Practitioner resources: penetration-testing technique, defence and detection engineering, open-source intelligence, CVE and proof-of-concept archives. Authorisation is everything here — test only systems you own or have written permission for, which is why bug-bounty programmes publish their scope.
74 links
A wiki that gathers application security resources (guides, tools, checklists, training) in one place. It is a starting point for the whole of appsec rather than a deep dive into one attack class.
A guide gathering OSINT techniques the usual tool lists skip — blockchain tracing, metadata, unconventional sources. Against standard OSINT lists it goes to the corners: it covers little-known methods rather than the tools everyone already names.
A list gathering the annual cybersecurity reports of research consultancies and government agencies in one place. Unlike reading a single report it is vendor-neutral: it sets them side by side so you can strip the marketing and compare the trends.
A list of asset discovery tools and methods — subdomain enumeration, certificate transparency, ASN lookups. Unlike general penetration-testing lists, it focuses only on discovery, the first and most decisive phase of a test.
A list of tools officially presented at Black Hat events, and only those. Against general tool lists it has a bar to entry: each was demonstrated live on stage, so these are field-tested, vetted tools rather than random repositories.
A list of CAPTCHA types and libraries used to tell humans from bots. Unlike a single CAPTCHA service, it sets the types and open-source libraries side by side.
A list for security research on IoT, embedded, industrial and automotive systems, gathering hardware attacks, wireless protocols (BLE, Zigbee, LoRa, NFC) and firmware resources. Unlike web-focused security lists it centres on physical devices and the radio layer.
A list of theory-basics papers on cryptography for non-cryptographers. Unlike textbooks, it points straight to the original papers and orders them for the non-specialist reader.
A list of detection, monitoring and response tools for the defensive (blue team) side. Unlike offensive lists it focuses on protecting systems and catching incidents.
A year-by-year archive of cybersecurity blog posts, write-ups and papers, with entries up to 2026. Unlike tool lists the links are technical analyses to read (exploit chains, CVE write-ups); tools sit in a separate file.
Resources for designing and operating the detection rules that catch attacks. Unlike ready tools it leans into the engineering of “how to write good detections”.
A list of tools and practices embedding security into the CI/CD pipeline. Unlike separate security tests it places the checks inside the development flow.
A compilation of fuzzing resources: tools, books, talks, papers and practice environments. Against the OWASP page the difference is breadth — this is where you go after you understand the method.
A resource list specific to game security — anti-cheat, reverse engineering, protection bypasses. Unlike general reverse-engineering lists it centres on games, gathering domain-specific topics like anti-cheat systems and game protections together.
A list that collects awesome lists for hackers, pentesters and researchers. Unlike the individual topic lists it is the index above them: one door into dozens of sub-lists from OSINT to malware analysis.
A list of decoy systems (honeypots) set up to lure attackers. Unlike general defence lists it focuses only on deception and early-warning tools.
A resource list for user accounts, authentication and authorisation. Unlike a single identity provider’s docs it is vendor-neutral, treating password storage, sessions, MFA, OAuth and permission models at the level of concepts.
A security-oriented resource list on industrial network protocols such as Modbus, S7 and OPC UA, with a page and dataset per protocol. Unlike general security lists it goes down to the OT/ICS protocol level.
Machine learning resources for security, gathering datasets and academic papers together. Unlike the second compilation in the same field, its labelled-data section is strong — and labelled data is the hardest thing to find here.
A category-by-category list of open-source intelligence tools and resources (people, domains, social media, geolocation). Unlike a single-purpose OSINT tool it is the map: the field’s most-cited starting index for which tool fits which job.
A list of tools and papers on the “prompt injection” vulnerability specific to language models. Unlike classic security lists it looks only at the new attack surface of AI systems.
A resource list focused on web security, split by attack class (XSS, SSRF, deserialisation). Against general hacking lists it is narrow and deep: it targets the web layer alone, gathering articles, tools and labs together for each vulnerability type.
Cryptographer David Wong’s blog and notes on applied cryptography. Against academic papers it explains protocols from an implementer’s seat — not the theorem, but where real systems get it wrong.
A tidy note archive of security topics. Unlike comprehensive handbooks it is pruned for speed — a quick reference for recalling a command or method mid-lab.
Advanced courses on malware development and offensive tooling. Unlike penetration testing training it goes down to evasion and implant development — aimed at red team tool developers rather than at anyone collecting certificates.
Passive reconnaissance for a domain: subdomains, DNS records and a host map, with no scan of the target itself. Runs in the browser and shows results as both a graph and a table. Unlike tools that scan the target, it uses passive sources only.
Offensive Security's searchable archive of published exploits and vulnerability write-ups, indexed by CVE. It also hosts the GHDB of Google dorks, and is a common citation point in penetration test reports. Unlike CVE databases, it archives working exploit code.
A knowledge base giving pentest, red-team, web, cloud and privilege-escalation techniques as step-by-step commands. Unlike conceptual security books it is directly runnable: every page is concrete enough to say “throw this command at that port, look for this in the output” — a field reference, not theory.
A numbered collection of XSS vectors arising from HTML5 and browser quirks, each listing the browsers it works in. It is dated, but still used to understand how filter bypasses work. Unlike the OWASP guides, it lists detailed vectors based on browser quirks.
Tools, protocol notes, sample pcaps, configurations and guides for industrial control system (ICS/SCADA) security. Unlike general security lists it covers only OT/ICS environments, and includes packet captures and protocol material. Last updated 2025.
A service enumeration script automating the command sequence you would otherwise run by hand during reconnaissance. Unlike hand-typed queries it bundles the steps into one script; bear in mind it depends on the availability of the external API it calls.
A vast security reference under one roof — red team, blue team, DFIR, AppSec and more. Unlike single-topic awesome lists it is holistic: instead of hunting a separate list per specialism, one annotated, organised reference in a single place.
The wiki of Kicksecure, a hardened Debian derivative, covering system hardening, kernel and browser settings, Tor and password management step by step. Unlike generic security checklists it shows how each recommendation is applied at operating-system level.
An Austrian firm focused on industrial control systems and critical infrastructure, with OT security training. Against general security training it addresses the operational technology side — PLCs and SCADA.
The repositories of a developer producing Turkish security and IT material. Unlike scattered English resources it gathers Turkish content under one developer’s profile — a single entry point for local resources.
Ready-made lists for weeding false positives out of threat indicators — public DNS resolvers, known cloud ranges, public services. Unlike raw indicator feeds it is the noise filter: it marks the legitimate infrastructure that should not raise an alarm.
A second compilation on machine learning for security. Unlike awesome-ml-for-cybersecurity, it is weighted more towards tools, courses and conference talks.
A Turkish discussion of Wi-Fi chipsets supporting monitor mode and packet injection. Unlike general hardware lists it focuses on cards available on the local market — the hardware question that must be settled before any wireless testing.
A resource set covering every branch of offensive security — infrastructure, wireless, IoT, exploit development, cloud — together with labs. Unlike single-topic lists it is broad and lab-focused: it points to environments where you can practise, not just read.
A GitBook site gathering OSINT web-resource and tool lists plus blog posts, with a separate page of newly added resources per year. Unlike a single framework page it has many topic-specific sub-lists; last updated in 2024.
An OSINT guide of 450+ tools, methods and ethics/legal notes across 35 sections, which also publishes a link-audit report. Unlike pure tool lists it adds a four-step research methodology and legal-framework sections.
A list that sorts OSINT resources by 193 countries and territories. Unlike global OSINT lists it is geographic: if you need a specific country’s public records, registries and local tools, you go straight to that heading.
A tree of open-source intelligence tools organised by target — email, username, domain, image. You start from what you are looking for and descend to the tool, not the other way round.
An introduction to fuzzing from OWASP’s own community pages: how it works, which tools exist, which classes of bug it finds. Against a tool’s own documentation it describes the method neutrally.
The OWASP guide to security testing Android and iOS apps, with test cases, tools and techniques in one place. Unlike general web security material it covers mobile-specific storage, binary analysis and network testing.
An open source OWASP tool for drawing data flow diagrams and doing threat modelling with methods such as STRIDE, with web and desktop versions. Unlike generic diagram tools it ties threats and mitigations to each diagram element.
Payloads and bypass notes for web security and CTFs, organised by vulnerability class (SQLi, SSRF, XXE, SSTI and more). Each folder has a short explanation and examples, so it works as a lookup by vulnerability class rather than as a tool.
A list that automatically harvests CVE proof-of-concept repositories from GitHub and updates daily. Against Trickest CVE it scans GitHub alone: for each vulnerability it states “this repo was published on this date” — a quick route to a PoC (its README warns of malware).
A hand-curated guide to links and resources split by topic for SOC, pentesting, DFIR, threat intelligence and AppSec. Unlike awesome lists that cover a single area, it collects blue-team and red-team material in one gitbook.
The SANS Institute’s security cheat sheets: forensics, incident response, memory analysis, the Windows registry. Unlike general cheat sheets these are built for use during an incident — which command yields which evidence.
Turkey’s cyber security authority, publishing national advisories, regulation and critical-infrastructure guidance. Unlike international sources it gives Turkey-specific regulation and compliance requirements.
A broad categorised OSINT link board, updated more frequently than the framework so fewer of its tools are dead.
A repository that makes the content extracted from thousands of threat-intelligence reports searchable. Unlike the reports themselves it searches inside them: you enter a tool or APT-group name and it lists every report that mentions it at once.
A repository that automatically gathers and keeps current every known CVE, with links to proof-of-concept code where it exists. Unlike official databases like the NVD it is exploit-focused: if you want to know where a vulnerability’s working code lives, it points straight to it.
A live IOC feed that collects malicious URLs, domains, IPs and hashes shared by the infosec community on Twitter/X, served as CSV/JSON/RSS/API. Unlike commercial threat feeds its source is open social posts and it is free: it turns researcher observations into real-time, machine-readable data.
A scanning service that opens a URL in a real browser and records every request the page makes, the domains it contacts, a screenshot and the DOM. Unlike VirusTotal it does not just give a reputation score; it shows the page's behaviour with evidence, and past public scans are searchable.
A single page listing web application security tests as a mind map; each branch is a test area with its tools. Unlike text checklists it shows the whole scope at a glance.