When I started learning cybersecurity, my notes were everywhere. Random Google Docs. Half-finished PDFs. Screenshots with no context. Bookmarks I never revisited. Nothing connected. Nothing made sense when I came back to it.

So I rebuilt everything as an Obsidian vault — structured as a proper learning path from absolute basics to advanced topics.

What's inside right now:

Networking fundamentals (OSI, TCP/IP, ports, protocols)

Operating systems & Linux basics

Security fundamentals (CIA triad, threats, risk)

Web application security (OWASP Top 10, common vulns)

Cryptography basics (symmetric/asymmetric, hashing, PKI)

SOC / Blue Team / Red Team concepts

Incident response fundamentals

Malware analysis basics

Cloud security intro

Cheat sheets and command references I actually use

The part I didn't expect: Everything is interlinked using Obsidian's graph view. So instead of flat notes, you get a proper knowledge map — click through related concepts as you're learning, and it actually connects.

It's now published as a live site too (built with Quartz), so you can browse it like a proper handbook instead of just a folder of markdown files.

I'm still actively adding to it — if you spot gaps or want a topic added, let me know. Hoping this saves someone the same scattered-notes chaos I went through.

Repo: https://github.com/priyanshu-rawa/Cybersecurity-Handbook
Live site: https://cybersecurity-handbook-lake.vercel.app

Would appreciate a star if this ends up being useful for your learning too 🙏

Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!

Here are some of the technologies I’ve been focusing on:

• Java / Java Web Containers
• ASP .NET
• PHP
• Ruby on Rails
• SQL
• XML
• SOAP / Web Services

The important part for a pentester isn't just identifying a technology.

The real question is:

Application Data Flow

Browser
   ↓
HTTP Request
   ↓
Web Server
   ↓
Application
   ↓
Database / Backend Service
   ↓
HTTP Response

From a Security Perspective

Java

Look at application servers, frameworks, dependencies, and how requests are handled.

ASP .NET

Understand the application framework, authentication, session handling, and server-side logic.

PHP

Pay attention to input handling, configuration, frameworks, and dependencies.

Ruby on Rails

Understand MVC, controllers, models, routes, and gems/dependencies.

SQL

Understand how application input reaches database queries and where unsafe query construction can create SQL injection risks.

XML / SOAP

Look beyond the frontend. XML data can travel through web services into backend systems, so the security of the underlying service also matters.

The Biggest Takeaway

Technology identification is only the starting point.

Understanding the application's data flow, input handling, trust boundaries, and security controls is what makes technology fingerprinting useful during a security assessment.

I'm building a structured series around web penetration testing, covering web architecture, HTTP, reconnaissance, APIs, authentication, authorization, and vulnerability research.

Full article:
https://zeroprotocolcyber.substack.com/p/common-web-application-technologies?r=8vt7fg&utm_campaign=post-expanded-share&utm_medium=web

I’ve been working on this for almost 3 years while exploring different areas of cybersecurity, and eventually turned a lot of that research and hands-on learning into 140+ practical project ideas.

The idea is pretty simple: learn cybersecurity by actually building things, breaking them, getting stuck, fixing them, and understanding why they work — rather than just following tutorials or copy-pasting AI-generated code.

I’m sharing it here in case it’s useful to anyone else learning cybersecurity. Feedback, suggestions, and contributions are always welcome.

If you find the collection useful, you can check it out here:

https://github.com/Osxninja/cybersecurity-projects

Built around one principle: actually learn the stuff, don’t just collect tools.

[deleted]

Hey everyone,

I’ve been working on a personal hardware project lately. I wanted to see how small I could realistically make a USB keystroke injector (primarily for IT automation and pentesting workflows). After a few iterations, I managed to get the PCB down to just 12x13mm.

It uses 32u4 and Arduino IDE for programming.

The biggest challenge was fitting the components without overlaping lines.

I’d love to hear your thoughts on the design or if anyone has experience making similar micro-boards. Are there any features you’d add for a V2?

I'm putting together some picture how invisible it is.

If anyone is interested in the technical details or wants to chat about the build process, feel free to drop me a DM or reach out at nebojsa.sjekloca@gmail.com.