These are the links I point students to most often, roughly in the order I’d use them. Most are free. You don’t need to finish one section before starting the next, so pick whatever gets you going.
Start with the fundamentals
- Linux Journey - LabEx: the Linux command line from zero. Start here if you’ve never used a terminal.
- The Missing Semester of Your CS Education - MIT: the shell, Git, editors and scripting. Classes assume you already know these.
- CompTIA Security+ SY0-701 Course - Professor Messer: a free video course covering the security fundamentals, whether or not you take the exam.
- NICE Framework - CISA: a map of the different jobs in security, so you can see what’s out there.
- Security Certification Roadmap - Paul Jerimy: every security certification on one chart. Use it to see where a cert fits, not as a checklist.
- So You Want To Work in Cyber Security? - Jack Hacks: a longer read on the different paths into the field.
Practice
Reading only gets you so far. These let you break things without breaking the law.
- Bandit - OverTheWire: the best first wargame. Each level teaches one Linux skill.
- picoCTF - Carnegie Mellon University: built for high school students, with past challenges you can play any time. The site now redirects to Carnegie Mellon’s CyLab Security Academy.
- TryHackMe: guided rooms that walk you through a topic step by step. Plenty is free, but some rooms need a subscription.
- Web Security Academy - PortSwigger: the best free way to learn how websites get hacked.
- pwn.college - Arizona State University: goes deeper into Linux, programming and binary exploitation once the basics feel easy.
- Holiday Hack Challenge - SANS: a story-driven challenge every December. Older years stay playable.
- Gandalf and Other AI Hacking Games - Lakera: trick an AI into giving up a secret. A fun way to learn prompt injection.
- CyberChef - GCHQ: decodes, encodes and converts almost any data. You’ll use it in nearly every CTF.
Compete
Competitions and CTFs were the most valuable part of college for me. Join a team if you can: you learn as much from your teammates as from the challenges.
- CyberPatriot - Air & Space Forces Association: the national high school competition. Teams find and fix security problems on Windows and Linux machines.
- National Cyber League: individual and team games built around real security skills. There’s a registration fee each season.
- CSAW - NYU Tandon: NYU’s yearly student security competitions, including one of the best-known CTFs.
- National Collegiate Cyber Defense Competition (CCDC): for once you’re in college. Your team defends a network while a professional red team attacks it.
- CTFtime: a calendar of nearly every CTF running. Pick a weekend and try one.
Stay curious
- Darknet Diaries - Jack Rhysider: true stories about hacks and the people behind them. (Incredibly Good)
- tl;dr sec - Clint Gibler: a weekly roundup of the best security reading. Skim the headlines and read what catches your eye.
- SocialProof Security - Rachel Tobac: social engineering, the human side of hacking. Look up her live phone-hacking demos.
- SheHacksPurple - Tanya Janca: beginner-friendly application security, meaning how to build software that’s hard to hack.
- Awesome Security - sbilly: a giant list of tools and resources for when you want to go deeper on something.
Career skills
- Building your first resume
- Interviewing for internships
- Your first internship
- Effectively Asking for Help - Nick Groenen: how to ask a question people want to answer.
- WiCyS - Women in CyberSecurity: a community for women in cybersecurity, with student chapters, scholarships and conference grants.
- Get Your Work Recognized: Write a Brag Document - Julia Evans: start a running list of what you’ve done now. It makes every resume and interview easier.
Going deeper
Career resources is the full list I keep for my own work, covering detection, incident response, cloud security, reverse engineering and more. It’s long and unranked, so come back to it once something here hooks you.