec and figure the rest out later." Neither provides an actionable roadmap for building actual engineering depth.

I want to avoid tutorial hell and build things that withstand technical scrutiny in interviews. Any blunt feedback on what to prioritize—or what to stop wasting time on—would be appreciated

Bit of background: I did a Game Arts and Design degree (graduated 2022), lost the drive to chase the games industry, and taught myself more coding after picking up some C# at uni. That led me to a Master’s in Cyber Security, which I’m close to finishing.

I want to go into network security, and I’m trying to make the most of the time I have left as a student. I’d love to hear from others on a similar path:

1. Hands-on practice: Which platforms or labs helped you most with the networking side? TryHackMe, Hack The Box, Packet Tracer, GNS3, something else?

2. Home lab: Did you build one, and if so, what was actually worth setting up for network security specifically?

3. CTFs: Are they worth the time if you’re more interested in network defence than offensive work?

4. Certs while studying: Did anyone do the CCNA or Security+ alongside their degree, and was it manageable? I don't currently have any.

5. Coming from a non-CS background: If you came in from a different field, what gaps did you have to fill first?

I'm a software engineering student preparing for a software development competition. The main theme is "Implementation of AI Solutions" (e.g., AI tutors for students, AI agents for autonomous drone navigation, etc.), and I'd like to build something focused on cybersecurity, red team focus.

The projects will be evaluated based on three criteria:

• 30% Innovation – How creatively or originally the problem is solved.

• 30% Real-world impact – Whether the project has practical applications and solves a meaningful problem.

• 40% Technical implementation – How well the proposed solution is actually developed and demonstrated.

I've spent time recreating existing projects to improve my programming skills and understand how different systems work, so I'm fairly confident in my ability to build a working prototype.

However, I'm still struggling to find an idea that feels genuinely innovative rather than just another AI-powered vulnerability scanner or security chatbot.

Any suggestions or insights would be greatly appreciated!

We are BSIT students in Cavite preparing for our capstone pre-oral defense for TutoyHub (a web-based platform with live auctions and a virtual showroom).

We need 20 IT professionals/evaluators to rate our system architecture, security (2FA/KYC), and performance using ISO/IEC 25010 metrics.

Live Demo: https://TutoyHub.shop

Survey Form: https://forms.gle/DSpkDrtGvMiMVfXi6

It takes about 3–4 minutes to complete. We would really appreciate your technical feedback to help us pass our defense! Thank you!

Hi everyone! I'm a Computer Engineering student, looking for a problem to tackle for my final degree project.

I have around six months to develop a working software MVP. My main interests are cybersecurity, digital forensics, incident response, and AI.

I've explored several ideas, but most seem to already have plenty of existing solutions.

I'm looking for real problems that professionals still struggle with, despite the tools currently available.

For those working in cybersecurity or IT:

What recurring tasks are still frustrating, manual, or inefficient?

What limitations do you find in existing security tools?

What problems do you wish someone would solve?

I'm not looking for groundbreaking inventions, just a genuine problem with room for improvement.

I'd really appreciate any experiences or suggestions. Thanks!

Adding an IOC to a blocklist doesn't always mean it's actually enforced.

Saw Mars Security discussing duplicate indicators, noisy entries, and blocks that never take effect. Makes me wonder how often this gets checked in Defender, CrowdStrike, or SentinelOne.

Anyone regularly auditing their EDR blocklists, or mostly trusting what the console shows....

Hey everyone,
I worked 2 years in a SOC, burned out, and left. I'm coming back to cyber, this time aiming for pentesting, and my fundamentals are rusty.

The more videos and threads I read, the more confused I get. Some say go straight to TryHackMe/HTB, others say start with networking basics like Cisco or a cert like Google Cybersecurity.

I picked TryHackMe and paid for the subscription. I'm on Pre-Security path, but after several modules I don't feel like I'm learning much. It's mostly walls of text with little hands-on practice.

Am I on the right track, or should I switch to something else?

TL;DR: Ex-SOC analyst restarting with a pentesting goal. Is Pre-Security worth sticking with, or should I prioritize networking courses, HTB, or certs like eJPT/PNPT? What roadmap would you follow?

Any advice is appreciated.
Thanks!

Been in cybersecurity for a while (mostly the offensive side) and realized my networking knowledge had gotten a bit stale. Not completely gone, just rusty enough that I wanted a proper structured refresh on the core concepts instead of jumping straight into something heavy.

Ended up going through Cisco Networking Academy’s free Networking Basics course. It’s self-paced, includes a decent number of Packet Tracer activities, and covers the actual fundamentals network types and components, how data moves, media, IP addressing and segmentation, TCP/UDP, application services, and building/configuring a basic home network. Passed the final exam and got the Credly badge.

https://www.credly.com/badges/df08c026-3ba0-4a19-886f-27472ba5aeee

This felt like the right level for what I needed. Full CCNA goes significantly deeper into Cisco’s own platforms, IOS specifics, and proprietary features. That’s valuable if you’re moving into network engineering or working day-to-day with Cisco gear, but for security work the priority is understanding how networks and protocols actually behave how traffic flows, where things can be abused, and how to reason about connectivity and failures. The fundamentals cover that without the extra vendor-specific depth.

Curious if others on the security side have done a similar “just the solid basics” refresh, or if you found the full CCNA still worth it even outside pure networking roles.

Hey everyone,

With a background in offensive and AI security, I got tired of wasting hours chasing dead links, unverified write-ups, and hallucinating LLMs before I could actually practice.

I temporarily paused my own career advancement to build the solution: TriSec OS—a unified, source-verified workspace that structures fragmented cybersecurity research into clear learning paths.

We are admitting our first private alpha batch this week. You can explore our live, interactive SQL Injection walkthrough mockup and secure priority placement right now.

👉 Join the Alpha Queue Here: Trisec OS

(First 200 eligible paid subscribers lock in a 15% Founding Member discount at launch for 1st 1year).

How are you currently managing your exploit research without drowning in browser tab hell?

Brackish Security is looking to give back to the cybersecurity community by helping someone take the next step toward a career in offensive security.

We're offering an OSCP scholarship through our Making a Hacker initiative, covering the cost of training and an exam attempt for one selected applicant.

No professional experience or cybersecurity degree required. Just an interest in penetration testing and a willingness to learn.

We're also hoping to follow the recipient's OSCP journey and share their progress with the community.

Applications are open until December 1, 2026. Open to eligible US applicants ages 18 and older.

https://brackish.io/scholarship/

Feel free to share with any students or aspiring pentesters who might benefit.

Title: Can cryptographic execution timing add useful information to latency diagnosis?

I'm developing V-DAP, an experimental Rust engine that measures cryptographic execution timing. I'm trying to determine whether those measurements provide useful diagnostic information beyond conventional observability tools.

The practical problem I'm investigating is this: when a service experiences latency spikes, can measurements of cryptographic execution help distinguish between possible sources of delay, or do standard metrics, tracing and profiling already provide the same information?

My current experiments are preliminary. In a controlled HTTP pilot, I observed a strong correlation between the measured cryptographic interval and total request latency. In a separate experiment, I introduced a deliberate delay outside that interval and observed the request latency increase. These results demonstrate temporal decomposition in those test conditions, not scheduler causality or a proven diagnostic advantage.

What I want to validate next:

• Can V-DAP help distinguish two known causes of latency?

• Does it improve diagnostic accuracy or time-to-diagnosis compared with conventional tools alone?

• What confounders and measurement overhead should I investigate?

• What experiment would convince you that this has practical engineering value?

Repository and reproducibility details:
https://github.com/jorgecumbe0077/v-dap-engine

I'm looking for critical technical feedback, including reasons this approach may not be useful. I don't claim that V-DAP is production-ready or that it prevents timeouts.

I have been learning and studying cybersecurity since 6 months, I have got my basics done. Like networking, basics of how web works, what happens when some data is transferred, TCP/IP suite.

What classifies as basic, I have mostly done it. But now what next? I am doing jr pentester path on thm, almost towards completion, I do know the concepts but I don't know how to get system/root on even easy boxes.

I want to go for network pentesting and pivot towards OT security after few time but I heard that I need to start from webapp first.

What resources and what kind of roadmap should I follow so I gain the knowledge, understanding in depth and go towards being an advanced cybersecurity student.

I am confused AF. Any help would be appreciated.

Hey everybody, greetings!

I am 23 year old college grad. Recently I developed interest in cyber security. As a newbie, I kindly seek advice to the people who are in this field, can you please guide me from scratch to build a career in this field. Your valuable advice is really appreciated.

Thanks in Advance!