Security covers a lot of ground: pentesting, incident response, forensics, network engineering, malware analysis. You don’t have to pick one yet. If you’re new, start here:
Resources
Where to start if you're new to cybersecurity.
Learn Linux or Windows Server
Plus Bash or PowerShell to go with it. You'll use one of them every meeting.
Learn basic networking
Start with the OSI model. Most of security sits on top of it.
Ask us things
Come to a meeting, or ask on Discord. Nobody minds beginner questions.
On this page
Our GitHub organization
CofC Cybersecurity Club on GitHub — we keep a lot of resources and in-progress projects there. Active member? Ask and we'll add you to the org so you can contribute too.
Linux
Linux is a family of open-source operating systems. Prominent distributions (distros) exist for personal computers (Ubuntu, Fedora), mobile devices (Android), embedded devices (BusyBox), and servers (Red Hat, Ubuntu Server).
Getting started
Infosec-oriented distros
New to Linux or security? Start with Kali.
Other distros worth knowing
Virtualization
Hypervisors like VirtualBox and VMware let you run virtual machines (VMs) on your computer — multiple operating systems, each in its own sandbox. We recommend setting up Kali using Kali's own virtualization guides, or one of ours below.
- VirtualBox
- VMware Workstation Player
- Windows VM installation guide
- VirtualBox + Hyper-V setup guide
- Mac VM installation guide
Tools of the trade
Our favorites — most come prepackaged with Kali. The most important to know are nmap, netcat, and Wireshark.
- nmap — the network mapper
- netcat — Swiss army knife network debugger
- Wireshark — packet analysis
- Metasploit — pentesting framework
- OWASP ZAP — web app security scanner
- Radare Cutter — decompiler and disassembler
- Nikto — web server scanner
- hashcat — password cracker (GPU)
- John the Ripper — password cracker (CPU)
- Aircrack-ng — wireless cracking and analysis
Other tools
- PEASS-ng — privilege escalation toolkit (Windows/macOS/Linux)
- Gobuster — web server directory enumeration
- SO-CRATES — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
Hardware hacking
- Hak5 — pentesting/infosec gear, including the WiFi Pineapple, network implants, and hardware keyloggers
- Raspberry Pi — cheap, versatile single-board computer
The cloud
Cloud knowledge is crucial to almost everything in computer science now, security included. Pick a platform and learn the basics — most offer free credit to get started.
YouTube channels & podcasts
- Hak5 — updates, HackByte, ThreatWire
- IppSec — Hack The Box walkthroughs
- danscourses — networking tutorials
- TechWorld with Nana — DevOps
- Hackersploit — infosec training
- NetworkChuck — CCNA, CompTIA A+/Network+
- Jack Rhysider (Darknet Diaries) — cybersecurity stories podcast
Guides & reference sheets
Cheat sheets the Defense Team uses during practice and competitions. Print them, or keep them open on a second screen.
Competition role references
Captain
Round order of operations, triage priority, the tracking template, and the delegation quick map across every role.
Download PDFDomain Admin
AD baselining, common attack patterns, GPO and trust checks, and the quick pattern library for domain-controller anomalies.
Download PDFEngineer
Hardening order of operations, eviction commands, patch management, and firewall/service reference for Linux and Windows.
Download PDFThreat Hunter
Find the user, trace the process, find the hole — cross-OS hunting workflow with a forensics deep-dive and handoff checklist.
Download PDFSIEM Lead
Security Onion / Wazuh setup checks, hunt queries, writing detections, and alert tuning without going deaf to real hits.
Download PDFOS hardening reference sheets
Windows Hardening Reference
Enumeration, user management, firewall, auditing, services, and threat-hunting commands for Windows hosts.
Download PDFLinux Hardening Reference
Enumeration, users, networking, file permissions, systemd/cron, and threat-hunting commands for Linux hosts.
Download PDFGuides written and maintained by Tyler McGuire.
Platforms & communities
Beyond club meetings, these are where most of us actually put in the hours.
TryHackMe
Guided, beginner-friendly rooms covering everything from Linux basics to full attack chains.
tryhackme.comHack The Box
Less hand-holding, more realistic boxes. A natural next step once TryHackMe starts feeling easy.
hackthebox.comOverTheWire
Wargames like Bandit are the fastest way to actually get comfortable at a Linux command line.
overthewire.orgPortSwigger Web Security Academy
Free, and the closest thing to an industry-standard curriculum for web application security.
portswigger.netNCL & CTFtime
The National Cyber League runs seasonal games open to students; CTFtime tracks nearly every other CTF happening.
nationalcyberleague.orgExplainshell & the man pages
Before asking the club, try man or paste the command into Explainshell. It's usually faster.
Metasploitable 2
A deliberately vulnerable VM built to practice pentesting against, at your own pace and offline.
sourceforge.netVulnHub
A whole library of vulnerable VMs beyond Metasploitable, ranging from beginner to brutal.
vulnhub.comUnderTheWire
Like OverTheWire's Bandit, but PowerShell-focused — good practice if Windows is your weak spot.
underthewire.techOur defense team competes in PCDC and SECCDC every year, and any member can join us for National Cyber League. See the full list on our Competitions page.