Let's start off with some of my own log files and then we can continue into some helpful resources to hopefully explain that unless you are under contract or working for a company in America, this is not a best practice.
Ethical and Authorized Use
Cybersecurity and penetration testing involve studying how computer systems, networks, applications, and security controls operate.
Penetration-testing tools should only be used against systems that you own or systems for which you have explicit authorization to test. A legitimate penetration test normally defines the systems being tested, the permitted techniques, the testing period, and the rules of engagement before testing begins.
I brought section 6. up to the top so you can see it first and you will see it again in section 6. Let's note that the experiments are within your HOME environment not mine.
6. Building a Cybersecurity Laboratory
Security exercises should be conducted in a controlled environment rather than against arbitrary Internet systems.
A basic learning environment can look like this:
CYBERSECURITY LAB
+--------------------+
| Host Computer |
+---------+----------+
|
Virtualization
|
+---------------+---------------+
| |
v v
+-------------------+ +-------------------+
| Security Testing | | Training Target |
| Virtual Machine | | Virtual Machine |
| | | |
| Kali / Parrot |<----------->| Lab-only system |
+-------------------+ Isolated +-------------------+
Network
Virtual machines, snapshots, and isolated virtual networks make it possible to study cybersecurity while reducing the risk of affecting unrelated systems.
1. Cybersecurity Fundamentals
The information provided is ChatGPT generated and reviewed by me, the prudent person says that I want to know what these scripts are doing, and a good place to start, for example, is going to the Kali Linux website before you download it and looking at the tools, reviewing the source code, and all of the things you would learn in academic or certification classes (accredited)
Cybersecurity includes technologies, processes, policies, and practices designed to manage risks affecting computers, networks, software, services, and information.
A useful starting point for organizing cybersecurity activities is the National Institute of Standards and Technology Cybersecurity Framework 2.0.
NIST Cybersecurity Framework 2.0
The framework organizes cybersecurity outcomes around six functions:
+------------+
| GOVERN |
+------------+
|
v
+------------+
| IDENTIFY |
+------------+
|
v
+------------+
| PROTECT |
+------------+
|
v
+------------+
| DETECT |
+------------+
|
v
+------------+
| RESPOND |
+------------+
|
v
+------------+
| RECOVER |
+------------+
These functions can help organizations understand cybersecurity risk and establish processes for preventing, detecting, responding to, and recovering from cybersecurity incidents.
2. Cybersecurity Books
Wallace Wang
Steal This Computer Book 4.0
Wallace Wang's Steal This Computer Book 4.0 discusses computers, Internet security, hackers, online threats, scams, privacy concerns, and methods that attackers may use against computer users.
The book is useful as a broad examination of security problems surrounding computers and the Internet.
Author: Wallace Wang
Publisher: No Starch Press
Published: 2006
Vinny Troia
Hunting Cyber Criminals
Hunting Cyber Criminals: A Hacker's Guide to Online Intelligence Gathering Tools and Techniques examines cyber investigations, open-source intelligence (OSINT), digital investigations, information gathering, and techniques used to identify cybercriminal activity.
Author: Vinny Troia
Publisher: Wiley
Published: 2020
Jason Andress and Ryan Linn
Coding for Penetration Testers: Building Better Tools
This book connects programming and scripting with authorized penetration testing.
Topics include:
- Shell scripting
- Python
- Perl
- Ruby
- PHP
- PowerShell
- Scanner scripting
- Information gathering
- Security tool development
- Post-assessment automation
The second edition expands the PowerShell material and updates the programming examples.
Authors: Jason Andress and Ryan Linn
Publisher: Syngress / Elsevier
Second edition: 2016
Georgia Weidman
Penetration Testing: A Hands-On Introduction to Hacking
Georgia Weidman's book introduces penetration-testing methodology through a controlled laboratory environment.
Subjects include networking, vulnerability assessment, web applications, exploitation concepts, and security testing.
Author: Georgia Weidman
Publisher: No Starch Press
Published: 2014
Justin Seitz and Tim Arnold
Black Hat Python, 2nd Edition
Black Hat Python examines Python programming from a security-research and penetration-testing perspective.
It is especially useful after the reader already understands fundamental Python programming and computer networking.
Authors: Justin Seitz and Tim Arnold
Publisher: No Starch Press
Published: 2021
Dafydd Stuttard and Marcus Pinto
The Web Application Hacker's Handbook
This book concentrates on web-application security and examines methods for discovering and understanding security weaknesses in web applications.
Authors: Dafydd Stuttard and Marcus Pinto
Publisher: Wiley
Second edition: 2011
Bryson Payne
Go H*ck Yourself (Go Hack Yourself)
Go Hack Yourself by Bryson Payne is an accessible, hands-on guide designed to introduce beginners to the core concepts of cybersecurity, ethical hacking, and digital self-defense. Through practical, step-by-step projects using standard tools like Kali Linux, readers learn how hackers execute common cyberattacks (such as phishing, password cracking, and network snooping) so they can better understand how to protect their own systems, devices, and personal data from real-world threats.
Author: Bryson Payne
Publisher: No Starch Press
Published: 2022
3. Cybersecurity Operating Systems
Kali Linux
Kali Linux is a Linux distribution designed for professional penetration testing, security assessment, digital forensics, and related cybersecurity work.
Kali provides packages and configurations intended to reduce the amount of setup required when building a security-testing workstation.
Parrot Security
Parrot Security is a Linux-based platform aimed at cybersecurity, penetration testing, digital forensics, development, and privacy.
4. Penetration Testing
Penetration testing is a controlled security assessment in which authorized testers attempt to identify weaknesses before those weaknesses can be exploited by an unauthorized party.
General Assessment Process
Authorization
|
v
Define Scope
|
v
Asset Discovery
|
v
Reconnaissance
|
v
Vulnerability Assessment
|
v
Controlled Validation
|
v
Document Findings
|
v
Remediation
|
v
Retesting
Common Areas of Study
- TCP/IP networking
- Linux administration
- Windows administration
- DNS
- HTTP and HTTPS
- TLS
- Firewalls
- Virtual private networks
- Authentication
- Authorization
- Access control
- Cryptography
- Web application security
- Network security
- Wireless security
- Digital forensics
- Incident response
- Threat intelligence
- Open-source intelligence
- Secure programming
5. Programming for Cybersecurity
Security professionals benefit from understanding several programming and scripting languages.
| Language | Common Security Uses |
|---|---|
| C | Operating systems, memory management, networking, low-level software, and understanding vulnerabilities. |
| Python | Automation, network utilities, analysis, security testing, API interaction, and log processing. |
| Bash | Linux automation, system administration, log analysis, and security workflows. |
| PowerShell | Windows administration, security auditing, configuration, and enterprise automation. |
| JavaScript | Understanding browser behavior and web application security. |
| PHP | Understanding server-side web applications and secure web development. |
| SQL | Understanding databases, queries, access control, application data storage, and database security. |
6. Building a Cybersecurity Laboratory
Security exercises should be conducted in a controlled environment rather than against arbitrary Internet systems.
A basic learning environment can look like this:
CYBERSECURITY LAB
+--------------------+
| Host Computer |
+---------+----------+
|
Virtualization
|
+---------------+---------------+
| |
v v
+-------------------+ +-------------------+
| Security Testing | | Training Target |
| Virtual Machine | | Virtual Machine |
| | | |
| Kali / Parrot |<----------->| Lab-only system |
+-------------------+ Isolated +-------------------+
Network
Virtual machines, snapshots, and isolated virtual networks make it possible to study cybersecurity while reducing the risk of affecting unrelated systems.
7. United States Government Cybersecurity Resources
National Institute of Standards and Technology
NIST publishes cybersecurity standards, frameworks, guidance, research, and security publications.
NIST Computer Security Resource Center
Cybersecurity and Infrastructure Security Agency
CISA publishes alerts, defensive guidance, cybersecurity resources, vulnerability information, and recommendations for organizations and individuals.
Cybersecurity and Infrastructure Security Agency
CISA Known Exploited Vulnerabilities Catalog
The KEV Catalog identifies vulnerabilities known to have been exploited and is useful when prioritizing defensive remediation.
8. Suggested Learning Path
Computer Fundamentals
|
v
Operating Systems
|
v
TCP/IP Networking
|
v
Programming
|
+------ C
|
+------ Python
|
+------ Bash
|
+------ PowerShell
|
v
Cybersecurity Fundamentals
|
v
NIST / CISA Guidance
|
v
Virtual Security Laboratory
|
v
Vulnerability Assessment
|
v
Authorized Penetration Testing
|
v
Digital Forensics
|
v
Incident Response
|
v
Advanced Security Research
References
References are presented in APA-style format.
Andress, J., & Linn, R. (2016). Coding for penetration testers: Building better tools (2nd ed.). Syngress. https://shop.elsevier.com/books/coding-for-penetration-testers/andress/978-0-12-805472-7
Cybersecurity and Infrastructure Security Agency. (n.d.). Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/
Kali Linux. (n.d.). Kali Linux: Penetration testing and ethical hacking Linux distribution. https://www.kali.org/
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29
Parrot Security. (n.d.). Parrot Security. https://parrotsec.org/
Seitz, J., & Arnold, T. (2021). Black Hat Python: Python programming for hackers and pentesters (2nd ed.). No Starch Press.
Stuttard, D., & Pinto, M. (2011). The web application hacker's handbook: Finding and exploiting security flaws (2nd ed.). Wiley.
Troia, V. (2020). Hunting cyber criminals: A hacker's guide to online intelligence gathering tools and techniques. Wiley. https://doi.org/10.1002/9781119541004
Wang, W. (2006). Steal this computer book 4.0: What they won't tell you about the Internet. No Starch Press.
Weidman, G. (2014). Penetration testing: A hands-on introduction to hacking. No Starch Press.