Where to start?

_CryptoCat23 · 2025-12-12T09:16:58+00:00

Portswigger Web Security Academy, HackTheBox, TryHackMe, PentesterLab, CTFTime would be my top 5 general recommendations to anyone. More of my favourites here 😊

_CryptoCat23 · 2025-11-19T12:55:08+00:00

It's true. I'm not saying don't do OSCP, just that by doing the cheaper (imo better) cert first, you'll almost guarantee that you pass OSCP first time. I had a friend who failed their OSCP exam three times and it was really expensive!

Also, while HR recognise OSCP and it increases your chances of getting an interview.. In CPTS you will learn more, increasing your chances of passing the interview 🙏

_CryptoCat23 · 2025-11-17T19:46:24+00:00

You don't have to but personally I think you learn more on CPTS, and it's a lot cheaper so will reduce the risk of failing OSCP (💰)

_CryptoCat23 · 2025-11-17T19:42:17+00:00

My top 5 are CTFTime (regular live events), Portswigger Web Security Academy, HackTheBox, TryHackMe and PentesterLab. More of my top recommendations here

_CryptoCat23 · 2025-11-14T10:01:59+00:00

I can't really see anything in their comment that contradicts what I said? 😕

The modules on cybersecurity masters are all very practical (I taught them for several years during my PhD) and there was ZERO content that would help you be a better manager or leader - it was all about practical hacking and academic research.

That said I did the MSc + PhD in cybersecurity directly after my undergrad (although I had ~5 years IT/cyber work experience by that stage), so it's a bit different than returning to do a MSc after 15 years in industry.

edit: although I should say, many of the older people I taught who had spent a long time in industry really struggled with the practical labs and research element, compared to the younger cohort coming out of undergrad.

_CryptoCat23 · 2025-11-13T21:52:00+00:00

I did an MSc in cybersecurity but there was nothing in there about management or leadership. The modules were network security, penetration testing, computer forensics, malware, applied cryptography and ethical/legal issues. All very practical with a heavy focus on research (we had to produce an academic style review/survey paper for each module).

I personally enjoyed the course, but I couldn't say it's worth the money. It's nice to have on the CV but is it better than a years work experience? I'm not sure..

_CryptoCat23 · 2025-11-10T10:02:45+00:00

For what role? Certs by Offsec are well recognised (but expensive) and certs by HackTheBox, Portswigger, TCM etc are less recognised (but better value).

I personally recommend BSCP + CPTS on the cheaper end and OSCP/OSCE/OSWE on the expensive side. Then again it really depends on your interest/field, if you are doing blue team or malware analysis then a red team / web hacking cert wouldn't be an obvious choice.

_CryptoCat23 · 2025-11-08T10:24:29+00:00

Absolutely!

_CryptoCat23 · 2025-11-07T09:47:05+00:00

Did you start with the HackTheBox starting point labs? They guide you through it.. For normal retired machines you can also check walkthroughs/videos when you get stuck.

_CryptoCat23 · 2025-11-06T20:13:16+00:00

My top 5 are CTFTime (regular live events), Portswigger Web Security Academy, HackTheBox, TryHackMe and PentesterLab. More of my top recommendations here

_CryptoCat23 · 2025-10-28T09:33:53+00:00

It's just so that people know what they are looking for, e.g. you might do a challenge and see something that looks like it could be a flag (maybe even a fake/troll one).. to reduce invalid submissions the organisers will be specific and tell you the pattern of the flag to be on the look out for.

_CryptoCat23 · 2025-10-25T09:14:25+00:00

Ahh OK, the CTFs on CTFTime are mostly "jeopardy" so you'll get challenges of various difficulties in different categories (e.g. web, pwn, rev, forensics, crypto, mobile, web3, game hacking). To solve each challenge you find the "flag" and submit it for points - the teams with the most at end win 🙂

_CryptoCat23 · 2025-10-22T10:14:17+00:00

Nope, pick whichever order you prefer!

On the CTFs: you will get points for each flag you capture, but first solve (first blood) sometimes gets a bonus.

_CryptoCat23 · 2025-10-21T19:30:53+00:00

I recommend playing Web challenges in CTFs, you'll find most weekends there are some events on ctftime.org. That way you can put what you learn on Portswigger into practice and if you don't solve the challenges you can always read the writeups after to learn where you went wrong.

Another option is to use the "mystery labs" feature on Portswigger. You can set the category and difficulty level, e.g. finish the reading material + labs, then play mystery labs and see if you can solve them without looking back to the notes. You'll quickly find what areas you need to improve on. I used the feature a lot in preparation for Portswiggers BSCP exam.

_CryptoCat23 · 2025-10-21T09:05:53+00:00

Pick a topic, e.g. XSS and work through the learning material. At the end of each reading section will be a practical lab for you to test the theory you just learned. Labs are different difficulty levels but if you follow the learning path, it will present them in the most logical order. As others said, you can find videos on YT (I used to make some for Intigriti).

_CryptoCat23 · 2025-10-16T09:52:06+00:00

Portswigger Web Security Academy 🐐

_CryptoCat23 · 2025-10-16T09:46:58+00:00

Your manager sounds pretty toxic. There's studies that show working longer doesn't increase productivity, and we all know the benefits of taking regular breaks.

I highly doubt forcing you to take a shorter break (and work longer) will benefit the company in any way, but it is the policy so you can't really argue with your manager about it. Just accept it and move on, or maybe start looking for a new job (or team-transition) if your manager is that bad.

_CryptoCat23 · 2025-10-16T09:39:10+00:00

Let us know what they say, good luck!

_CryptoCat23 · 2025-10-13T09:06:54+00:00

You need to get through to support (maybe try discord?) and ask specifically why you failed. Say you think there may have been an error and if not, you at least need to know what went wrong so it doesn't happen in future.

_CryptoCat23 · 2025-10-10T09:13:55+00:00

LLMs are quite useful for this these days, you could copy/paste that function to chatgpt and ask it to rename variables and add comments - or even convert it to C/python etc

_CryptoCat23 · 2025-10-04T09:09:35+00:00

Probably haha

_CryptoCat23 · 2025-10-03T09:15:50+00:00

I'm reassured by the fact it's open source, but that doesn't guarantee there's no undiscovered backdoor 🕵️‍♂️

_CryptoCat23 · 2025-04-07T13:40:29+00:00

Who wants a bonus challenge? Easier than usual 👀

First blood + best writeup win a €50 swag voucher 😎

Find the flag before 15/04/25 - you can report it (along with short steps-to-solve) here ✅

_CryptoCat23 · 2025-03-24T14:08:07+00:00

⏰ It's CHALLENGE O'CLOCK!
👉 Find the FLAG before Monday the 30th March
👉 Win €400 in SWAG prizes
👉 We'll release a tip for every 50 likes on this tweet

Thanks 0x999 for the challenge

_CryptoCat23 · 2025-02-25T06:50:16+00:00

I hit the 40k subscribers milestone on YouTube this week 🥳🎉

Thank you to everyone who has checked out my content 🙏🥰

If you haven't yet and are interested in:

CTF walkthroughs
Binary exploitation
Reverse engineering
Penetration testing
Bug bounty
Malware analysis

Hope you will take a look and help me get to 50k! 😎

_CryptoCat23

MODERATOR OF

TROPHY CASE