From 96830a17d7ecb2685c0a6cf7fb1f4514dd4ffb68 Mon Sep 17 00:00:00 2001
From: Ajay Dhangar <ajaydhangar49@gmail.com>
Date: Wed, 22 Oct 2025 08:58:22 +0530
Subject: [PATCH] Docs: added content for cybersecurity

---
 docs/cybersecurity/best-practices.mdx         | 218 ++++++++++++++
 docs/cybersecurity/certification-guide.mdx    |   0
 .../cryptography-and-encryption.mdx           | 214 +++++++++++++
 docs/cybersecurity/cybersecurity-tools.mdx    | 283 ++++++++++++++++++
 docs/cybersecurity/dark-web.mdx               | 139 +++++++++
 .../ethical-hacking-and-cyber-defense.mdx     | 170 +++++++++++
 docs/cybersecurity/ethical-hacking-basics.mdx | 185 ++++++++++++
 docs/cybersecurity/incident-response.mdx      | 216 +++++++++++++
 docs/cybersecurity/index.mdx                  | 105 +++++++
 .../introduction-to-cybersecurity.mdx         | 142 +++++++++
 .../cybersecurity/network-security-basics.mdx | 204 +++++++++++++
 docs/cybersecurity/types-of-cyberattacks.mdx  | 219 ++++++++++++++
 .../web-application-security.mdx              | 230 ++++++++++++++
 13 files changed, 2325 insertions(+)
 create mode 100644 docs/cybersecurity/best-practices.mdx
 create mode 100644 docs/cybersecurity/certification-guide.mdx
 create mode 100644 docs/cybersecurity/cryptography-and-encryption.mdx
 create mode 100644 docs/cybersecurity/cybersecurity-tools.mdx
 create mode 100644 docs/cybersecurity/dark-web.mdx
 create mode 100644 docs/cybersecurity/ethical-hacking-and-cyber-defense.mdx
 create mode 100644 docs/cybersecurity/ethical-hacking-basics.mdx
 create mode 100644 docs/cybersecurity/incident-response.mdx
 create mode 100644 docs/cybersecurity/index.mdx
 create mode 100644 docs/cybersecurity/introduction-to-cybersecurity.mdx
 create mode 100644 docs/cybersecurity/network-security-basics.mdx
 create mode 100644 docs/cybersecurity/types-of-cyberattacks.mdx
 create mode 100644 docs/cybersecurity/web-application-security.mdx

diff --git a/docs/cybersecurity/best-practices.mdx b/docs/cybersecurity/best-practices.mdx
new file mode 100644
index 0000000..3050e82
--- /dev/null
+++ b/docs/cybersecurity/best-practices.mdx
@@ -0,0 +1,218 @@
+---
+title: "Best Practices in Cybersecurity"
+description: "Learn the essential cybersecurity best practices that protect individuals and organizations from evolving digital threats — from passwords to patching and beyond."
+tags: [cybersecurity, best-practices, security-awareness, safe-computing]
+---
+
+In cybersecurity, **prevention is always better than recovery**. Even the strongest systems can be compromised if users or administrators neglect basic security hygiene.
+
+This lesson explores the **best practices** followed by professionals and organizations worldwide to stay safe in an increasingly connected world.
+
+---
+
+## What Are Cybersecurity Best Practices?
+
+Cybersecurity best practices are **proven methods and habits** that minimize the risk of attacks, data loss, or unauthorized access.
+
+They’re not just technical steps — they’re a **mindset**.
+
+Think of them as your “digital seatbelts.”  
+You may not need them every day, but when danger strikes, they can save you from serious harm.
+
+---
+
+## 1. Use Strong and Unique Passwords
+
+Weak passwords are like leaving your front door unlocked.
+
+### Good Practices:
+* Use at least **12+ characters** with a mix of upper/lowercase letters, numbers, and symbols.  
+* Avoid using personal info like birthdays or pet names.  
+* Never reuse the same password across sites.  
+* Use a **password manager** (e.g., Bitwarden, 1Password, or LastPass) to store and generate passwords.
+
+### Avoid:
+* `password123`, `qwerty`, or `admin` — these are hacker favorites.
+* Using the same password for multiple accounts.
+
+---
+
+## 2. Enable Two-Factor Authentication (2FA)
+
+Even if someone steals your password, **2FA adds a second barrier** — like needing both your key and fingerprint to open a safe.
+
+### Common 2FA Methods:
+* SMS or email codes  
+* Authenticator apps (e.g., Google Authenticator, Authy, Microsoft Authenticator)  
+* Hardware keys (YubiKey, Titan Key)
+
+:::tip
+Prefer authenticator apps or hardware keys over SMS for stronger protection.
+:::
+
+---
+
+## 3. Keep Software and Systems Updated
+
+Cybercriminals often exploit outdated software to access systems.
+
+* Regularly install security patches for your OS, apps, and browsers.  
+* Enable **automatic updates** whenever possible.  
+* Don’t ignore update prompts — they often fix known vulnerabilities.
+
+*Example:* The WannaCry ransomware spread globally in 2017 because many systems skipped a critical Windows update.
+
+---
+
+## 4. Beware of Phishing and Social Engineering
+
+Phishing is one of the most common and successful attack methods — tricking users into revealing secrets or clicking malicious links.
+
+### How to Identify a Phishing Attempt:
+* The sender’s email looks suspicious or unfamiliar.  
+* Urgent tone (“Your account will be locked!”).  
+* Links don’t match the real website domain.  
+* Attachments you weren’t expecting.
+
+### Always:
+
+* Hover over links before clicking.  
+* Verify requests directly from official sources.  
+* Report phishing attempts to your IT or security team.
+
+---
+
+## 5. Use Secure Networks
+
+Avoid connecting to public Wi-Fi for sensitive activities like banking or work logins.
+
+### Safer Options:
+* Use a **Virtual Private Network (VPN)** when on public Wi-Fi.  
+* Turn off automatic Wi-Fi connections.  
+* Avoid using public computers for private tasks.
+
+*Why?* Attackers can intercept unencrypted traffic or create fake “Free Wi-Fi” networks to steal data.
+
+---
+
+## 6. Backup Data Regularly
+
+Data loss can happen from ransomware, hardware failure, or accidental deletion.
+
+### Best Practices:
+* Follow the **3-2-1 rule**:
+  * Keep **3** copies of your data  
+  * Store them on **2** different types of media  
+  * Keep **1** copy **offsite or in the cloud**
+* Automate backups whenever possible.
+* Test backups periodically to ensure they work.
+
+*Remember:* A backup is useless if it’s never tested.
+
+---
+
+## 7. Limit Access and Apply the Principle of Least Privilege
+
+Not everyone needs access to everything.
+
+* Grant users **only the permissions they require** to perform their duties.  
+* Regularly review access rights and revoke unnecessary privileges.  
+* Monitor admin account activity closely.
+
+This limits the impact of insider threats or compromised accounts.
+
+---
+
+## 8. Secure Your Devices
+
+* Use **strong screen locks** and **biometric authentication**.  
+* Enable device encryption (BitLocker for Windows, FileVault for macOS).  
+* Keep Bluetooth and file-sharing off when not in use.  
+* Install **trusted security software**.
+
+:::tip
+Treat your phone like your wallet, it contains sensitive data, and losing it can expose everything.
+:::
+
+---
+
+## 9. Educate and Train Continuously
+
+Human error remains the **#1 cause of cybersecurity incidents**.
+
+* Conduct regular **security awareness training**.  
+* Simulate phishing attacks to test readiness.  
+* Stay updated on the latest threats and trends.
+
+*Cybersecurity is everyone’s job — not just the IT team’s.*
+
+---
+
+## 10. Implement Network and Endpoint Security
+
+* Use **firewalls** to control incoming/outgoing traffic.  
+* Deploy **antivirus** and **endpoint protection** tools.  
+* Segment networks — isolate critical systems from public-facing ones.  
+* Monitor all network activity through **SIEM tools** (e.g., Splunk, ELK Stack).
+
+---
+
+## 11. Encrypt Sensitive Data
+
+Encryption ensures that even if attackers access your data, they can’t read it.
+
+* Encrypt files, drives, and communication channels (HTTPS, VPN, TLS).  
+* Avoid sending unencrypted confidential data over email.  
+* Use tools like **VeraCrypt** or **BitLocker** for local encryption.
+
+*Example:* When you see a padlock icon in your browser, it means the site uses HTTPS — encrypting your communication.
+
+---
+
+## 12. Have an Incident Response Plan (IRP)
+
+Even with all precautions, incidents can still happen.
+
+Create and maintain an **Incident Response Plan** that outlines:
+* How to detect and report suspicious activity.  
+* Steps to contain and recover from an attack.  
+* Contact list of key security personnel.  
+* Backup and communication procedures.
+
+Practicing your response plan reduces panic and speeds up recovery when real incidents occur.
+
+---
+
+## 13. Practice Safe Online Behavior
+
+* Don’t overshare personal information on social media.  
+* Verify friend requests or messages before responding.  
+* Avoid downloading software or files from untrusted sites.  
+* Always log out of accounts on shared devices.
+
+---
+
+## Summary of Cybersecurity Best Practices
+
+| Category | Best Practice | Why It Matters |
+|-----------|----------------|----------------|
+| Passwords | Strong, unique passwords | Prevent unauthorized access |
+| Authentication | Enable 2FA | Adds an extra security layer |
+| Updates | Keep systems patched | Fixes known vulnerabilities |
+| Awareness | Avoid phishing scams | Prevents identity theft |
+| Networks | Use VPN & secure Wi-Fi | Protects online data |
+| Backups | Follow 3-2-1 rule | Ensures data recovery |
+| Access Control | Least privilege | Limits potential damage |
+| Devices | Encrypt & lock | Prevents physical data theft |
+| Response | Have an IR plan | Reduces incident impact |
+
+---
+
+## Final Thoughts
+
+Cybersecurity isn’t about being paranoid — it’s about being **prepared**.  
+A small daily habit, like updating software or verifying an email sender, can prevent massive problems.
+
+> “The best defense in cybersecurity isn’t a firewall — it’s awareness.”
+
+By practicing these principles consistently, you’ll build a strong foundation of cyber hygiene and resilience — both for yourself and any organization you work with.
\ No newline at end of file
diff --git a/docs/cybersecurity/certification-guide.mdx b/docs/cybersecurity/certification-guide.mdx
new file mode 100644
index 0000000..e69de29
diff --git a/docs/cybersecurity/cryptography-and-encryption.mdx b/docs/cybersecurity/cryptography-and-encryption.mdx
new file mode 100644
index 0000000..d6de8ac
--- /dev/null
+++ b/docs/cybersecurity/cryptography-and-encryption.mdx
@@ -0,0 +1,214 @@
+---
+title: "Cryptography and Encryption"
+description: "Learn how cryptography and encryption protect data, ensure privacy, and form the backbone of modern cyber security."
+tags: [cybersecurity, cryptography, encryption, data-security, privacy]
+---
+
+In the digital world, **trust** depends on one simple thing, whether data is **safe and private**. That’s exactly what **cryptography** does.
+
+It ensures that your messages, passwords, and transactions can only be understood by the people who are meant to see them, and no one else.
+
+---
+
+## What Is Cryptography?
+
+**Cryptography** is the practice of securing information by transforming it into a form that cannot be understood by unauthorized people.
+
+It comes from two Greek words:
+* *Krypto* (hidden)
+* *Graphy* (writing)
+
+So, cryptography literally means **“hidden writing.”**
+
+It’s how your **WhatsApp** chats stay private, your bank transactions remain secure, and your passwords aren’t readable to hackers.
+
+---
+
+## The Core Goals of Cryptography
+
+Cryptography isn’t just about hiding data, it’s about protecting it in **four key ways** (often called the “CIAA principles”):
+
+| Principle | Meaning | Example |
+|------------|----------|----------|
+| **Confidentiality** | Keeps data secret from unauthorized users | Encrypting messages so only the recipient can read them |
+| **Integrity** | Ensures data isn’t altered during transmission | Detecting tampered files |
+| **Authentication** | Confirms the identity of users | Digital signatures or certificates |
+| ⏱**Non-repudiation** | Prevents users from denying their actions | Proof that a sender really sent a message |
+
+---
+
+## How Cryptography Works
+
+Cryptography works by converting readable data (**plaintext**) into an unreadable form (**ciphertext**) using a **key**.
+
+Here’s the basic process:
+
+```
+
+Plaintext → Encryption → Ciphertext
+Ciphertext → Decryption → Plaintext
+
+```
+
+Let’s visualize it:
+
+| Step | Action | Example |
+|------|---------|----------|
+| 1️⃣ | You write: “Hello Ajay” | (Plaintext) |
+| 2️⃣ | Encryption turns it into: “H8$k*20z!” | (Ciphertext) |
+| 3️⃣ | The receiver decrypts it with a secret key | (Plaintext restored) |
+
+Without the right **key**, the message is meaningless, that’s the power of encryption.
+
+---
+
+## Types of Cryptography
+
+There are **two main types** of cryptography, each with different purposes and use cases.
+
+---
+
+### 1. Symmetric Encryption
+
+In **symmetric encryption**, the **same key** is used to **encrypt and decrypt** data. It’s fast and efficient but risky, because if the key is leaked, the attacker can decrypt everything.
+
+**Example:**
+* Algorithms: **AES**, **DES**, **Blowfish**
+* Real-life use: Encrypting files on your computer
+
+```
+Sender and Receiver share one secret key.
+```
+
+| Pros | Cons |
+|------|------|
+| Fast and efficient | Key sharing is risky |
+| Works well for large data | Less secure if key is exposed |
+
+---
+
+### 2. Asymmetric Encryption
+
+In **asymmetric encryption**, two keys are used:
+* **Public Key:** Shared openly
+* **Private Key:** Kept secret
+
+Whatever is encrypted with one key can only be decrypted by the other.
+
+**Example:**
+- Algorithms: **RSA**, **ECC**
+- Real-life use: HTTPS websites, emails, digital signatures
+
+```
+Public Key → Encrypts message
+Private Key → Decrypts message
+```
+
+| Pros | Cons |
+|------|------|
+| More secure (no key sharing needed) | Slower than symmetric |
+| Perfect for communication over the internet | Complex to manage |
+
+---
+
+## Example: How Encryption Works on WhatsApp
+
+When you send a message on **WhatsApp**, it uses **end-to-end encryption**:
+* Your device encrypts the message before sending it.
+* Only the recipient’s private key can decrypt it.
+* Even WhatsApp itself can’t read your chat.
+
+So even if a hacker intercepts your message, they’ll only see scrambled data like:
+
+```
+@2h1Lx9!d0eP#rW8Z
+```
+
+That’s encryption in action, invisible but powerful.
+
+---
+
+## Common Encryption Algorithms
+
+| Algorithm | Type | Purpose | Notes |
+|------------|------|----------|--------|
+| **AES (Advanced Encryption Standard)** | Symmetric | File & data encryption | Very secure and widely used |
+| **DES (Data Encryption Standard)** | Symmetric | Legacy encryption | Now outdated due to weaknesses |
+| **RSA** | Asymmetric | Secure key exchange & authentication | Used in HTTPS and emails |
+| **ECC (Elliptic Curve Cryptography)** | Asymmetric | Modern lightweight encryption | Used in mobile & IoT devices |
+| **SHA (Secure Hash Algorithm)** | Hashing | Ensures integrity | Used in passwords & digital signatures |
+
+---
+
+## Cryptography in Everyday Life
+
+You use cryptography *every single day* — often without realizing it.
+
+| Situation | Technology Used |
+|------------|-----------------|
+| Logging into Gmail | SSL/TLS encryption |
+| Online payments | RSA + AES |
+| Saving passwords | Hashing (SHA/Bcrypt) |
+| Sending messages on WhatsApp | End-to-end encryption |
+| Accessing websites (HTTPS) | Digital certificates |
+
+Without cryptography, modern life would be *wide open* to cyberattacks.
+
+---
+
+## Hashing vs Encryption
+
+These two terms often get mixed up — but they’re very different.
+
+| Feature | Encryption | Hashing |
+|----------|-------------|----------|
+| Purpose | Hide data but make it reversible | Verify data integrity (one-way) |
+| Reversible? | Yes (with key) | No |
+| Example | AES, RSA | SHA-256, MD5 |
+| Common Use | Messaging, data transfer | Password storage |
+
+> Hashing is like sealing a fingerprint — you can verify it but never reverse it.
+
+---
+
+## Digital Signatures
+
+A **digital signature** ensures that a message hasn’t been changed and confirms the sender’s identity.
+
+It’s widely used in:
+* Email verification
+* Document signing (like PDFs)
+* Software authenticity (you’ve seen “Verified Publisher” in installers)
+
+It combines hashing and encryption to provide **authenticity + integrity**.
+
+---
+
+## Real-Life Example: HTTPS
+
+When you visit a website with **HTTPS**:
+1. Your browser checks the site’s **digital certificate**.  
+2. It uses **asymmetric encryption (RSA)** to exchange keys.  
+3. Then switches to **symmetric encryption (AES)** for fast data transfer.
+
+That’s how your data (like login credentials or credit card info) stays safe online.
+
+---
+
+## Summary
+
+Let’s recap what we learned:
+
+* Cryptography protects digital information from unauthorized access.  
+* Encryption transforms data into unreadable code using keys.  
+* Two main types — **Symmetric** (same key) and **Asymmetric** (public/private keys).  
+* Hashing ensures integrity but is irreversible.  
+* Cryptography powers everything from WhatsApp to online banking.
+
+---
+
+## What’s Next
+
+In the next tutorial, you’ll explore **Ethical Hacking & Cyber Defense** — how experts use hacking techniques *for good* to strengthen systems.
+
+> Continue learning: [Ethical Hacking & Cyber Defense ›](./ethical-hacking-and-cyber-defense.mdx)
\ No newline at end of file
diff --git a/docs/cybersecurity/cybersecurity-tools.mdx b/docs/cybersecurity/cybersecurity-tools.mdx
new file mode 100644
index 0000000..d01a307
--- /dev/null
+++ b/docs/cybersecurity/cybersecurity-tools.mdx
@@ -0,0 +1,283 @@
+---
+title: "Cybersecurity Tools"
+description: "Explore the essential tools used by cybersecurity professionals for scanning, testing, monitoring, and securing systems."
+tags: [cybersecurity, tools, ethical-hacking, network-security, penetration-testing]
+---
+
+In the world of **Cybersecurity**, the right tools can make the difference between **detecting an attack early** and **falling victim to it**. Professionals rely on specialized software to analyze, test, and protect systems from potential threats.
+
+This guide introduces you to the most popular and effective cybersecurity tools, grouped by their core purpose, so you can understand what each one does and why it’s used.
+
+---
+
+## 🕵️1. Network Scanning & Analysis Tools
+
+These tools help you **discover devices**, **analyze traffic**, and **identify vulnerabilities** in a network.
+
+### Nmap (Network Mapper)
+> *The Swiss Army knife of network scanning.*
+
+* Used to scan networks, find open ports, detect services, and identify operating systems.
+* Great for reconnaissance and vulnerability assessment.
+
+**Example usage:**
+
+```bash
+nmap -sV 192.168.1.1
+```
+
+👉 This command scans a system to find running services and their versions.
+
+---
+
+### Wireshark
+
+> *The most powerful packet analyzer.*
+
+* Captures and inspects network traffic in real-time.
+* Helps you understand what data is moving through your network.
+* Often used to detect suspicious activities or data leaks.
+
+**Use Case:**
+When analyzing network intrusions, Wireshark helps identify abnormal packets or malicious communication patterns.
+
+---
+
+### Angry IP Scanner
+
+> *A simple and fast IP address scanner.*
+
+* Lightweight and beginner-friendly.
+* Scans IP ranges and ports quickly.
+* Useful for identifying connected devices within a local network.
+
+---
+
+## 2. Vulnerability Assessment Tools
+
+These tools help identify weaknesses before attackers do.
+
+### **OpenVAS**
+
+> *An open-source vulnerability scanning system.*
+
+* Scans for thousands of known vulnerabilities.
+* Generates detailed reports and risk scores.
+* Useful for network admins and security auditors.
+
+---
+
+### Nessus
+
+> *One of the most widely used vulnerability scanners.*
+
+* Detects misconfigurations, missing patches, and software vulnerabilities.
+* Provides remediation suggestions.
+* Used by both enterprises and individual ethical hackers.
+
+---
+
+## 3. Penetration Testing & Exploitation Frameworks
+
+Used by ethical hackers to simulate attacks and test system defenses.
+
+### Metasploit Framework
+
+> *The ultimate toolkit for ethical hacking.*
+
+* Allows you to exploit vulnerabilities in a controlled environment.
+* Includes hundreds of pre-built exploits and payloads.
+* Ideal for penetration testing, learning exploitation techniques, and testing patch effectiveness.
+
+**Example workflow:**
+
+1. Identify a vulnerability.
+2. Use a Metasploit module to exploit it.
+3. Gain controlled access (for testing and reporting).
+
+---
+
+### Burp Suite
+
+> *The hacker’s browser companion.*
+
+* Focuses on **Web Application Security**.
+* Intercepts HTTP requests and responses.
+* Useful for finding vulnerabilities like XSS, SQL Injection, and CSRF.
+
+**Burp Suite Editions:**
+
+* 🧩 Community (Free)
+* ⚙️ Professional (Paid, used in bug bounty and enterprise testing)
+
+---
+
+### Aircrack-ng
+
+> *The go-to suite for Wi-Fi network testing.*
+
+* Used to crack Wi-Fi passwords and test wireless encryption.
+* Supports packet capture, replay attacks, and WEP/WPA/WPA2 analysis.
+
+**Note:** Always test *only* on networks you own or have permission to test.
+
+---
+
+## 4. Monitoring & Intrusion Detection Tools
+
+Used for continuous observation and alerting of suspicious network activity.
+
+### Snort
+
+> *A powerful open-source intrusion detection and prevention system.*
+
+* Monitors network traffic for suspicious patterns.
+* Can block or alert admins of malicious packets.
+* Maintained by Cisco.
+
+---
+
+### Suricata
+
+> *An advanced network threat detection engine.*
+
+* Similar to Snort but supports multi-threading for better performance.
+* Detects intrusions, logs network events, and monitors traffic in real-time.
+
+---
+
+### OSSEC
+
+> *Host-based Intrusion Detection System (HIDS).*
+
+* Monitors system logs, file changes, and rootkit attempts.
+* Sends alerts for unauthorized activities.
+* Works on Windows, Linux, and macOS.
+
+---
+
+## 5. Password Cracking & Security Tools
+
+These tools are used by ethical hackers to **test password strength** and recover lost credentials.
+
+### John the Ripper
+
+> *A fast password cracking tool.*
+
+* Tests password strength by using dictionary and brute-force attacks.
+* Commonly used in penetration tests to identify weak credentials.
+
+---
+
+### Hydra
+
+> *Network login cracker.*
+
+* Supports various protocols like FTP, SSH, HTTP, and SMB.
+* Useful for testing login systems for brute-force vulnerabilities.
+
+---
+
+### Hashcat
+
+> *One of the fastest and most advanced password recovery tools.*
+
+* GPU-accelerated for high-speed cracking.
+* Supports various hash types (MD5, SHA, bcrypt, etc.).
+* Often used in digital forensics and penetration testing.
+
+---
+
+## 6. Security & SIEM Platforms
+
+Used by enterprises to **collect, analyze, and respond to security events**.
+
+### Splunk
+
+> *Data-driven security monitoring platform.*
+
+* Collects and analyzes logs from multiple systems.
+* Provides real-time dashboards and alerts.
+* Commonly used in Security Operations Centers (SOCs).
+
+---
+
+### ELK Stack (Elasticsearch, Logstash, Kibana)
+
+> *Open-source alternative to Splunk.*
+
+* Elasticsearch: Stores and searches logs.
+* Logstash: Collects and processes logs.
+* Kibana: Visualizes data through dashboards.
+
+Together, they form a robust solution for **log management and security analytics**.
+
+---
+
+## 7. Digital Forensics & Incident Response (DFIR)
+
+Used to **analyze breaches**, **gather evidence**, and **recover data** after an attack.
+
+### Autopsy
+
+> *A digital forensics platform.*
+
+* Recovers deleted files, analyzes drives, and investigates breaches.
+* Often used by law enforcement and cybersecurity experts.
+
+---
+
+### Volatility
+
+> *Memory forensics framework.*
+
+* Analyzes RAM dumps to identify malware, hidden processes, and active network connections.
+* Useful for post-incident investigations.
+
+---
+
+## 8. Encryption & Privacy Tools
+
+Protect sensitive data and communication from unauthorized access.
+
+### VeraCrypt
+
+> *Secure encryption for files and drives.*
+
+* Creates encrypted volumes to protect confidential data.
+* Simple UI — great for beginners and professionals alike.
+
+---
+
+### Tor Browser
+
+> *Browse the web anonymously.*
+
+* Routes traffic through multiple servers to hide your identity.
+* Used for privacy-focused browsing and security research.
+
+---
+
+## Summary
+
+| Category               | Key Tools                | Purpose                      |
+| ---------------------- | ------------------------ | ---------------------------- |
+| Network Analysis       | Nmap, Wireshark          | Discover and inspect traffic |
+| Vulnerability Scanning | OpenVAS, Nessus          | Detect system weaknesses     |
+| Penetration Testing    | Metasploit, Burp Suite   | Simulate attacks             |
+| Intrusion Detection    | Snort, Suricata          | Monitor and alert            |
+| Password Testing       | John the Ripper, Hashcat | Assess credential security   |
+| Forensics              | Autopsy, Volatility      | Investigate incidents        |
+| Encryption             | VeraCrypt, Tor           | Protect and anonymize data   |
+
+---
+
+## Final Thoughts
+
+Cybersecurity tools are powerful allies — but remember, **tools don’t make you a professional**.
+Understanding *how and why* to use them responsibly is what truly matters.
+
+> “A skilled security professional isn’t defined by the tools they use,
+> but by the way they think.”
+
+So, explore, experiment, and practice — always with ethics and permission.
\ No newline at end of file
diff --git a/docs/cybersecurity/dark-web.mdx b/docs/cybersecurity/dark-web.mdx
new file mode 100644
index 0000000..a14747c
--- /dev/null
+++ b/docs/cybersecurity/dark-web.mdx
@@ -0,0 +1,139 @@
+---
+title: "The Dark Web"
+description: "Understand what the Dark Web really is, how it differs from the surface and deep web, common uses (both legitimate and criminal), risks, legal/ethical considerations, and safe ways to learn more without crossing lines."
+tags: [cybersecurity, privacy, dark-web, ethics, osint]
+---
+
+The term *dark web* carries a lot of drama: shadowy markets, hackers in hoodies, and illicit deals. While the headlines often focus on the worst cases, the truth is more nuanced. The dark web is a technical layer of the internet with both legitimate and illegal uses, and understanding that difference is essential if you want to study it responsibly.
+
+This guide explains what the dark web actually is, how it differs from the surface and deep web, common use cases, the real risks involved, and, importantly, how to **learn about it safely and legally**.
+
+---
+
+## Surface Web vs Deep Web vs Dark Web — what’s the difference?
+
+* **Surface Web**: The websites indexed by search engines (Google, Bing). Public pages, blogs, news sites — everything you visit normally.
+* **Deep Web**: Content that is *not* indexed by search engines. This includes private databases, webmail, bank accounts, internal company portals, and content behind logins. Most of the web is "deep" — perfectly legal and ordinary.
+* **Dark Web**: A small portion of the deep web that requires special software or configurations to reach (for example, services reachable over anonymizing networks). Dark web sites commonly use alternate address systems and are intentionally hidden from standard search engines.
+
+> Short version: the surface web is public, the deep web is private but usually legitimate, and the dark web is hidden by design, sometimes for privacy, sometimes for illegal activity.
+
+---
+
+## How is the dark web accessed? (High-level explanation)
+
+Dark web resources are typically hosted on networks that provide strong privacy and anonymity features. The most well-known is the **Tor network** (The Onion Router), which routes traffic through multiple volunteer-run relays to obscure the origin and destination of traffic. Sites hosted on Tor use special addresses (often called “.onion” addresses).
+
+:::warning Important
+This is a **high-level overview**, not a how-to. There is a difference between understanding a technology and using it for harmful or illegal behavior. If your goal is research or learning, focus on reputable academic work and legal, safe labs.
+:::
+
+---
+
+## Legitimate uses of the dark web
+
+Not everything on the dark web is criminal. Some legitimate and important uses include:
+
+* **Journalism & whistleblowing** — Platforms that allow sources to report securely to journalists.  
+* **Privacy-preserving access** — Activists, dissidents, or people in censored countries sometimes use anonymizing networks to access information or communicate safely.  
+* **Research** — Academics and security researchers study hidden services to understand threats and improve defenses.  
+* **Secure publishing** — Organizations may publish content in a way that resists censorship or tampering.
+
+---
+
+## Criminal misuse and common threats
+
+Many of the sensational stories about the dark web focus on criminal marketplaces, stolen data, malware-as-a-service, or fraud. Common illegal activities linked to hidden services include:
+
+* Buying or selling stolen personal data or credentials  
+* Illegal drug or weapons marketplaces  
+* Trading malware, hacking tools, or botnets  
+* Fraudulent financial schemes and money laundering
+
+Because of these risks, people who interact with such services, even naively, can become targets for scams, malware, or legal trouble.
+
+---
+
+## Risks you should know about
+
+* **Legal risk**: Visiting or interacting with illegal marketplaces, downloading certain content, or participating in transactions can lead to criminal charges. Laws vary by country — ignorance is rarely a defense.
+* **Security risk**: Hidden services are frequently used to distribute malware. Clicking unknown links or downloading files can compromise your system.
+* **Privacy illusions**: While networks like Tor provide anonymity tools, they are not magic. Misconfiguration, browser vulnerabilities, downloads, or operational mistakes can deanonymize users.
+* **Scams and fraud**: Many listings are fraudulent; payments are irreversible and often tracked by investigators or criminals.
+
+---
+
+## Ethics and legal guidance, the right way to learn
+
+If your interest is academic, defensive, or journalistic, follow these principles:
+
+1. **Stay legal.** Never attempt to buy or sell illegal goods, access stolen data, or participate in criminal activity.  
+2. **Document responsibly.** If you conduct research, protect your data, follow institutional review guidelines, and avoid exposing innocent people's information.  
+3. **Prioritize safety.** Use controlled, isolated environments (virtual machines, lab networks) when working with suspicious files or datasets, and only under clear legal and ethical boundaries.  
+4. **Learn from reputable sources.** Read peer-reviewed research, law enforcement whitepapers, and university materials rather than relying solely on forum posts or sensational articles.
+
+If you’re unsure about whether an activity crosses a legal boundary, ask a mentor, a qualified lawyer, or your institution’s ethics review board.
+
+---
+
+## How researchers and defenders study the dark web (safely)
+
+Security researchers and defenders gather intelligence about hidden services to improve protections. Common, safe research methods include:
+
+* **Reading academic papers and published reports** from universities, security firms, or government agencies.  
+* **Using public datasets** and sanitized datasets released by researchers.  
+* **Simulating attacks in an isolated lab** (air-gapped or virtualized) under clear legal authority and with no real victims.  
+* **Collaborating with law enforcement or experienced research groups** when investigations require operational reach beyond the lab.
+
+These approaches let you learn how threats operate without engaging in or enabling criminal activity.
+
+---
+
+## Practical, safe learning alternatives
+
+If you're curious about the dark web for defensive or research purposes, try these legal and constructive paths:
+
+* Study **Tor’s design and research papers** to understand anonymizing routing and privacy trade-offs.  
+* Explore **Open Source Intelligence (OSINT)** techniques on the surface and deep web — a lot can be learned without touching hidden services.  
+* Take courses on **digital forensics**, **threat intelligence**, and **malware analysis** that teach safe lab practices.  
+* Read law enforcement or security company **threat reports** that summarize trends and defenses.  
+* Build defensive skills: network monitoring, intrusion detection, secure coding, and incident response.
+
+These options give you practical skills while keeping you on the right side of the law.
+
+---
+
+## Practical precautions (for researchers & students)
+
+If your work involves suspicious content or threat research, follow these precautions:
+
+* Use **isolated virtual machines** (snapshots, no personal data) for analysis.  
+* Do not use personal accounts, emails, or devices for research.  
+* Keep all research under an **institutional or legal framework** (supervisors, legal counsel).  
+* Avoid engaging in transactions or communication that could be illegal or incriminating.  
+* Be transparent with your supervisors and, if required, coordinate with law enforcement when you uncover criminal activity.
+
+---
+
+## Law enforcement and takedowns
+
+Law enforcement agencies worldwide monitor criminal activity on hidden services and sometimes conduct investigations or takedowns. These operations can involve technical measures, legal processes, and international cooperation. Remember: just because content is hidden does not mean it is outside legal reach.
+
+---
+
+## Recommended reading & resources (safe, non-operational)
+
+* Academic papers on anonymizing networks and Tor architecture  
+* Security company reports on cybercrime trends and darknet marketplaces  
+* OSINT tutorials and threat intelligence blogs  
+* Certifications and courses: digital forensics, incident response, and threat intelligence tracks
+
+(If you want, I can list specific, reputable papers and reports next — no how-to guides, only educational sources.)
+
+---
+
+## 🔚 Final thoughts
+
+The dark web is a complex, technically fascinating space. It supports valuable privacy tools for vulnerable people while also enabling criminal markets and harmful activity. If you’re studying the dark web, do so with responsibility, strict safety measures, and a legal/ethical mindset.
+
+> Curiosity is a great trait for a security professional — pair it with responsibility, and you’ll learn a lot without crossing dangerous lines.
diff --git a/docs/cybersecurity/ethical-hacking-and-cyber-defense.mdx b/docs/cybersecurity/ethical-hacking-and-cyber-defense.mdx
new file mode 100644
index 0000000..906e093
--- /dev/null
+++ b/docs/cybersecurity/ethical-hacking-and-cyber-defense.mdx
@@ -0,0 +1,170 @@
+---
+title: "Ethical Hacking & Cyber Defense"
+description: "Learn ethical hacking techniques, the penetration testing lifecycle, common tools, and defensive strategies to harden systems and respond to attacks."
+tags: [cybersecurity, ethical-hacking, penetration-testing, defense]
+---
+
+Ethical hacking is the practice of intentionally testing systems, networks, and applications to find security weaknesses, but with permission and the goal of improving security. Think of ethical hackers as professional testers: they try to break things so owners can fix them before a real attacker shows up.
+
+This tutorial teaches a practical, responsible approach to offensive security (testing) and defensive security (hardening and response). You’ll learn the standard testing workflow, useful tools, how defenders think, and — importantly — the ethics and legal rules that must guide every test.
+
+---
+
+## Ethics & Legal Boundaries — Read This First
+
+Before you run any tests, remember:
+* **Always get explicit written permission** from the owner of the system.  
+* Only test **within the agreed scope** (specific hosts, apps, time windows).  
+* Maintain **confidentiality** of any sensitive data you find.  
+* Report issues **responsibly and promptly** — provide remediation steps.  
+* Never exploit discovered vulnerabilities for personal gain or to harm others.
+
+If you’re practicing, use intentionally vulnerable labs (DVWA, WebGoat, Hack The Box, local VMs), do **not** test random live sites or networks.
+
+---
+
+## The Penetration Testing (Pentest) Lifecycle
+
+A pentest is usually organized into clear phases. Each phase has goals, techniques, and deliverables.
+
+### 1. Reconnaissance (Passive & Active)
+* **Goal:** Gather information about the target without alerting defenders (passive) and then with direct queries (active).  
+* **Passive techniques:** Public records, WHOIS, search engines, social media, public repos.  
+* **Active techniques:** pings, banner grabs, DNS enumeration.
+
+> Deliverable: Asset list, IP ranges, domain names, public-facing services.
+
+### 2. Scanning & Enumeration
+* **Goal:** Discover live hosts, open ports, services, and versions.  
+* **Techniques:** Port scanning, service/version detection, directory brute-forcing.  
+* **What you learn:** Which services are exposed, outdated software, misconfigurations.
+
+> Deliverable: Scan results, list of vulnerable services to test.
+
+### 3. Exploitation (Gaining Access)
+* **Goal:** Validate vulnerabilities by gaining access or demonstrating exploitability.  
+* **Techniques:** Exploit chains, SQL injection, command injection, misconfigured services, weak credentials.  
+* **Note:** Always follow the rules of engagement — do minimal disruptive actions unless agreed otherwise.
+
+> Deliverable: Proof-of-concept (screenshots, safe logs) showing where/how access was gained.
+
+### 4. Post-Exploitation (Privilege Escalation & Lateral Movement)
+* **Goal:** Determine impact: can an attacker move to other systems, access sensitive data, or maintain persistence?  
+* **Techniques:** Credential harvesting, privilege escalation, pivoting to internal networks.
+
+> Deliverable: Impact analysis (what an attacker could reach) and recommended containment.
+
+### 5. Reporting & Remediation
+* **Goal:** Deliver a clear, prioritized report with evidence and recommended fixes.  
+* Reports should include: Executive summary, technical findings, risk ratings, reproducible steps, remediation guidance, and proof the issue was addressed (if re-tested).
+
+---
+
+## Common Tools (and what they’re used for)
+
+These are standard tools you’ll see in many labs and real-world engagements:
+
+* **Nmap** — network discovery & port scanning.  
+* **Wireshark** — packet capture and analysis.  
+* **Burp Suite** — web application testing and proxy for intercepting traffic.  
+* **OWASP ZAP** — free web-app scanner/proxy.  
+* **Metasploit** — exploitation framework and payload delivery.  
+* **Nikto** — web server scanner for common misconfigurations.  
+* **John the Ripper / Hashcat** — password cracking and hash analysis.  
+* **Netcat** — simple TCP/UDP connections and listeners.  
+* **SQLmap** — automated SQL injection testing.  
+* **Atom/VSCode, curl, telnet, openssl** — utility tools useful in many steps.
+
+:::tip
+Learn one tool well (e.g., Nmap or Burp), then expand. Tools are helpers — the skill is understanding what the tool output means.
+:::
+
+---
+
+## Hands-On Labs & Safe Exercises
+
+Use deliberately vulnerable environments or isolated labs to practice these exercises.
+
+### Lab 1 — Recon & Scanning (Safe VM)
+1. Setup: Provision two VMs on a local network (Attacker + Target).  
+2. Run Nmap from the attacker: `nmap -sC -sV -oN scan.txt <target-ip>`  
+3. Analyze open ports and service versions. Document findings.
+
+**Goal:** Identify services that can be tested further.
+
+### Lab 2 — Web App Assessment (Local DVWA or WebGoat)
+1. Configure your browser proxy (Burp Suite or OWASP ZAP).  
+2. Intercept a login request and attempt input tampering (SQLi patterns).  
+3. Use a safe payload in a test environment to confirm vulnerability.
+
+**Goal:** Understand how input handling leads to vulnerabilities and how interception works.
+
+### Lab 3 — Password Cracking (Local Hashes)
+1. Create a known password hash (bcrypt/sha256) in a test file.  
+2. Use John the Ripper or Hashcat to run a dictionary attack.
+3. Analyze how strong passwords slow down attacks.
+
+**Goal:** Appreciate password strength and the value of hashing + salt.
+
+### Lab 4 — Packet Analysis (Wireshark)
+1. Capture traffic over an isolated network with and without TLS.  
+2. Observe differences between HTTP and HTTPS payloads.  
+3. Identify sensitive information leaking in plaintext.
+
+**Goal:** See the real impact of unencrypted traffic.
+
+---
+
+## Defensive Techniques — What Organizations Should Do
+
+Understanding attacks helps defenders design better systems. Here are practical defenses:
+
+* **Patch Management:** Keep software and firmware updated. Many breaches start with known, unpatched vulnerabilities.  
+* **Least Privilege:** Limit user permissions to only what’s necessary. Reduce blast radius.  
+* **Multi-Factor Authentication (MFA):** Add a second factor beyond passwords to prevent credential misuse.  
+* **Secure Development Lifecycle (SDLC):** Integrate security checks (SAST/DAST) into development and CI/CD pipelines.  
+* **Web Application Firewall (WAF):** Block common web-based attacks like SQLi and XSS at the edge.  
+* **Network Segmentation:** Isolate critical systems so attackers can’t easily move laterally.  
+* **Intrusion Detection/Prevention:** Monitor for suspicious behavior and act quickly.  
+* **Backup & Recovery:** Regular offline backups, tested restores, and ransomware plans.  
+* **Training & Awareness:** Teach staff about phishing, social engineering, and secure behavior.  
+* **Logging & Monitoring:** Centralize logs, use SIEM, and set alerts for anomalous activities.
+
+---
+
+## Reporting: The Most Important Deliverable
+
+A clear report turns technical findings into business value. Include:
+- **Executive summary** (non-technical): What happened and business impact.  
+- **Technical details**: Steps to reproduce, evidence, and affected assets.  
+- **Risk rating & prioritization**: Which issues must be fixed first.  
+- **Remediation steps**: Concrete fixes and code/configuration examples.  
+- **Re-test plan**: How you’ll verify that issues were fixed.
+
+A good report helps engineers fix issues and helps leadership make informed decisions.
+
+---
+
+## Career Paths & Certifications (brief)
+
+Ethical hacking and cyber defense have several career paths:
+* **Penetration Tester / Red Team** — offensive testing.  
+* **Security Analyst / Blue Team** — detection and response.  
+* **Application Security (AppSec)** — secure development and code review.  
+* **Security Engineer / Architect** — design defensive systems.
+
+Certifications (e.g., CEH, OSCP, CISSP) help structure learning and prove skills, but hands-on practice matters most.
+
+---
+
+## Final Notes & Mindset
+
+Ethical hacking is about **curiosity, method, and responsibility**.  
+Two final reminders:
+
+1. **Be curious but lawful.** Curiosity opens doors — legality keeps you out of trouble.  
+2. **Report what you find, don’t exploit it.** The goal is to improve security, not to brag.
+
+If you’d like, I can:
+* Provide a ready-made lab setup script (VM/Docker) for these exercises, or  
+* Generate step-by-step Burp Suite and Nmap playbooks you can paste and run in a safe lab.
diff --git a/docs/cybersecurity/ethical-hacking-basics.mdx b/docs/cybersecurity/ethical-hacking-basics.mdx
new file mode 100644
index 0000000..f445c02
--- /dev/null
+++ b/docs/cybersecurity/ethical-hacking-basics.mdx
@@ -0,0 +1,185 @@
+---
+title: "Ethical Hacking Basics"
+description: "Learn the mindset, methodology, and safe tools ethical hackers use to find and fix security weaknesses—always in a controlled, authorized environment."
+tags: [cybersecurity, ethical-hacking, pentest, hands-on]
+---
+
+Ethical hacking is the practice of legally and responsibly probing systems to find security weaknesses **before** malicious actors do. Think of it as authorized stress-testing: you look for problems, then report and help fix them.
+
+This tutorial introduces the ethical hacker mindset, the typical testing workflow, common tools, how to build a safe lab, and beginner-friendly exercises — all with a strong focus on legality and responsibility.
+
+---
+
+## Who is an Ethical Hacker?
+
+An **ethical hacker** (also called a penetration tester or security researcher) is someone who uses hacking techniques with permission to:
+- Discover vulnerabilities in systems, applications, or networks  
+- Demonstrate the impact of those vulnerabilities safely  
+- Provide practical remediation and recommendations
+
+Ethical hackers wear many hats: detective, developer, systems engineer, and — importantly — communicator. Delivering a clear, prioritized report is as vital as finding the issue.
+
+---
+
+## ⚖️ Ethics & Legal Ground Rules (Read this first)
+
+Before you touch any tool or target, these are non-negotiable:
+
+- **Only test systems you own or have explicit written permission to test.**  
+- **Don’t exploit bugs in production systems without authorization.** A vulnerability proof-of-concept on a live customer system can cause outages and legal trouble.  
+- **Follow responsible disclosure policies**: report findings to the owner, give them time to fix, and coordinate public disclosure if applicable.  
+- **Keep data safe**: never exfiltrate or publish sensitive data encountered during testing.
+
+If you want real-world experience, use purpose-built labs (see the Lab Setup section below) or join bug bounty programs that explicitly authorize testing.
+
+---
+
+## 🧭 Pentest Methodology — the typical lifecycle
+
+Ethical hacking follows a repeatable lifecycle. Learn this like a recipe — you’ll reuse it for web apps, networks, and cloud environments.
+
+1. **Scope & Rules of Engagement**  
+   Define what systems, IPs, domains, and time windows are in scope. Get written authorization.
+
+2. **Reconnaissance (Passive & Active)**  
+   Collect public information: domain names, IP ranges, employee emails, open ports. Passive recon avoids directly touching the target; active recon uses scans (only when authorized).
+
+3. **Scanning & Enumeration**  
+   Identify open ports, services, versions, and reachable endpoints. Map assets and running software.
+
+4. **Vulnerability Analysis**  
+   Correlate discovered services with known vulnerabilities and misconfigurations.
+
+5. **Exploitation (Controlled)**  
+   Attempt to confirm vulnerabilities in a way that minimizes risk — typically in a lab or with explicit permission. The goal is *proof*, not destruction.
+
+6. **Post-Exploitation & Pivoting**  
+   If exploitation succeeds, analyze impact: what can an attacker access? Could they escalate privileges or move laterally?
+
+7. **Reporting & Remediation**  
+   Write an actionable report: findings, risk levels, reproduction steps (safe), and prioritized fixes. Work with the owner to validate remediations.
+
+8. **Retest**  
+   Confirm fixes are effective.
+
+---
+
+## 🧰 Common Tools (what ethical hackers use)
+
+Below are the everyday tools you’ll learn to use. Use them only in authorized environments.
+
+- **Nmap** — port scanning & service discovery (first step in enumeration).  
+  Example (for a lab machine): `nmap -sV -p- 192.168.56.101`
+
+- **Wireshark** — packet capture and protocol analysis (learn how protocols look on the wire).
+
+- **Burp Suite** — web application proxy for inspecting and manipulating HTTP(S) traffic.
+
+- **Metasploit Framework** — exploitation framework and payload testing (use in lab only).
+
+- **Nikto / OpenVAS / Nessus** — vulnerability scanning (identify potential issues; validate manually).
+
+- **sqlmap** — automated SQL injection testing (lab-only; focus on learning detection & mitigation).
+
+- **John the Ripper / Hashcat** — password-cracking tools for assessing password strength on hashes you own.
+
+- **OWASP ZAP** — open-source web application scanner & proxy (great beginner tool).
+
+This is not an exhaustive list — as you learn you’ll choose tools that fit the target and your workflow.
+
+---
+
+## 🧪 Lab Setup — a safe place to practice
+
+Never test on production. Build a sandbox using local virtual machines or cloud VMs you own.
+
+Minimal lab components:
+- **Host machine**: your laptop/desktop. Use snapshots so you can revert.
+- **Virtualization**: VirtualBox or VMware Workstation Player.
+- **Attacker machine**: Kali Linux or any distro with pentest tools.
+- **Victim machines/apps** (intentionally vulnerable):
+  - Metasploitable (legacy but instructive)
+  - OWASP Juice Shop (modern, web-app focused)
+  - DVWA (Damn Vulnerable Web App) for SQL/XSS practice
+  - Custom vulnerable containers or intentionally misconfigured VMs
+
+Keep your lab isolated from your home/office network (use host-only or internal network modes), so your testing can’t accidentally touch other devices.
+
+---
+
+## ✅ Practical, safe exercises (beginner → intermediate)
+
+Each exercise should be done in your lab and accompanied by notes you’ll later use in a report.
+
+1. **Reconnaissance & Footprinting**
+   - Identify hosts and services on an isolated network using `nmap`.
+   - Collect banner info and note service versions.
+
+2. **Web App Mapping with Burp**
+   - Proxy a browser through Burp, map all endpoints of the test web app, and identify hidden parameters.
+
+3. **Find a Vulnerability (Discovery)**
+   - Run a scanner (OWASP ZAP or Nikto) against a lab app, then manually verify findings.
+
+4. **Controlled Exploit & Impact Analysis**
+   - In the lab, verify a low-risk vulnerability and document safe proof-of-concept steps. Focus on impact (what data or access is at risk).
+
+5. **Password Policy Check**
+   - Use hash-cracking tools on password hashes in the lab to evaluate password strength and recommend improvements.
+
+6. **Write a Short Report**
+   - For one finding, write a concise report: summary, technical details, risk level, reproduction steps (safe), remediation steps, and suggested timeline.
+
+---
+
+## 🛡️ Defensive & Remediation Mindset
+
+Ethical hacking is not just about finding issues — it’s about enabling fixes. When you find problems, think like a defender:
+
+- What simple configuration change would block this attack?
+- Can the vulnerability be mitigated by patching, or does it require code changes?
+- What monitoring/alerts would detect exploitation attempts?
+- What’s the least disruptive patch schedule for production systems?
+
+Good remediation guidance is specific, prioritized, and cost-aware.
+
+---
+
+## 🧾 Reporting — your most important deliverable
+
+A good pentest report contains:
+- Executive summary (non-technical, risk-focused)  
+- Technical details (reproduction steps, evidence, affected assets)  
+- Risk rating (e.g., High / Medium / Low) and business impact  
+- Concrete remediation steps and suggested testing after fixes  
+- Appendix with raw logs or screenshots (sanitized if needed)
+
+Practice writing clear, usable reports — your findings are only valuable if the owner can act on them.
+
+---
+
+## 🧭 Career & Next Steps
+
+If you enjoy this path, consider:
+- Learning deeper tools and platform-specific testing (cloud, mobile).  
+- Studying relevant certifications (e.g., OSCP, CEH, CompTIA PenTest+) when you have hands-on practice.  
+- Contributing to open-source security projects or building your own test cases and labs.
+
+Remember: curiosity + discipline + ethics = great security work.
+
+---
+
+## ⚠️ Final Warning (again): Be Responsible
+
+Ethical hacking is powerful. Always:
+- Get permission in writing before testing any system you don’t own.  
+- Use controlled labs for learning.  
+- Respect data privacy and follow responsible disclosure processes.
+
+---
+
+### ▶️ Next:
+→ [Cybersecurity Tools ›](./cybersecurity-tools.mdx)
+```
+
+Would you like me to convert any of the hands-on exercises into step-by-step lab guides (with safe, lab-only commands and screenshots) you can drop directly into the `projects/` folder?
diff --git a/docs/cybersecurity/incident-response.mdx b/docs/cybersecurity/incident-response.mdx
new file mode 100644
index 0000000..b44a4c4
--- /dev/null
+++ b/docs/cybersecurity/incident-response.mdx
@@ -0,0 +1,216 @@
+---
+title: "Incident Response"
+description: "Learn how cybersecurity professionals detect, respond to, and recover from security incidents through structured response frameworks and real-world practices."
+tags: [cybersecurity, incident-response, DFIR, SOC, security-operations]
+---
+
+No matter how secure a system is, **cyber incidents can still happen**. What matters most is **how quickly and effectively** you respond. Incident Response (IR) is the **organized process** of detecting, investigating, containing, and recovering from security threats or breaches. It’s about turning chaos into control — minimizing damage and restoring trust.
+
+---
+
+## What Is Incident Response?
+
+In simple terms, **Incident Response (IR)** is the set of actions taken to **identify, manage, and mitigate the impact of a cybersecurity incident**.
+
+Think of it like a fire drill — when a security "fire" breaks out, you need a clear plan to:
+1. Identify what’s happening  
+2. Contain the spread  
+3. Eliminate the cause  
+4. Recover systems safely  
+
+IR ensures that security events don’t turn into full-blown disasters.
+
+---
+
+## Why Incident Response Matters
+
+Here’s why IR is a **critical part of every cybersecurity strategy**:
+
+* **Minimizes damage** – Limits data loss and system downtime.  
+* **Identifies root cause** – Helps prevent future incidents.  
+* **Maintains trust** – Shows users and stakeholders that threats are handled professionally.  
+* **Legal compliance** – Many industries (like finance and healthcare) require formal IR procedures.  
+* **Reduces cost** – Quick responses can save millions in breach recovery.
+
+---
+
+## Types of Security Incidents
+
+Not every event is a crisis — but knowing the types helps in prioritizing.
+
+| Type | Description | Example |
+|------|--------------|----------|
+| **Data Breach** | Unauthorized access to confidential data | Stolen customer records |
+| **Malware Infection** | Malicious software infects systems | Ransomware encrypting files |
+| **DDoS Attack** | Overloading servers to crash services | Flooding a website with fake traffic |
+| **Insider Threat** | Malicious or careless employee action | Sharing sensitive info |
+| **System Misconfiguration** | Improper setup leading to exposure | Open S3 buckets or unpatched firewalls |
+
+---
+
+## The Incident Response Lifecycle (NIST Framework)
+
+The **National Institute of Standards and Technology (NIST)** defines a structured 6-phase process for handling incidents effectively:
+
+### 1. **Preparation**
+> Build a defense plan before the attack happens.
+
+* Develop IR policies and communication plans.  
+* Set up monitoring tools (SIEM, IDS/IPS).  
+* Train your team with simulations and tabletop exercises.  
+
+*Key tools:* Splunk, Snort, Suricata, OSSEC, ELK Stack.
+
+---
+
+### 2. **Identification**
+> Detect and confirm that an incident is taking place.
+
+* Monitor alerts, logs, and anomalies.  
+* Determine the scope and severity of the attack.  
+* Ask: *Is this a real threat or a false alarm?*
+
+*Example:* Suspicious outbound traffic from an internal server may indicate a data exfiltration attempt.
+
+---
+
+### 3. **Containment**
+> Stop the attack from spreading further.
+
+Containment can be **short-term** (isolating affected systems) or **long-term** (implementing temporary fixes).
+
+* Disconnect compromised hosts from the network.  
+* Change passwords and revoke access tokens.  
+* Block malicious IPs or domains.
+
+*Goal:* Limit the damage without shutting down everything.
+
+---
+
+### 4. **Eradication**
+> Remove the root cause completely.
+
+* Delete malware, malicious accounts, or unauthorized files.  
+* Patch exploited vulnerabilities.  
+* Strengthen configurations to avoid recurrence.
+
+*Example:* If malware entered through a vulnerable web server, remove it and patch the vulnerability.
+
+---
+
+### 5. **Recovery**
+> Restore systems to normal operations — safely.
+
+* Rebuild or restore from clean backups.  
+* Reconnect systems gradually while monitoring for re-infection.  
+* Verify that normal services and data integrity are restored.
+
+⚙️ *Tip:* Always validate recovery through post-restoration testing.
+
+---
+
+### 6. **Lessons Learned**
+> Reflect, document, and improve.
+
+* Conduct a post-incident review.  
+* Update your playbooks, tools, and training.  
+* Share insights with other teams or organizations (responsibly).
+
+*Every incident is a lesson. Don’t waste it.*
+
+---
+
+## Common Tools Used in Incident Response
+
+| Category | Tools | Purpose |
+|-----------|--------|----------|
+| **Log Analysis** | Splunk, ELK Stack, Graylog | Identify abnormal patterns |
+| **Network Monitoring** | Wireshark, Zeek (Bro), Suricata | Capture and analyze packets |
+| **Endpoint Detection** | OSSEC, CrowdStrike Falcon | Monitor devices for intrusions |
+| **Forensics** | Autopsy, Volatility | Investigate after attacks |
+| **Malware Analysis** | Cuckoo Sandbox, Any.Run | Analyze malicious files |
+| **Automation** | TheHive, Cortex, Shuffle | Speed up response and triage |
+
+---
+
+## Building an Incident Response Team (IRT)
+
+A successful IR plan depends on **people as much as tools**.  
+Here’s what a typical **Incident Response Team (IRT)** looks like:
+
+| Role | Responsibility |
+|------|----------------|
+| **Incident Handler** | Leads investigation and coordinates response |
+| **Forensic Analyst** | Collects and analyzes digital evidence |
+| **Network Engineer** | Contains attacks and restores connectivity |
+| **System Administrator** | Secures and recovers affected systems |
+| **Communications Lead** | Handles internal and external updates |
+| **Legal & Compliance Advisor** | Ensures actions meet laws and regulations |
+
+Each member must know their role *before* an incident happens — not during.
+
+---
+
+## Real-World Example: The SolarWinds Attack (2020)
+
+In late 2020, attackers inserted malicious code into SolarWinds’ software updates.  
+This supply chain attack affected thousands of organizations, including U.S. government agencies.
+
+**What worked:**
+* Rapid detection through anomaly monitoring.  
+* Coordinated multi-agency response.  
+* Transparency and post-incident collaboration.
+
+**What failed:**
+* Lack of multi-layered verification in the software supply chain.  
+
+*Lesson:* Even trusted updates can be compromised — verification and response readiness are essential.
+
+---
+
+## Best Practices for Effective Incident Response
+
+* Create a written **Incident Response Plan (IRP)** and update it regularly.  
+* Conduct **tabletop exercises** — simulate attacks to test readiness.  
+* Implement **continuous monitoring** using SIEM and EDR tools.  
+* Maintain **secure, offline backups** for recovery.  
+* Document every step for legal, technical, and learning purposes.  
+* Always analyze incidents post-resolution — prevention grows from experience.
+
+---
+
+## Incident Response Plan Template
+
+Here’s a simple structure your organization can use:
+
+1. **Overview** — Define objectives and scope.  
+2. **Roles & Responsibilities** — Assign clear tasks to each member.  
+3. **Communication Plan** — Define who to contact and how.  
+4. **Detection Procedures** — Outline log and alert systems.  
+5. **Containment & Recovery Steps** — Document step-by-step actions.  
+6. **Post-Incident Review** — Conduct analysis and update playbooks.
+
+---
+
+## Summary
+
+| Phase | Purpose | Example |
+|--------|----------|----------|
+| Preparation | Build readiness | Train team, configure SIEM |
+| Identification | Detect issues | Analyze alerts and logs |
+| Containment | Limit impact | Isolate infected devices |
+| Eradication | Remove threat | Delete malware, patch flaws |
+| Recovery | Restore safely | Rebuild from clean backups |
+| Lessons Learned | Improve strategy | Update documentation and training |
+
+---
+
+## Final Thoughts
+
+Incident response is not just about reacting — it’s about **being prepared**.  
+The faster you detect, contain, and recover, the less damage you face.
+
+> “Cybersecurity is not about preventing all incidents —  
+> it’s about responding smartly when they happen.”
+
+By mastering IR processes and practicing regularly, you’ll gain the confidence to turn panic into precision during any cyber crisis.
\ No newline at end of file
diff --git a/docs/cybersecurity/index.mdx b/docs/cybersecurity/index.mdx
new file mode 100644
index 0000000..33bd472
--- /dev/null
+++ b/docs/cybersecurity/index.mdx
@@ -0,0 +1,105 @@
+---
+title: "Cyber Security Tutorials"
+description: "Learn Cyber Security from the ground up — from basic concepts and threats to advanced tools, ethical hacking, and best practices."
+tags: [cybersecurity, ethical-hacking, network-security, beginner]
+---
+
+Welcome to the **Cyber Security learning series**, your practical guide to understanding how the digital world stays safe (and how to make it safer). Whether you’re a beginner trying to understand what cyber security really means, or an aspiring ethical hacker looking to sharpen your skills, this section will walk you through everything step by step.
+
+## What Is Cyber Security?
+
+**Cyber Security** is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft. Every time you connect to Wi-Fi, send an email, or make an online payment, you rely on cyber security to keep your data safe.
+
+It’s not just about hacking or coding, it’s about **defense, awareness, and prevention**. Cyber security experts act as digital guardians who identify threats, analyze risks, and build protection mechanisms against cyberattacks.
+
+## Why Cyber Security Matters
+
+We live in a digital-first world. From banking to healthcare, education to entertainment, almost everything is online. That means **our data is valuable**, and attackers constantly look for ways to exploit vulnerabilities.
+
+Cyber Security matters because it:
+
+* **Protects personal and organizational data**
+* **Builds trust** between users and systems
+* **Prevents financial and reputational losses**
+* **Supports global safety and privacy**
+
+Even a small vulnerability, a weak password, a missing software update, or a fake email — can open the door to big problems.
+
+## Core Areas You’ll Learn Here
+
+Our Cyber Security tutorials are designed to take you from fundamentals to real-world applications. Here’s what you’ll explore:
+
+### 1. **Introduction to Cyber Security**
+Understand what cyber security is, its key principles like the CIA Triad (Confidentiality, Integrity, Availability), and how it forms the backbone of digital safety.
+
+### 2. **Types of Cyberattacks**
+Learn about common attacks like phishing, malware, DDoS, and ransomware — how they work and how to defend against them.
+
+### 3. **Network Security**
+Dive into how networks function, what vulnerabilities exist, and how to secure communication channels using firewalls, VPNs, and IDS/IPS systems.
+
+### 4. **Cryptography & Encryption**
+Discover how data is protected through encryption, hashing, and digital certificates, and why encryption keeps your private messages truly private.
+
+### 5. **Ethical Hacking Basics**
+Step into the shoes of an ethical hacker. Learn how penetration testers identify system weaknesses responsibly to make systems stronger.
+
+### 6. **Cybersecurity Tools**
+Hands-on tutorials with tools like **Wireshark**, **Nmap**, **Burp Suite**, and **Metasploit**, essential for scanning, testing, and defending systems.
+
+### 7. **Incident Response & Recovery**
+Understand how professionals respond when systems are compromised, and how organizations recover from security incidents effectively.
+
+### 8. **Best Practices & Certifications**
+From password hygiene to two-factor authentication and security audits, you’ll learn how to apply security in your daily digital life. We’ll also guide you through global certification paths like **CompTIA Security+**, **CEH**, and **CISSP**.
+
+## Learning Approach
+
+We believe in **learning by doing**.  
+Every topic includes:
+* **Clear explanations**
+* **Real-world examples**
+* **Hands-on labs**
+* **Tools and resources**
+* **Practice exercises**
+
+No prior experience is needed, just curiosity and a willingness to explore how the internet really works under the hood.
+
+## Projects You’ll Build
+
+To truly understand cyber security, you’ll build and test:
+* A **SQL Injection demo** to see how web vulnerabilities work  
+* A **Network Sniffing lab** using Wireshark  
+* A **Password Cracking test** with John the Ripper  
+* A **Penetration Testing simulation** using Metasploit  
+
+Each project teaches **responsible hacking**, understanding systems to protect them, not exploit them.
+
+## Who This Series Is For
+
+This tutorial series is perfect for:
+* **Students & beginners** exploring cybersecurity for the first time  
+* **Developers** who want to write more secure code  
+* **IT professionals** seeking a structured foundation  
+* **Aspiring ethical hackers** preparing for hands-on challenges  
+
+## How to Navigate
+
+Start from the basics and move upward:
+1. [Introduction to Cyber Security](./introduction-to-cybersecurity.mdx)
+2. [Types of Cyberattacks](./types-of-cyberattacks.mdx)
+3. [Network Security Basics](./network-security-basics.mdx)
+4. [Cryptography and Encryption](./cryptography-and-encryption.mdx)
+5. [Ethical Hacking Basics](./ethical-hacking-basics.mdx)
+6. [Cybersecurity Tools](./cybersecurity-tools.mdx)
+7. [Incident Response](./incident-response.mdx)
+8. [Best Practices](./best-practices.mdx)
+
+## Final Thoughts
+
+Cyber security is not a one-time skill, it’s a **constant learning process**. Every new technology introduces new risks, and staying ahead means keeping your curiosity alive.  
+
+As you progress through these tutorials, remember:
+> “Security isn’t just a skill, it’s a mindset.”
+
+So, gear up, and let’s make the web a safer place, one byte at a time.\
\ No newline at end of file
diff --git a/docs/cybersecurity/introduction-to-cybersecurity.mdx b/docs/cybersecurity/introduction-to-cybersecurity.mdx
new file mode 100644
index 0000000..e4f3ced
--- /dev/null
+++ b/docs/cybersecurity/introduction-to-cybersecurity.mdx
@@ -0,0 +1,142 @@
+---
+title: "Introduction to Cyber Security"
+description: "Understand what cyber security is, why it matters, and how it shapes the foundation of our digital world."
+tags: [cybersecurity, introduction, beginners, digital-safety]
+---
+
+Welcome to the starting point of your journey into the world of **Cyber Security**. Before diving into tools, attacks, or hacking techniques, it’s crucial to understand *what cyber security actually is*, *why it matters*, and *how it works behind the scenes*.
+
+---
+
+## What Is Cyber Security?
+
+**Cyber Security** is the art and science of protecting computers, servers, networks, and data from malicious attacks.
+
+:::tip
+
+In simple words, it’s about **keeping digital information safe** from people who shouldn’t access or misuse it.
+
+Think of it like locking your house:
+* The **door locks** are your passwords.  
+* The **CCTV camera** is your firewall.  
+* The **security guard** is your antivirus.  
+* And **you** are the homeowner, responsible for using them wisely.
+
+:::
+
+Cyber security ensures that our personal, professional, and national data stays private, intact, and accessible only to the right people.
+
+---
+
+## Why Cyber Security Matters
+
+Every day, billions of devices communicate over the internet. While that’s powerful, it also means **billions of opportunities for attackers** to steal data or disrupt systems.
+
+Here’s why cyber security is vital:
+
+* **Protects data and privacy** — Keeps personal information, passwords, and credit card details safe.  
+* **Prevents cyber crimes** — Blocks hackers, scammers, and malware.  
+* **Safeguards businesses** — Avoids data breaches, reputation damage, and financial losses.  
+* **Ensures trust** — People and companies can confidently use digital platforms.
+
+Even a small mistake, like clicking a fake link, can lead to massive security incidents. That’s why awareness and prevention are at the heart of cyber security.
+
+---
+
+## The CIA Triad: The Foundation of Security
+
+At the core of every cyber security concept lies the **CIA Triad** — three simple yet powerful principles that define how information should be protected:
+
+### **C – Confidentiality**
+Data should be accessed **only by authorized people**.  
+> Example: Your online banking password should be known only to you.
+
+### **I – Integrity**
+Data should remain **accurate and unchanged** unless modified by authorized users.  
+> Example: An attacker shouldn’t be able to alter your exam results or transaction amount.
+
+### **A – Availability**
+Information should be **accessible whenever needed**, without unnecessary delays.  
+> Example: A website going offline during a DDoS attack violates availability.
+
+Together, these principles make up the foundation of every secure system.
+
+---
+
+## Common Threats You Should Know
+
+Cyber threats come in many forms. Here are a few you’ll hear often:
+
+| Threat Type | Description | Example |
+|--------------|-------------|----------|
+| **Malware** | Malicious software that damages or controls systems | Viruses, Worms, Trojans |
+| **Phishing** | Fake emails or messages to steal data | “Your bank account is locked. Click here!” |
+| **Ransomware** | Locks your data until ransom is paid | WannaCry Attack |
+| **DDoS Attack** | Overloads a website or server to make it crash | Flooding a web server with fake traffic |
+| **Man-in-the-Middle** | Intercepts communication between two parties | Eavesdropping on Wi-Fi connections |
+
+Understanding these threats is the first step toward defending against them.
+
+---
+
+## How Cyber Security Works
+
+Cyber security isn’t just a single tool or software, it’s a **layered approach**.
+
+1. **Prevention** – Use firewalls, antivirus software, and secure coding.  
+2. **Detection** – Monitor systems for suspicious activity.  
+3. **Response** – Act fast when something goes wrong.  
+4. **Recovery** – Fix damage and restore data or systems.
+
+Every company, from small startups to global enterprises, follows this cycle to stay secure.
+
+---
+
+## Key Domains in Cyber Security
+
+Cyber Security covers many areas, each with its own focus:
+
+| Domain | Focus Area | Example |
+|--------|-------------|----------|
+| **Network Security** | Protecting data in transit | Firewalls, VPNs |
+| **Application Security** | Securing software & web apps | Secure coding, patching |
+| **Information Security** | Managing data privacy | Encryption, access control |
+| **Cloud Security** | Securing cloud-based platforms | AWS, Google Cloud security |
+| **Ethical Hacking** | Testing systems for weaknesses | Penetration testing |
+| **Incident Response** | Handling and analyzing attacks | Recovery planning |
+
+These domains often overlap — modern security requires a bit of knowledge from all of them.
+
+---
+
+## Real-Life Example
+
+In 2021, a major oil pipeline in the U.S. was attacked by ransomware, causing **fuel shortages across several states**. The company had to **shut down operations and pay millions** to regain access.  
+
+This shows how one cyber incident can impact entire economies, not just computers.
+
+---
+
+## Building a Strong Security Mindset
+
+Cyber security starts with **you**, not just technology.
+
+Here are a few daily habits to stay safe:
+* Use strong, unique passwords (or a password manager)  
+* Keep your devices and software updated  
+* Think before clicking links or downloading files  
+* Enable two-factor authentication  
+* Backup important files regularly  
+
+Good security isn’t about paranoia, it’s about **awareness and responsibility**.
+
+---
+
+## What You’ll Learn Next
+
+Now that you understand what cyber security is and why it’s essential, let’s move ahead to learn about **specific attacks** and how they work behind the scenes.
+
+You’ll explore:
+* Different **types of cyberattacks**
+* How hackers exploit weaknesses
+* And most importantly, **how to defend** against them
\ No newline at end of file
diff --git a/docs/cybersecurity/network-security-basics.mdx b/docs/cybersecurity/network-security-basics.mdx
new file mode 100644
index 0000000..f61bc3e
--- /dev/null
+++ b/docs/cybersecurity/network-security-basics.mdx
@@ -0,0 +1,204 @@
+---
+title: "Network Security Basics"
+description: "Learn how network security protects data in motion, prevents unauthorized access, and keeps communication safe across the web."
+tags: [cybersecurity, network-security, firewalls, vpn, encryption]
+---
+
+Every time you open a website, send an email, or make an online payment, your data travels across networks — through routers, switches, and servers around the world. **Network Security** ensures that this journey stays safe, private, and uninterrupted.
+
+In this tutorial, we’ll explore what network security is, how it works, and the different tools and methods used to protect communication across digital highways.
+
+---
+
+## What Is Network Security?
+
+**Network Security** is the practice of protecting data as it moves between devices or systems. It ensures that only authorized users can access information, and that the network remains available and reliable.
+
+Think of it like securing a city:
+* **Walls and gates** → Firewalls  
+* **Security guards** → Intrusion detection systems (IDS)  
+* **Secret routes and codes** → Encryption and VPNs  
+* **Traffic lights** → Routers and switches managing flow
+
+When these layers work together, they create a **defensive shield** around your digital environment.
+
+---
+
+## Why Network Security Matters
+
+Without network security, our connected world would be chaos, data could be stolen, altered, or blocked at any point in transit.
+
+Here’s why it’s crucial:
+* **Prevents data breaches** and leaks  
+* **Protects business operations** and communications  
+* **Secures online transactions** and financial data  
+* **Maintains trust** in digital systems and services  
+
+Even a small unprotected Wi-Fi network can become an entry point for attackers — that’s why every connection matters.
+
+---
+
+## Key Components of Network Security
+
+Network security isn’t just one tool, it’s a combination of multiple layers working together.  
+Let’s break down the most important ones
+
+---
+
+### 1. Firewalls
+
+A **firewall** acts as a **digital gatekeeper** between your internal network and the outside world. It filters incoming and outgoing traffic based on predefined security rules.
+
+- **Hardware Firewalls**: Installed between network devices (e.g., routers).  
+- **Software Firewalls**: Installed on computers or servers.  
+
+Example:  
+If your computer tries to connect to a suspicious website, the firewall blocks it automatically.
+
+ 
+:::tip Defense
+Always keep your firewall enabled and updated. Configure it to block unknown or unused ports.
+:::
+
+---
+
+### 2. Intrusion Detection & Prevention Systems (IDS/IPS)
+
+These systems monitor network traffic for unusual patterns or behavior.
+
+* **IDS (Intrusion Detection System)** – Detects suspicious activity and sends alerts.  
+* **IPS (Intrusion Prevention System)** – Detects *and* blocks malicious traffic automatically.
+
+Example:  
+If a hacker tries multiple failed logins within seconds, the IPS can detect it and block the IP.
+
+:::tip Defense 
+Regularly review logs and set up alerts for unusual network activity.
+:::
+
+---
+
+### 3. Encryption
+
+**Encryption** converts readable data into a coded format that only authorized users can decrypt. It ensures **confidentiality and integrity** of data as it travels over the internet.
+
+Example:
+When you visit a site with **HTTPS**, your browser and the server exchange data using encryption. That’s why you see a **padlock** symbol next to the URL.
+
+:::tip Defense  
+Always use encrypted protocols like HTTPS, SSL/TLS, and VPN for sensitive communication.
+:::
+
+---
+
+### 4. Virtual Private Networks (VPN)
+
+A **VPN** creates a secure “tunnel” between your device and a remote server, encrypting all the data passing through. It hides your real IP address and prevents eavesdropping on public networks.
+
+Example:
+When using public Wi-Fi at a café, a VPN ensures your online banking or emails remain private.
+
+:::tip Defense 
+Use trusted VPN providers that do not log your data. Avoid free VPNs — they often sell user information.
+:::
+
+---
+
+### 5. Access Control
+
+Not everyone should have access to every part of a network. **Access Control** limits who can enter, view, or modify information.
+
+It’s often managed through:
+* **Authentication** – Verifying identity (username, password, biometrics)  
+* **Authorization** – Granting specific permissions  
+* **Accounting (AAA)** – Logging user activity for monitoring
+
+Example:
+An employee can access internal emails but not financial databases — that’s access control in action.
+
+:::tip Defense  
+Use strong multi-factor authentication (MFA) and role-based permissions.
+:::
+
+---
+
+### 6. Network Segmentation
+
+**Network Segmentation** divides a large network into smaller zones or segments. If one zone is compromised, the attacker can’t easily reach others.
+
+Example:
+In an organization:
+* HR systems and Finance servers are kept in separate network segments.  
+* Guest Wi-Fi is isolated from internal systems.
+
+:::tip Defense
+Use VLANs (Virtual LANs) and subnetting to separate sensitive resources.
+:::
+
+---
+
+### 7. Network Monitoring & Logging
+
+Continuous monitoring helps detect anomalies, track traffic patterns, and catch intrusions early.
+
+Example:
+Tools like **Wireshark**, **SolarWinds**, or **Nagios** help monitor traffic flow and detect suspicious packets.
+
+:::tip Defense 
+Implement real-time monitoring and alert systems for faster incident response.
+:::
+
+---
+
+## Common Network Attacks
+
+Even secure networks can be targeted.  
+Here are a few common attacks every security professional should recognize:
+
+| Attack | Description | Defense |
+|--------|--------------|----------|
+| **DDoS** | Flooding servers with traffic to cause downtime | Use CDNs & firewalls |
+| **Sniffing** | Capturing data packets on the network | Use encryption & VPN |
+| **Spoofing** | Faking IP/MAC addresses to impersonate devices | Enable authentication, ARP security |
+| **MITM (Man-in-the-Middle)** | Intercepting communication between devices | Use HTTPS & SSL/TLS |
+| **ARP Poisoning** | Manipulating ARP tables to redirect traffic | Use static ARP entries, IDS |
+
+---
+
+## Real-World Example
+
+In 2021, a major U.S. pipeline company suffered a **ransomware attack** that began with weak network segmentation. Once inside, attackers moved laterally through internal systems, disrupting fuel supply across multiple states.
+
+This highlights why **layered network security** is essential, even one weak spot can expose an entire system.
+
+---
+
+## Best Practices for Network Security
+
+Here’s how you can build stronger and safer networks:
+
+* Keep software, routers, and firmware updated.  
+* Use strong encryption protocols (SSL/TLS, WPA3).  
+* Enable firewalls and intrusion detection systems.  
+* Train employees to identify phishing and scams.  
+* Limit public Wi-Fi usage without VPNs.  
+* Regularly monitor logs and audit activity.  
+* Implement Zero Trust Architecture — *never trust, always verify*.
+
+---
+
+## 🧩 Learn by Doing
+
+Try these **hands-on exercises** to strengthen your understanding:
+1. Analyze network traffic using **Wireshark**.  
+2. Set up a basic **firewall rule** on your local machine.  
+3. Create a **VPN connection** and compare your public IP before and after.  
+4. Observe packet encryption by comparing HTTP vs HTTPS traffic.  
+
+These small experiments help you *see* network security in action — not just read about it.
+
+---
+
+## What’s Next?
+
+You now understand how data travels and how networks stay secure. Next, we’ll explore **Cryptography & Encryption** — the science behind protecting information and making it unreadable to outsiders.
\ No newline at end of file
diff --git a/docs/cybersecurity/types-of-cyberattacks.mdx b/docs/cybersecurity/types-of-cyberattacks.mdx
new file mode 100644
index 0000000..b0e67a1
--- /dev/null
+++ b/docs/cybersecurity/types-of-cyberattacks.mdx
@@ -0,0 +1,219 @@
+---
+title: "Types of Cyberattacks"
+description: "Explore the most common types of cyberattacks, how they work, and how to protect yourself and your systems from them."
+tags: [cybersecurity, attacks, threats, beginners]
+---
+
+In the digital world, not all battles are fought with weapons, some are fought with code, data, and deception. Cyberattacks are the ways hackers exploit weaknesses in systems, software, or people to gain unauthorized access, steal information, or cause harm.
+
+Understanding how these attacks work is the first step in learning how to **defend** against them. Let’s dive into the most common types you’ll encounter as a cybersecurity learner.
+
+---
+
+## 1. Malware Attacks
+
+**Malware** stands for **malicious software**, any program designed to damage or control your computer without permission.
+
+### Common Types of Malware
+* **Virus** – Attaches to a file and spreads when executed.  
+* **Worm** – Spreads automatically through networks.  
+* **Trojan Horse** – Disguises itself as a legitimate file or app.  
+* **Spyware** – Secretly monitors your activity or steals data.  
+* **Ransomware** – Locks files and demands payment to unlock them.
+
+### Real Example:
+The **WannaCry ransomware attack (2017)** affected over 200,000 computers worldwide, encrypting files and demanding Bitcoin payments.
+
+### How to Defend:
+- Keep your system and software updated.  
+- Avoid downloading unknown files or clicking suspicious links.  
+- Use a trusted antivirus or anti-malware tool.
+
+---
+
+## 2. Phishing Attacks
+
+**Phishing** is one of the most common and effective cyberattacks, it tricks users into revealing sensitive data by pretending to be a trustworthy source.
+
+### How It Works:
+An attacker sends a fake email or message that looks real, like from your bank, employer, or delivery service, asking you to click a link or share credentials.
+
+### Example:
+> “Your account has been suspended. Click here to verify your identity.”
+
+The link leads to a fake login page designed to steal your username and password.
+
+### Variants:
+* **Spear Phishing:** Targeted at specific individuals or organizations.  
+- **Whaling:** Targets high-profile people like CEOs or executives.  
+- **Smishing & Vishing:** Use SMS or voice calls instead of emails.
+
+### How to Defend:
+* Double-check sender addresses.  
+* Never click suspicious links or download unexpected attachments.  
+* Enable two-factor authentication (2FA).  
+* Report suspicious emails to your organization’s IT team.
+
+---
+
+## 3. Denial of Service (DoS) & Distributed DoS (DDoS)
+
+**DoS** and **DDoS** attacks aim to make a website or service unavailable by flooding it with massive traffic requests.
+
+### How It Works:
+Imagine a restaurant receiving 10,000 fake reservations at once, the system crashes, and real customers can’t book a table.
+
+In a **DDoS attack**, this traffic comes from thousands of infected devices (a *botnet*) across the world.
+
+### Real Example:
+In 2016, the **Dyn DNS DDoS attack** took down major websites like Twitter, Netflix, and Reddit by overwhelming internet servers.
+
+### How to Defend:
+* Use **CDNs** and **load balancers** to distribute traffic.  
+* Deploy **firewalls and DDoS protection services** (like Cloudflare).  
+* Monitor unusual traffic patterns.
+
+---
+
+## 4. Man-in-the-Middle (MitM) Attacks
+
+In a **Man-in-the-Middle attack**, the hacker secretly intercepts and alters communication between two parties.
+
+### Example:
+You log in to your bank using public Wi-Fi. A hacker between your device and the router captures your login credentials, without you realizing it.
+
+### Variants:
+* **Session Hijacking:** Stealing cookies or session tokens.  
+* **Eavesdropping:** Listening to unencrypted traffic.  
+* **SSL Stripping:** Downgrading HTTPS connections to HTTP.
+
+### How to Defend:
+* Avoid using public Wi-Fi for sensitive logins.  
+* Always check for HTTPS in the browser bar.  
+* Use **VPNs** to encrypt communication.
+
+---
+
+## 5. SQL Injection (SQLi)
+
+**SQL Injection** happens when attackers insert malicious SQL queries into web forms or URLs to manipulate a database.
+
+### Example:
+A login form that doesn’t validate input properly:
+```sql
+' OR '1'='1
+````
+
+This trick forces the system to bypass authentication and give unauthorized access.
+
+### Real Example:
+
+In 2019, over **9 million records** were exposed from a booking website due to a SQL injection flaw.
+
+### How to Defend:
+
+* Use **prepared statements** and **parameterized queries**.
+* Sanitize and validate all user inputs.
+* Limit database privileges for application accounts.
+
+---
+
+## 6. Cross-Site Scripting (XSS)
+
+**XSS** allows attackers to inject malicious scripts into trusted websites, often targeting users rather than servers.
+
+### Example:
+
+If a comment box on a website doesn’t filter scripts, an attacker could post:
+
+```html
+<script>alert('You have been hacked!')</script>
+```
+
+When others view the comment, the script runs in their browser.
+
+### How to Defend:
+
+* Escape and sanitize user inputs.
+* Use **Content Security Policy (CSP)** headers.
+* Encode data before rendering in the browser.
+
+---
+
+## 7. Insider Threats
+
+Not all cyber threats come from outsiders. Sometimes, employees or contractors misuse their access for malicious purposes.
+
+### Example:
+
+An IT staff member copies confidential client data before leaving a company.
+
+### How to Defend:
+
+* Apply **least privilege principle** — give only necessary access.
+* Monitor insider activities.
+* Use strong access control and logging.
+
+---
+
+## 8. Zero-Day Exploits
+
+A **Zero-Day exploit** targets a software vulnerability before the developer has released a patch, making it extremely dangerous.
+
+### Example:
+
+An attacker discovers a flaw in a browser update before the company knows about it. They exploit it while users are unprotected.
+
+### How to Defend:
+
+* Keep software updated automatically.
+* Use trusted vendors with strong patch policies.
+* Employ **intrusion detection systems**.
+
+---
+
+## 9. Password Attacks
+
+Attackers often use different methods to crack or steal passwords:
+
+### Common Methods:
+
+* **Brute Force:** Trying every possible combination.
+* **Dictionary Attack:** Using a list of common passwords.
+* **Credential Stuffing:** Using leaked passwords from other sites.
+* **Social Engineering:** Tricking people into revealing passwords.
+
+### How to Defend:
+
+* Use **strong, unique passwords** (mix letters, numbers, symbols).
+* Enable **multi-factor authentication**.
+* Avoid reusing passwords across accounts.
+* Use a **password manager**.
+
+---
+
+## Summary Table
+
+| Attack Type      | Target           | Primary Goal          | Prevention         |
+| ---------------- | ---------------- | --------------------- | ------------------ |
+| Malware          | Systems & Data   | Damage or control     | Antivirus, updates |
+| Phishing         | Users            | Steal credentials     | Awareness, 2FA     |
+| DDoS             | Servers          | Disrupt service       | Firewalls, CDNs    |
+| MitM             | Communications   | Eavesdrop, steal data | VPN, HTTPS         |
+| SQL Injection    | Databases        | Gain access           | Input validation   |
+| XSS              | Websites         | Inject scripts        | Output encoding    |
+| Insider Threat   | Internal systems | Data theft            | Access control     |
+| Zero-Day         | Software         | Exploit unknown flaws | Regular updates    |
+| Password Attacks | Users            | Unauthorized access   | Strong passwords   |
+
+---
+
+## Final Thoughts
+
+Cyberattacks evolve constantly, and attackers are becoming smarter every day. But remember, **understanding the threat is the first step in defense**.
+
+You don’t have to be a hacker to fight hackers. You just need awareness, curiosity, and the right mindset.
+
+> “Security isn’t about fear, it’s about being prepared.”
+
+In the next tutorial, we’ll explore how **Network Security** keeps data safe as it travels through the web.
\ No newline at end of file
diff --git a/docs/cybersecurity/web-application-security.mdx b/docs/cybersecurity/web-application-security.mdx
new file mode 100644
index 0000000..e72acbc
--- /dev/null
+++ b/docs/cybersecurity/web-application-security.mdx
@@ -0,0 +1,230 @@
+---
+title: "Web Application Security"
+description: "Practical guide to securing web applications — threats, secure coding practices, OWASP Top Ten, testing methods, and deployment hardening."
+tags: [cybersecurity, web-security, appsec, secure-coding]
+---
+
+Web applications are where users, data, and business logic meet — and where attackers love to look for weak spots. This guide walks you through the most common web app threats, practical secure-coding patterns, testing techniques, and deployment hardening so your apps stay safe in production.
+
+The tone here is hands-on and pragmatic: think of this as advice from a developer who’s fixed vulnerabilities late at night and then wrote it down so you don’t have to learn the hard way.
+
+---
+
+## Why Web App Security Matters
+
+A single vulnerability in your website can expose user data, compromise servers, or let attackers run malicious code on clients.  
+Bad outcomes include data breaches, regulatory fines, lost user trust, and expensive remediation work. Treat security as part of the product — not an afterthought.
+
+---
+
+## The OWASP Top Ten (Practical Summary)
+
+The OWASP Top Ten is the best practical starting point for web-app security. Here’s a developer-focused summary and what you should do.
+
+1. **A1 — Broken Access Control**  
+   * *Problem:* Users can access functions they shouldn’t (e.g., change other users’ data).  
+   * *Fix:* Enforce access checks server-side on every request; avoid client-side `if` checks as the only protection. Use role-based access and least privilege.
+
+2. **A2 — Cryptographic Failures**  
+   * *Problem:* Weak or missing encryption for sensitive data.  
+   * *Fix:* Use HTTPS everywhere (HSTS), store secrets securely (KMS/secret manager), and use modern algorithms (AES-GCM, RSA/ECDSA). Never roll your own crypto.
+
+3. **A3 — Injection (SQL, OS, NoSQL, LDAP)**  
+   * *Problem:* Untrusted input interferes with query execution.  
+   * *Fix:* Use parameterized queries/prepared statements, ORMs, and input validation. Sanitize inputs where necessary.
+
+4. **A4 — Insecure Design**  
+   * *Problem:* Flaws in architecture or design (no fallback for auth, poor threat modeling).  
+   * *Fix:* Threat model features before release, design for least privilege and failure-safe defaults.
+
+5. **A5 — Security Misconfiguration**  
+   * *Problem:* Default credentials, verbose error messages, unused features enabled.  
+   * *Fix:* Harden servers (CSP, secure headers), remove dev middleware in production, and automate secure baseline configs.
+
+6. **A6 — Vulnerable and Outdated Components**  
+   * *Problem:* Using libraries with known vulnerabilities.  
+   * *Fix:* Keep dependencies up to date, scan with SCA tools (e.g., Dependabot, Snyk), and apply patches promptly.
+
+7. **A7 — Identification & Authentication Failures**  
+   * *Problem:* Broken login flows, weak session handling, insecure password storage.  
+   * *Fix:* Use proven auth frameworks, enforce MFA, use secure cookie flags, and hash passwords with strong algorithms (bcrypt/argon2).
+
+8. **A8 — Software & Data Integrity Failures**  
+   * *Problem:* Trusting unverified updates or deserializing untrusted data.  
+   * *Fix:* Sign artifacts, validate input before deserialization, and use immutable deployment pipelines.
+
+9. **A9 — Security Logging & Monitoring Failures**  
+   * *Problem:* Insufficient logging or monitoring to detect incidents.  
+   * *Fix:* Centralize logs, monitor for anomalies, and keep forensic logs (WORM where required).
+
+10. **A10 — Server-Side Request Forgery (SSRF)**  
+    * *Problem:* Server is tricked into making requests to internal services.  
+    * *Fix:* Block private IP ranges, validate and whitelist URLs, and isolate outgoing network access.
+
+---
+
+## Secure Coding Practices (Checklist)
+
+Adopt these habits in day-to-day development:
+
+* **Validate input, encode output.** Validate on server-side; always escape user data before rendering in HTML, JSON, SQL, etc.
+* **Use parameterized queries / ORM.** Never build SQL with string concatenation.
+* **Principle of least privilege.** Reduce permissions for services, DB users, and tokens.
+* **Avoid verbose error messages.** Show user-friendly errors; log stack traces securely.
+* **Store secrets properly.** Use environment variables + secret manager (AWS Secrets Manager, Vault).
+* **Use prepared statements and safe APIs.** Prefer safe standard libraries over custom parsing.
+* **Enforce secure default configs.** Ship secure defaults (CSP, secure cookies, minimal CORS).
+
+---
+
+## Authentication & Session Management
+
+Common pitfalls and how to avoid them:
+
+* **Passwords:** Hash with bcrypt/argon2; enforce strong policies; support password rotation.
+* **Sessions:** Use secure, HttpOnly, SameSite cookies; rotate session IDs after privilege elevation (login).
+* **MFA:** Encourage or require multi-factor for sensitive actions/accounts.
+* **Remember-me:** Implement long-lived tokens securely (refresh tokens, revocation lists).
+* **OAuth / Social Login:** Validate state and redirect URIs; avoid implicit flow for web apps.
+
+Example (Express + secure cookie):
+
+```js
+res.cookie('sid', sessionId, {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'Lax'
+});
+```
+
+---
+
+## Input Validation & Output Encoding
+
+* **Whitelist input where possible.** E.g., allow only `[0-9]{10}` for phone numbers.
+* **Use contextual encoding** (HTML encode for HTML, URL encode for URLs, JSON encode for JS).
+* **Never trust client-side validation** — always validate server-side.
+
+Example: Properly handling user-generated content before injecting into HTML:
+
+```js
+const safeText = escapeHtml(userInput); // use a trusted library
+element.innerText = safeText;
+```
+
+---
+
+## Cross-Site Scripting (XSS) & Cross-Site Request Forgery (CSRF)
+
+* **XSS:** Sanitize and encode data rendered on the page. Use templating engines that auto-escape. Use CSP to reduce impact.
+* **CSRF:** Use anti-CSRF tokens for state-changing requests or require sameSite=strict cookies and/or custom request headers.
+
+CSRF token example (server-rendered form):
+
+```html
+<input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+```
+
+---
+
+## CORS, CSP & Secure Headers
+
+* **CORS:** Whitelist trusted origins; avoid `Access-Control-Allow-Origin: *` for sensitive endpoints.
+* **CSP (Content Security Policy):** Mitigate XSS by restricting script sources. Start with a strict policy and add necessary exceptions.
+* **Other headers:**
+
+  * `X-Frame-Options: DENY` (prevent clickjacking)
+  * `Referrer-Policy: no-referrer-when-downgrade` (or stricter)
+  * `Permissions-Policy` (control feature access)
+  * `Strict-Transport-Security` (HSTS)
+
+Example (Express helmet):
+
+```js
+const helmet = require('helmet');
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "https://trusted.cdn.com"]
+    }
+  }
+}));
+```
+
+---
+
+## Dependency & Supply-Chain Security
+
+* Pin dependency versions (lockfile).
+* Automate vulnerability scanning (Snyk, Dependabot, GitHub Advanced Security).
+* Review third-party packages and avoid unnecessary dependencies.
+* Sign and verify artifacts in CI/CD. Use reproducible builds if possible.
+
+---
+
+## Logging, Monitoring & Incident Response
+
+* **Log important events:** Auth failures, privilege escalations, admin actions.
+* **Protect logs:** Avoid storing secrets in logs. Use centralized, immutable logging.
+* **Alerting:** Set up alerts for unusual spikes, repeated failures, or privilege abuse.
+* **Playbooks:** Maintain incident response runbooks for common scenarios (data leak, RCE, credential compromise).
+
+---
+
+## Secure CI/CD & Deployment
+
+* **Secrets in CI:** Use dedicated secret stores, avoid plaintext variables in pipelines.
+* **Immutable infrastructure:** Use images/artifacts that are tested and signed.
+* **Automated scanning:** Run SAST/DAST in the pipeline; fail builds on high-severity findings.
+* **Runtime protection:** Use runtime application self-protection (RASP), WAFs, and host hardening.
+
+---
+
+## Testing & Tools (Practical)
+
+* **Static Analysis (SAST):** Find insecure code patterns (Semgrep, SonarQube).
+* **Dynamic Analysis (DAST):** Scan running apps for common issues (OWASP ZAP, Burp Scanner).
+* **Interactive App Sec (IAST):** Combine both during functional tests.
+* **Dependency Scanning:** Snyk, Dependabot, npm audit.
+* **Fuzzing:** Test unexpected input shapes to find edge issues.
+
+Useful quick commands:
+
+* Nmap: `nmap -sV <host>` (discover services)
+* Nikto: `nikto -h https://example.com` (check common misconfigs)
+* OWASP ZAP: automated scan of your staging environment
+
+---
+
+## Hands-On Exercises (Mini-Labs)
+
+1. **XSS lab:** Create a small comment form. Demonstrate stored and reflected XSS and mitigate using output encoding + CSP.
+2. **SQLi lab:** Build a sample endpoint that uses parameterized queries and show how injection is prevented.
+3. **Auth lab:** Implement login with hashed passwords, sessions, and MFA (simulate with time-based one-time passcodes).
+4. **CI/CD lab:** Integrate SAST tool into CI and block merges for critical issues.
+
+These labs help bridge knowledge into daily practice.
+
+---
+
+## Quick Security Checklist (For Every Release)
+
+* [ ] HTTPS enforced (HSTS enabled)
+* [ ] Secrets removed from code & CI (use secret manager)
+* [ ] Dependencies scanned and up-to-date
+* [ ] CSP & secure headers configured
+* [ ] Session & cookie flags set (HttpOnly, Secure, SameSite)
+* [ ] Input validation and output encoding in place
+* [ ] Logging & monitoring enabled with alerts
+
+---
+
+## Final Thoughts
+
+Web application security is a constant process: design with security, build defensively, test often, and monitor continuously. Small mistakes in code can have large consequences, but with a consistent, practical approach you can reduce risk dramatically.
+
+If you want, I can:
+
+* Generate a set of practical lab repositories (template code + vulnerable examples) for teaching, or
+* Produce an automated CI pipeline example that runs SAST, DAST, and dependency checks.
\ No newline at end of file