Cybersecurity
Security fundamentals, ethical hacking, and SOC tooling.
Tutorials
Incident Response Lifecycle and Digital Forensics Basics
Learn how to prepare for, detect, contain, and recover from security incidents, following NIST SP 800-61 Rev. 3, with basic evidence handling.
MITRE ATT&CK and Threat Hunting Basics
Use the ATT&CK knowledge base to describe attacker behavior, map your detections, and start simple hypothesis-driven hunts.
Security Logging and SIEM Basics with Wazuh and Sigma
Collect and analyze security logs, write a Python log detector, and learn how Wazuh and Sigma detection rules work.
Network Defense: Firewalls, Segmentation, and Suricata IDS
Limit how far an attacker can move with network segmentation and firewall rules, and detect suspicious traffic with Suricata.
Linux Server Hardening Essentials
Reduce a Linux server's attack surface with updates, SSH key authentication, a host firewall, fail2ban, and a Lynis audit.
Web Application Testing with Burp Suite and the OWASP WSTG
Intercept and inspect traffic to a practice app with Burp Suite Community, and use the OWASP Web Security Testing Guide to structure testing.
Network Reconnaissance and Scanning with Nmap in Your Lab
Discover hosts, open ports, and service versions in your own lab with Nmap, and learn how defenders use the same results.
Build a Safe Cybersecurity Home Lab
Set up an isolated virtual lab with an attacker machine and intentionally vulnerable targets that cannot reach your real network.
Ethical Hacking Fundamentals: Law, Scope, and Methodology
Learn what separates a penetration tester from a criminal: authorization, scope, rules of engagement, and a repeatable methodology.
Automated Security Testing with OWASP ZAP Against a Local Practice App
Run ZAP's baseline scan in Docker against OWASP Juice Shop on a private network, read the report, and add it to CI safely.
Dependency and Supply Chain Security: SCA, SBOMs, and Scanning
Find known vulnerabilities in your dependencies with Dependabot, OSV-Scanner, and Trivy, and scan your own Python code with Bandit.
API Security: The OWASP API Security Top 10 (2023)
Understand the ten most critical API risks, and the practical controls that prevent object-level flaws, excess data, and abuse.
Broken Access Control, CSRF, and Session Management
Enforce server-side authorization, block cross-site request forgery, and manage sessions securely using OWASP's guidance.
Preventing SQL Injection and Cross-Site Scripting (XSS)
Use parameterized queries, allow-lists, context-aware output encoding, and safe DOM APIs to remove the two classic injection flaws.
The OWASP Top 10:2025 Explained for Developers
Walk through all ten categories of the 2025 edition, what changed from 2021, and the core defense for each.
HTTP Security Headers, Secure Cookies, and Content Security Policy
Harden a web application with the right response headers, cookie attributes, and a strict Content Security Policy.
MFA, Passkeys, and Modern Password Policy (NIST SP 800-63B-4)
Apply NIST's current password and authenticator guidance, understand authentication assurance levels, and learn how passkeys resist phishing.
OAuth 2.0, OpenID Connect, and JWT Security Basics
Understand the authorization code flow with PKCE, the difference between ID tokens and access tokens, and how to validate JWTs safely.
Identity and Access Management (IAM) Fundamentals
Understand authentication, authorization, the identity lifecycle, access models like RBAC, and the standards behind single sign-on.
Secure Password Storage and Secrets Handling in Python
Hash passwords with Argon2id, use the secrets module for tokens, compare values safely, and avoid common storage mistakes.
Cryptography Basics: Hashing, Encryption, Signatures, and TLS
Understand what hashing, encryption, signing, and encoding do, which algorithms to use, and how TLS and certificates protect web traffic.
Phishing, Social Engineering, and Ransomware: Practical Defense
Spot phishing, respond correctly, and apply the backup, patching, and MFA practices that stop most ransomware damage.
Cybersecurity Fundamentals: The CIA Triad, Threats, Risk, and Defense in Depth
Learn the core vocabulary of security, common attack types, and the frameworks professionals use to organize defenses.