r/learncybersecurity

if anyone is wants to learn how to build a cybersecurity home lab in their own laptop/PC , i made a video regarding it 😄. Hope it helps

I’ve been in cyber for years now, working as a SOC analyst, and I’ve seen the same mistake over and over — especially from beginners trying to get their first role.

Everyone wants the perfect first job

Has to be remote.
I’m not working weekends.

I need to earn X amount minimum

I get it, but the truth is when you’re starting out you don’t really have leverage yet. Companies don’t know you , you haven’t proved anything in a real environment.

When I was starting out I had to drop that mindset fast. The biggest thing that actually moved me forward was simple:
Take the first opportunity you can get.

It doesn’t have to be perfect It probably won’t be, but that first role changes everything.

Once you have real experience even just a few months everything shifts, you understand how things actually work, your confidence goes up, and suddenly recruiters start taking you seriously.

I’ve seen people struggle for months applying with no result, then the moment they get that first role and update their profile, opportunities start coming in.

Another thing people underestimate is just putting themselves out there, talking to people, being in the right spaces, asking questions — that matters way more than just spamming applications.

Cybersecurity isn’t just about skills it’s about getting your foot in the door.

Once you’re in you can move, Level up, Earn more and Be selective later.

But at the start, you just need that one shot

hello guys, i just finished my first project which is a NGFW Firewall .
and after testing it on over 40 kinds of malwares it was really successful against polymorphics and other kind of malwares i need someone to guide me should i publish it as an Open-source firewall or should i wait for someone to get interested in it and maybe he could buy it from me .
.
github.com/manaf-dev1/sentinel-firewall
this is the firewall its just a readme i update everytime i accomplish something and you'll find the latest update of what i've done .
i wish if a real expert could guide me what to do with it because in my region there's no support for this kind of stuff and they're just interested in famous providers . such as PaloAlto , etc...

Hi everyone,
I’m a complete beginner in cybersecurity, and my long-term goal is to become a Security Engineer.
I recently started Jeremy’s IT Lab CCNA course to build a strong networking foundation, but I’m not sure what I should focus on after that.
My ultimate goal is to work as a Security Engineer in Dubai, so I’d also like to know which skills, certifications, and learning path are most valued by employers there.
I’m feeling a bit overwhelmed because there are so many learning paths, certifications, and resources available. I don’t want to waste time studying the wrong things, so I’d really appreciate some guidance from people who have already been through this journey.
Here are a few questions I have:
. Am I starting with the right thing by learning CCNA first?
. What should I study after I finish the CCNA course?
. What topics should I prioritize? (Linux, Python, Windows, Active Directory, cloud, scripting, etc.)
. What roadmap would you recommend for someone aiming to become a Security Engineer?
. Since I want to work in Dubai, which certifications and skills are the most valuable there?
. Which certifications are actually worth getting, and in what order? (CCNA, Security+, eJPT, PNPT, CySA+, etc.)
. What hands-on labs, platforms, or projects should I focus on? (TryHackMe, Hack The Box, home lab, CTFs, etc.)
. Are there any books, YouTube channels, or courses you highly recommend?
. What mistakes do beginners usually make that I should avoid?
I’d also love to hear how you got started and what you would do differently if you had to start over today.
Thanks in advance for any advice. I really appreciate your help!

https://preview.redd.it/mbzfmausz1bh1.png?width=2167&format=png&auto=webp&s=fe0389e61e653caf81bee4ae46396f0f07b178b4

I have a strong foundation in computer science and networking, and I'm interested in learning cybersecurity from a practical, offensive-security perspective (purely for educational purposes and in authorized lab environments).

Most courses I've found focus on theory or beginner-level content. I'm looking for resources that teach how attacks actually work under the hood—things like phishing infrastructure, payload delivery, lateral movement, social engineering, OSINT, C2 frameworks, and realistic red-team tradecraft—along with how defenders detect and mitigate them.

Are there any advanced courses, labs, communities, or learning resources you'd recommend? I'm not looking for script-kiddie content or illegal activities—I want to understand the real techniques used by professionals so I can build and break things in a controlled environment.

I've heard people mention private communities or even resources on the dark web , discords, telegram . Are any of those actually worth exploring, or are there better legitimate alternatives for learning the same material?

Any recommendations would be appreciated.

Yoo, Everyone, I'm AtomEJ I'm an engineering student, my branch is data science, which I'm a bit interested in but the day I was introduced to hacking and get in know about it, I was fixed that i have to master this, 🤩🤩🤩

But i know shit about it 😅😅, to be honest i don't know anything about it, i don't know where to start, what to follow, and which yt channels to look😅😅😔😔,

I have research my self and messed my system, and got to rebooted and reinstall windows twice by, doing things i shouldnt have done 😂😂.

But Im here to get some

• Details

• Advice

• Any books to read, and learn

• Tools

• SOFTWARE REQUIRED

• Website to learn and research

• And road map if possible,

Thank you

Hi everyone,

I'm learning web security and came across something on my university's student portal. Before I report it, I'd like to get some opinions on whether this is actually a security vulnerability.

Here's what happened:

• I logged in using my own student account in the university portal.
• While inspecting the requests, I found one like:GET /app.php?a=getDetailedResults&regno=<my_registration_number>
• I changed only the regno parameter to another valid registration number using burp suite repeater.
• The server returned that student's academic details (grades/CGPA/course information) instead of mine.

I didn't enumerate multiple students or attempt to modify any data. I stopped after confirming the behavior.

My questions are:

1. Does this qualify as an IDOR/Broken Access Control vulnerability?
2. Is it worth reporting to the university's IT/security team?
3. What severity would you typically assign to this if it only allows unauthorized viewing of academic records?

I'm intentionally not naming the university or sharing screenshots with student information because I don't want to expose anyone's data.

Thank you!!

If you had to choose between becoming a Penetration Tester and a Cloud Security Engineer in 2026, which would you choose and why?

I would like to start my career in cybersecurity and get my certification. Unfortunately, it's not possible for me to pursue a bachelor's degree right now. Do you have any recommendations for reputable cybersecurity certifications or training programs? .

Hello everyone, i was exploring what career path would align with my interests and i think cyber is the closest.. i want to know what exactly led you to choose this path and what cybersecurity is all about

Hello everyone!

I am very new to the whole IT thing in general, but it does interest me to learn about it.

Problem is… i have no idea what to start with. I feel like a needle in a haystack everytime i try to figure out whats the best thing to learn in order to understand the basics. I would appreciate some help and directions on what you guys think is most important to learn in the beginning.

Is it networking? Coding? Linux? Etc. Im so lost lol

I'll say Metasploit.

Don't get me wrong, it's powerful and industry standard. But beginners treat it like a magic button without understanding what's actually happening under the hood. You're just running modules without knowing the exploit, the payload, or why it works.

Real learning happens when you understand the attack manually first. Metasploit should come after that, not before.

What are your Opinions?

Hey everyone,

I recently got selected for an Information Security Trainee role, and I'll be joining on July 1st. I'm really excited, but I also want to prepare as much as possible before my first day.

My background so far:

\- Found few bugs on hackerone/bugcrowd

\- Built a SOC home lab and have some hands-on experience with log analysis and monitoring.

\- Completed ISO 27001 training.

\- Currently preparing for the CEH certification.

Since this will be my first full-time role in cybersecurity, I'm curious about what an Information Security Trainee typically does on a day-to-day basis.

Will I mostly be working with SOC, vulnerability management, compliance, incident response, or something else? What tools should I expect to use? Also, what topics or skills should I revise over the next few days so I can make a good first impression?

I'd really appreciate any advice from people who've started in a similar role. Thanks!

Hi, I am a beginner in the cybersecurity field. I love coding and solving coding problems. In the past i had learned C++ (i remember the concepts not the syntax right now) and i dont know if its worthy to learn it for cybersecurity reasons.

Hi everyone! I'm learning ethical hacking from scratch. I'm currently studying networking, Python, Metasploit, OSINT, and exploit development. I'm looking for study partners or a small group to learn together, discuss concepts, and practice CTFs. If anyone is interested, feel free to comment or DM me.

I wanna start cyber secutiy from scratch ....!!!!!!. How should i start?pls help everyone