Security

Where systems fail — the flaws, the attacks, and the people cataloguing them.

Learning

pwn.college (Website) — a free hacking curriculum split into “dojos”, each covering a high-level topic and assuming everything the previous ones taught — you work the challenges in a browser workspace, and the core track doubles as a certification path.

• Start Here (Course) — the platform itself: how challenges, flags, and the workspace work, in 2 modules.
• Linux Luminarium (Course) — the command line from scratch, 17 modules and 128 challenges deep.
• Computing 101 (Course) — assembly, memory, processes, and what a computer is actually doing underneath.
• Program Security (Course) — where individual programs break: memory errors, format strings, and the rest.
• Software Exploitation (Course) — turning those bugs into working exploits.
• Cryptographic Exploitation (Course) — a community dojo on attacking crypto implementations rather than the maths.

TryHackMe (Website) — over 1,000 hands-on labs that teach offence and defence on intentionally vulnerable machines, run through a browser workspace so there's nothing to set up — 8.4 million registered learners, with a free tier and structured paths towards specific roles.

• Cyber Security 101 (Course) — the way in: networking, cryptography, Linux and Windows basics, then both offensive and defensive tooling. 14 modules, 56 labs, about 46 hours.
• SOC Level 1 (Course) — the defensive track, built around real analysis scenarios for a Level 1 analyst. 14 modules and 65 labs.
• Offensive Pentesting (Course) — industry tooling and realistic attack scenarios, aimed at the standard certifications. 5 modules, 27 labs.
• Red Teaming (Course) — past pentesting into adversary emulation: initial access, persistence, evading security products, Active Directory. 6 modules, 36 labs.

Hacksplaining (Website) — interactive lessons on the most common web vulnerabilities, each one played from the attacker's side against a deliberately broken demo app, then explained as the code fix. Filterable by OWASP Top 10, PCI DSS, or the newer AI category.

• SQL Injection (Interactive) — fourteen stages against a fake “Secure Bank”: a failed login, an error message, a look at the query behind it, and then the break-in. The clearest way in if you only do one.
• AI Prompt Injection (Interactive) — getting an LLM-backed application to follow the attacker’s instructions instead of its own.
• Slopsquatting (Interactive) — the supply-chain attack that registers the package names AI assistants hallucinate, and waits for someone to run the install.
• CSS Injection (Interactive) — how user-supplied stylesheets can be turned into a channel for extracting data off the page.
• Cross-Origin Resource Sharing (Interactive) — what an over-permissive CORS policy actually hands to a malicious origin.
• Privilege Escalation (Interactive) — going from an ordinary account to an administrative one without ever stealing a password.

References

• Vulnerability Garden (Website) — a growing, sortable catalogue of 1,000+ named vulnerabilities, exploits, and attack techniques, each with its CVE, publish date, and links out to the original research.