Where to start if you're new to cybersecurity.
Getting into cybersecurity can be a bit daunting. It’s a huge, rapidly evolving field with specializations including penetration testing, incident response, digital forensics, network engineering, malware analysis, and more.
If you’re just getting started, here’s what we recommend:
Along with Bash or PowerShell, respectively. You'll use these daily.
Start with the OSI model. It underpins almost everything else in security.
We want to help. Come to a meeting, or ask on Discord.
On this page
CofC Cybersecurity Club on GitHub — we keep a lot of resources and in-progress projects there. Active member? Ask and we'll add you to the org so you can contribute too.
Linux is a family of open-source operating systems. Prominent distributions (distros) exist for personal computers (Ubuntu, Fedora), mobile devices (Android), embedded devices (BusyBox), and servers (Red Hat, Ubuntu Server).
New to Linux or security? Start with Kali.
Hypervisors like VirtualBox and VMware let you run virtual machines (VMs) on your computer — multiple operating systems, each in its own sandbox. We recommend setting up Kali using Kali's own virtualization guides, or one of ours below.
Our favorites — most come prepackaged with Kali. The most important to know are nmap, netcat, and Wireshark.
Cloud knowledge is crucial to almost everything in computer science now, security included. Pick a platform and learn the basics — most offer free credit to get started.
Cheat sheets the Defense Team uses during practice and competitions. Print them, or keep them open on a second screen.
Round order of operations, triage priority, the tracking template, and the delegation quick map across every role.
Download PDFAD baselining, common attack patterns, GPO and trust checks, and the quick pattern library for domain-controller anomalies.
Download PDFHardening order of operations, eviction commands, patch management, and firewall/service reference for Linux and Windows.
Download PDFFind the user, trace the process, find the hole — cross-OS hunting workflow with a forensics deep-dive and handoff checklist.
Download PDFSecurity Onion / Wazuh setup checks, hunt queries, writing detections, and alert tuning without going deaf to real hits.
Download PDFEnumeration, user management, firewall, auditing, services, and threat-hunting commands for Windows hosts.
Download PDFEnumeration, users, networking, file permissions, systemd/cron, and threat-hunting commands for Linux hosts.
Download PDFGuides written and maintained by Tyler McGuire.
Beyond club meetings, these are where most of us actually put in the hours.
Guided, beginner-friendly rooms covering everything from Linux basics to full attack chains.
tryhackme.comLess hand-holding, more realistic boxes. A natural next step once TryHackMe starts feeling easy.
hackthebox.comWargames like Bandit are the fastest way to actually get comfortable at a Linux command line.
overthewire.orgFree, and the closest thing to an industry-standard curriculum for web application security.
portswigger.netThe National Cyber League runs seasonal games open to students; CTFtime tracks nearly every other CTF happening.
nationalcyberleague.orgBefore asking the club, try man or paste the command into Explainshell. It's usually faster.
A deliberately vulnerable VM built to practice pentesting against, at your own pace and offline.
sourceforge.netA whole library of vulnerable VMs beyond Metasploitable, ranging from beginner to brutal.
vulnhub.comLike OverTheWire's Bandit, but PowerShell-focused — good practice if Windows is your weak spot.
underthewire.techOur defense team competes in PCDC and SECCDC every year, and any member can join us for National Cyber League. See the full list on our Competitions page.