Guided Learning Paths
Structured tracks through Hmmnm's tutorials and analyses. Check off each step — your progress is saved on this device, no account needed.
Web Application Pentesting
From the core bug classes to real CVE case studies: how web apps actually get broken and defended.
Get it done professionally: Web & API Penetration Testing →
📄 Free checklist: Web Security Starter Checklist →
- 1 Web App Pentesting — the complete guide 25 min
- 2 Cross-Site Scripting (XSS): the complete tutorial 30 min
- 3 Error-based exploitation and mitigation (SQLi, SSTI) 20 min
- 4 Keycloak CVE-2026-18963: account takeover via password reset 15 min
- 5 cPanel CVE-2026-41940: authentication bypass in the wild 15 min
AI Agent Security
The OWASP Agentic Skills Top 10, the AST attack series, and containment defenses — the 2026 agent attack surface end to end.
Get it done professionally: AI & LLM Security Assessment →
📄 Free checklist: AI Agent & LLM Security Checklist →
- 1 AI Agent Security — the complete guide (2026) 30 min
- 2 AI agents: the new attack surface 20 min
- 3 OWASP Agentic Skills Top 10 explained 20 min
- 4 AST01: malicious skills & Markdown exfiltration 15 min
- 5 AST02: skill supply chain compromise 15 min
- 6 AST03–AST06: over-privileged skills to weak isolation 35 min
- 7 AST07–AST10: update drift to governance 35 min
- 8 Capstone: how AI agents break containment 20 min
Software Supply Chain Security
From SolarWinds and XZ to the AUR hijack and AI-era skill compromises — how dependency attacks evolved and how to defend the pipeline.
Get it done professionally: Software Supply Chain Assessment →
- 1 Foundations: dependencies, builds, and secrets 25 min
- 2 SolarWinds Sunburst: the fallout that changed everything 20 min
- 3 Dependency confusion: attacking the package registry 15 min
- 4 The XZ Utils backdoor (CVE-2024-3094) 20 min
- 5 The polyfill.io hijack 15 min
- 6 Over 400 AUR packages hijacked (2026) 25 min
- 7 Capstone: AI skill supply chain (AST02) 15 min
Threat Intelligence & Defense
Build the analyst mindset: historical context, live zero-day tracking, weekly briefings, and modern defense operations.
Get it done professionally: Threat Intel & Detection Review →
- 1 Cyber Threat Intelligence — the complete guide 30 min
- 2 The 33 biggest cyberattacks in history (1988–2024) 45 min
- 3 5 critical zero-days: June 2026 threat intel 20 min
- 4 Weekly briefing: the June 2026 supply chain crisis 20 min
- 5 Weekly briefing: GitLab, Rust backdoor, NetScaler (Aug 2026) 20 min
- 6 Memory forensics: evidence that never touches disk 25 min
- 7 Capstone: SOC automation & autonomous defense 25 min
Identity & Authentication Attacks
Passwords, tokens, and MFA are the new perimeter — how credentials get stolen, how auth flows get abused, and how to design identity that holds.
Get it done professionally: Cloud & Identity Security Review →
- 1 Inside the combo-list economy: your password after the breach 15 min
- 2 Device code phishing: how attackers bypass MFA 20 min
- 3 Keycloak CVE-2026-18963: account takeover via password reset 15 min
- 4 Marquis breach: one firewall, 74 banks, 672k identities 20 min
- 5 Zero-trust architecture: an implementation guide 25 min
- 6 AI agent identity and least privilege 20 min
Cloud & Data Security
The Snowflake era proved one leaked credential can empty a cloud — secrets management, vendor risk, and what "cloud-secure" really requires.
Get it done professionally: Cloud & Identity Security Review →
- 1 One leaked secret, your entire multi-cloud 20 min
- 2 Snowflake-Ticketmaster: the cloud-secure myth breaks 15 min
- 3 Snowflake extortion: 165+ customers, one credential wave 20 min
- 4 AT&T's Snowflake ransom payment: the $370K precedent 15 min
- 5 Sisense breach: CI credentials and AWS keys 15 min
Ransomware Defense & Case Studies
Ten years of ransomware through its defining incidents — then the survival playbook, the response checklist, and where AI takes it next.
Get it done professionally: Ransomware Readiness Check →
- 1 Ransomware evolution 2016-2026: what defenders keep missing 25 min
- 2 Colonial Pipeline: one password, 17 emergency states 15 min
- 3 Kaseya VSA: 60 MSPs, 1,500 businesses, one Friday 15 min
- 4 Conti's 60,000 chats: anatomy of a ransomware giant 20 min
- 5 The first 24 hours of a ransomware attack 25 min
- 6 CISO ransomware response checklist 20 min
- 7 Capstone: how AI is transforming ransomware 20 min
Breaking Into Security
The starter track: core skills, the interview grind, what the market pays for, and the tools you will run on day one.
Get it done professionally: Security Training & Workshops →
- 1 10 essential tips for aspiring ethical hackers 15 min
- 2 100 network topics to revise before your interview 30 min
- 3 Top 10 emerging cybersecurity threats in 2026 20 min
- 4 How much does a penetration test cost? 15 min
- 5 SIEM cost in 2026: Splunk vs Sentinel vs Elastic 20 min
API Security
APIs carry the most sensitive logic in modern apps — authorization, authentication, and injection from the API lens, with real breach case studies.
Get it done professionally: API Security Testing →
📄 Free checklist: API Security Testing Checklist →
- 1 Web App Pentesting — the complete guide (foundations) 25 min
- 2 Error-based exploitation and mitigation (SQLi, SSTI) 20 min
- 3 Keycloak CVE-2026-18963: account takeover via password reset 15 min
- 4 cPanel CVE-2026-41940: authentication bypass in the wild 15 min
- 5 Snowflake-Ticketmaster: how an API-era breach unfolds 15 min
Bug Bounty Hunting
From core skills to real-world bug classes — the mindset, the methodology, and the economics of finding and reporting vulnerabilities for bounties.
Get it done professionally: Web & API Penetration Testing →
📄 Free checklist: Bug Bounty Field Checklist →
- 1 10 essential tips for aspiring ethical hackers 15 min
- 2 Web App Pentesting — the complete guide 25 min
- 3 Cross-Site Scripting (XSS): the complete tutorial 30 min
- 4 Error-based exploitation and mitigation 20 min
- 5 cPanel CVE-2026-41940: a real-world auth bypass 15 min
- 6 How much does a penetration test cost? 15 min
Incident Response & Forensics
When the attack already happened: the first 24 hours, evidence that never touches disk, and what attacker internals teach responders.
Get it done professionally: Incident Response Support →
- 1 The first 24 hours of a ransomware attack 25 min
- 2 CISO ransomware response checklist 20 min
- 3 Memory forensics: evidence that never touches disk 25 min
- 4 Conti’s 60,000 chats: anatomy of a ransomware giant 20 min
- 5 Kaseya VSA: 60 MSPs, 1,500 businesses, one Friday 15 min
- 6 Capstone: SOC automation & autonomous defense 25 min
Threat Modeling & Secure Design
Think like an attacker before the code exists: attack surfaces, trust boundaries, zero-trust design, and the lessons of history’s biggest architecture failures.
Get it done professionally: Threat Modeling →
- 1 AI Agent Security — attack surfaces and trust boundaries 30 min
- 2 Zero-trust architecture: an implementation guide 25 min
- 3 Foundations: dependencies, builds, and secrets 25 min
- 4 Web App Pentesting — the complete guide (methodology) 25 min
- 5 AI agent identity and least privilege 20 min
- 6 The 33 biggest cyberattacks in history — design lessons 45 min
Network & Active Directory Security
From perimeter to privilege: Active Directory attack paths, lateral movement, and the network fundamentals every defender needs.
Get it done professionally: Network Penetration Testing →
- 1 100 network topics to revise before your interview 30 min
- 2 Colonial Pipeline: one password, 17 emergency states 15 min
- 3 Kaseya VSA: 60 MSPs, 1,500 businesses, one Friday 15 min
- 4 Marquis breach: one firewall, 74 banks, 672k identities 20 min
- 5 cPanel CVE-2026-41940: authentication bypass in the wild 15 min
Container & Kubernetes Security
From image to cluster: container escape, supply chain risks in the pipeline, and secrets management for cloud-native infrastructure.
Get it done professionally: Container & Kubernetes Security Testing →
- 1 Software supply chain: dependencies, builds, and secrets 25 min
- 2 One leaked secret, your entire multi-cloud 20 min
- 3 Sisense breach: CI credentials and AWS keys 15 min
- 4 XZ Utils backdoor (CVE-2024-3094) 20 min
- 5 Over 400 AUR packages hijacked (2026) 25 min
Source Code Review
Finding the flaws scanners cannot see — business logic, injection sinks, and reading code like an attacker.
Get it done professionally: Source Code Review →
- 1 Web App Pentesting — the complete guide 25 min
- 2 Error-based exploitation and mitigation (SQLi, SSTI) 20 min
- 3 Cross-Site Scripting (XSS): the complete tutorial 30 min
- 4 Keycloak CVE-2026-18963: reading the auth flow 15 min
- 5 Capstone: OWASP Agentic Skills Top 10 — reading agent code 20 min
Mobile App Security
Android and iOS security from the ground up — storage, transport, and the backend APIs mobile apps expose.
Get it done professionally: Mobile App Security Testing →
- 1 10 essential tips for aspiring ethical hackers 15 min
- 2 Web App Pentesting — the complete guide (foundations) 25 min
- 3 Error-based exploitation and mitigation 20 min
- 4 Complete XSS tutorial (output contexts) 30 min
- 5 Top 10 emerging cybersecurity threats in 2026 20 min
Compliance & GRC
Security frameworks, audit readiness, and the governance side — the language your board and auditors speak.
Get it done professionally: Compliance Readiness →
- 1 Zero-trust architecture: an implementation guide 25 min
- 2 SIEM cost in 2026: Splunk vs Sentinel vs Elastic 20 min
- 3 How much does a penetration test cost? 15 min
- 4 Top 10 emerging cybersecurity threats in 2026 20 min
- 5 Cyber Threat Intelligence — the complete guide 30 min
Purple Team & Detection Engineering
Attack and defend in the same room — detection rules, ATT&CK mapping, and building the analyst mindset.
Get it done professionally: Purple Team Exercise →
- 1 SOC automation & autonomous defense (SOAR) 25 min
- 2 CISO ransomware response checklist 20 min
- 3 Cyber Threat Intelligence — the complete guide 30 min
- 4 Weekly briefing: GitLab, Rust backdoor, NetScaler (Aug 2026) 20 min
- 5 Memory forensics: evidence that never touches disk 25 min
Password & Credential Security
How credentials get stolen, sold, and used — and how to build authentication that actually holds.
Get it done professionally: Password Strength Audit →
📄 Free checklist: Password & Credential Hygiene Checklist →
- 1 Inside the combo-list economy: your password after the breach 15 min
- 2 Device code phishing: how attackers bypass MFA 20 min
- 3 One leaked secret, your entire multi-cloud 20 min
- 4 Snowflake extortion: 165+ customers, one credential wave 20 min
- 5 Zero-trust architecture: an implementation guide 25 min
Social Engineering & Phishing
The human attack surface — how phishing works, why it beats technology, and how to build resilience.
Get it done professionally: Phishing Simulation →
- 1 Device code phishing: how attackers bypass MFA 20 min
- 2 Inside the combo-list economy: your password after the breach 15 min
- 3 Colonial Pipeline: one password, 17 emergency states 15 min
- 4 Top 10 emerging cybersecurity threats in 2026 20 min
- 5 AI agents: the new attack surface 20 min
Learning Resources by Service
Every service area has three tiers of learning material — from free public content to advanced paid resources included with engagements.
// resources by service area
Finish all steps in a path and receive a certificate of completion — free, verifiable, and shareable on LinkedIn. No account needed; your progress is tracked on this device.