title: Cybersecurity Handbook
description: A community-driven cybersecurity knowledge base with 400+ notes, mind maps, and cheat sheets — built from first principles.

Cybersecurity Handbook

A continuously evolving cybersecurity knowledge base focused on practical understanding, technical accuracy, and first-principles learning — from your first terminal command to writing your own detection rules.

Browse the coverage ↓ · Read the philosophy ↓ · GitHub →

Overview

This isn’t another collection of scattered notes. It’s a structured, living knowledge base that breaks complex cybersecurity topics into clear, practical pieces — useful whether you’re a student making sense of the OWASP Top 10, a SOC analyst hunting for IoCs, or a red teamer building a custom exploit.

No fluff, no copy-pasted documentation. Just clear explanations, real-world examples, and a consistent focus on understanding why things work the way they do — not just which command to run.

Philosophy

Cybersecurity is best learned by understanding systems — not by memorizing tools.

Mastering security requires a solid grasp of the underlying technology. So every topic here starts from first principles: how a protocol actually works, how an OS manages memory, how a cryptographic algorithm achieves its guarantees. Only after that do we move to practical application, attack scenarios, and defensive strategy.

It’s a slower, more deliberate approach than most tutorials take. But it builds understanding that’s still useful long after you’ve closed the browser tab.

What makes it different

First principles before tools. Before you learn to crack a WiFi password, you understand how 802.11 authentication actually works. Tools change; the underlying systems don’t.

Internal architecture, not surface-level. How does Kerberos actually issue a ticket? What happens inside the CPU when a buffer overflow occurs? We go under the hood.

Attack and defense, together. Every vulnerability is explained from both sides — how an attacker exploits it, and how a defender detects and prevents it. Red teamers learn how blue teams think, and vice versa.

Real implementation, not just theory. Every topic comes back to practical application: configuration examples, command references, sample code, and hands-on labs.

Learning methodology

Every concept in this handbook follows the same progression:

Fundamentals — the core idea, stripped of complexity
Internal working — how it actually operates under the hood
Real-world example — a practical demonstration
Hands-on practice — labs and exercises to apply it
Attacker’s perspective — how an adversary would exploit it
Defender’s perspective — how to detect and prevent it
Detection & mitigation — logs, alerts, and countermeasures

This ensures you’re not memorizing commands — you’re building understanding that scales from beginner to expert.

Coverage

The handbook spans the full spectrum of modern cybersecurity, organized into six areas:

Core Computing & Systems

Linux — Commands, file systems, process management, security hardening
Windows — Internals, Active Directory, PowerShell for automation and security
Networking — TCP/IP, DNS, routing, VPNs, firewalls, packet analysis
Operating Systems — Process scheduling, memory management, file systems, kernel security
Virtualization & Containers — Docker, Kubernetes, hypervisors, container security

Offensive Security

Reconnaissance — OSINT, scanning, service enumeration, information gathering
Web Application Security — OWASP Top 10, SQL injection, XSS, SSRF, CSRF, secure coding
Wireless Security — WiFi attacks, WPA/WPA2 cracking, evil twin, wireless auditing
Active Directory Attacks — Kerberos attacks, LDAP enumeration, privilege escalation, lateral movement
Privilege Escalation — Linux and Windows techniques, from kernel exploits to misconfigurations
Exploit Development — Buffer overflows, ROP, shellcode, fuzzing
Reverse Engineering — Binary analysis, decompilation, debugging, compiled code
Red Team Methodology — Full attack lifecycle, C2, persistence, threat simulation

Defensive Security

Detection Engineering — Sigma rules, YARA rules, SIEM detection logic
Threat Hunting — Proactive, hypothesis-driven investigation
Incident Response — Playbooks, containment, eradication, recovery, post-incident analysis
Malware Analysis — Static, dynamic, and behavioral analysis
Digital Forensics — Memory, disk, and network forensics, evidence handling
SIEM — Log aggregation, correlation, alerting, tuning (Splunk, ELK, QRadar)
Endpoint Security — EDR, antivirus, application control, hardening
Network Security — Firewalls, IDS/IPS, segmentation, secure architecture
Threat Intelligence — Consuming and producing intel, IoCs, threat actor profiling

Cloud & Infrastructure Security

AWS Security — IAM, S3 bucket security, EC2 security groups, cloud attack vectors
Azure Security — Entra ID, Key Vault, Azure Security Center
GCP Security — IAM, Cloud Run, Google Cloud best practices
Container & Kubernetes Security — Docker hardening, Kubernetes RBAC, cluster hardening
DevSecOps — CI/CD security, infrastructure-as-code scanning, shift-left practices

Programming & Automation

Python — Scripting for security tasks, tool building, automation
Bash — Shell scripting for Linux administration and automation
PowerShell — Windows automation and offensive scripting
APIs — REST and GraphQL security, authentication, common vulnerabilities

Cryptography

Classical Cryptography — Historical ciphers and their modern relevance
Modern Cryptography — Symmetric/asymmetric algorithms, AES, RSA, ECC, post-quantum
PKI — Certificates, Certificate Authorities, trust models, deployment
TLS — The handshake, cipher suites, vulnerabilities, best practices
Hashing — SHA-2, SHA-3, MD5, and integrity verification
Authentication — Passwords, MFA, biometrics

Who this is for

Students & self-learners — a structured path without the noise
SOC analysts — playbooks, log analysis guides, detection engineering deep dives
Penetration testers — practical content from enumeration through post-exploitation
Red & blue teams — attackers get methodology, defenders get detection and mitigation
Detection engineers & incident responders — SIEM configs, forensic workflows, real IR playbooks
Cloud & infrastructure engineers — hands-on security for AWS, Azure, GCP, Docker, Kubernetes
Reverse engineers & malware analysts — static/dynamic analysis, binary RE, malware behavior
Researchers & IT professionals — deep dives into emerging threats, cryptography, networking internals

The material stays accessible without sacrificing depth — whether you’re learning your first Linux command or analyzing a kernel exploit.

A living resource

Cybersecurity is a moving target, and this handbook moves with it: new research and threat intelligence, new labs and walkthroughs, updated tools and techniques, and ongoing refinement based on community feedback.

Found something wrong or outdated?

Open an issue or submit a pull request — contributions are always welcome.

Built with

Obsidian — knowledge management and note-taking
Quartz 5 — the static site generator turning markdown into a fast, searchable website
Git & GitHub — version control and collaboration
Vercel — hosting and continuous deployment

Push to GitHub, and the site rebuilds and redeploys automatically. Fast, searchable, and easy to maintain over the long term.

About the author

I’m Priyanshu Rawat, a self-taught security learner sharing what I discover. I believe the best way to learn is to document everything — this handbook is the result of that habit turned into a project.

I’m particularly interested in Linux and Windows internals, networking protocols and their security implications, offensive and defensive methodology, cloud security and containerization, and automation for security workflows.

This is my attempt at a comprehensive, accessible, practical resource for anyone serious about cybersecurity. It’s free, open, and always evolving.

Core principles

Learn deeply. Build deliberately. Document everything. Share knowledge.

Always learning. Always documenting. Always improving.

Cybersecurity Handbook · Created and maintained by Priyanshu Rawat

Built with Obsidian + Quartz

If this helped you, a star on GitHub is always appreciated.