Security
Protecting apps, data & users. · 7 notebooks
Cryptography Fundamentals
The math and practice that secures the modern world — demystified. A hands-on, diagram-rich walk through symmetric & asymmetric encryption (AES, RSA, ECC), hashing & HMAC, digital signatures, Diffie-Hellman key exchange, hybrid encryption, PKI & certificates, how TLS/HTTPS actually works, randomness, the common mistakes that break real systems, end-to-end encryption (Signal), blockchain, and the coming post-quantum shift — grounded in how HTTPS, Signal, Bitcoin and Let's Encrypt really use crypto.
Open notebookOWASP Top 10 Deep Dive
The ten most critical web application security risks, dissected. A hands-on, diagram-rich walk through the OWASP Top 10 — broken access control, cryptographic failures, injection (with deep dives on SQL injection and XSS), insecure design, security misconfiguration, vulnerable components, authentication failures, integrity failures, logging gaps and SSRF — each with how it's exploited, real breaches, and concrete defenses, plus cross-cutting secure-coding practices. Grounded in real incidents like Capital One, Log4Shell, the Samy worm and Equifax.
Open notebookNetwork Security
How to defend the network — the layer where so many attacks live. A hands-on, diagram-rich walk through firewalls, network segmentation & DMZs, VPNs & secure tunnels, zero-trust networking, encryption in transit, and the major attacks (man-in-the-middle, DDoS, DNS poisoning, wireless), plus the defenses that stop them (IDS/IPS, traffic monitoring, WAF, NAC, microsegmentation, SPF/DKIM/DMARC). Grounded in real incidents like the Mirai botnet, the record memcached DDoS, DNS cache poisoning and the Target breach.
Open notebookPenetration Testing & Ethical Hacking
Learn to think like an attacker — legally and ethically — to make systems more secure. A hands-on, diagram-rich walk through authorized penetration testing: the legal & ethical foundation, test types and red/blue/purple teams, the five-phase methodology (reconnaissance, scanning, exploitation, post-exploitation, reporting), the tooling and testing domains (web, network, password, social engineering), standards like PTES and MITRE ATT&CK, bug bounties & responsible disclosure, and how offensive findings drive real defensive improvement. For authorized engagements, CTFs, labs and education only.
Open notebookIncident Response & Digital Forensics
What to do when — not if — you get breached. A hands-on, diagram-rich walk through the incident response lifecycle (preparation, detection, containment, eradication, recovery, lessons learned), digital forensics (evidence handling & chain of custody, the forensic process, disk/memory/network/cloud forensics), the detection stack (SIEM, EDR, threat intelligence & IOCs, threat hunting), ransomware and cloud incident response — grounded in real incidents like Colonial Pipeline, SolarWinds, Equifax and NotPetya. The blue-team counterpart to offensive security.
Open notebookAPI Security
APIs are the new attack surface — and they fail in their own distinctive ways. A hands-on, diagram-rich walk through the OWASP API Security Top 10: broken object- and function-level authorization (BOLA/BFLA), mass assignment & excessive data exposure, broken authentication & token handling, unrestricted resource consumption, business-flow abuse, SSRF, misconfiguration, shadow/zombie API inventory, and unsafe third-party consumption — plus schema validation, API gateways and GraphQL/gRPC security. Grounded in real API breaches like Facebook, Peloton, Optus and Parler.
Open notebookWeb Security Basics
Hand-written notes on the core ideas of securing web apps — the CIA triad, common attacks and HTTPS.
Open notebook