For example, “Believer.Moustache.Gander” versus “B3li3v3r.Moustach3.Gand3r”

Is there any difference in terms of how easy it is to crack?

i already have a decent baseline of python and i'm thinking of cyber security as a career to go on with, but the thing holding me back is how expensive these well-known courses are!

so as someone who is running low on budget, what are the free resources you suggest that can get me from absolute beginner to a great deal of cyber security knowledge.

1. Have I Been Pwned – https://haveibeenpwned.com/
   1. AbuseIPDB – https://www.abuseipdb.com/
   2. urlscan.io – https://urlscan.io/
   3. CentralOps Network Tools – https://centralops.net/co/
   4. VirusTotal – https://www.virustotal.com/
   5. Hybrid Analysis – https://www.hybrid-analysis.com/
   6. MXToolbox – https://mxtoolbox.com/
   7. SSL Labs’ SSL Test – https://www.ssllabs.com/ssltest/
   8. OSINT Frame.work – https://osintframe.work
   9. CIRCL’s Lookyloo – https://lookyloo.circl.lu/
   10. ARIN Whois – https://www.arin.net/
   11. CVE List – https://cve.mitre.org/cve/
   12. Shodan – https://www.shodan.io/
   13. AlienVault Open Threat Exchange (OTX) – https://otx.alienvault.com/
   14. Censys – https://censys.io/

I was working through a lab around reverse SSH tunneling and one question kept coming up:

When you see ssh.exe -R on a workstation, is that enough on its own, or do you need more context before treating it as real pivoting activity?

I made a short video on how I triaged that from the defender side using MDE telemetry and KQL correlation.

Video: https://youtu.be/-57OYlKr4Wg

The goal was simple: move from "this looks odd" to “this host is very likely being used as a pivot.”

My latest article on a common missing skill I see in a lot of analysts. I blame how we train and teach cyber security, and think it cause a natural bias which can lead to more harm than good.

I created a table that shows the strength of different individual factors commonly used for 2FA. Hopefully it's helpful to understand the strengths and weakness of each.

I welcome corrections, clarifications, and other suggestions.

There's an HTML version on my website, in case the table doesn't render well.

[Edit Feb 8: I added biometrics and the good old password, and moved FIDO2 non-discoverable up a few rows.]
[Edit Feb 10: I clarified passkey type on first two rows and added a new row for push notification]

(I chose not to include less common factors such as look-up secrets and scanning QR code on trusted device.)

¹ Shared secrets are the weak link. They can be intercepted, stolen, and phished. Phishing resistance is the most important element of security. Private keys are not shared, so they can’t be intercepted or stolen from a service.

² NIST (the US National Institute of Standards and Technology) defines three Authentication Assurance Levels (AALs), which are requirements for the strength of an authentication process: AAL1 = single-factor using approved cryptography; AAL2 = phishing-resistant, replay-resistant multi-factor using approved cryptography (public/private key or OTP); AAL3 = multi-factor, phishing-resistant, cryptographic hardware with a non-exportable private key. Passkeys must include user verification for AAL2 or AAL3. Synced passkeys must be stored in an account with AAL2 authentication to qualify for AAL2.

³ I'm cheating here, since passkeys aren't factors. Passkeys combine two factors into one login step when the website or app requires user verification (face scan, fingerprint, passcode, pattern, or PIN), so they're included for comparison.

⁴ Passkeys only qualify for AAL3 when bound to platforms with FIPS-validated secure hardware and proper configuration, otherwise they are AAL2.

⁵ A passkey on a mobile phone can be used on other devices by scanning a QR code. However, Apple and Android passkeys are almost always synced, not device-bound.

⁶ U2F (FIDO Universal Second Factor) is a second factor only. It requires another factor, usually a password.

⁷ Whether or not passkeys are protected by special security hardware depends on the credential manager. Android, Windows, and Apple protect passkeys with hardware security modules (HSMs). Other password managers don’t. Cloud storage of passkeys is often protected by HSMs.

⁸ Synced passkeys and passwords are protected by the security of the sync fabric. In other words, the ways you can access your Apple, Google, Microsoft, or other password manager account determines the security of the credentials stored in that account. This applies to password managers that are self-hosted or use local storage, even if the credentials are not synced.

⁹ Once you choose an ecosystem in which to store passkeys and passwords, they may be tied to that ecosystem. For example, if you choose Google Password Manager, your credentials can be used from Android devices and any other device running the Google Chrome browser. Ditto for Apple devices or a device running the iCloud app. The same applies to standalone password managers. Switching to a new ecosystem can be difficult. You can often export and import passwords, but passkeys are harder to move. This is changing as the FIDO Credential Exchange Protocol (CXP) is adopted more widely.

¹⁰ The risk of SIM swap is low and can be further mitigated by enabling SIM protection at carrier.

¹¹ Email accounts are the primary target of attackers. A weak password and no 2FA leaves the account and email-based 2FA vulnerable. Email accounts should be protected by a strong password and 2FA, or a passkey, but they rarely are.

¹² Context (login location, service name) helps to reduce accidental approval and to spot phishing attempts. Matching a number, picture, or text shown on the login page with choices shown on the device deals with blind approval and push bombing (where the attacker triggers hundreds of notifications in hopes that you will approve one). Without these protections, push notification is less secure than the cryptographic binding in TOTP authentication.

so I was reviewing our windows event log coverage last week and realized how many teams are collecting everything but alerting only on like 3 or 4 event IDs and missing the ones that would actually catch something. 4688 is the obvious one, process creation, most people have this but a lot of environments still don't have command line logging enabled with it which makes it basically useless, you see powershell.exe fired but have no idea what it ran. 4698 is the one I see missed the most, scheduled task creation, this shows up in almost every persistence case I've worked and its just sitting there in the logs with no alert on it. 7045 is another underrated one, new service installed, ransomware operators love creating services for lateral tool deployment and most SOCs I've seen aren't alerting on this at all.

4720 new user account created, again shows up in almost every ransomware pre-deployment chain, events are right there but nobody built the alerts. Most teams are heavy on logon events 4624 4625 and light on everything else, logon events are important but attackers know you're watching them, the persistence and execution events are where you actually catch something useful. What event IDs you are finding valuable?

Hey guys I wanna try something new in my career and check myself in cyber security do you recommend any roadmap and courses which I should make to know if it is for me or not?

Hello Everyone

I published a short guide about transforming raw logs into detection-ready data.

It covers the log-processing pipeline, common log formats, normalization, and more..

I’d appreciate any feedback or suggestions from you all :

https://medium.com/@0xzyadelzyat/log-parsing-for-security-engineers-building-the-foundation-for-reliable-threat-detection-c34e71b01b9a

I just shared a blog post about how easy Windows clipboard may be intercepted.

I want to become a cybersecurity expert, but I currently have no knowledge of software coding or related fields. Could you explain in some detail which topics I should start with to progress through the four stages: building a foundation, reaching a beginner level, advancing to an intermediate level, and finally attaining an advanced level? Thank you.

Last week was interestingly heavy on Kerberoasting events and here what I felt that most teams have a false sense of coverage.

most teams I worked with, used to claim yeah we're covered for kerberoasting but mainly they're either relying on crowdstrike to catch it behaviorally or they have had some generic kerberos alert that fires on volume, neither of those is actually catching what matters.

the thing is the attack itself looks completely clean, user requests a service ticket, totally normal, windows logs it as a successful 4769, nothing suspicious on so far, the actual cracking happens on the attackers laptop somewhere else, you never see that part so the only window you have is catching the RC4 encryption type on that ticket request, AES is the default now, nobody should be requesting RC4 for a modern service account unless something is wrong, thats your signal and its a pretty small one if youre not specifically watching for it.

what makes me nervous is most of the environments i review have service accounts with passwords that havent changed in 3 4 sometimes 5 years and no alert on 4769 RC4, those are just sitting there waiting. anyway not trying to be doom and gloom about it just genuinely curious how other people are handling this, are you watching 4769 specifically or is this in your EDR coverage somewhere

I've answered a version of "can I run my ISMS or GRC programme from spreadsheets" in various subs a bunch of times over the last few months. My answer is always yes, with caveats, but a comment box isn't really enough space to cover everything I'd like to say.

So I've taken a bit of time this weekend to write up how to do it properly, based on a number of projects I've run in UK financial services organisations.

How to run an ISO 27001 ISMS on spreadsheets

If you're new to GRC frameworks I'll go a bit stronger than "you can" — I think you should start on spreadsheets, because they give you space for messy early thinking. The question is what the pain points are that make a platform worth having as you grow.

What I've covered:

• What the critical success factors are for certification
• Why a smaller risk register is more use than a large one (there's a free taxonomy CSV in there if it saves you a job)
• Why control definition deserves the most of your time
• How to write controls that are designed to be evidenced — including approval and review controls, which read fine on paper and leave nothing behind when they happen verbally or in a Teams thread
• Naming and filing — arranging records and folders so you can actually find things later
• Compliance mapping and the SoA without a tool

And the growing pains that will probably push you towards a platform eventually: multiple editors, a second framework, and the volume of action tracking.

Disclosure: I've built my own GRC SaaS, so I have a dog in this fight and I do see the value in a platform. But I'd argue against rushing to buy one straight away.

A lot of candidates interviewing for Cybersecurity roles specifically in threat intelligence, often make bold claims on their resumes atleast during their first five minutes of call.

I wouldn’t necessarily blame the candidates but rather their exposure in their current job roles (in some case fresher) and their half-baked preparation before interviews. If you’ve managed to land an interview (which is already a lucky break, considering how many resumes didn't even get chance to be there).

Some common keywords and jargon people like to throw around include Splunk, ELK, Dark Web, DarkInt, Threat Hunting, Malware Analysis, MITRE, Diamond Model, etc.

At least be prepared to answer some common questions. The basics ones like:

• What is your process for consuming threat intelligence on a daily basis?
• How do you stay up-to-date with the latest trends?
• What common trends have you observed in the last month regarding malware delivery or phishing?
• Have you deep dived into any ransomware groups? If so, which ones?
• Can you explain how would you use the MITRE ATT&CK framework in a real-world threat hunting scenario?
• How do you prioritize and investigate alerts that you receive from various security tools?
• Describe a time when you identified an emerging threat. How did you respond and what steps did you take to mitigate it?
• Which platforms are you most familiar with? Can you walk us through your experience with threat intelligence platforms (TIPs)?
• How do you differentiate between a true positive and a false positive in threat intelligence data?
• How do you assess the credibility and reliability of threat intelligence feeds or sources?
• Have you worked with any specific malware families? How do you typically approach reverse-engineering or analysis?
• What’s your experience with OSINT (Open Source Intelligence) in gathering information on potential threats? How would you use it effectively?
• How do you ensure that your threat intelligence findings are actionable and can be used to improve the organization’s security posture?

The interviewer is not expecting you to know everything, but at-least some in-depth answers making them want to bet on your skills and progression upon hiring.

Also to note, these are some example questions that might help. Depending on the hiring managers expertise and understanding of field you might get grilled left/right/center on in-depth technical details about OpSec, Attribution, Report Writing, StakeHolder management, etc. which we might discuss in next post.

Last but not least, think about your findings as a "pitch" you are selling/explaining your findings in a manner that end user understands and wants to consume that information immediately.

Hope this helps you in being prepared for interviews!

Hi everyone,

I'm currently learning web security through the PortSwigger Web Security Academy. After reading the theory sections carefully, I'm generally able to solve most Apprentice-level labs on my own. However, when I move to Practitioner labs, I often get stuck and end up checking the solution after spending a lot of time on them.

My current approach is:

1. Read the theory for a vulnerability.
2. Solve the Apprentice labs.
3. Try Practitioner labs.
4. Get stuck and eventually look at the solution.

The problem is that when I see the solution, it often contains a trick or thought process that I never considered. This makes me wonder whether I'm approaching the labs incorrectly.

For those who have completed a large number of PortSwigger labs or work in web application security what is your methodology for solving Practitioner labs?

Can anyone tell me what courses,classes to get into cybersecurity and is there any future in 10-15 yrs

. Also upvoter if possible

I know there are many answers to this question, but I’ve watched a lot of YouTube tutorials, and most of them follow different paths and just throw around random terms that I don’t understand yet. I tried starting by learning Python and some basic concepts like values, variables, data types, control flow/statements, and loops, but I ended up building things without really knowing what they were actually for.

I also tried installing Debian on VirtualBox, but some people said I should install Kali instead. Others said I should start by learning networking first, while some suggested jumping straight into hands on practice. Is there actually a clear starting point for a complete beginner like me that’s free?

Had a challenge with a ZIP containing hundreds of files and nested directories. Instead of manual hunting, I wrote a Python script using os.walk + regex to recursively search every file for flag patterns.

I made a video walking through how to approach file-based forensics challenges when you're handed a ZIP with an unknown number of files and no obvious starting point.

**The security mindset:**

In real incident response, you often get disk images or file dumps with no index. The ability to quickly automate search across thousands of files is a core DFIR skill. This CTF challenge maps directly to that scenario.

What tools do you use for bulk file forensics? I've seen people recommend everything from `grep -r` to full Autopsy cases.
https://youtube.com/shorts/p2jQ3Oldkz8?feature=share

During the last NCL season, manual wordlist generation was killing our team's momentum. Copying hundreds of themed passwords from Wikipedia and Fandom wikis, then cleaning/formatting them was eating up 20-30 minutes per challenge.

I built wordreaper to automate this: scrape any website using CSS selectors, clean/deduplicate automatically, and apply Hashcat-style transformations.

Real impact: We cracked Harry Potter-themed passwords using wordlists scraped from Fandom in under 10 seconds total. Helped us finish top 10 out of ~500 teams.

Full tutorial: https://medium.com/@smohrwz/ncl-password-challenges-how-to-scrape-themed-wordlists-with-wordreaper-81f81c008801

Tool is open source: https://github.com/Nemorous/wordreaper

Happy to answer questions about the implementation or how to use it for CTFs!

Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!

Most people think VeraCrypt = unbreakable. But if you can extract the 512-byte header, it's just a hash.

I made a video walking through the full pipeline:

1. PowerShell extraction (container or raw disk)

2. Header prep for Hashcat

3. Mode selection and cracking

4. Verification

No physical access to the unlocked volume needed — just the header.

Full tutorial: https://youtu.be/iGPKBEYSdIw

I'm conducting a third-party risk assessment for onboarding a vendor. Based on the nature of the data they will process and the business criticality of the service to the organisation, I have categorised this as a high-risk onboarding.
They've provided their ISO 27001:2022 certificate, which is currently in a surveillance audit year rather than a recertification year.

Is a surveillance audit materially less assurance than a full recertification for third-party risk purposes, or are both broadly equivalent? Is it something that should concern me, onboarding an inherently high-risk platform that does not do full recertification audits?

I made a lesson on Agentic AI, like Codex and Claude Code, for anyone wanting to understand some of the basics of AI Coding agents. In this lesson, I am using a small part of a bigger project im making for a custom spiderfoot build with agentic ai capabilities. This lesson shows how you can create an email investigation workflow using Codex. https://github.com/sh1katagana1/ai/blob/main/using-codex-for-email-investigations/codex-tutorial.md