Start Here: A Free Cybersecurity Learning Path, From Home Lab to SOC

Everything else happens here. One evening, no cost, and you end up with a safe machine you are allowed to break.

• Lab 00 — Set Up Your Lab — VirtualBox, a ready-made Kali VM, and a snapshot to roll back to
• Build an isolated attack range — Kali plus a target VM on a network with no way out. Do this before any offensive lab

Ready to move on when you can start Kali, open a terminal, and restore your snapshot without looking anything up.

Most security work happens in a terminal. These labs use a free wargame to teach it one small puzzle at a time.

• Lab 02 — Bandit 0 to 5 — logging in over SSH, reading files, awkward filenames
• Lab 03 — Bandit 5 to 10 — find, grep, sort, uniq and strings
• Lab 05 — Bandit 10 to 15 — encodings, compression and your first SSH key
• Lab 07 — Bandit 15 to 20 — TLS, services, diff and file permissions
• Linux for Defenders — eight labs that turn command-line skills into defending a Linux box: sudo, services, cron, firewall, SSH, packages, file permissions and a daily health-check script
• study-notes.org visual cheat sheets — a one-page memory jogger while you practise

Ready to move on when you can find a file by size or owner, search inside it, and log in with a key — without copying commands.

Before you can defend or test a system, you need to see what it exposes. This stage is ports, services and name lookups.

• Lab 01 — Your First Scan — nmap against a host that invites it
• Nmap cheat sheet — the flags you will actually use
• Nmap itself — where to download the scanner and read its official docs
• Common ports cheat sheet — what usually lives on which port
• tcpdump cheat sheet — watch the packets themselves, including your own scans
• Run your own DNS resolver — how names become addresses, and why defenders log it
• Lab 15 — Find and fix dangling DNS — a forgotten record that points at nothing, simulated safely on your own machine

Ready to move on when you can look at a scan result and explain what each open port probably is.

Web applications are where most real-world attacks land. Learn the classic mistakes on targets built to be broken — then learn the fix.

• Lab 04 — Natas 0 to 5 — page source, robots.txt, headers and cookies
• Lab 06 — Natas 6 to 10 — file inclusion, encodings and command injection
• Build a security lab with Docker — disposable targets in one command
• Attack OWASP Juice Shop locally — a modern vulnerable app, on your own machine

Ready to move on when you can explain, for one bug you found, both how it worked and what the developer should change.

This is the SOC analyst path — the most common way into security jobs. Start by reading one machine by hand, then let a SIEM do it at scale.

• Lab 09 — Read your own logs — journalctl, sudo, accounts, open ports and a timeline
• journalctl cheat sheet — the log commands on one page
• Which SIEM should you learn? — Splunk, Wazuh, Sentinel and the rest, compared
• Set up Splunk Free with Docker — plus the SPL cheat sheet for searching
• Run Wazuh, a free SIEM — the one you can run at home forever
• Lab 08 — Enroll a Wazuh agent — your first real alerts, mapped to MITRE ATT&CK
• Lab 10 — Test your detections — check that Wazuh really alerts, then tune it
• Lab 11 — Build your analysis VM — look inside a suspicious file without running it
• The Cyber Kill Chain — how the pieces of an attack fit together
• LetsDefend — SOC analyst practice on simulated alerts

Ready to move on when you can take one alert and write a short note: what happened, when, on which host, and which ATT&CK technique.

The newest part of the field, and short on people who understand it. Learn the risk list, then break and fix a deliberately vulnerable AI app.

• LLM Security map — every OWASP LLM risk, plus the labs and CTF, in one place
• OWASP LLM Top 10 (2026) — the ten risk categories, explained
• Prompt injection cheat sheet — the risk everything else builds on
• Gandalf: talk a chatbot out of its password — a free beginner warm-up to try prompt injection for yourself
• AI agent security — what goes wrong when models get tools
• LLM security lab with LLMVault — attack and defend, all on your machine
• Is this model file safe? — scan a downloaded AI model for hidden code before you load it

Ready to move on when you can name three LLM risks and, for each, one control that reduces it.