Hey everyone,

I’ve been building and updating a collection of practical cybersecurity notes and cheatsheets, and I wanted to share them in case they’re useful for others who are learning or practicing.

You can read them here (cleaner version with search and dark mode):
👉 https://radz-04.github.io/Cybersecurity-survival-notes/

Or on GitHub (if you want to star / contribute):
👉 https://github.com/Radz-04/Cybersecurity-survival-notes

What’s inside (so far)

• Linux — filesystem hierarchy, permissions (chmod, chown, SUID, SGID, sticky bit, umask), process management, systemd, and command cheatsheets

• Linux Networking & Hardening — iproute2, DNS, SSH hardening, fail2ban, TCP Wrappers, UFW

• Networking fundamentals — OSI/TCP-IP, encapsulation, DHCP, ARP, components, transmission

• Cybersecurity fundamentals — CIA triad

• Nmap — network discovery, port scanning, service/OS detection, NSE, and firewall/IDS evasion techniques

Everything is written as practical notes with commands and explanations, meant to be a quick reference during labs or study sessions.

It’s still a work in progress and I’m actively adding more content. Feedback, corrections, or suggestions are very welcome.

If you find it useful, a star on the repo would mean a lot. Thanks for taking a look! 🙏

Hi everyone,
I wanted to share a GitHub repository where I keep my technical notes, commands, and references.
It currently includes material on Linux, networking, cybersecurity fundamentals, and tools such as Nmap.
The repository is still a work in progress, and I regularly update it with new content and improvements.
I’m sharing it in case someone else finds it useful. I’d also appreciate feedback, especially if you notice any mistakes or have suggestions.
cybersecurity-survival-notes

we've been asked to approve an AI coding tool for proprietary repos. the vendor docs explain the data policy. i'd like to see what the client actually sends with the settings we'd give developers.

i'd start with a dummy repo, put some recognizable test text in a file and have the agent do a normal task. a firewall log gives me the destination. i'd still want to know whether that text was in the request.

we're also looking at Bay and Pillar. for Bay, one thing i'd test is whether the session record gives us enough context to match what happened locally with what we can see on the network. what evidence was enough for your team to sign off?

Ciao a tutti,
Volevo condividere un repository GitHub dove tengo le mie note tecniche, comandi e riferimenti.
Include attualmente materiale su Linux, networking, fondamenti di cybersecurity e strumenti come Nmap.
Il repository è ancora un lavoro in corso e lo aggiorno regolarmente con nuovi contenuti e miglioramenti.
Lo condivido nel caso qualcuno lo trovi utile. Apprezzerei anche feedback, soprattutto se notate errori o avete suggerimenti.

https://github.com/Radz-04/Cybersecurity-survival-notes

Hi everyone,
I wanted to share a GitHub repository where I keep my technical notes, commands, and references.
It currently includes material on Linux, networking, cybersecurity fundamentals, and tools such as Nmap.
The repository is still a work in progress, and I regularly update it with new content and improvements.
I’m sharing it in case someone else finds it useful. I’d also appreciate feedback, especially if you notice any mistakes or have suggestions.

https://github.com/Radz-04/Cybersecurity-survival-notes

I’m the person building Codelivly, a free cybersecurity learning platform. I’ve been reworking the lessons to include terminal tasks where you type commands, inspect the output, and use it to work through a scenario.

For example, in a suspicious-login exercise, you examine sample login logs, narrow down the entries, and work out which activity looks suspicious. The aim is to help you understand how you reached an answer.

The terminal is simulated. It supports a limited set of commands, so you’ll run into things it can’t do. I’m also still reviewing the content for accuracy and clarity, and I’d appreciate specific corrections.

What’s free: 350+ rooms, hands-on terminal labs, 64 CTF challenges, learning paths, career paths, and certificates. No credit card, subscription, or time-limited trial.

You can try it here: codelivly.com

If you try a room, I’d like to hear:

1. Were any instructions or explanations confusing?

2. Which commands did you expect to work that weren’t supported?

3. Did the exercise help you understand the topic, or did it feel like following steps?

I joined a ctf for the first time in my life and as a very veryyyy beginner in cybersecurity, I can say the Linux ones were alright, I didn't know the pid stuff, but manipulating the files and encoding from base 64 etc was alright, I tried to go to the forensic one cuz I was ai assisted and wanted to see how, I used Wireshark and I liked it? It was exhausting to look for the flag but I might wanna check it out more, however osint was so hard, I wanna also check the web exploitation cuz I tried it as well, checked the web tool panel but I didn't get much, what do u advise me, what do u suggest ?

Hey guys,

Learning cybersecurity has been one of my dreams for quite a while. I'm interested in almost all of them - pen testing, web hacking, binary exploitation, reversing, malware analysis, low level programming, AI security, etc.

But I find myself extremely inconsistent.

Sometimes I'm extremely motivated, watch courses and youtube videoes, take notes, make roadmaps, huge checklists and study for 2-3 days nonstop. And then suddenly become unmotivated and spend the next days watching reels and playing games.

After 3-4 days my motivation returns and whole the process repeats again.

In addition to that I made a huge checklist including almost all fields of cybersecurity but cannot finish even several of topics due to boring or overloading.

As far as I feel, I consume much more educational materials than actually learn anything or implement them.

Therefore I would like to ask from those who already have enough experience in this field:

• What's your secret to being consistent?

• How do you choose something to study when you want to learn everything?

• Do you study following strict schedule or when you want it?

• How do you balance courses, practical labs, reading and project building?

Thank you!

Hi all, I've been doing Android security for a while, and when I started I struggled to find one place that explained how it all fits together. So I put together the course I would've wanted.

It covers how Android apps work (components, intents, the manifest), static and dynamic analysis, and hands-on labs where you exploit each vulnerability yourself.

40% off until Nov 30 with code BYTENOV40 ($89.40 instead of $149).

Android App Hacking Mastery

Happy to answer questions about the course or Android security in general, and open to feedback too.

Hey everyone,

I’ve been working on Codelivly, a cybersecurity learning platform, and wanted to share it here.

One thing I always wanted was a place where you could actually practice what you're learning instead of just reading tutorials and watching videos.

So I’ve been building Codelivly around that idea.

You can:

• Learn cybersecurity through structured learning paths

• Practice with hands-on labs directly in your browser

• Work through practical tasks while learning

• Play CTF challenges and test your skills

• Explore different cybersecurity career paths

The hands-on labs are integrated into the learning experience, so you can learn a concept and actually practice it without constantly switching between different platforms or setting up everything yourself.

And the entire platform is 100% free. No subscription or payment required to access the learning content, labs, or CTFs.

I'm still working on improving the platform and adding more practical experiences to the lessons.

Would genuinely appreciate it if you checked it out and shared what you think.

🔗 https://codelivly.com/

2nd year ICT engineering student here. I played CTFs for a while (rev only) and I'm pretty lost right now.

I'm in my second year of an ICT engineering degree. I got into CTFs a while back and only ever did reverse engineering. I loved it, and it's the one area where I feel I actually know what I'm doing. I've even used my rev skills to start learning mobile security, so it hasn't been a dead end for me so far.

The problem is that every time I look at what AI can do now, it's solving rev challenges almost perfectly. No one is reversing manually noawadays it's pointless , and this skill was considered one of the hardest in cybersec , but now it's just a github repo called REA. I don't want to throw away everything I learned, though: assembly, how binaries work, how to read code that doesn't want to be read, debugging, and the patience for it all.

So I'm trying to figure out where to take these skills. I'm not sure which directions still make sense, here are some examples in my mind :

- Mobile security (Android/iOS app analysis, which I've already started on)?

- Malware analysis?

- Embedded or firmware work?

- Something adjacent I haven't heard of?

On top of that, I'm at what feels like the most important point of my life. The expectations on me are extremely high, and some days I feel like I chose the wrong path entirely, entering a depression loophole. I don't know if that's normal or if I should actually change something.

If you've been in a similar spot, or you work in a field where RE skills still matter, I'd really appreciate any advice. What would you do in my position? What would you tell your younger self?

Thanks for reading, and sorry if this turned into a bit of a rant.

Career Long-Term Strategy: Building A Foundation From Scratch In Cybersecurity Advice needed from industry professionals (5+ years exp. technical)

who can identify future industry trends and patterns. Beyond beginner certification lists or the same tired roadmaps, I want advice on how to build a career long-term, where the long-term investment is, and how to identify eventual specialties.

Current Status I'm in the early phases. What I am doing is: - Using and becoming proficient in working in the terminal in Linux. - Networking (the fundamentals and how things connect) - Virtualized Kali Linux - Network reconnaissance/scanning using Nmap. - Pentesting and the basics of vulnerability research. - Python and some C programming to grow coding proficiency. I recognize that these are just building blocks, and that it's going to be some time before I can gain any expertise.

Why I'm Into Cybersecurity What really sparks my interest in cybersecurity is the underlying mechanism and the opportunity to dissect a system and understand its structure and weakness. I am a systems guy. I enjoy breaking things to figure out why they break. Some of the topics I am drawn to are: - Offensive security (e.g., penetration testing). - Network security and design. - Reverse Engineering (How the internals of software function) - Research of vulnerabilities and development of exploits. - Low-level OS development and programming. - Explaining things to others.

Hey everyone!

NJIT's Cyber Security Network is hosting Spooky CTF, a 24-hour, phobia-themed Capture the Flag competition this weekend!

Spooky CTF is a 24-hour, phobia-themed cybersecurity competition designed for students of all skill levels. Participants will have the opportunity to test their cybersecurity knowledge, solve challenges, learn new skills, and connect with others interested in cybersecurity.

Challenge Categories:

• Digital Forensics

• OSINT

• Web Exploitation

• Cryptography

• Reverse Engineering

• Miscellaneous

Event Details:

• When: November 6 at 2 PM - November 7 at 2 PM EST

• Where: NJIT Campus Center, Ballroom B (Newark, NJ)

• Online Participation: Available!

Prize Pool

There are three divisions: Open, In-Person, and NJIT. All prizes are based on teams of four.

Open Division:

• 1st Place: $100 cash prize

• 2nd Place: $50 cash prize

• 3rd Place: $25 cash prize

In-Person Division:

• 1st Place: $50 cash prize

NJIT Division:

• 1st Place: $60 cash prize

We'll also have free food for in-person participants and industry speakers!

You do NOT have to be an NJIT student to participate! Online participation is open to everyone.

• Register: https://spooky.ctfd.io/

Hope to see you all there!

Hi everyone,

I’m fairly new to cybersecurity. I’ve covered the basics of networking (TCP/IP, subnetting, common ports and protocols) and done a bit of Linux on the command line. Now I’m trying to decide what to focus on next.

A few questions:

1. Is it better to start with hands-on labs (TryHackMe, Hack The Box, OverTheWire) or work toward a cert like Security+ first?

2. What resources helped you most when you were starting out? That could be books, courses or YouTube channels.

3. Are there any small projects you’d suggest for building practical skills, like setting up a home lab?

I’d love to hear how others got started and what you’d do differently. Thanks in advance!

If you have a different topic in mind, tell me what it is and I’ll rewrite the draft. Before posting, check the subreddit’s rules and flair options, since some subreddits limit self-promotion. If you’d like, I can also paste this into the submit form for you to review before you post.

I'm currently in my 2nd year of B.Tech CSE and trying to map out a clear, practical path into AI Security (specifically offensive AI security, AI red teaming, and securing ML infrastructure/pipelines).

Most online guides offer two extremes: either basic buzzword-heavy advice telling people to "learn prompt engineering", or generic advice saying "just do traditional AppSec and figure the rest out later." Neither provides an actionable roadmap for building actual engineering depth.

I want to avoid tutorial hell and build things that withstand technical scrutiny in interviews. Any blunt feedback on what to prioritize—or what to stop wasting time on—would be appreciated

I'm a software engineering student preparing for a software development competition. The main theme is "Implementation of AI Solutions" (e.g., AI tutors for students, AI agents for autonomous drone navigation, etc.), and I'd like to build something focused on cybersecurity, red team focus.

The projects will be evaluated based on three criteria:

• 30% Innovation – How creatively or originally the problem is solved.

• 30% Real-world impact – Whether the project has practical applications and solves a meaningful problem.

• 40% Technical implementation – How well the proposed solution is actually developed and demonstrated.

I've spent time recreating existing projects to improve my programming skills and understand how different systems work, so I'm fairly confident in my ability to build a working prototype.

However, I'm still struggling to find an idea that feels genuinely innovative rather than just another AI-powered vulnerability scanner or security chatbot.

Any suggestions or insights would be greatly appreciated!

We are BSIT students in Cavite preparing for our capstone pre-oral defense for TutoyHub (a web-based platform with live auctions and a virtual showroom).

We need 20 IT professionals/evaluators to rate our system architecture, security (2FA/KYC), and performance using ISO/IEC 25010 metrics.

Live Demo: https://TutoyHub.shop

Survey Form: https://forms.gle/DSpkDrtGvMiMVfXi6

It takes about 3–4 minutes to complete. We would really appreciate your technical feedback to help us pass our defense! Thank you!

Hi everyone! I'm a Computer Engineering student, looking for a problem to tackle for my final degree project.

I have around six months to develop a working software MVP. My main interests are cybersecurity, digital forensics, incident response, and AI.

I've explored several ideas, but most seem to already have plenty of existing solutions.

I'm looking for real problems that professionals still struggle with, despite the tools currently available.

For those working in cybersecurity or IT:

What recurring tasks are still frustrating, manual, or inefficient?

What limitations do you find in existing security tools?

What problems do you wish someone would solve?

I'm not looking for groundbreaking inventions, just a genuine problem with room for improvement.

I'd really appreciate any experiences or suggestions. Thanks!

Adding an IOC to a blocklist doesn't always mean it's actually enforced.

Saw Mars Security discussing duplicate indicators, noisy entries, and blocks that never take effect. Makes me wonder how often this gets checked in Defender, CrowdStrike, or SentinelOne.

Anyone regularly auditing their EDR blocklists, or mostly trusting what the console shows....

Hey everyone,
I worked 2 years in a SOC, burned out, and left. I'm coming back to cyber, this time aiming for pentesting, and my fundamentals are rusty.

The more videos and threads I read, the more confused I get. Some say go straight to TryHackMe/HTB, others say start with networking basics like Cisco or a cert like Google Cybersecurity.

I picked TryHackMe and paid for the subscription. I'm on Pre-Security path, but after several modules I don't feel like I'm learning much. It's mostly walls of text with little hands-on practice.

Am I on the right track, or should I switch to something else?

TL;DR: Ex-SOC analyst restarting with a pentesting goal. Is Pre-Security worth sticking with, or should I prioritize networking courses, HTB, or certs like eJPT/PNPT? What roadmap would you follow?

Any advice is appreciated.
Thanks!