Hi everyone,

We've made available the first 10+ hours of our Practical Ethical Hacking course. This covers the foundations including Linux, Networking, and Python and then builds into beginner level hacking.

This is 100% free. There is no sign up or registration required to view the videos. Just press preview on the first video and it will take you to the player.

I hope this helps anyone who might be struggling. Best of luck and happy hacking!

https://academy.tcm-sec.com/p/practical-ethical-hacking-the-complete-course

Hi everyone,

I’ve been deeply interested in hacking and cybersecurity ever since I was a kid. I don’t mean anything illegal, my main interests are:

Bug bounty programs

OSINT (Open Source Intelligence)

Cybersecurity research & projects that can help society

I come from a very poor background, so I was never able to buy a PC. The only device I have is a tablet, which I received as an award. I don’t have any proper knowledge yet, I don’t fully understand how the web works, how calls/messages function, or even the basics of networking.

But I want to start from zero, build up my understanding of computers and networking, and work on projects so I can one day earn money for myself and my family through bug bounty and ethical hacking.

Here’s what I can commit:

I have 5–8 hours per day until September.

After that, I’ll have 2–3 hours daily that I can dedicate to learning.

What I’m looking for:

1. Free, beginner-friendly resources (courses, books, websites, YouTube channels) to learn:

Basic computer literacy

Networking fundamentals

Linux basics

Web technologies (HTTP, HTML, APIs, etc.)

Bug bounty / OSINT paths

2. Advice on what gadgets/tools I actually need to get started. Can I do anything useful with just a tablet for now?

3. If anyone knows of communities or initiatives that help students from poor backgrounds get laptops, I’d be grateful for pointers.

I’d really appreciate any structured roadmap or personal experiences. My dream is to make a career in ethical hacking, but right now I don’t even know where to begin.

Thanks in advance!

I just responded to a user asking for mentorship saying that I would help (with some caveats). I ended up putting together what, from my personal experience, is the best path through learning / digging into this profession in a relatively short time-frame. There are certainly other ways to get there, this is just what seems to be working for me. I figure if I'm going to be explaining the key points of everything I've learned to one person, it couldn't hurt to have a few extra people on those calls / chats to benefit, so this offer extends to as many of you as is feasible. Or just use the resources linked.

My reply, pasted:

If you believe in investing your time in learning the topic without being spoon fed, I'll help you. I'm not a SME by any means, but I've been living and breathing the subject matter for the past 3 years. Explaining concepts helps with mastery of them so we probably both benefit.

Scope (Understand the depth of the problem-set)

Like I said, I will explain ideas and concepts from the highest level (think NIST) down to the lowest level (think firmware / x86-64 architecture), and all the tools in between; think NIDS, EDR/XDR (HBIS), SIEM, threat intel / taxonomy. The list goes on, seemingly forever (expect these acronyms to be re-branded into new buzzwords by vendors yearly, but it's really not so bad).

I can point you toward resources, but will not be bothered if I can tell you haven't put in the sweat to figure it out yourself. Feel free to DM me.

Resources (Be constantly learning)

In addition to anything we discuss, you should be following Reddit's r/cybersecurity and r/blueteamsec, have a feed from only those communities, and follow up on every interesting post / article / discussion that appears, daily. Five times daily. You should also subscribe to SANS Institute, SANS DFIR (defense) and John Hammond (offense) on YouTube and watch at least 3-4 videos per week for the next few years. Over the years, all of this will help you fill in the gaps between book knowledge and all the thousands of important topics and discussion relevant to the industry your college courses won't teach you.

Mindset (Be curious, love the challenge)

None of this should feel like a chore, or some overwhelming mountain to climb. You should be like an astronomer looking up at the sky and realizing how little you know, and not be stressed by that, but rather excited and curious to uncover its mysteries. Some people see this field as a paycheck and nothing more. If that's you, fine, but I've seen one too many posts about depression over on r/sysadmin to be able to recommend it. We're putting out fires all the time. It's not an easy line of work; you need to love it and you need to be curious. But don't take it from me.

Along the way make sure you're climbing this ladder, and building an info sec resume correctly.

Get hands-on

Finally, none if this means anything without copious amounts of hands-on experience. I recommend purchasing a Proving Grounds membership; it's roughly the cost of two Netflix subscriptions although there are free alternatives if you're cash strapped as many college students are. Offense and defense are two sides of the same coin; you cannot excel at one without the other.

Communication

Edit: And one more thing; Communication. Believe it or not, your skills in this industry will be either amplified or diminished by your ability to communicate effectively across different target audiences (your boss, your boss's boss, that new hire you need to train, and also that genius working in the basement who won't look you in the eyes but writes mind-blowing kernel exploits for fun). The two keys here are language and value, and there are far better resources than me to learn that from.

P.S. Many people see posts like this covering so much training within such a large scope and lament; "I just want an entry level role. I'm not trying to get my PhD here; why so complicated?" I want share the answer to that frustration in the way that finally made it click for me. Did you know a seasoned cyber security professional makes roughly the same as a pediatrician? If you're making a PhD's pay it's probably reasonable to infer that this job's difficulty is comparable to a PhD's level of knowledge and skill.

Cyber security is not typically an entry level role. Computer systems are incredibly complex; Defending them is hard.

Also: There are some non-technical administrative roles in the industry.

Hey guys, so I had applied for a Web App Security Research Intern position at a small/medium sized IT company in India and these were the questions I was asked during the technical interview. I am a 4th year CSE University student and they told me they were looking for an intern who they wanted as a full-time employee after graduation so they would offer a job depending on the performance during the internship. It was also a proper paid internship(lot of unpaid internships in India) and the monthly stipend was pretty high, so it was a serious company.

Here are the questions:

• What is the OWASP Top 10?

• What are different Injection attacks?

• SQL Injection? What are the types of SQL Injection attacks? What are some of the payloads you've used while doing SQL Injection? Why is UNION used in error based SQL Injection? Do you know how to use SQL map?

• What is LDAP Injection?

• What is Command Injection?

• What is LFI, RFI? How do you exploit?

• What is XSS? Types of XSS? Different XSS payloads?

• What is XXE? What is XML used for? Give an example of how you could exploit XXE?

• What is CSRF and how to mitigate?

• What is SSRF and how to mitigate?

• What is CORS?

• What is Insecure Deserialization? How to mitigate?

• What are some of the tools you've used?

• How does burp suite work? What are some of burp suites tools? How is Intruder, Repeater, Sequencer, Decoder used? Have you used any Burp extensions?

• What fuzzing tools have you used in Kali?

• What do you know in cryptography? What is asymmetric and symmetric algs?

• What is the difference between http and https? How do SSL certificates work? What are the contents of a SSL certificate?

• What programming languages are you comfortable writing? What languages can you read and understand what the code is doing?

• Give an example of a script you wrote recently in Python and how you used it?(I told them I had strong python scripting skill)

I told them I frequently did boxes on HackTheBox and TryHackMe, so they asked me if I had faced any challenges in any web-based box and how I overcame that challenge.

At the end I was given a code snippet on GitHub (it was a merged pull request) and was asked what changes were made to the code.

A function was added to the code which checked if the input had any special characters( /,>,<, ; etc,.) and gave an error saying those characters were not allowed. I was asked what attack was this code preventing against. It was input sanitization to prevent XSS.

I hope this was helpful for you guys if you have any interviews coming up for WebApp Security

I could answer most of the questions clearly, there were some questions in which I gave a half-answer or told them I couldn't recall it. Hopefully I get the internship!