A complete, beginner-to-advanced cybersecurity curriculum - built in public, one day at a time.
by Sudeep Ravichandran - MS Cybersecurity @ Indiana University Bloomington
This repository documents my 100-day public learning challenge in cybersecurity.
Every day has:
- 📖 A concept explained from scratch - no assumed knowledge
- 💻 Working code, scripts, or tool walkthroughs (most days)
- 🔗 A LinkedIn post where I share what I learned
The curriculum is structured to take anyone from zero cybersecurity knowledge to job-ready skills across offensive security, cloud security, and AI-driven detection.
If you're a complete beginner - start at Day 1. Every concept is introduced before it's used.
If you have some experience - jump to the phase that matches your level.
Phase 1 │ Foundations │ Days 001 – 020 │ Networking, Linux, Cryptography
Phase 2 │ Offensive Security │ Days 021 – 045 │ Pen Testing, Web Attacks, Exploitation
Phase 3 │ Defensive Security │ Days 046 – 065 │ SIEM, Detection Engineering, IR
Phase 4 │ Cloud Security │ Days 066 – 080 │ AWS/Azure, Cloud Attacks & Auditing
Phase 5 │ AI × Security │ Days 081 – 095 │ ML for Detection, LLM Security
Phase 6 │ Portfolio Sprint │ Days 096 – 100 │ Capstone Projects, Interview Prep
Build the mental model first. You can't secure or hack what you don't understand.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 001 | The CIA Triad: Foundation of Everything | - | 🔗 |
| 002 | How the Internet Works: TCP/IP Deep Dive | packet_analyzer.py | 🔗 |
| 003 | The OSI Model: Why Every Layer Matters to Attackers | - | 🔗 |
| 004 | DNS: The Protocol Hackers Love to Abuse | dns_enum.py | 🔗 |
| 005 | Firewalls & What They Can't Stop | - | 🔗 |
| 006 | Linux for Security: Commands That Actually Matter | linux_cheatsheet.sh | 🔗 |
| 007 | File Permissions & Why Misconfigs Get People Fired | perm_audit.sh | 🔗 |
| 008 | Cryptography 101: Symmetric vs Asymmetric | crypto_basics.py | 🔗 |
| 009 | Hashing: How Passwords Are (and Shouldn't Be) Stored | hash_demo.py | 🔗 |
| 010 | PKI & Certificates: How HTTPS Actually Works | - | 🔗 |
| 011 | Authentication vs Authorization: Not the Same Thing | - | 🔗 |
| 012 | VPNs, Proxies, and Tor: Anonymity Explained | - | 🔗 |
| 013 | Nmap: Your First Recon Tool | nmap_basics.sh | 🔗 |
| 014 | Wireshark: Reading Network Traffic Like a Pro | analysis_notes.md | 🔗 |
| 015 | Common Attack Types: A Threat Taxonomy | - | 🔗 |
| 016 | Social Engineering: The Human Vulnerability | - | 🔗 |
| 017 | OWASP Top 10: The Web Hacker's Bible | - | 🔗 |
| 018 | CVEs & the Vulnerability Lifecycle | cve_lookup.py | 🔗 |
| 019 | Setting Up a Free Home Lab (Legal & Safe) | lab_setup.md | 🔗 |
| 020 | Phase 1 Recap + First CTF Attempt | ctf_writeup.md | 🔗 |
Think like an attacker. Ethical hacking, web app exploitation, and pen testing methodology.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 021 | Penetration Testing Methodology (PTES) | - | 🔗 |
| 022 | Passive Recon: OSINT & Footprinting | osint_toolkit.py | 🔗 |
| 023 | Active Recon: Banner Grabbing & Enumeration | recon_enum.py | 🔗 |
| 024 | Vulnerability Scanning with OpenVAS | - | 🔗 |
| 025 | Metasploit Framework: Basics | msf_workflow.md | 🔗 |
| 026 | SQL Injection: From Theory to Exploitation | sqli_demo.py | 🔗 |
| 027 | XSS: Stored, Reflected, and DOM-Based | xss_payloads.md | 🔗 |
| 028 | CSRF, IDOR, and Broken Access Control | csrf_idor_demo.py | 🔗 |
| 029 | Burp Suite: Web App Proxy Masterclass | burp_workflow.md | 🔗 |
| 030 | Authentication Attacks: Brute Force & Credential Stuffing | auth_attack_demo.py | 🔗 |
| 031 | API Hacking: Vulnerabilities in REST APIs | api_recon.py | 🔗 |
| 032 | Server-Side Request Forgery (SSRF) | - | 🔗 |
| 033 | File Upload Vulnerabilities & Bypasses | - | 🔗 |
| 034 | Command Injection & OS Execution | - | 🔗 |
| 035 | Privilege Escalation: Linux (GTFOBins & SUID) | privesc_check.sh | 🔗 |
| 036 | Privilege Escalation: Windows | win_privesc.md | 🔗 |
| 037 | Password Cracking: Hashcat & John the Ripper | crack_guide.py | 🔗 |
| 038 | Wireless Security: WPA2 Attacks & Defenses | - | 🔗 |
| 039 | Post-Exploitation: What Happens After a Shell | - | 🔗 |
| 040 | Writing a Professional Pen Test Report | pentest_report_template.py | 🔗 |
| 041 | CTF Writeup: HackTheBox (Easy Machine) | - | 🔗 |
| 042 | CTF Writeup: TryHackMe Room | - | 🔗 |
| 043 | Building a Subdomain Scanner from Scratch | subdomain_scanner.py | 🔗 |
| 044 | OWASP Juice Shop: Full Walkthrough | - | 🔗 |
| 045 | Phase 2 Capstone: Full Pen Test on Lab VM | - | 🔗 |
The blue team. SIEM, threat hunting, log analysis, and incident response.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 046 | Blue Team vs Red Team: How Detection Engineering Works | - | 🔗 |
| 047 | Log Analysis: What to Look For and Why | log_parser.py | 🔗 |
| 048 | Splunk: Searching, SPL Queries & Dashboards | splunk_queries.md | 🔗 |
| 049 | SIEM Architecture: How It All Fits Together | - | 🔗 |
| 050 | Writing Detection Rules: Sigma & YARA | detection_rules/ | 🔗 |
| 051 | MITRE ATT&CK: A Defender's Map | attack_mapper.py | 🔗 |
| 052 | Threat Intelligence: IOCs, TTPs & Feeds | ioc_enricher.py | 🔗 |
| 053 | Network Traffic Analysis: Spotting Anomalies | traffic_baseline.py | 🔗 |
| 054 | UEBA: User and Entity Behavior Analytics | ueba_demo.py | 🔗 |
| 055 | Incident Response: The 6-Phase Process | - | 🔗 |
| 056 | Digital Forensics: Disk & Memory Analysis | - | 🔗 |
| 057 | Malware Analysis 101: Static vs Dynamic | - | 🔗 |
| 058 | IDS/IPS: Writing Snort Rules | snort_rules.md | 🔗 |
| 059 | Threat Hunting: Proactive Detection | - | 🔗 |
| 060 | Ransomware: How It Works & How to Detect It | - | 🔗 |
| 061 | SOC Analyst Workflow: A Day in the Life | - | 🔗 |
| 062 | Building an Automated Alert Triage Tool | alert_triage.py | 🔗 |
| 063 | Zero Trust Architecture Explained | - | 🔗 |
| 064 | Security Metrics: What to Measure & Why | - | 🔗 |
| 065 | Phase 3 Capstone: Building a Detection Lab | - | 🔗 |
The future is cloud. Learn to attack and defend AWS and Azure environments.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 066 | Cloud Security 101: Shared Responsibility Model | - | 🔗 |
| 067 | AWS IAM: Permissions, Roles & Least Privilege | - | 🔗 |
| 068 | S3 Misconfigurations: A Real-World Epidemic | - | 🔗 |
| 069 | Cloud Attack Techniques: Top 10 | - | 🔗 |
| 070 | AWS CloudTrail: Logging & Monitoring | - | 🔗 |
| 071 | AWS GuardDuty: Threat Detection at Scale | - | 🔗 |
| 072 | Container Security: Docker & Kubernetes Threats | - | 🔗 |
| 073 | Serverless Security: Lambda Attack Vectors | - | 🔗 |
| 074 | Azure Sentinel: Cloud-Native SIEM | - | 🔗 |
| 075 | Cloud Pen Testing: Methodology & Tools | cloud_enum.py | 🔗 |
| 076 | Secrets Management: Vault & AWS Secrets Manager | - | 🔗 |
| 077 | DevSecOps: Shifting Security Left in CI/CD | ci_security_scan.yml | 🔗 |
| 078 | IaC Security: Scanning Terraform for Misconfigs | tf_security_check.py | 🔗 |
| 079 | Cloud Incident Response: What's Different | - | 🔗 |
| 080 | Phase 4 Capstone: Full Cloud Environment Audit | - | 🔗 |
Where my research lives. ML-driven detection, LLM vulnerabilities, and adversarial AI.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 081 | Why AI is Changing Cybersecurity | - | 🔗 |
| 082 | Anomaly Detection with Isolation Forest | isolation_forest.py | 🔗 |
| 083 | Network Intrusion Detection with ML | - | 🔗 |
| 084 | Log Anomaly Detection: DeepLog vs LogREx | - | 🔗 |
| 085 | Phishing Detection with NLP | - | 🔗 |
| 086 | LLM Security: Prompt Injection Attacks | - | 🔗 |
| 087 | Jailbreaking LLMs: AI Red Teaming | - | 🔗 |
| 088 | RAG Poisoning & Data Exfiltration Attacks | - | 🔗 |
| 089 | Adversarial ML: Evading AI-Based Detectors | - | 🔗 |
| 090 | AI-Powered Threat Intelligence Pipelines | ti_pipeline.py | 🔗 |
| 091 | Explainable Alert Triage Using LLMs (Inspired by LogREx) | - | 🔗 |
| 092 | Knowledge Graphs for Security Context | - | 🔗 |
| 093 | Deepfake & Synthetic Media Threats | - | 🔗 |
| 094 | AI Governance & Responsible Security AI | - | 🔗 |
| 095 | Phase 5 Capstone: AI-Powered SIEM Alert Explainer | - | 🔗 |
The job hunt. Real projects, a polished portfolio, and strategy to land the offer.
| Day | Topic | Code / Lab | Post |
|---|---|---|---|
| 096 | Building a Security Portfolio That Gets Interviews | - | 🔗 |
| 097 | HTB / TryHackMe: Advanced Machine Writeup | - | 🔗 |
| 098 | Contributing to Open Source Security Tools | - | 🔗 |
| 099 | Top 30 Cybersecurity Interview Q&A | - | 🔗 |
| 100 | Day 100: What I Learned & What's Next | - | 🔗 |
Offensive Kali Linux · Metasploit · Burp Suite · Nmap · OWASP ZAP · Wireshark · Hashcat · SQLMap · Gobuster
Defensive Splunk · Snort · Sigma · YARA · Volatility · Elastic Stack
Cloud AWS (IAM, GuardDuty, CloudTrail, S3) · Azure Sentinel · Terraform · Docker · Kubernetes
AI & Data Science Python · scikit-learn · TensorFlow · Hugging Face · LangChain · NetworkX
Frameworks MITRE ATT&CK · OWASP Top 10 · NIST CSF · Zero Trust · PTES
I'm Sudeep Ravichandran - MS Cybersecurity student at Indiana University Bloomington (4.0 GPA), published researcher in AI-driven threat detection, and international student building toward a full-time security engineering role by May 2027.
My published research:
- LogREx - LLM + Knowledge Graph based log anomaly detection (Springer LNNS, CIS 2025)
- PCMedIR - Privacy-preserving medical image retrieval (Springer LNNS, ICCIS 2024)
📫 LinkedIn · Portfolio · sudeep7217@gmail.com
If this repo helps your cybersecurity journey, please ⭐ star it.
Recruiter? I graduate May 2027 and I'm actively looking for security engineering roles.