Security, from the first concepts to real tools. Every exercise runs in a lab you own, and every claim links to its source.
What security protects, the words people use for it, and how attacks and defenses fit together.
4 articles
IP, DNS, HTTP and TLS: how a request travels and where it can be read or changed.
4 articles
From the Caesar cipher to hashes, keys and signatures, with code you can run.
6 articles
The terminal, Git, GitHub, Docker and Python: the tools every lab starts with.
5 articles
Finding what is public about a target you are allowed to look at, and checking it.
3 articles
Legal practice environments you build and break on your own machine.
4 articles
Injection, access control, authentication and the rest of the OWASP list, tested by hand.
4 articles
Installing and using the open-source tools of the trade, from upstream sources.
2 articles
Reading binaries you compiled yourself, from hexadecimal to Ghidra.
2 articles
How analysts study malicious code and what a system remembers after an incident.
2 articles
Logs, alerts, Sigma rules and the investigation that turns an event into a finding.
3 articles
CVE, CVSS, EPSS and KEV: reading an advisory and deciding what to fix first.
3 articles
Agents that run security tools, how to set them up and how to check their work.
2 articles
Calling a model from code: keys, requests, streaming, tools and cost.
2 articles
How models refuse, what abliteration changes, and the rules around using them.
2 articles
Scope, reports, certifications and the habits of people who do this for a living.
2 articles
Security fundamentals
The CIA triad explained: confidentiality, integrity and availability, with everyday examples, hash and signature checks, and ten incidents to classify.
Security fundamentals
Separate vulnerability, threat, risk and exploit, see how CWE and CVE name flaws, and learn why unreachable flaws can still matter.
Security fundamentals
Learn data flow diagrams, trust boundaries and the six STRIDE categories, then model a local OWASP Juice Shop in Threat Dragon.
Networks and the web
A port is a numbered door on your machine. Learn how TCP and UDP use ports, then start, find and test a local server on 127.0.0.1.
Networks and the web
Read a real HTTP exchange line by line: methods, URLs, headers, status code classes and cookies, tested with curl against a local server.
Networks and the web
TLS 1.3 gives HTTPS confidentiality, integrity and server authentication. Learn the handshake, certificate chains and what the padlock does not prove.
Cryptography
Separate encoding, encryption and hashing with Base64, SHA-256 and OpenSSL labs. Learn why Base64 is not protection and hashes are one-way.
Cryptography
Why fast hashes fail for passwords, what salts and work factors do, and how to hash and verify with Argon2id in Python using argon2-cffi.
Cryptography
Public and private keys from zero: what a signature proves, why the private key stays secret, and an Ed25519 lab where a changed file fails.
Linux and developer tools
Learn pipes, redirection, variables, loops, exit codes and set -euo pipefail, then use them to count failed logins and hash a folder.
Linux and developer tools
Linux owners, groups, rwx bits, chmod, umask and setuid, with a lab that tests access as a second user and finds risky file modes.
Linux and developer tools
How SSH host and user keys work, why Ed25519 with a passphrase is the default to use, and how to set up and harden a key login on a lab VM you own.
OSINT and recon
Learn purpose, proportionality, consent and data minimisation for OSINT, with LGPD and GDPR basics and a one-page research plan template.
OSINT and recon
Learn how Certificate Transparency logs record public TLS certificates, and how to review crt.sh results for a domain you own without touching its hosts.
Hacking labs
Build a Docker network with no internet access, run OWASP Juice Shop on it, and publish a browser copy only on 127.0.0.1. Verify each step.
Hacking labs
Structure a pentest report and write one finding someone else can reproduce, with evidence, impact, a CVSS v4.0 vector and a fix.
Web and API security
What the OWASP Top 10 is, what each 2025 category means, how to defend it, and how to map Juice Shop challenges to it.
Web and API security
How SQL injection changes a query's meaning, why parameterized queries fix it, and a Juice Shop login lab with a Python sqlite3 demo.
Web and API security
Learn reflected, stored and DOM-based XSS, why output encoding depends on context, and how CSP adds defence in depth, in a local lab.
Web and API security
Cross-site request forgery uses your browser's cookies against you. Learn the defences in order of strength and test SameSite with a Flask lab.
Security tools
Nmap maps the open ports on your own machine. Learn connect and SYN scans, service detection and output files, then match each port to its process.
Security tools
Run ZAP's passive baseline scan against Juice Shop on your own machine, read the report, and check one alert by hand before trusting it.
Reverse engineering
Learn what compilation discards, how disassemblers differ from decompilers, and the legal limits to know before you analyze a binary.
Reverse engineering
Compile a toy C licence check two ways, then use Ghidra to find its string, follow references and compare the decompiler with your source.
Malware and forensics
Learn how hashes identify files, why SHA-256 replaced MD5, how NSRL filters known software, and why uploading a file to VirusTotal shares it.
Malware and forensics
Write a first YARA rule, match one harmless test file and not another, and learn why every rule needs positive and negative tests.
Detection and blue team
A SIEM collects logs, normalizes them, runs correlation rules and raises alerts for triage. Learn the pipeline with a runnable example.
Detection and blue team
Read the Windows Security log: audit policy, event IDs 4624, 4625, 4634, 4672, 4688 and 1102, what Sysmon adds, and a failed logon you find yourself.
Detection and blue team
Write a Sigma rule for failed Windows logons, validate it, convert it to Splunk, and test it against known-good and known-bad events.
Vulnerability intelligence
A CVE record names the flaw and points to the vendor, and the vendor advisory sets the fixed version.
Vulnerability intelligence
What a CVSS score like 9.8 means, how v4.0 and v3.1 vector strings are built, and how to decode and recalculate one by hand.
Vulnerability intelligence
Rank CVEs with CISA's KEV catalog and FIRST's EPSS scores next to CVSS, then build a priority table from both free feeds.
AI agents for security
How tool use works: a model returns a structured call, your host program runs the tool, and approval rules decide what is allowed.
AI agents for security
MCP is the open protocol that connects AI apps to tools and data. Learn its roles, primitives, transports and security model with a sandboxed lab.
LLM models and APIs
How large language models turn text into tokens, predict the next one, and why they sound confident when they are wrong.
LLM models and APIs
How a chat API request is built: model, messages, tokens, streaming, API keys, rate limits and HTTP errors, with annotated examples.
AI safety and governance
Prompt injection lets text in an LLM's input act as instructions. Learn direct and indirect attacks, why no complete fix exists, and layered defenses.
AI safety and governance
The four main risks of AI assistants in security work, a method to keep them small, and a lab that checks an AI-written CVE summary against NVD and KEV.
Careers and methodology
Compare eight common cybersecurity roles by daily work, core skills and a free first practice step, then pick two to explore.
Careers and methodology
Read a bug bounty policy for scope, safe harbour and disclosure terms, then write a pre-test checklist before any authorized test.
Security fundamentals
What cybersecurity covers, the CIA triad, common ways systems fail, and a safe first exercise with hashes on your own machine.
Cryptography
Cryptography from zero: encryption, keys, hashes, signatures, and why a Caesar cipher teaches ideas but protects nothing.
Cryptography
The Caesar cipher shifts each letter a fixed number of places. Encrypt HELLO to KHOOR by hand, reverse it, and see why it fails.
Cryptography
Build a Caesar cipher in Python, test it with unittest, and see why this shift cipher gives no real secrecy.
Linux and developer tools
GitHub explained for beginners: what Git and GitHub do, the terms you need, a local Git practice run, and how to check a project before you run it.
Linux and developer tools
Create a GitHub account and a first repository in the browser, add a README and a second commit, and keep secrets out of it.
Networks and the web
How DNS turns names into addresses: resolvers, authoritative servers, TTL caching, the A, AAAA, CNAME, MX and TXT records, and a safe lookup.
OSINT and recon
What OSINT means, how to verify public information, where the ethical limits are, and how to write a short report that shows its evidence.
Hacking labs
Build a home lab you are allowed to attack: a scope file, Docker ports bound to loopback, an isolated network, a notebook and a clean teardown.
Hacking labs
Run OWASP Juice Shop in a Docker container bound to your own machine, confirm it responds, and stop it cleanly.
Create an account, add credits from $10 and ask the first question in the chat or the terminal.
Individual or company. You can switch to a company later without losing balance or keys.
By card, from $10. Pay per token, no subscription.
In the chat, or install the CLI and run notholy login in your terminal.
