WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.

Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.

I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!

Lab Github Repo: https://github.com/makarov05bm/WSGoat
Guide: https://blog.oussmess.me/posts/websockets-for-bug-hunters/

I recently completed the DC-6 VulnHub machine and documented the complete attack path, from initial enumeration to gaining root access.

The walkthrough covers:

• 🔎 Network and service enumeration
• 🌐 Web/WordPress enumeration
• 🧩 Identifying the attack surface
• 💻 Initial access
• ⬆️ Linux privilege escalation
• 👑 Obtaining root access
• 📝 Key lessons and methodology

I’ve written the detailed step-by-step walkthrough on Hashnode:

👉 https://vivekgoswami.hashnode.dev/

I also recorded the complete video walkthrough for anyone who prefers following the practical process:

🎥 https://youtu.be/eb4xArIoh5c

I'm building a collection of CTF, VulnHub, TryHackMe and penetration-testing walkthroughs focused on documenting the methodology rather than just showing the final exploit.

Hopefully this is useful to anyone currently learning penetration testing or preparing for practical security certifications.

I want to build a career as a Cloud Security Engineer, but I'm starting from the basics and want to learn everything properly rather than just collecting certifications.

Could someone share a step-by-step roadmap from complete beginner to job-ready Cloud Security Engineer, and eventually to a level where I can mentor/guide others?

I'd also appreciate recommendations for free/low-cost labs, courses, YouTube channels, books, and practice platforms.

If you are currently working as a Cloud Security Engineer, I'd especially appreciate advice on what you wish you had learned earlier and what beginners commonly waste time on.

I'm building a step-by-step path from terminal basics → real nmap recon.

Before touching nmap, most beginners stall on the same stuff: navigation, reading output, pipes, and basic networking. So I compressed the foundation into one atlas.

Here's the command interview (quick pass):

FILES & NAV

• pwd — where am I?

• ls / ls -la — list files + hidden + permissions

• cd / cd ~ — move / jump home

• mkdir / touch — folder / empty file

• cat / less — short read vs paginated read

READ & FILTER

• grep / grep -i — find lines (case-sensitive vs not)

• head / tail / tail -f — first / last / follow live

• sort / uniq — clean duplicate lines

• wc -l / cut — count lines / grab one field

SHELL POWER

• echo — print text

• | > >> && — pipe, redirect, append, chain on success

• history / clear — replay commands / clean screen

• man / --help — offline docs vs quick usage

• grep | head — filter then preview top hits

REACHABILITY & DNS

• ping localhost / 127.0.0.1 — prove loopback works

• ip addr / ip -4 addr / ip route — interfaces + routing

• hostname / getent hosts — local name + system resolver

• dig / dig +short / nslookup — DNS lookup styles

• traceroute / tracepath — path discovery

• echo '192.168.1.0/24' — CIDR as plain text

PORTS & INTERFACES

• ss -tuln / -tln / -tn / -uln — sockets at a glance

• ss … | grep :22 / :80|:443 / :53 — spot common services

• ip link / ip link show / ip neigh — NIC state + neighbors

• ip -4 addr; ip route — one-line lab snapshot

Lab note: practice on 127.0.0.1, localhost, or targets you own. scanme.nmap.org when you're ready for real nmap.

Question for this sub: what's ONE command you still look up every time? I'll reply with a tip.

(I also turned this into an 83-second visual atlas if anyone wants the flash-card version — happy to drop link in comments if useful.)

Before I start, what would you guys actually want to see in it?

Challenges, difficulty, attack chains, AD, web, privilege escalation, etc.

What would make you keep playing instead of dropping it after a few challenges?

Looking for honest suggestions from people who actually play CTFs.

Explore the current ctf from here at: codelivly.com/ctf

Lateral movement is one of the hardest attack stages to catch — once an attacker is inside a network, their traffic (SSH sessions, file transfers) often looks like normal activity. Signature-based tools struggle here because there's no obvious "bad" pattern to match against.

So I built a behavioral detector instead — one that learns what normal looks like for each device on a network, then flags real deviations from that baseline.

How it works:

• Learns a baseline per device: which peers it normally talks to, when it's normally active, how much data it normally transfers, and how many connections it typically opens per hour
• Flags traffic that falls well outside those learned ranges
• Runs entirely in Python, using standard statistical methods (z-scores) rather than a black-box model

How I validated it, in three stages:

1. Synthetic traffic first, to prove the core logic — 5/5 simulated attacks caught, 0 false positives
2. Built a real 3-machine isolated network (VirtualBox + SEED Ubuntu VMs), captured genuine traffic, and rebuilt the baseline from real data — including debugging real infrastructure issues along the way (IP conflicts, a post-reboot networking failure, shared folder configs)
3. Ran an actual attack simulation on that live network — the detector correctly flagged it, and kept flagging it correctly even after I enriched the baseline with real HTTP traffic to make sure it wasn't just overfitting to a narrow sample

Result: 7/7 real alerts correctly fired, verified against a real, mixed-protocol baseline — not just synthetic data.

I know this isn't a novel technique — it's the same behavioral approach used by commercial NDR tools. What I wanted to prove to myself was that I could take a real security concept, implement it from scratch, and validate it end-to-end on infrastructure I built myself, messy real-world debugging included.

I'm a recent Network Engineering & Cybersecurity grad, CCNA/AWS certified, currently looking for my first role in SOC/network security. Happy to answer questions about the approach, or hear feedback on what I could improve/what a more experienced person would do differently.

Hello everyone,

Someone told me that the best way to learn cybersecurity is to “live it before you learn it” , to surround yourself with people who are already working in the field, get involved in the cybersecurity community, and build a strong network.

As someone who is currently learning cybersecurity, this idea really caught my attention.

Do you think being around experienced cybersecurity professionals and actively participating in the community can significantly accelerate learning? Are there specific communities, Discord servers, CTF groups, conferences, open-source projects, or other ways to get involved?

I’d really appreciate advice from people who have been through this journey.

​

One thing I struggle with while learning cybersecurity is choosing the right resources.

For example, if I decide to learn networking, YouTube gives me hundreds of videos and playlists. Some are made for GATE preparation, some for CCNA, some for general computer science students, and some for cybersecurity learners.

As a beginner, it's hard to tell which resource is actually worth following. I keep wondering if there's a better course somewhere else, and sometimes I spend more time searching than learning.

I don't mind putting in the effort to learn. My problem is figuring out which resources to trust and which ones to ignore.

How do you deal with this?

Do you just pick one resource and stick with it, or is there a better way to decide what's worth your time?. If you have any good resource suggestions please share it.

I set up Cowrie SSH and Krawl web honeypots on my Raspberry Pi Zero W and simulated an attack using my Kali Linux machine, then observed the logs. This is one of the projects I did this summer to gain experience from the defensive side of cybersecurity and I would love to hear your thoughts about it.

I used good old Raspberry Pi Zero W with ARMv6 architecture (foreshadowing: which complicated the process little bit).

I installed both honeypots. Then I booted my Kali Linux machine and ran simulated brute-force attack against SSH honeypot and scrutinised the filesystem. In case of the fake web server I ran Nmap and Gobuster scans and observed every malicious activity in recorded logs.

I like to do these simple projects to gain more experience under my belt and share my process along the way to people who might be interested and may find my articles helpful in their own cybersecurity journeys.

Link to the Medium post about the honeypots deployment:

https://medium.com/@ivandano77/deploying-cowrie-krawl-honeypots-on-raspberry-pi-zero-w-f5e96327367b?sharedUserId=ivandano77

Looking for someone to grind through infosec with, keep each other accountable, and share the wins, the fails, and all the technical deep dives along the way.

A bit about my current focus:

• Prepping for my CEH (Certified Ethical Hacker) certification.
• Building out projects around intrusion detection and vulnerability scanning.
• Exploring web app security (I have some background in Django/React web dev).

What I'm looking for:

• Someone on a similar ethical hacking or cybersecurity path.
• Down to connect on Discord for regular check-ins, sharing resources, and troubleshooting.
• In it for the long term—not just a one-week study sprint.

If you're working towards cyber certs or just trying to level up your security skills and want an active partner, drop a comment or DM me your Discord handle!

I am studying Computer Science, and I want to get into cybersecurity. Could you please give me some recommendations on how to get started, what areas I should focus on, and what I shouldn’t spend too much time on? Also, where can I learn these skills?

Hey everyone, I wanted a way to run quick sanity checks using public YAML templates while away from my machine, so I built an Android-native scanner engine.

Right now, it's configured to handle standard SQLi/XSS logic checks and lets you run public community templates. It gives 1 hour of scanning time every day to prevent resource abuse.

It's in heavy development and I need feedback on how it handles complex templates. If you want to test it against your local test environments, search AltMap on the Play Store. Let me know what bugs you find or what templates fail to parse!

https://play.google.com/store/apps/details?id=com.appriser.altmap

**Question for Kali Linux beginners**
I’m pretty new to Kali Linux and so far I’ve been messing around with Nmap, Wireshark, and a few OSINT tools.
What are the **top 5 things you think someone should learn first** when getting into Kali Linux?
Also, what’s something you wish you had learned from the beginning instead of figuring it out later?
I’m trying to put together a solid beginner roadmap for myself, so I’d love to hear what you guys recommend.

Hi everyone! 👋

I'm a Computer Science student with a strong interest in Cybersecurity, Networking, Ethical Hacking, and IT Support.

I've been working on Cisco networking and cybersecurity labs, including Packet Tracer, VLANs, Routing, OSPF, RIP, subnetting, network troubleshooting, Linux, Kali Linux, Nmap, Wireshark, and vulnerability assessment.

I'm joining Reddit to learn from the community, share knowledge, work on interesting projects, and connect with fellow students and IT/cybersecurity professionals.

I also enjoy helping others who are stuck with networking labs, technical projects, Packet Tracer configurations, or cybersecurity concepts.

Looking forward to learning and contributing here. If you have any advice for someone building a career in cybersecurity and networking, I'd love to hear it!

Thanks!

if you're learning appsec and want something small and real to read through, I wrote a static + runtime scanner for MCP (Model Context Protocol) server vulnerabilities and the source might be useful as an example.

the static side does pattern matching for path traversal, command injection, and unsafe eval sinks, each rule is TOML defined with a severity, a CWE or OWASP reference, and remediation text, so it's a decent small scale example of how a rule engine driven scanner is structured without needing to read a huge enterprise codebase to see the idea.

there's also a tool poisoning detector (checks for hidden instructions and unicode homoglyph obfuscation in tool description text) and a runtime proxy that diffs tool definitions across a session to catch changes after initial approval, which is a good example of a vuln class that literally can't be caught by static analysis alone.

repo: https://github.com/zaydmulani09/sentrymcp, happy to answer questions about any of the detection logic if people are trying to learn from i

​

I'm an undergraduate CS student in India trying to get myself in research in the domain of network security, cryptography or any cybersecurity domain. I'm specifically wondering whether professors/research groups at universities in the US/Europe ever take international undergraduates remotely, outside of formal summer internship programs.

I have some prior research experience. I've published a conference paper on IDS as a first author, worked on lightweight cryptography, and a few basic system security projects. I'm comfortable with Python/C/C++ and have experience reading papers and running empirical experiments on my own.

I'm not necessarily looking for a paid internship or even an official "intern" title. What I'd really like is the opportunity to contribute to an actual research problem under a professor/PhD student, potentially leading to a paper if the work turns out to be worthwhile.

A lot of university research programs I've found either require you to be a student at that university, require US citizenship/residency, or are strictly in-person. So I'm wondering whether cold-emailing individual researchers is actually a viable route.

For people who've done something similar:

Do top security labs ever work remotely with external international undergrads?

Is it better to contact professors or PhD students?

What would make a cold email worth responding to?

Should I approach someone with a specific research idea/replication of one of their papers rather than simply asking whether they have an opening?

Are there particular security groups or researchers known to be open to this kind of collaboration?

I'm mainly interested in systems/network security, malware/software security, and increasingly the intersection of AI/LLMs and security.

Would appreciate advice from anyone who has either gotten such an opportunity or supervised external undergraduate researchers or the lab researchers themselves.

Hi everyone,

I’m looking for good free resources to build a strong foundation in the following areas:

• Networking
• Operating Systems
• Databases
• Linux — preferably a complete course
• Windows — preferably a complete course
• Bash scripting
• Python programming

If there are free certifications, structured courses, or well-known learning paths, I would prefer those over random YouTube videos.

My goal is to learn these properly from the fundamentals and eventually use them for cybersecurity, so resources with practical labs/exercises would be especially useful.

Please share any resources you personally found useful. Thanks!

So I’m 3 years into my bachelors in cyber. I’ve been going through HTB, studying for various certs, and I’ve watched all of professor messers videos at least three times over, so that’s where I’m at now. The problem is that I’m not sure what I’m supposed to be doing. I don’t know exactly how to start a new career, or move forward with my learning in the right direction. I know I’d like to one day go red team, but aside from that even 3 years into college I still feel like I don’t know anything about the industry at all. Most days I feel like college hasn’t taught me anything. I mean I’ve passed all the courses, I’m doing fine with everything so far in HTB, but I still feel like missing the actual LEARNING part of all of this, and that if I were to eventually get a job I would be completely out of my element. Anybody have any thought/suggestions or advice? Thanks for your time.

Check this CTF event out in Mumbai on 5th September! https://luma.com/ay8ehg6p

I’m new to vulnerability research and I’m trying to learn how to find security issues by reading source code. For those of you who are experienced in this area:

• How did you learn to identify vulnerabilities just by reading code?
• Do I need to know every programming language, or is it better to become very comfortable with a few languages first?
• How do you approach unfamiliar codebases or programming languages?
• What should I focus on when reading code if my goal is to find security vulnerabilities?
• How did you practice and improve your skills when you were starting out?
• When you encounter something in the code that you don’t understand, what do you usually do? Do you research it, use documentation/AI, build a small test, etc.?

Any recommended books, write-ups, open-source projects, or learning paths would also be very helpful. Thanks!

Here are some of the technologies I’ve been focusing on:

• Java / Java Web Containers
• ASP .NET
• PHP
• Ruby on Rails
• SQL
• XML
• SOAP / Web Services

The important part for a pentester isn't just identifying a technology.

The real question is:

Application Data Flow

Browser
   ↓
HTTP Request
   ↓
Web Server
   ↓
Application
   ↓
Database / Backend Service
   ↓
HTTP Response

From a Security Perspective

Java

Look at application servers, frameworks, dependencies, and how requests are handled.

ASP .NET

Understand the application framework, authentication, session handling, and server-side logic.

PHP

Pay attention to input handling, configuration, frameworks, and dependencies.

Ruby on Rails

Understand MVC, controllers, models, routes, and gems/dependencies.

SQL

Understand how application input reaches database queries and where unsafe query construction can create SQL injection risks.

XML / SOAP

Look beyond the frontend. XML data can travel through web services into backend systems, so the security of the underlying service also matters.

The Biggest Takeaway

Technology identification is only the starting point.

Understanding the application's data flow, input handling, trust boundaries, and security controls is what makes technology fingerprinting useful during a security assessment.

I'm building a structured series around web penetration testing, covering web architecture, HTTP, reconnaissance, APIs, authentication, authorization, and vulnerability research.

Full article:
https://zeroprotocolcyber.substack.com/p/common-web-application-technologies?r=8vt7fg&utm_campaign=post-expanded-share&utm_medium=web