Roadmap of Web 3 in Cybersecurity
In This article, I will share a path/roadmap with you through which I started to learn Blockchain Security.
✔️The only Roadmap you need
This Roadmap is not so big, This is organized and covers all essential topics that one needs to know in order to get into the field of Blockchain Security.
Elementary Topics:
- Familiarity with Linux OS
- Understanding of commonly used
bashcommands
- Understanding of version control systems such as
Git,Github,Gitlab, etc
- What is
CI/CDpipeline?
- Learn JavaScript
- Learn Python
- Good understanding of Object Oriented programming
- Familiarity with Package Managers (
npm,yarn,pnpm,pip)
Basics of Internet:
- Good understanding of Networking concepts
- How a Web Browser works
- What is
DNS(What happens behind the scenes when you typegoogle.comin web browser)
- What is
HTTPProtocol and how it works
- What are
HTTPRequest and Response headers
- What is
RPCProtocol
- Familiarity with Browser’s developer tools
Web2.0(how a typicalWeb2.0application is packaged and deployed)
Existing Authentication/Authorization models in Web2.0 applications
- SSO — Single Sign On
- OAuth — Open Authorization
- JWT Authentication
- Token Based Authentication
- Session Based Authentication
- Basic Authentication
https://www.ibm.com/docs/en/cics-ts/5.2?topic=concepts-http-basic-authentication
- What is HTTP Caching.
https://www.cloudflare.com/en-in/learning/cdn/what-is-caching/
Web 2.0 Security:
OWASP Top 10:
- Broken Access Control vulnerabilities
- Cryptographic Failures
- Injection vulnerabilities
- Insecure Design
- Security Misconfigurations
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery
1. Learn Blockchain Basics
2. Learn Ethereum Basics
3. Smart Contracts
What Are Smart Contracts?
4. Solidity
5. Learn Testing Frameworks
Foundry:
Hardhat:
Brownie:
Truffle Suit:
Infura:
OpenZeppelin:
Dapptools:
6. Learn Basics of Finance
7. DEFI and DEFI Attack Vectors:
8. Learn Libraries & Token Standards which are commonly used:
9. Learn Smart Contract Security
Visualization Tools
Linters & Formatters
10. Learn Vulnerabilities in Smart Contract
- What is Integer Overflow and Underflow
- What is Floating
Pragma
- What is Unchecked call return value
- What is Unprotected
SELFDESTRUCTInstruction
- What is Reentrancy
- State Variable Default Visibility
- What is Uninitialized Storage Pointer
- Use of Deprecated Solidity Functions
- DoS with Failed Call
- Authorization through
tx.origin
- Signature Malleability
- Weak Sources of Randomness from Chain Attributes
- Missing Protection against Signature Replay Attacks
- Lack of Proper Signature Verification
- Insufficient Gas Griefing
- DoS With Block Gas Limit
- Hash Collisions With Multiple Variable Length Arguments
- Message call with hardcoded gas amount
- What is Junk code (Code With No Effects)
- What is Unencrypted Private Data On-Chain
11. Learn Smart contract bugs & Best Security Practices
12. Learn CTF and do the challenges
Openzeppelin’s Ethernaut
Capture The Ether
Damn Vulnerable DeFi
Paradigm CTF-2021
Ciphershasta
Smart Contract CTF
13. Read Reports (Audit Reports):
- QuillAudits
- Openzeppelin blogs
- Consensys Audit
- Code4rena Audit Reports
- Secureum Audit Findings 101
- Secureum Audit Findings 201
13. Learning through several stuffs:
Newsletters :
Blockthreat
HashingBit
QuillHash
Delivering Enterprise-grade blockchain technology to leading companies worldwide.
medium.com
Immunefi
Discord Communities:
Immunefi
Secureum
QuillAudits
Blogs:
Immunefi
Coinmonk
TrailOfBits
Secureum
Openzeppelin
QuillAudits
[-] Bug Bounty in Web3
Immunefi
Code4rena
Hakenproof
Hackerone
✨ Bonus
For your convenience in tracking your progress while following the above roadmap, I am sharing a publicly readable version of Notion notes of @0xAsm0d3us, which you can copy it to your own Notion notebook as a template for tracking your progress. Also, follow him on Twitter as the above links is the part of this blog. I just make a roadmap after gathering links from all of the internet so it can help you learn better.
Additional Resources
- Ethereum Homestead Documentation
- Ethereum Community guides and resources
- Solidity Documentation
- Solidity, Blockchain, Smart Contract Course
- DeFi Developer Road Map
- Scott Sunarto Web3 Handbook
- Find some resources on Web3 Hacking with Tweets of Adrian Hetman
Any type of comments are welcome. Thank you for your time :)).
Happy Hacking !!!
If you enjoyed reading the article do clap and follow:
Twitter: https://twitter.com/i_amsphinx
LinkedIn: https://www.linkedin.com/in/pathakabhi24/
GitHub: https://github.com/pathakabhi24
If you find this helpful, please click the clap 👏 button below a few times to show your support for the author 👇
