Whether you’re brand new to tech or you’ve been circling cybersecurity for a while and just haven’t jumped in — this post is for you. It follows the same curriculum covered in the Cover6 Community’s free 6-hour Intro to Cyber livestream, taught live by Tyrone Wilson, CEO of Cover6 Solutions. Think of this as your preview and your reference guide — enough to get oriented, not enough to replace the real thing.
Every section below maps directly to the livestream. We’ll introduce the concept, show you the tools practitioners actually use, and point you toward where to go deeper. That deeper place is the Cover6 Academy Intro2Cyber course — free, self-paced, and built for people who are serious about making this move.
Want the bigger picture first? Read the 2026 Breaking Into Cyber Roadmap — then come back here for the hands-on breakdown.
Let’s get into it.
What Is Cybersecurity? (CIA Triad, Threat Actors, Attack Types)
Before you touch a single tool, you need to understand what you’re protecting and why. Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage. But the real foundation is the CIA Triad: Confidentiality, Integrity, and Availability. Every security decision you’ll ever make maps back to one of those three principles — and every compliance framework, from NIST CSF to ISO 27001, is built on top of them.
Confidentiality means keeping data accessible only to those authorized to see it. Integrity means ensuring that data isn’t tampered with. Availability means systems are up and accessible when they need to be. A ransomware attack, for example, violates all three.
You’ll also need to understand who’s coming after you. Threat actors range from script kiddies running pre-built tools to nation-state groups with unlimited budgets. Attack types include phishing, malware, denial of service (DoS/DDoS), man-in-the-middle (MITM), SQL injection, and more. The MITRE ATT&CK Framework is the industry-standard map of real-world adversary tactics and techniques — bookmark it now.
For common vulnerability and exposure tracking, the CVE Database and NIST National Vulnerability Database (NVD) are your go-to references. Every known vulnerability has a CVE ID — learning to look them up is day-one tradecraft.
For a full breakdown of threat actor categories, attack classifications, and real-world examples — the Academy course covers this in depth.
Home Lab Setup Overview
You cannot learn cybersecurity by reading alone. You need a lab — a safe, controlled environment where you can break things on purpose. The good news: you don’t need expensive hardware. A mid-range laptop and free software will get you started.
The standard beginner setup (all free):
- VirtualBox — 100% free, open-source virtualization software to run multiple operating systems on one machine. Download from virtualbox.org.
- Kali Linux — the go-to penetration testing distro, packed with hundreds of security tools out of the box. Download the VM image directly from kali.org/get-kali and import it into VirtualBox.
- Metasploitable — an intentionally vulnerable Linux VM designed to be attacked. Your free practice target.
- DVWA (Damn Vulnerable Web Application) — a deliberately insecure web app for practicing web application attacks like SQL injection and XSS. Free and open-source.
- VulnHub — a library of free downloadable vulnerable VMs for practice. Hundreds of machines at every skill level.
Note: VMware Workstation Player is a popular alternative to VirtualBox (free for personal use). VirtualBox is recommended as your starting point since it’s 100% free for all use cases.
Your lab is where everything else in this post comes to life. Set it up early. Don’t skip this step.
The Academy course walks you through the full setup process step by step, including network configuration so your lab traffic stays isolated.
Passive Recon & OSINT
Before an attacker ever touches a target system, they spend time gathering intelligence — without ever triggering an alert. This is called passive reconnaissance, and it’s a critical skill for both offensive and defensive security professionals.
OSINT (Open Source Intelligence) is the practice of collecting publicly available information to build a profile of a target. The amount of data that’s already out there about any organization — or individual — is staggering.
Free tools and techniques:
- Google Dorking — using advanced Google search operators to surface sensitive files, login pages, and exposed data. The Google Hacking Database (GHDB) maintained by Exploit-DB is the definitive reference for dork queries. Completely free.
- WHOIS — domain registration lookup that surfaces ownership info, registration dates, and nameservers. Try whois.com or who.is for a clean interface. Free.
- theHarvester — a command-line tool for gathering emails, subdomains, hosts, and employee names from public sources. Pre-installed on Kali Linux. Free.
- OSINT Framework — a visual directory of free OSINT tools organized by category. Bookmarkable reference for any investigation. Free.
- SpiderFoot — an automated OSINT reconnaissance tool that queries hundreds of data sources simultaneously. Open-source and free.
Tools with free tiers (upgrade available):
- Shodan — the search engine for internet-connected devices. Cameras, industrial control systems, misconfigured servers — Shodan indexes them all. Free account available with limited results; paid plans unlock full data.
- Maltego — a visual link analysis tool for OSINT investigations. Maps relationships between domains, IPs, people, and organizations. Free Community Edition available; paid plans unlock more data sources and transforms.
OSINT is also a discipline in itself — is many security professionals specialize in it for threat intelligence, fraud investigations, and competitive analysis.
The full Academy course covers additional OSINT frameworks and how to build a complete target profile before touching a single packet.
Active Scanning & Enumeration
Once passive recon is done, you move to active scanning — directly probing a target to map its attack surface. This is where things get technical, and where you need to make sure you only ever scan systems you have explicit written permission to test.
The tools every security professional knows (all free):
- Nmap (Network Mapper) — the industry-standard open-source tool for network discovery and security auditing. With Nmap you can discover live hosts, identify open ports, detect running services and their versions, and fingerprint the operating system. Download it free from nmap.org/download. It comes pre-installed on Kali Linux.
- Gobuster — a free, open-source directory and DNS busting tool for web enumeration. Essential for finding hidden web directories and subdomains.
- Sublist3r — free subdomain enumeration using multiple public sources. Great for expanding scope during recon.
- Wireshark — free, open-source; not just for analysis. Useful during active recon to monitor your own scanning traffic and understand what’s on the wire.
Common Nmap techniques include SYN scans (-sS), service version detection (-sV), OS detection (-O), and the Nmap Scripting Engine (NSE) for deeper enumeration. During the livestream, Tyrone runs live Nmap demos so you can see exactly what the output looks like against real targets.
The Academy course covers enumeration methodology in full — including how to interpret results, what to escalate, and how enumeration fits into a structured penetration test.
Common Services, Threats & Attacks
Networks run on services — HTTP, FTP, SSH, SMB, DNS, RDP, and dozens more. Each service has known vulnerabilities, default misconfigurations, and common attack patterns. Understanding what each service does and where it breaks is foundational knowledge for any security role.
Some of the most commonly exploited services:
- SMB (Server Message Block) — the protocol behind EternalBlue (CVE-2017-0144), the exploit used in the WannaCry and NotPetya attacks. Still one of the most dangerous unpatched vulnerabilities in enterprise environments.
- RDP (Remote Desktop Protocol / Port 3389) — frequently targeted for brute force and credential stuffing. The BlueKeep vulnerability (CVE-2019-0708) is a well-known critical RDP flaw.
- FTP (Port 21) — often misconfigured to allow anonymous login, exposing sensitive files. Always check for anonymous FTP access during assessments.
- DNS (Port 53) — target of zone transfer attacks, cache poisoning, and DNS tunneling for data exfiltration. Use DNSRecon and DNSEnum (both on Kali, both free) to enumerate DNS records.
- SSH (Port 22) — secure by design, but commonly misconfigured. Default credentials, weak key management, and outdated algorithms are common findings.
- HTTP/HTTPS (Ports 80/443) — the attack surface of web applications. See the OWASP Top 10 for the most critical web application security risks — the industry reference for web attack categories. Free.
You don’t need to memorize every CVE. You need to understand the patterns. The CVE database and Exploit-DB are your free research tools when you find something interesting.
The full Academy course maps common services to their attack vectors and walks through real exploitation scenarios in a lab environment.
IPv6 Overview
Most people learned networking on IPv4. But the internet is mid-transition to IPv6, and most organizations already have IPv6 running on their networks — often without proper security controls. Attackers know this. Many security tools default to monitoring IPv4 traffic only, leaving IPv6 as a blind spot.
Key concepts to understand:
- Address structure — IPv6 uses 128-bit addresses (vs 32-bit IPv4), expressed in hexadecimal. The IANA IPv6 address space registry breaks down the allocation. Free reference.
- Neighbor Discovery Protocol (NDP) — replaces ARP in IPv6. Subject to rogue router advertisement (RA) attacks, which can redirect traffic at Layer 3 without touching a firewall rule.
- THC-IPv6 Toolkit — a free, open-source suite of IPv6 attack tools included in Kali Linux. Useful for understanding what IPv6-native attacks look like in practice.
This isn’t the deepest section of the livestream, but it’s one of the most overlooked — which is exactly why it’s in the curriculum. If you’re doing assessments and ignoring IPv6, you’re leaving findings on the table.
Wireshark Fundamentals
If Nmap tells you what’s on a network, Wireshark tells you what’s happening on it. Wireshark is the world’s most widely used network protocol analyzer — a free, open-source tool that captures and displays network traffic in real time, packet by packet. Download it free at wireshark.org/download.
In the right hands, Wireshark can reveal:
- Credentials being passed in cleartext over unencrypted protocols like FTP, Telnet, and HTTP
- Malware communicating with a command-and-control (C2) server
- Unusual traffic patterns that indicate data exfiltration
- Misconfigured services broadcasting sensitive information
- ARP spoofing and man-in-the-middle attacks in progress
Key Wireshark skills to build:
- Display filters — harrow down captures to only what matters (e.g.,
http,tcp.port == 443,ip.addr == 192.168.1.1) - Protocol hierarchy — understand what protocols are dominant in a capture
- Following TCP/UDP streams — reassemble conversations to read data in context
- Export objects — pull files transferred over HTTP, SMB, and other protocols directly out of a capture
For practice with pre-made captures, visit malware-traffic-analysis.net — a free library of real malware PCAP files used by security professionals worldwide.
The Academy course includes hands-on Wireshark labs with pre-captured traffic files so you can practice analysis on your own schedule.
Vulnerability Identification & Analysis
Scanning tells you what’s there. Vulnerability analysis tells you what’s broken. This is the process of identifying weaknesses in systems and applications — misconfigurations, unpatched software, weak credentials, exposed services — before an attacker does.
Free tools covered in the livestream:
- OpenVAS / Greenbone Vulnerability Manager — the leading open-source, completely free vulnerability scanner. Regularly updated feed of 50,000+ vulnerability tests, deployable via Docker in your home lab. Preferred when you need full control over your scanning infrastructure. 100% free.
- Nmap Vulners Script — a free NSE script that cross-references Nmap service detection results against vulners.com CVE data. Lightweight vuln scanning without a full scanner. Free.
Free tier available (limitations apply):
- Nessus Essentials — the free tier of Tenable’s industry-leading vulnerability scanner. Free for up to 16 IPs. Produces detailed reports with severity ratings, remediation guidance, and CVE references. Widely recognized by hiring managers. Register free at tenable.com. (Full commercial Nessus is a paid product used in enterprise environments.)
Learning to run a vulnerability scan is easy. Learning to read the results intelligently — prioritizing critical findings, eliminating false positives, understanding CVSS scores, understanding the business context of each finding — is the actual skill.
The full Academy course covers scan configuration, results interpretation, and how to write findings that actually help organizations remediate.
Exploitation Fundamentals
This is the section that gets people’s attention — and the one that comes with the most responsibility. Exploitation is the act of leveraging a vulnerability to gain unauthorized access to a system. In a penetration test, it’s how you prove a vulnerability is real and impactful, not just theoretical.
Free tools to start with:
- Metasploit Framework — the world’s most widely used penetration testing framework, maintained by Rapid7. Metasploit provides a library of tested exploits, payloads, and auxiliary modules. Pre-installed on Kali Linux. The official documentation is solid for beginners. Free and open-source.
- Exploit-DB — the largest public archive of exploits and vulnerable software, maintained by Offensive Security. Use
searchsploiton Kali to query it from the terminal. Free. - Sliver — an open-source C2 framework from BishopFox, used in professional red team engagements. Free.
Enterprise tools you’ll encounter on the job (not free):
- Cobalt Strike — the industry-standard commercial C2 framework used by professional red teams. Mentioned for awareness; Metasploit is your starting point. Paid enterprise license required.
The livestream walkthrough covers the Metasploit console (msfconsole), search, use, set, and run — the core workflow for moving from vulnerability identification to proof-of-concept exploitation against intentionally vulnerable lab targets.
This is demonstration, not a license — you only ever run exploitation tools against systems you own or have explicit written permission to test. Unauthorized access is a federal crime under the Computer Fraud and Abuse Act (CFAA).
The Academy course covers Metasploit methodology in a structured lab environment with legal/ethical boundaries clearly defined.
Post-Exploitation & Privilege Escalation
Getting in is step one. What happens after is where real penetration testers earn their reputation. Post-exploitation covers everything from maintaining access and pivoting through a network to escalating privileges — moving from a low-level user account to full administrative control.
Privilege escalation techniques by platform (all tools below are free):
- Linux — SUID/SGID binary abuse, weak sudo configurations, cron job hijacking, kernel exploits, writable paths. Use LinEnum or LinPEAS for automated enumeration of escalation vectors.
- Windows — unquoted service paths, DLL hijacking, token impersonation, misconfigured ACLs, AlwaysInstallElevated. Use WinPEAS for automated enumeration.
- GTFOBins — a curated list of Unix binaries that can be abused for privilege escalation, breakouts, and reverse shells. A bookmark every practitioner has. Free.
- LOLBAS (Living Off the Land Binaries) — the Windows equivalent. Native Windows binaries that attackers abuse to avoid detection. Free.
- Mimikatz — credential dumping tool, standard in professional red team engagements. Free/open-source.
- CrackMapExec — network enumeration and exploitation post-access. Free/open-source.
- BloodHound — visualize AD attack paths and find the fastest route to Domain Admin. Free/open-source.
- Rubeus and Impacket — Kerberos abuse and AD attack toolkits. Free/open-source.
The Academy course goes deep here — structured escalation labs across both Linux and Windows environments.
Windows Active Directory Forensics
Active Directory (AD) is the backbone of identity management in most enterprise Windows environments. It’s also one of the most targeted attack surfaces in corporate networks. AD knowledge is non-negotiable if you want to work in enterprise security.
Key concepts and attack techniques covered:
- AD Structure — Domains, Organizational Units (OUs), Security Groups, Group Policy Objects (GPOs), Forests, and Trusts. The Microsoft AD documentation is the ground truth reference. Free.
- Kerberoasting — requesting service tickets for service accounts and cracking them offline. Use Rubeus or Impacket’s
GetUserSPNs.py. Crack with Hashcat. All free tools. - Pass-the-Hash (PtH) — authenticating with an NTLM hash instead of a plaintext password, bypassing the need to crack credentials.
- DCSync — mimicking a domain controller to pull password hashes for any account in the domain, including the
krbtgtaccount (enabling Golden Ticket attacks). - BloodHound — the industry-standard free tool for visualizing AD attack paths. Maps relationships between users, groups, and computers to find the shortest path to Domain Admin.
- PowerShell for AD Enumeration — native Windows commands and the Active Directory PowerShell module. No third-party tools required — just the built-in environment.
For forensic investigation of AD compromises, Windows Event Logs (Event IDs 4624, 4625, 4648, 4768, 4769, 4776) are your primary artifact source.
The full Academy course includes dedicated AD labs and walkthroughs of the most common enterprise attack paths.
SIEM & Log Analysis
Security events leave traces. Every login, every failed authentication, every unusual process execution generates a log. A SIEM (Security Information and Event Management) system aggregates those logs from across an environment, correlates them, and surfaces the patterns that indicate a threat.
Free platforms to learn on:
- Wazuh — a powerful open-source SIEM, XDR, and HIDS platform. Free, actively maintained, and increasingly adopted by organizations that want enterprise-grade detection capabilities. Deploy it in your lab from Docker in under 30 minutes. 100% free.
- Security Onion — a free Linux distribution for threat hunting, network security monitoring, and log management. Bundles Elasticsearch/Kibana, Suricata, Zeek, and Wazuh into one platform. The preferred free SIEM for home lab environments. 100% free.
- Elastic SIEM (ELK Stack) — Elasticsearch + Logstash + Kibana. Free to self-host, widely deployed, and a core skill for many SOC analyst roles. Free to self-host.
For log analysis practice, Blue Team Labs Online and CyberDefenders offer free hands-on challenges built around real log data and SIEM investigation scenarios.
Free tier available (industry-standard, widely required by employers):
- Splunk — the industry-leading SIEM platform. Free tier allows up to 500MB of data ingested per day — more than enough to learn on. Splunk SPL (Search Processing Language) is one of the most hireable skills in blue team security. Get started with Splunk Fundamentals 1 — free training from Splunk itself. (Full enterprise Splunk is a paid platform.)
Enterprise tools you’ll encounter on the job (not free):
- CrowdStrike Falcon — enterprise EDR/XDR platform. Industry-leading; you’ll see it in SOC environments. Paid enterprise platform.
- SentinelOne — AI-powered endpoint detection and response. Increasingly common in enterprise SOC roles. Paid enterprise platform.
- Microsoft Sentinel — cloud-native SIEM and SOAR from Microsoft. Dominant in Azure-heavy environments. Paid cloud platform.
The Academy course includes Splunk and Wazuh labs with real log data and guided detection exercises.
Incident Handling & Response
When something goes wrong — and in security, something always eventually goes wrong — the difference between a contained incident and a full-scale breach is often the quality of the response. Incident handling is the structured process of detecting, containing, eradicating, and recovering from a security event.
Free key frameworks and resources:
- NIST SP 800-61 Rev. 2 — the industry-standard incident response framework. Covers the full lifecycle: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity. Free to download from NIST CSRC.
- SANS Incident Handler’s Handbook — a practical, free companion resource from SANS Institute, the gold standard in security training.
- MITRE ATT&CK — use it in IR to map attacker activity to known TTPs (Tactics, Techniques, and Procedures) and identify what else might be compromised. Free.
- The DFIR Report — free, detailed incident response reports published by a volunteer research group. Real intrusion cases with full timelines and IOCs. One of the best free learning resources in the field.
Free IR tools you’ll use in the field:
- Autopsy — free, open-source digital forensics platform for disk image analysis
- Volatility — the standard free tool for memory forensics analysis
- Eric Zimmerman’s Tools — a free suite of Windows forensic tools used by incident responders and law enforcement worldwide
The full Academy course covers incident response procedures, communication templates, and tabletop exercise scenarios.
Capture the Flag (CTF) — How to Get Started
CTFs are competitive security challenges where you solve puzzles — finding hidden “flags” by exploiting vulnerable systems, reversing code, cracking encryption, analyzing network traffic, and more. They’re one of the best ways to build practical skills in a legal, structured environment — and they build a portfolio that gets you hired.
Fully free platforms (start here):
- PicoCTF — designed for students, excellent for fundamentals. Developed by Carnegie Mellon University. 100% free.
- CTFtime.org — tracks upcoming CTF competitions worldwide. Find team-based competitions to join and compete in. Free.
- VulnHub — downloadable CTF-style vulnerable VMs for offline practice in your home lab. Free.
- pwn.college — a free, rigorous platform from Arizona State University focused on binary exploitation, program security, and systems-level skills. 100% free.
Free tier available (upgrade unlocks more content):
- TryHackMe — the most beginner-friendly platform available. Guided learning paths, browser-based labs, no setup required. Start with the Pre-Security path if you’re brand new. Free tier available; premium subscription unlocks all content.
- HackTheBox (HTB) — more advanced, community-driven, respected by hiring managers as a legitimate credential signal. Once you’re comfortable in TryHackMe, move here. Free tier available; VIP unlocks retired machines and faster access.
Write-ups from CTF challenges have gotten people hired. Document your work. Post it on Medium or GitHub. That’s your portfolio.
Career Paths & Next Steps
Cybersecurity is not one job — it’s a field with dozens of distinct career tracks, each with its own skill set, certifications, and hiring landscape. The livestream closes with a real talk about where you can go from here.
A few of the most in-demand paths right now:
- SOC Analyst (Tier 1/2/3) — the most common entry point. Monitor alerts, investigate incidents, escalate threats. Tools: Splunk, Wazuh, Security Onion (free to learn on). Enterprise tools you’ll encounter: CrowdStrike, SentinelOne, Microsoft Sentinel.
- Penetration Tester / Ethical Hacker — offensive security role. Find vulnerabilities before attackers do. Tools: Nmap, Metasploit, Burp Suite, BloodHound (all free).
- GRC (Governance, Risk & Compliance) — policy, frameworks, audits. Frameworks: NIST CSF, ISO 27001, HIPAA, PCI-DSS, CMMC. All free to study.
- Cloud Security Engineer — securing AWS, Azure, GCP infrastructure. One of the fastest-growing and highest-paying tracks in the field right now.
- Incident Responder / Digital Forensics (DFIR) — investigate breaches, analyze evidence, contain damage. High demand post-breach; increasingly required by cyber insurance carriers.
- vCISO / Security Advisor — what Cover6 does. Strategic security leadership for organizations that can’t afford a full-time CISO. Learn more about Cover6 vCISO services here.
Practice all of these areas with Cover6 Academy’s free practice exams — built to simulate the real thing.
Entry-level certifications that carry real weight (all paid — budget accordingly):
- CompTIA Security+ — the DoD-baseline cert, required for many federal contractor roles. Start here. (~$404 exam fee)
- CompTIA Network+ — if you need to shore up networking fundamentals first. Pairs well with Security+. (~$369 exam fee)
- CompTIA Linux+ — strong foundation for anyone working in offensive security or cloud environments. (~$369 exam fee)
- eJPT (INE) — a hands-on entry-level pentesting cert from INE. A practical alternative to pure multiple-choice exams. Highly regarded for Hands-on validation. (~$200 exam fee)
- CEH (Certified Ethical Hacker) — from EC-Council. Widely recognized, especially in government and DoD-adjacent roles. (~$1,199+ exam fee)
- OSCP (Offensive Security Certified Professional) — from Offensive Security. The gold standard in hands-on penetration testing certification. Advanced — work up to it. (~$1,499+ with lab access)
The field needs people who look like us. It has always needed them. You are not too late.
Watch the Full 6-Hour Livestream ℔ Today
Everything above is the preview. The livestream is the experience — Tyrone at the terminal, walking through each of these topics live, taking questions in real time, and showing you exactly how this work gets done.
Cover6 Community — Intro to Cyber Livestream
📅 Saturday, March 21st
🕙 10:00 AM – 4:00 PM EST (we’ll probably go over 😅)
💻 Virtual / Free
Join the community and register:
🔗 meetup.com/cover6community
Just want to watch?
▶️ Watch live on YouTube — @Cover6Solutions
Go Deeper — Cover6 Academy
The livestream covers the roadmap. The Academy course is where you build the skills. The Intro2Cyber course at Cover6 Academy is free, self-paced, and designed to take you from zero to job-ready — with structured labs, guided walkthroughs, and the same no-gatekeeping philosophy that Cover6 Community was built on.
Your success is our reward.
— The Cover6 Solutions Team
#BreakingN2Cyber #Intro2Cyber #PentesterPrep #SOCAnalystPrep #AttackNDefend
Get Free Cybersecurity Training & Meetups
Join The 6 newsletter — meetups, workshops, and career insights. Free forever.