Learn how to use cybersecurity tools and techniques through step-by-step tutorials. Explore content on vulnerability analysis, security testing, environment reconnaissance, and other hands-on practices used in day-to-day security work.
-
Semgrep: Practical SAST for AppSec
Security testing does not need to begin after an application is running. A large class of security problems can be detected while the code is still sitting in a repository, before a developer deploys it, before a pentester reaches the application, and ideally before the vulnerable change is merged at all. That is where Semgrep…
-
Subfinder: Passive Subdomain Enumeration for Reconnaissance
Subfinder is a command-line tool for discovering subdomains associated with a target domain. It belongs to the reconnaissance and attack surface discovery stage of a penetration test. Its job is not to find vulnerabilities directly. Its job is to help answer a more fundamental question: What actually belongs to the target? A company may present…
-
OWASP ZAP Guide: Free DAST for Web Application Security
OWASP ZAP, short for Zed Attack Proxy, is an open-source Dynamic Application Security Testing tool used to identify security issues in web applications and APIs. Think of ZAP as a security proxy and scanner that sits between your browser and the application. It observes traffic, maps the application, passively analyzes responses, and can actively test…
-
Burp Suite Guide: The Heimdall of the Web
Burp Suite is the standard toolkit for intercepting, inspecting, and modifying HTTP traffic between a client (browser or mobile app) and a web server. If you can see the request and the response, you can test what matters: authentication, authorization, input handling, session behavior, and the real security posture of the application. This tutorial focuses…
-
Using Shodan – Attack Surface Discovery & Monitoring
Shodan is a search engine for internet-exposed systems. Instead of indexing web pages, it indexes services (SSH, HTTP, databases, VPNs, remote admin panels, etc.) and their banners/metadata, which makes it extremely useful for attack surface discovery and continuous exposure monitoring. This tutorial focuses on authorized, defensive use: mapping what your company exposes to the internet,…
-
SQLMap: Automating SQL Injection
sqlmap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection (SQLi) vulnerabilities in web applications and databases. This tutorial focuses on responsible, low-impact validation: confirm whether a parameter is injectable, identify the back-end DBMS and technique used, and collect just enough evidence to help engineering fix the issue—without turning…