惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

小众软件
小众软件
量子位
博客园 - 叶小钗
Apple Machine Learning Research
Apple Machine Learning Research
U
Unit 42
IT之家
IT之家
F
Fortinet All Blogs
GbyAI
GbyAI
MongoDB | Blog
MongoDB | Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
大猫的无限游戏
大猫的无限游戏
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
The Register - Security
The Register - Security
NISL@THU
NISL@THU
Webroot Blog
Webroot Blog
A
Arctic Wolf
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
V
Visual Studio Blog
Recent Announcements
Recent Announcements
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Blog — PlanetScale
Blog — PlanetScale
L
LangChain Blog
P
Palo Alto Networks Blog
Y
Y Combinator Blog
WordPress大学
WordPress大学
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
AWS News Blog
AWS News Blog
有赞技术团队
有赞技术团队
Engineering at Meta
Engineering at Meta
C
Cybersecurity and Infrastructure Security Agency CISA
aimingoo的专栏
aimingoo的专栏
Know Your Adversary
Know Your Adversary
Cyberwarzone
Cyberwarzone
Martin Fowler
Martin Fowler
The Hacker News
The Hacker News
P
Privacy International News Feed
T
Threat Research - Cisco Blogs
G
GRAHAM CLULEY
宝玉的分享
宝玉的分享
博客园 - 聂微东
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
The GitHub Blog
The GitHub Blog
S
Securelist
T
The Exploit Database - CXSecurity.com
T
Threatpost
Microsoft Azure Blog
Microsoft Azure Blog
The Cloudflare Blog
F
Full Disclosure

Black Hills Information Security, Inc.

Bad Habits: An ANTISOC Operation Same Problem, Different Angles: When Red Team and Blue Team Actually Talk to Each Other How to Identify and Exploit New Vulnerabilities Swapper – A Pure Regex Match/Replace Burp Extension A Practical Guide to BloodHound Data Collection Network Engineering Basics Signed, Trusted, and Abused: Proxy Execution via WebView2 Getting Started In Pentesting – Advice From The BHIS Pentest Lead Cloud Security: Tips and Resources for Securing the Cloud Lessons From A Chatbot Incident How to Lead Effective Tabletops Understanding GRC: How to Navigate Risks and Compliance Standards The “P” in PAM is for Persistence: Linux Persistence Technique Malware Analysis: How to Analyze and Understand Malware OSINT: How to Find, Use, and Control Open-Source Intelligence What to Do with Your First Home Lab When the SOC Goes to Deadwood: A Night to Remember Social Engineering and Microsoft SSPR: The Road to Pwnage is Paved with Good Intentions Common Cyber Threats Finding the Right Penetration Testing Company Deceptive-Auditing: An Active Directory Honeypots Tool The Curious Case of the Comburglar How to Set Smart Goals (That Actually Work For You) Inside the BHIS SOC: A Conversation with Hayden Covington Abusing Delegation with Impacket (Part 3): Resource-Based Constrained Delegation Why You Got Hacked – 2025 Super Edition Abusing Delegation with Impacket (Part 2): Constrained Delegation Abusing Delegation with Impacket (Part 1): Unconstrained Delegation GoSpoof – Turning Attacks into Intel Model Context Protocol (MCP) Bypassing WAFs Using Oversized Requests Getting Started with AI Hacking Part 2: Prompt Injection Wrangling Windows Event Logs with Hayabusa & SOF-ELK (Part 2) DomCat: A Domain Categorization Tool Wrangling Windows Event Logs with Hayabusa & SOF-ELK (Part 1) Microsoft Store and WinGet: Security Risks for Corporate Environments Default Web Content MailFail Commonly Abused Administrative Utilities: A Hidden Risk to Enterprise Security Stop Spoofing Yourself! Disabling M365 Direct Send Bypassing CSP with JSONP: Introducing JSONPeek and CSP B Gone Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource DNS Triage Cheatsheet GraphRunner Cheatsheet Burp Suite Cheatsheet Impacket Cheatsheet Wireshark Cheatsheet Hashcat Cheatsheet EyeWitness Cheatsheet Nmap Cheatsheet Netcat (nc) Cheatsheet Hunt for Weak Spots in Your Wireless Network with Airodump-ng from the Aircrack-ng Suite Detecting ADCS Privilege Escalation Vulnerability Scanning with Nmap Getting Started with NetExec: Streamlining Network Discovery and Access How to Use Dirsearch Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 3: Arcanum Cyber Security Bot How to Design and Execute Effective Social Engineering Attacks by Phone Abusing S4U2Self for Active Directory Pivoting Why Use a Macro Pad? Espanso: Text Replacement, the Easy Way Caging Copilot: Lessons Learned in LLM Security Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 2: Copilot Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 1: Burpference Intercepting Traffic for Mobile Applications that Bypass the System Proxy How to Root Android Phones Communicating Security to the C-Suite: A Strategic Approach Offline Memory Forensics With Volatility Getting Started with AI Hacking: Part 1 Go-Spoof: A Tool for Cyber Deception How to Test Adversary-in-the-Middle Without Hacking Tools Canary in the Code: Alert()-ing on XSS Exploits How to Hack Wi-Fi with No Wi-Fi Why Your Org Needs a Penetration Test Program Burp Suite Extension: Copy For Light at the End of the Dark Web Wi-Fi Forge: Practice Wi-Fi Security Without Hardware Avoiding Dirty RAGs: Retrieval-Augmented Generation with Ollama and LangChain Gone Phishing: Installing GoPhish and Creating a Campaign 5 Things We Are Going to Continue to Ignore in 2025 John Strand’s 5 Phase Plan For Starting in Computer Security Questions From a Beginner Threat Hunter GRC for Security Managers: From Checklists to Influence AI Large Language Models and Supervised Fine Tuning Attack Tactics 9: Shadow Creds for PrivEsc w/ Kent & Jordan One Active Directory Account Can Be Your Best Early Warning Introduction to Zeek Log Analysis Indecent Exposure: Your Secrets are Showing Creating Burp Extensions: A Beginner’s Guide Pitting AI Against AI: Using PyRIT to Assess Large Language Models (LLMs) The Top Ten List of Why You Got Hacked This Year (2023/2024) ICS Hard Knocks: Mitigations to Scenarios Found in ICS/OT Backdoors & Breaches Intro to Data Analytics Using SQL Finding Access Control Vulnerabilities with Autorize The Detection Engineering Process Cyber Risk Lessons We Can Learn From Hurricane Preparedness Intro to Desktop Application Testing Methodology What Is Penetration Testing? Adversary in the Middle (AitM): Post-Exploitation Pentesting, Threat Hunting, and SOC: An Overview
From High School to Cyber Ninja—For Free (Almost)!
BHIS · 2024-06-20 · via Black Hills Information Security, Inc.

Carrie Roberts is an Antisyphon instructor and experienced cyber security professional who has mentored many on their journey into cyber.

My name is Carrie Roberts and I love my job in cyber security because there is so much to be learned and so many ways to contribute in positive and imaginative ways. Not to mention, the pay is great, the skillset is in high demand, and there are flexible work arrangements and schedules. I encourage everyone to consider cyber security as a career, and I am always looking for ways to help them do it. That is why I have created this Cyber Ninja training plan.

I have three high school-age daughters who are interested in becoming cyber engineers, and I have been spending my time developing the best and most cost-effective plan to take them from high school all the way to Cyber Ninja! To my pleasant surprise, I found that the education and hands-on practice to make that happen is already available for free to anyone with a computer and an internet connection. It is only the credentials (certifications and degrees) that cost money. In fact, you could spend a lifetime reviewing all the free content available. But what you need is a guide that will take you through the maze of material in the most logical and efficient manner possible, and that is what I am offering you here. I have not put anything on this list that I have not personally completed to confirm the quality of the content, and I believe that this content will take you well on your way towards becoming a cyber professional.

I originally wanted to have a list of completely free resources but then I discovered TryHackMe training, and it was so amazing and affordable ($15/mo) that I decided to make it part of the plan.

Cyber Ninja Training Plan (Free)

TryHackMe Training Plan

The Cyber Ninja training starts off with some low level “how computers and the internet work” content to get everyone on solid footing. It then takes you through 40 hours of Professor Messer’s excellent training courses to prepare you for the CompTIA A+, Network+, and Security+ certifying exams. You don’t have to pay to take exams, but, if you do, they will give your resume a nice boost. Next, I highly encourage you to try the TryHacKMe hands-on learning. It is free to use to some extent, but you will need the $15/month subscription to complete all of it. You will be well on your way to developing your cyber skills after completing the ~380 hours of training modules within TryHackMe.

Ok, back to the Cyber Ninja Training plan, where you get in-depth hands-on training with “Burp Suite Intercepting Proxy,” arguably the most used tool by pentesters. Then, we get into the “Ninja” part of the training, where you will learn HTML, Javascript, SQL, Python, PowerShell, Bash and Batch Scripting, Regular Expressions, Git/GitHub, and more!

Completing the approximately 600 hours of training above may be enough to land you the cyber security job that you want. To increase your chances and your potential for higher income, I recommend obtaining a degree and some industry certifications, but this is expensive! Let’s talk about college hacks to minimize the cost.

First, there are great companies that will pay for your degree in full if you work for them at least part-time. This includes Walmart’s Live Better U program, which covers 100% tuition and books; eligibility starts on your first day of part-time or full-time work. My next favorite is Kentucky Fried Chicken’s partnership with Western Governors University, covering 100 percent tuition and fees. Or look here for more corporate-sponsored options.

These employer-paid programs are all great options. But time is money, and the more time you spend working, the longer school will take you to complete. For this reason, I offer this method for fast-tracking your college degree:

  1. Complete your prerequisites at Sophia Learning (things like math, science, English, writing, etc.)
  2. Transfer your credits to a self-paced college (you know, one where you can work faster than average)

Sophia Learning is an online university whose credits transfer to several partner universities. The cost is only $99/month, or you can purchase 1 year of access for $600. That is only $50/month! You can take 2 classes at a time and complete them at any speed you want (like, really fast, for example). The minimum age to enroll is 13 years old and you don’t need to have completed high school first. It is available to anyone worldwide (you don’t have to be a US citizen). It only takes 5 minutes and a credit card to sign up, and no prior transcripts are required. I suspect that even the mildly ambitious student can complete 1 course per month on average, about 44 credits within a year.

Next, let’s assume that you are going to enroll in Western Governors University (US residents only) and pursue one of their cyber-related degrees which are linked to below:

All these degrees are great options for helping you be successful in cyber security. Let’s assume you choose the Cybersecurity and Information Assurance degree. The cost per 6 months of access to courses is $4,265. At WGU, there is no homework, only testing (often only one) to confirm that you know the material. This means that if you already know the material, you can start and finish the course within a single day by simply passing the test. Everything is graded pass/fail so there is no GPA to worry about and there are options to retake a failed test if needed. Since you will have already completed your general education requirements through Sophia Learning, and already learned the majority of the course material through the Cyber Ninja training program, you are going to be able to work through the courses quickly. WGU publishes the exact courses from Sophia learning that will transfer into their program, which is currently 44 of the required 122 credits. This means you already have over one-third of your degree credits complete. Do you think you could complete 2 classes per month considering there is no homework and you have already learned the majority of the material? If so, you would be done with your degree in one year at a total cost of $8,530.

Another exciting thing about WGU is that the course work and tuition covers many industry certifications. For the cyber degree, you complete the following 15 certifications (certification fees covered by WGU).

  • B.S. Cybersecurity and Information Assurance
  • ITIL®*^ Foundation Certification
  • CompTIA A+
  • CompTIA Network+
  • CompTIA Security+
  • CompTIA Project+
  • CompTIA CySA+
  • CompTIA Network Vulnerability Assessment Professional
  • CompTIA Network Security Professional
  • CompTIA Security Analytics Professional
  • CompTIA PenTest+
  • CompTIA IT Operations Specialist
  • CompTIA Secure Infrastructure Specialist
  • Linux Essentials
  • Certified Cloud Security Professional (CCSP)
  • Systems Security Certified Practitioner (SSCP)

Assume you take 6 months to complete the Cyber Ninja Training including TryHackMe ($90), 6-12 months with Sophia learning ($600), and one year at WGU ($8,530). This means you will be able to add a degree and 15 industry certifications to your resume in about 2 years for less than $10,000. Now that is a college hack!

If you have questions about anything here, reach out to Carrie (@OrOneEqualsOne) on the Atomic Red Team Slack or the Antisyphon or Black Hills Discord channels.

If you would like to learn more about Carrie and how she got into cybersecurity, check the links below:

Failing a Pentest is not the End, It’s a Beginning — My Beginning

My Journey: From Pentest to Red Team to Blue

Got Enough Monitors?

Carrie’s Resume

Carrie is currently a Red Teamer at Walmart. Comments and opinions are provided as personal opinion and not as a representative of Walmart. They do not reflect the views of Walmart and are not endorsed by Walmart.

Read more in our “Infosec for Beginners” blog series: