-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
fb7f5d1
commit 5a4d9e6
Showing
9 changed files
with
399 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| --- | ||
| title: "Learning Path: Riding without training wheels 🚲" | ||
| --- | ||
| <div class="balloon_l"> | ||
| <div class="faceicon"><img src="../icon/otter_says.png" alt="faceicon" ></div> | ||
| <p class="says"> | ||
| In this blog post, my goal is to share tips that, from my perspective, can significantly aid your learning journey in web security. | ||
| These insights will serve not only as a starting point for your exploration into the subject but also as a means to continually uncover new and intriguing topics. Similarly, as you progress through your journey, you'll develop personalized methods of learning that suit your individual approach. | ||
| </p> | ||
| </div> | ||
|
|
||
| # Introduction | ||
|
|
||
| In computer science, like many other fields, being self-taught is key. Essentially, you'll need to harness the infinite possibilities of the internet to learn on your own. The internet can feel overwhelming initially, but it offers numerous possibilities once you explore its potential. Steering clear of all sorts of deceptive promises like 'become a hacker in 20 days' schemes peddled by opportunists. Similarly, one can become a proficient researcher without investing in costly courses or programs. To serve this purpose, this post shares my experiences and insights — resources I wish I had possessed when I first began. Before delving into the various sections, I'd like to highlight these introductory blogs by [Jack Halon](https://twitter.com/jack_halon), offering a great starting point for this post. | ||
|
|
||
| - [Beginners Quest - Introduction](https://jhalon.github.io/2018-google-ctf-beginners-intro/) | ||
| - [So You Want To Be a Pentester?](https://jhalon.github.io/becoming-a-pentester/) | ||
|
|
||
| ### Capture The Flag (CTF) competition | ||
|
|
||
| An essential aspect of security is balancing theoretical knowledge acquisition with practical application. Capture The Flags (CTF) competitions ([What is a CTF?](https://www.youtube.com/watch?v=8ev9ZX9J45A)) stand out as one of the finest resources for simultaneous theoretical learning and practical application. I won't delve extensively into this, but I highly recommend readers explore this further online (check the references for some of them). What I aim to emphasize in this subsection are resources specifically tailored to Web Security that I love. All of them free ;-) | ||
|
|
||
| - [CTFTime](https://ctftime.org/): A centralized platform for tracking past, ongoing, and upcoming CTF competitions. Moreover, CTF competitions incorporate a rating system that assesses their difficulty level or the engaging nature of the challenges. CTF's rated from 0 to 25 typically represent new events, beginner-friendly competitions, or those considered less engaging. On the other hand, challenges rated above 50 tend to be highly competitive and challenging, offering compelling and engaging experiences from players with a minimum level. | ||
|
|
||
| - [Web Security Academy (PortSwigger)](https://portswigger.net/web-security): I risk to affirm that one of the most complete web-security platform. | ||
|
|
||
| - [TryHackMe](https://tryhackme.com/): Not limited to web. 'Gamified lessons' in different topics in Cyber. | ||
|
|
||
| - [HackTheBox](https://www.hackthebox.com/) Not limited to web. Mostly focused in pentesting machines (e.g., boot2root). | ||
|
|
||
| - [root-me](https://www.root-me.org/) Not limited to web. French based CTF platform. In my case, I started CTF's in this platform. | ||
|
|
||
| - [picoCTF](https://play.picoctf.org/): Not limited to web. Beginner's CTF platform, by excellence. | ||
|
|
||
| - [pwn.college](pwn.college): Focused in low-level concepts but with some sections focusing web. IMHO, one of the best platforms and learning path I have seen. | ||
|
|
||
| - [CryptoHack](https://cryptohack.org/): Crypto stuff. | ||
|
|
||
| - Bug Bounty Platforms challenges: [Intigriti](https://blog.intigriti.com/hackademy/xss-challenges/), [BugCrowd](https://www.bugcrowd.com/blog/bugcrowds-october-challenge-month/), ... | ||
|
|
||
| - [OverTheWire](https://overthewire.org/wargames/natas/): Not limited to web. One of the most historical platform. | ||
|
|
||
| ### Research Blogs & Security researchers | ||
|
|
||
| Research blogs serve as pivotal resources in Cybersecurity, encompassing both company research blogs and individual blogs authored by leading researchers in the field. In this section, I'll highlight a few blogs that immediately spring to mind. Disclaimer, for sure, there are a plenty of them that I do not mention. | ||
|
|
||
| - [PortSwigger Research Blog](https://portswigger.net/blog). | ||
| - [Cure53](https://cure53.de/#publications). | ||
| - [Chrome for Developers](https://developer.chrome.com/blog/). | ||
| - [Acunetix](https://www.acunetix.com/blog/category/web-security-zone/). | ||
| - [Securitum](https://research.securitum.com/). | ||
| - [Sonar Source](https://www.sonarsource.com/blog/). | ||
| - [Github Blog](https://github.blog/category/security/). | ||
| - [NCC Group](https://research.nccgroup.com/category/cyber-security/). | ||
| - [Intigriti](https://blog.intigriti.com/hackademy/). | ||
| - [Bugcrowd University](https://www.bugcrowd.com/hackers/bugcrowd-university/). | ||
| - Almost any R&D Business in Security has a blog. | ||
|
|
||
| Another crucial aspect of cybersecurity involves following the right people. Specifically, following security researchers on Twitter (I refuse to call it the other way). In the following words, I'll highlight some of the best (IMHO) researchers in our exciting field. Random list of security researchers: [Huli](https://blog.huli.tw/en/archives/), [Orange tsai](https://blog.orange.tw/), [text/plain](https://textslashplain.com/), [strellic](https://brycec.me/blog) [Terjanq](https://twitter.com/terjanq), [Zeyu](https://infosec.zeyu2001.com/), [Siunam](https://siunam321.github.io/), [Kahla](https://ahmed-belkahla.me/), [Gareth Heyes](https://twitter.com/garethheyes), [James Kettle](https://twitter.com/albinowax), [Ark](https://twitter.com/arkark_), [liveoverflow](https://twitter.com/LiveOverflow), [Ankur Sundara](https://ankursundara.com/), [Michał Bentkowski](https://twitter.com/SecurityMB), [Kévin Mizu](https://mizu.re/), [Sirdarkcat](http://sirdarckcat.blogspot.com/), [Ben Stock](https://twitter.com/kcotsneb), [Peter Snyder](https://twitter.com/pes10k), [Nick Nikiforakis](https://www.securitee.org/), [Alexandros Kapravelos](https://kapravelos.com/), ... | ||
|
|
||
| ### Conferences | ||
|
|
||
| Conferences, whether from industry or academia, serve as another invaluable source of knowledge. Most of the conferences publish the videos on Youtube after some months. Same as previous sections, I'll mention a list of them: | ||
|
|
||
| - [BlackHat](https://www.blackhat.com/). | ||
| - [DEF CON](https://defcon.org/). | ||
| - [Chaos Computer Club (CCC)](https://www.ccc.de/en/). | ||
| - [OffensiveCon](https://www.offensivecon.org/). | ||
| - [NullCon](https://nullcon.net/). | ||
| - [M0lecon](https://m0lecon.it/). | ||
| - [DragonJAR](https://www.dragonjarcon.org/). | ||
| - [Ekoparty](https://ekoparty.org/). | ||
| - [NahamCon](https://www.nahamcon.com/). | ||
| - [No Hat](https://www.nohat.it/). | ||
| - [DefCamp](https://def.camp/). | ||
| - [Usenix Security (Academic)](https://www.usenix.org/conference/usenixsecurity24). | ||
| - [NDSS Symposium (Academic)](https://www.ndss-symposium.org/ndss2024/). | ||
| - [ACM CCS (Academic)](https://www.sigsac.org/ccs/CCS2023/). | ||
| - [IEEE Security&Privacy (Academic)](https://sp2023.ieee-security.org/). | ||
| - [TheWebConf WWW (Academic)](https://www2024.thewebconf.org/). | ||
| - [PETS (Academic)](https://petsymposium.org/). | ||
| - [Web Engines Hackfest](https://webengineshackfest.org/). | ||
| - [Ad-Filtering Dev Summit (AFDS)](https://adfilteringdevsummit.com/public/-NXuG6IckpLeVt7jyeIm). | ||
|
|
||
| ### Other resources | ||
|
|
||
| #### Videos / Podcasts | ||
|
|
||
| Another intriguing avenue for learning about cybersecurity topics is through security content creators. They're not only beneficial for getting started in the field but also for staying updated on the latest concepts within it. In the following list I write some of really good youtube channels: | ||
|
|
||
| - [CTFRadiooo](https://www.youtube.com/@ctfradiooo) | ||
| - [Security Content Creators](https://securitycreators.video/) | ||
| - [Critical Thinking - Bug Bounty Podcast](https://www.youtube.com/@criticalthinkingpodcast) | ||
| - [LiveOverflow](https://www.youtube.com/@LiveOverflow) | ||
| - [John Hammond](https://www.youtube.com/@_JohnHammond) | ||
| - [CryptoCat](https://www.youtube.com/@_CryptoCat) | ||
| - ... | ||
|
|
||
| #### Chromium bugs / Individual CVEs / Bug Bounty reports / CTF writeups | ||
|
|
||
| Reading software bugs blogs provide another really interesting way of improving yourself and learning. In our field, a few of these resources include the following: | ||
|
|
||
| - [Chromium bugs](https://bugs.chromium.org/p/chromium/issues/list). | ||
| - Individual CVEs (e.g., [vulns in common libraries](https://blog.huli.tw/2023/11/13/en/sentry-nextjs-sdk-cve-2023-46729/)). | ||
| - Bug Bounty reports (e.g., [HackerOne](https://github.com/reddelexc/hackerone-reports)). | ||
| - [Capture-The-Flag (CTF) Writeups](https://ctftime.org/writeups). | ||
|
|
||
| #### Books | ||
| In this final section, I'd like to highlight some books related to this topic. While not essential reads, they offer valuable insights into the subject. (I have a fondness for reading physical books when away from the computer, which is why I'm also mentioning them here). | ||
|
|
||
| - [The web application hackers handbook](https://edu.anarcho-copy.org/Against%20Security%20-%20Self%20Security/Dafydd%20Stuttard,%20Marcus%20Pinto%20-%20The%20web%20application%20hacker's%20handbook_%20finding%20and%20exploiting%20security%20flaws-Wiley%20(2011).pdf) | ||
| - [Javascript for hackers](https://www.amazon.com/JavaScript-hackers-Learn-think-hacker/dp/B0BRD9B3GS/) | ||
| - [Bug Bounty Bootcamp by No Starch Press](https://nostarch.com/bug-bounty-bootcamp) | ||
| - [Real-World Bug Hunting](https://nostarch.com/bughunting). | ||
| - Almost all the [No Starch Press books](https://nostarch.com/). | ||
|
|
||
| ### Mental Health | ||
|
|
||
| Last but certainly not least, I'd like to touch on the subject of mental health. Learning cybersecurity or web security content isn't a sprint; it's more like a marathon. At times, the abundance of concepts to learn can be overwhelming, leading to comparisons with experts in the field without knowing their background. I recommend to see the following video by LiveOverflow ([link](https://www.youtube.com/watch?v=AMMOErxtahk)) about enjoying the path and this another about starting in Hacking ([link](https://www.youtube.com/watch?v=2TofunAI6fU)). Moreover, there are instances where dedicating excessive time to learning in this field can lead to burnout. It's crucial to strike a balance between immersion in the subject and maintaining a healthy pace to avoid mental and physical exhaustion. | ||
|
|
||
| ### Conclusion | ||
|
|
||
| In conclusion, my aspiration for this blog is to facilitate the entry of newcomers into the field without overwhelming them in the process of exploration and learning. Additionally, this blog serves as a means for me to solidify my understanding by articulating intriguing concepts within the field, attempting to encapsulate over 20 years of web research into accessible blog posts. | ||
|
|
||
| ## References: | ||
|
|
||
| - _Recommended [VIDEO]:_ [Building a Competitive Hacking Team (USENIX Enigma 2016) by Tyler Nighswander](https://www.youtube.com/watch?v=-r-B1uOj0W4) | ||
| - _Recommended [VIDEO]:_ [Real World CTF Finals 2018 by LiveOverflow](https://www.youtube.com/watch?v=2S_TXaGYD8E) | ||
| - _Recommended [VIDEO]:_ [What is a CTF by CTFRadiooo](https://www.youtube.com/watch?v=aBKhuWTc1Eg) | ||
| - _Recommended [VIDEO]:_ [How to get into it, by CTFRadiooo](https://www.youtube.com/watch?v=UuKX5pbsA0o) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters