Learning Paths
Guided Learning Paths
Structured tracks through Hmmnm's tutorials and analyses. Check off each step — your progress is saved on this device, no account needed.
Beginner friendly
~2 h total
Web Application Pentesting
From the core bug classes to real CVE case studies: how web apps actually get broken and defended.
0 / 5 steps completed
- 1 Web App Pentesting — the complete guide 25 min
- 2 Cross-Site Scripting (XSS): the complete tutorial 30 min
- 3 Error-based exploitation and mitigation (SQLi, SSTI) 20 min
- 4 Keycloak CVE-2026-18963: account takeover via password reset 15 min
- 5 cPanel CVE-2026-41940: authentication bypass in the wild 15 min
Intermediate
~4 h total
AI Agent Security
The OWASP Agentic Skills Top 10, the AST attack series, and containment defenses — the 2026 agent attack surface end to end.
0 / 8 steps completed
- 1 AI Agent Security — the complete guide (2026) 30 min
- 2 AI agents: the new attack surface 20 min
- 3 OWASP Agentic Skills Top 10 explained 20 min
- 4 AST01: malicious skills & Markdown exfiltration 15 min
- 5 AST02: skill supply chain compromise 15 min
- 6 AST03–AST06: over-privileged skills to weak isolation 35 min
- 7 AST07–AST10: update drift to governance 35 min
- 8 Capstone: how AI agents break containment 20 min
Intermediate
~3 h total
Software Supply Chain Security
From SolarWinds and XZ to the AUR hijack and AI-era skill compromises — how dependency attacks evolved and how to defend the pipeline.
0 / 7 steps completed
- 1 Foundations: dependencies, builds, and secrets 25 min
- 2 SolarWinds Sunburst: the fallout that changed everything 20 min
- 3 Dependency confusion: attacking the package registry 15 min
- 4 The XZ Utils backdoor (CVE-2024-3094) 20 min
- 5 The polyfill.io hijack 15 min
- 6 Over 400 AUR packages hijacked (2026) 25 min
- 7 Capstone: AI skill supply chain (AST02) 15 min
Analyst track
~4 h total
Threat Intelligence & Defense
Build the analyst mindset: historical context, live zero-day tracking, weekly briefings, and modern defense operations.
0 / 7 steps completed
- 1 Cyber Threat Intelligence — the complete guide 30 min
- 2 The 33 biggest cyberattacks in history (1988–2024) 45 min
- 3 5 critical zero-days: June 2026 threat intel 20 min
- 4 Weekly briefing: the June 2026 supply chain crisis 20 min
- 5 Weekly briefing: GitLab, Rust backdoor, NetScaler (Aug 2026) 20 min
- 6 Memory forensics: evidence that never touches disk 25 min
- 7 Capstone: SOC automation & autonomous defense 25 min