Getting Started In Security

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 23 Mar 2022 12:00:30 -0700

This page represents a list of almost every resource that I’ve found useful on my journey to doing cybersecurity. If you’re brand new and interested in learning, or if you’re an old-timer exploring someone else’s viewpoint, I hope you find something interesting here.

Wargames

Tryhackme: One of the best places for a complete novice to start. After learning the ropes using TryHackMe, move on to HackTheBox.
HackTheBox: Super great place for playing boot2root machines. A variety of difficulties. I’d say that easy to medium HackTheBoxMachines are roughly equivalent to OSCP level machines.
HackThisSite: An older wargame which mainly focuses on exploitation of older web applications, but still super fun.
OverTheWire A classic wargame that starts with the fundamentals of Linux, and takes you up to complicated exploitation exercises. This is my favorite place to recommend to beginners.
PicoCTF: I haven’t used this one too much, but for learning the basics of Jeopardy-style CTFs, this is a great start.
VulnHub: Place to find vulnerable virtual machines to put in your lab and attack.
Exploit Education: A collection of challenges to teach binary exploitation.

Training

PortSwigger Web Security Academy: Incredible free resource that covers almost everything you need to know about web application hacking. It’s the replacement for the Web Application Hacker’s Handbook.

Youtube Channels

LiveOverflow: Great security creator. Goes above and beyond to explain the “why” of all his exploits. My favorite series from him are the Pwnie Island Series, and the Binary Exploitation Playlist.
Rana Khalil: Amazing videos walking through the entire PortSwigger Web Academy.
S1REN from OffensiveSecurity: Offensive Security posts walkthroughs of Offensive Security Proving Grounds boxes by S1REN. Although she mainly sticks to OSCP-level boxes, I really appreciate how she demonstrates proper note taking, and I’ve taken many tips from her style.
IppSec: A classic cybersecurity youtuber that posts video walkthroughs of every HackTheBox machine.

My Favorite Resources

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 23 Mar 2022 12:00:30 -0700

On this page is a list of resources that I’ve stumbled upon that have been helpful for my workflow. I’m not going to list super common tools like Nmap or Metasploit, just the ones that were unknown to me and really useful.

Reference

Ippsec.Rocks: A website that allows you to search through IppSec videos for techniques and tools.
Hacktricks: A huge compilation of techniques for exploitation and privilege escalation.
pentestmonkey’s Reverse Shell Cheatsheet: A place to copy-paste reverse shells.

Tools

Cyberchef: The best tool for dealing with formatting and encoding.
UpDog: A great tool for exfiltration from a compromised machine.
Joplin: The note taking app that works for me. It’s similar to Evernote and Cherrytree, but FOSS. Uses markdown formatting, so it’s really convenient for copy-pasting into Hugo or a Pandoc converter.
Flameshot: One of the best Linux screenshot utilities. I used this app to take and annotate the screenshots for my OSCP.

News

The Daily Swig: Security focused news from PortSwigger
Schneier on Security: Great place for security news and opinion

security on Stephen Swanson