From N00b to Ninja: Hacking Your Way into Cybersecurity

So, you're looking to dive into the world of cybersecurity but don't know where to start? You've come to the right place! In this post, I'll walk you through everything—from the basics to advanced platforms like TryHackMe, HackTheBox, and PortSwigger Academy. We'll also compare OSCP and PNPT certifications and give you an intro on how to build your own home hacker playground. Let's get cracking!

First Things First: The Basics

Before we start hacking the Gibson (movie reference, anyone?), it's crucial to lay a solid foundation.

Networking Fundamentals

Understanding networks is like knowing how roads work before driving a car. Get comfy with:

• OSI Model: The seven-layer dip of networking.
• TCP/IP Protocols: The language of the internet.
• Subnetting: Because who doesn't love slicing IP addresses into smaller chunks?

No need to know these concepts like the back of your hand, but explore the concepts. They'll help things click in your head later on.

Programming Skills

You don't need to be the next Zuckerberg, but a bit of coding goes a long way.

• Python: The hacker's Swiss Army knife. A simple scripting language.
• Bash Scripting: Automate tasks and learning basic terminal functionality.

Exploring TryHackMe

Why Start with TryHackMe?

Think of TryHackMe as the friendly neighborhood tutor. It's beginner-friendly and offers guided pathways that ease you into the complex world of cybersecurity.

Getting Started

1. Sign Up: Head over to TryHackMe and create an account.
2. Beginner Paths: Start with "Pre-Security" or "Complete Beginner" paths. Once you start getting more confident, go for the
3. Interactive Labs: Practice in a controlled environment without the fear of breaking anything (except maybe your ego). TryHackMe offers a sea of machines that are configured to be vulnerable and to allow you to experiment and learn to exploit vulnerabilities.

Leveling Up with HackTheBox

Why Move to HackTheBox Next?

Once you've got the basics down, it's time to level up. HackTheBox is like the gym for hackers—it toughens you up.

Getting In

The Invite Challenge: Yes, you used to have to hack your way in to sign up. This has changed, you can now just register with your email address.

Choose Your Machines: Start with "Easy" boxes and work your way up. Remember, "Easy" is a relative term here.

Join a Team: Many hackers on the platform will create and join teams to hack together and learn off of each other. The community is welcoming and generally full of great people. Don't be scared to ask around and join some groups, this is also a good way to start building your support network and contacts in the cyber industry.

Why This Order?

TryHackMe builds your foundation, and HackTheBox challenges you to apply what you've learned in more complex scenarios. HackTheBox does not hold your hand through challenges, it is a testing ground for your hacker arsenal and methodology. It's the natural next step in your hacking evolution.

Mastering Web Exploitation with PortSwigger Academy

Why Focus on Web Applications Now?

Web applications are like the front doors to most companies—they're everywhere and often the first point of attack. Fun fact: Most cybersecurity providers get the highest number of requests for web application security. So, mastering this skill instantly boosts your market value.

Getting Started with PortSwigger

1. Sign Up: Visit PortSwigger Web Security Academy and create a free account.
2. Burp Suite Basics: Download Burp Suite Community Edition. It's your new best friend for web hacking.
3. Interactive Labs: Dive into labs on SQL injection, XSS, and more. Break things (ethically) and learn.
4. OWASP Top 10: There are countless web vulnerability categories, I suggest you start with learning the OWASP Top 10 as they are generally regarded as the most commonly found in the wild and are typically what clients expect you to test during real penetration tests.

Some solid vulnerabilities types to start learning with are:

• SQL Injections
• OS Command Injection
• Cross-Site Scripting (XSS)
• Server-Side Request Forgeries (SSRF)
• IDOR (Insecure Direct Object Referencing)

The order does not matter, but make sure you make an effort to understand what pre-conditons exist that make those vulnerabilities appear, and take notes on how to exploit them based on what you learn. Taking notes is crucial to develop your methodology. I suggest using something like Obsidian or Notion for this.

Why This Order?

After honing your general hacking skills, specializing in web applications makes you a hot commodity. Plus, it's super satisfying to find vulnerabilities in websites—legally, of course. You can test your skills on bug bounty platforms too like HackerOne and BugCrowd which essentially allow you to hack real companies legally. You receive rewards for disclosing vulnerabilities to bug bounty programs, but you should know that it is an extremely competitive area and you are not only up against these company's security teams but also against millions of hackers worldwide trying to find these bugs before you, so be patient and more importantly, be consistent if you want to try your luck in bug bounty programs. It is not for the feint of heart and I would only suggest getting involved here once you feel you have gained a strong foundation.

Certifications: OSCP vs. PNPT

Why Talk About Certs Now?

With some solid skills under your belt, it's time to get those credentials. Certifications like OSCP and PNPT validate your expertise to employers. This is how you hack HR departments to get yourself some interviews.

OSCP (Offensive Security Certified Professional)

• Recognition: The OG of hacking certifications.
• Focus: Hands-on penetration testing using Kali Linux.
• Exam: A grueling 24-hour test where sleep is for the weak, and you are being watched.
• Ideal For: Those wanting a well-respected cert that's recognized worldwide.
• Not Ideal For: Those with limited budgets (both in money and time). The certification is pretty expensive now and requires you to be committed to it for a few months.
• Created by Offensive Security, a well established Cyber Security organisation.

PNPT (Practical Network Penetration Tester)

• Recognition: The new kid on the block but gaining respect fast.
• Focus: Real-world network penetration testing, including reporting.
• Exam: A multi-day practical exam that feels like actual client work.
• Ideal For: Those who want a cert that's as practical as it gets. It is realistic, and it teaches you soft-skills as well which will come in handy when handling  clients.
• Created by The Cyber Mentor, a well respected member of the Cyber community online.

OSCP vs. PNPT: The Lowdown

While OSCP has long been the gold standard, PNPT is shaking things up with its real-world approach. OSCP is more widely recognized, but PNPT offers a more realistic exam experience. Depending on your career goals, either cert can open doors. It really depends on your budget and time constraints. OSCP is a longer process and really starts from the very beginner skills and covers all the foundational skills you need. PNPT in my opinion is a more gentle approach, more realistic and teaches you how to build a methodology that you can apply to real penetration tests. The downside of PNPT is that it is less recognised as it is more recent.

Why This Order?

After gaining practical experience on platforms like HackTheBox and PortSwigger, you're better prepared to tackle these challenging certifications.

Building Your Home Lab

Why Build a Lab Now?

By now, you're ready to create your own hacking playground. A home lab lets you tinker, break, and fix things without any legal repercussions.

Getting Started

1. Set Up Virtual Machines: Use VirtualBox or VMware. Install Kali Linux and a few intentionally vulnerable machines like Metasploitable.
2. Network Simulation: Create a mini-network to practice pivoting and lateral movement.
3. Check out GOAD: A pre-built lab with lots of Active Directory vulnerabilities to learn about. This is more advanced, but for those with a backgrounfd in IT and networks, you might feel surprisingly at home looking at this environment.

Why This Order?

Building a lab after certifications allows you to apply what you've learned on your own terms, further solidifying your skills.

Join Communities

Why Now?

No hacker is an island. Connecting with others accelerates your learning and keeps you updated. Having people around that you can throw questions at is always a positive thing. In Cyber there are so many areas, that even people with decades of experience are aware that they don't know everything there is to know. There are therefore no "stupid" questions. (Though if something can be searched easily on Google, it's very likely someone responds to these types of questions with a link like the one here: Let Me Google That For You...

Discord Servers

• HackTheBox: Full of people looking to hack together, learn and share ideas. Lots of memes too.
• The Cyber Mentor's Discord: A welcoming community led by Heath Adams, the creator of PNPT.
• Hacker101: From the folks at HackerOne, great for web app hackers that want to get involved in bug bounty hunting.
• 0x00sec: A community-driven server for sharing knowledge.
• TryHackMe: A server full of people starting their cybersecurity journey.

Other Communities

• Reddit's r/cybersecurity: News, memes, and everything in between. Also lots of dumb content. Not the best place, but you do get the occasional news and update here.
• X (Twitter): A lot of the best hackers share their content, thoughts, ideas, and memes here. You can start with following people like John Hammond and NahamSec.

Additional Tips for Success

Stay Updated

• Blogs: Follow Krebs on Security, The Hacker News, and BleepingComputer.
• Podcasts: Check out Darknet Diaries for some hacker storytelling. Jack Rhysider, the host, is a great storyteller and interviewer.

Ethical Hacking Only

Remember, with great power comes great responsibility. Always hack within legal boundaries. Use TryHackMe, HackTheBox and VulnHub, and your own lab as your training grounds - there is no need to commit crimes to learn this craft anymore thankfully.

Why Learning Webapps Is Crucial

To reiterate, web applications are the most targeted assets. Companies are constantly seeking professionals skilled in web app security. By mastering this area, you become an immediate asset in the cybersecurity market.

Wrapping It Up

And there you have it—the only guide you'll ever need to start your cybersecurity journey (well, until you find another one at least). Remember, the key is persistence and continuous learning. The cyber world evolves fast, and so should you.

Until next time, happy hacking! And may your exploits be fruitful and your logs clean.

You can catch me on X if you have questions or are looking for some more tips:
@kreepsec