Cybersecurity
Learn to break things so you can defend them.
Linux, web security and capture-the-flag practice, with the tools security folks use every day.
129 resourcesSuggest a resource
Learning path
Work through these in order. Each step builds on the last.
Step 1: Linux first
Most security work happens on the command line.
Step 5: Compete
Everything in Cybersecurity
OverTheWire, Bandit
A wargame that teaches Linux basics by making you hunt for passwords over SSH.
overthewire.org
picoCTF
Carnegie Mellon's beginner-friendly CTF, with a year-round practice gym.
picoctf.org
TryHackMe
Guided, browser-based hacking rooms. Many paths are free.
tryhackme.com
OWASP Top 10
The ten most critical web application security risks, explained.
owasp.org
PortSwigger Web Security Academy
Free, hands-on labs for every major web vulnerability, from the makers of Burp Suite.
portswigger.net
CyberChef
The "cyber Swiss Army knife". Encode, decode, encrypt and analyse data in the browser.
gchq.github.io
HackTricks
A huge open knowledge base of pentesting techniques, tools and methodology.
book.hacktricks.wiki
CTFtime
The calendar and rankings for capture-the-flag competitions worldwide.
ctftime.org
Hack The Box
Realistic machines and challenges to hack, with free tiers.
hackthebox.com
pwn.college
Arizona State's free course on binary exploitation and systems security.
pwn.college
GTFOBins
Unix binaries that can be abused to escalate privileges or bypass restrictions.
gtfobins.github.io
Cyber Security Roadmap
A map of the skills and roles in security.
roadmap.sh
OverTheWire Wargames
The full set of wargames after Bandit, covering web, binary exploitation, crypto and more.
overthewire.org
Under The Wire
Wargames that teach PowerShell and Windows internals over SSH.
underthewire.tech
CMD Challenge
Bite-sized shell puzzles you solve in the browser to sharpen your command-line skills.
cmdchallenge.com
Professor Messer's Security+ Course
A complete free video course for the CompTIA Security+ exam, great for security fundamentals.
professormesser.com
Google Cybersecurity Certificate
Google's beginner program on SOC work, Linux, SQL, Python and incident response.
coursera.org
ISC2 Certified in Cybersecurity
An entry-level certification whose official training and exam are often offered free.
isc2.org
Cisco Introduction to Cybersecurity
A short free Cisco NetAcad course on threats, attacks and staying safe online.
netacad.com
OWASP Juice Shop
A deliberately insecure modern web shop packed with hacking challenges to practise on.
owasp.org
DVWA
Damn Vulnerable Web Application, a classic PHP app for practising common web attacks locally.
github.com
OWASP Cheat Sheet Series
Concise, practical guidance on securing specific parts of an application.
cheatsheetseries.owasp.org
OWASP Web Security Testing Guide
The standard methodology for testing the security of web applications.
owasp.org
OWASP API Security Top 10
The most common security risks specific to APIs, with examples and fixes.
api-security.owasp.org
OWASP ASVS
A checklist of security requirements for designing and reviewing web applications.
owasp.org
Hacksplaining
Short interactive lessons that show how common web vulnerabilities work and how to fix them.
hacksplaining.com
Snyk Learn
Free interactive lessons on vulnerabilities and secure coding across many languages.
learn.snyk.io
Stanford CS253, Web Security
Stanford's web security course with lecture slides and videos on browser and server attacks.
web.stanford.edu
MIT 6.858, Computer Systems Security
MIT's classic course on designing and attacking secure systems, with lectures and labs.
ocw.mit.edu
PayloadsAllTheThings
A huge collection of payloads and bypasses for web application security testing.
github.com
SecLists
The go-to collection of wordlists for usernames, passwords, URLs and fuzzing.
github.com
Hacker101
HackerOne's free video lessons and CTF for aspiring bug bounty hunters.
hacker101.com
HackerOne
The largest bug bounty platform, with public programs and disclosed reports to learn from.
hackerone.com
Bugcrowd
A major bug bounty platform with public programs and learning material for hunters.
bugcrowd.com
Intigriti
A European bug bounty platform known for its monthly XSS challenges.
intigriti.com
Real-World Bug Hunting
A field guide to web hacking built around real, paid bug bounty reports.
nostarch.com
PentesterLab
Hands-on web pentesting exercises, with a set of free badges to start.
pentesterlab.com
Hack The Box Academy
Structured modules on pentesting, web, Active Directory and more, with free tiers.
academy.hackthebox.com
VulnHub
Downloadable vulnerable virtual machines to practise pentesting offline.
vulnhub.com
Root Me
Hundreds of free challenges across web, crypto, forensics, networking and reversing.
root-me.org
Google CTF
Google's annual CTF, with a Beginner's Quest and past challenges to try.
capturetheflag.withgoogle.com
SANS Holiday Hack Challenge
A free, story-driven yearly CTF with talks, suitable for beginners and experts.
sans.org
CTF Wiki
A wiki covering the techniques behind every major CTF category.
ctf-wiki.org
Trail of Bits CTF Field Guide
A classic guide to getting started in CTFs, from forensics to exploitation.
trailofbits.github.io
Awesome CTF
A curated list of CTF frameworks, tools, resources and practice sites.
github.com
Awesome Hacking
A collection of awesome lists for hackers, pentesters and security researchers.
github.com
Awesome Security
A curated list of security software, libraries, documents and resources.
github.com
Kali Linux Documentation
Official docs for installing and using Kali, the standard pentesting distro.
kali.org
Burp Suite Community Edition
The free edition of the standard proxy for intercepting and testing web traffic.
portswigger.net
Wireshark
The standard network protocol analyser for capturing and inspecting packets.
wireshark.org
Nmap Network Scanning
The official Nmap book by its author, with much of it free online.
nmap.org
Ghidra
The NSA's free and open source reverse engineering suite with a decompiler.
github.com
IDA Free
The free edition of IDA, the industry-standard disassembler and decompiler.
hex-rays.com
radare2
A free, scriptable command-line framework for reverse engineering binaries.
rada.re
x64dbg
An open source Windows debugger widely used for reversing and malware analysis.
x64dbg.com
Metasploit Unleashed
OffSec's free course on using the Metasploit Framework.
offsec.com
Hashcat
The fastest password recovery tool, using your GPU to crack hashes.
hashcat.net
John the Ripper
A classic open source password cracker supporting hundreds of hash types.
openwall.com
ffuf
A fast web fuzzer for discovering hidden directories, files and parameters.
github.com
Exploit Database
An archive of public exploits and vulnerable software, maintained by OffSec.
exploit-db.com
CVE Program
The official catalogue of publicly disclosed security vulnerabilities.
cve.org
Shodan
A search engine for internet-connected devices, used in recon and research.
shodan.io
Have I Been Pwned
Check whether an email address has appeared in a known data breach.
haveibeenpwned.com
Nightmare
An intro to binary exploitation and reversing taught through past CTF challenges.
guyinatuxedo.github.io
ROP Emporium
Challenges that teach return-oriented programming one technique at a time.
ropemporium.com
Exploit Education
Free VMs like Phoenix and Nebula for learning memory corruption and privilege escalation.
exploit.education
pwnable.kr
A long-running wargame of binary exploitation challenges, from easy to brutal.
pwnable.kr
pwnable.tw
Harder binary exploitation challenges for when you outgrow the basics.
pwnable.tw
pwntools
The Python library CTF players use to write exploits and talk to remote services.
docs.pwntools.com
pwndbg
A GDB plugin that makes debugging and exploit development far more pleasant.
github.com
Hacking, The Art of Exploitation
A classic book on C, assembly, memory corruption and networking from a hacker's view.
nostarch.com
Reverse Engineering for Beginners
Dennis Yurichev's free book on reading compiled code across architectures.
beginners.re
crackmes.one
Community-made crackme programs to practise reverse engineering.
crackmes.one
Microcorruption
A browser-based embedded security CTF where you debug and exploit a fake lock.
microcorruption.com
OpenSecurityTraining2
Free in-depth courses on assembly, reversing, firmware and OS internals.
p.ost2.fyi
Malware Unicorn RE101
A free workshop introducing reverse engineering of Windows malware.
malwareunicorn.org
Practical Malware Analysis
The classic hands-on book on dissecting malicious software.
nostarch.com
Awesome Malware Analysis
A curated list of malware analysis tools and resources.
github.com
Sysinternals
Microsoft's free Windows utilities for inspecting processes, files and the registry.
learn.microsoft.com
Volatility 3
The leading open source framework for memory forensics.
github.com
Autopsy
A free digital forensics platform for analysing disk images.
autopsy.com
13Cubed
A YouTube channel with clear, practical videos on digital forensics and incident response.
youtube.com
The DFIR Report
Detailed write-ups of real intrusions, from initial access to ransomware.
thedfirreport.com
Awesome Incident Response
A curated list of tools and resources for incident response.
github.com
SANS Posters and Cheat Sheets
Free posters and cheat sheets on forensics, incident response and more.
sans.org
MITRE ATT&CK
The knowledge base of real-world attacker tactics and techniques used by defenders.
attack.mitre.org
Blue Team Labs Online
Defensive challenges and investigations on forensics, threat hunting and incident response.
blueteamlabs.online
CyberDefenders
Blue team labs where you investigate real-looking incidents with SOC tools.
cyberdefenders.org
LetsDefend
A simulated SOC where you triage alerts and investigate incidents.
letsdefend.io
Splunk Boss of the SOC
Splunk's blue team CTF datasets for practising log investigation.
bots.splunk.com
Sigma
An open, generic format for writing detection rules that work across SIEMs.
github.com
Security Onion Docs
Docs for a free platform for threat hunting, monitoring and log management.
docs.securityonion.net
Wazuh
An open source SIEM and XDR platform you can run in a home lab.
wazuh.com
Zeek
An open source network monitor that turns traffic into rich logs.
zeek.org
Suricata
An open source intrusion detection and prevention engine.
suricata.io
flAWS
A free challenge that teaches common AWS security mistakes level by level.
flaws.cloud
flAWS 2
The sequel to flAWS, with attacker and defender paths through AWS.
flaws2.cloud
CloudGoat
A vulnerable-by-design AWS environment for practising cloud attacks.
github.com
HackTricks Cloud
HackTricks for AWS, GCP, Azure, Kubernetes and CI/CD security.
cloud.hacktricks.wiki
Pwned Labs
Cloud security labs on AWS, Azure and GCP, with free starter labs.
pwnedlabs.io
Cryptopals
Hands-on challenges where you break real cryptography by writing code.
cryptopals.com
CryptoHack
A fun platform to learn modern cryptography by solving challenges.
cryptohack.org
Cryptography I
Dan Boneh's famous Stanford course on how cryptographic primitives work.
coursera.org
Crypto 101
A free introductory book on cryptography for programmers.
crypto101.io
Serious Cryptography
A practical introduction to modern encryption and how it fails.
nostarch.com
Security Engineering
Ross Anderson's classic book on building dependable systems, free to read online.
cl.cam.ac.uk
OSINT Framework
A clickable map of open source intelligence tools grouped by what you're looking for.
osintframework.com
Awesome OSINT
A curated list of OSINT tools and resources.
github.com
Bellingcat Online Investigations Toolkit
Bellingcat's catalogue of tools for open source investigations.
bellingcat.gitbook.io
ired.team
Red team notes on offensive techniques, Active Directory and Windows internals.
ired.team
GOAD
Game of Active Directory, a vulnerable AD lab you can build at home.
github.com
IppSec
Detailed video walkthroughs of retired Hack The Box machines.
youtube.com
ippsec.rocks
Search every IppSec video by technique to jump to the exact moment.
ippsec.rocks
0xdf hacks stuff
Thorough written write-ups for Hack The Box machines and CTF challenges.
0xdf.gitlab.io
InfoSec Write-ups
A large collection of community write-ups on bug bounties, CTFs and security.
infosecwriteups.com
LiveOverflow
Deep, curious videos on binary exploitation, web hacking and CTFs.
youtube.com
John Hammond
CTF walkthroughs, malware analysis and security news on YouTube.
youtube.com
NetworkChuck
Energetic beginner videos on networking, Linux and hacking.
youtube.com
NahamSec
Videos and streams on recon and bug bounty hunting.
youtube.com
TCM Security
Free full-length courses on ethical hacking, Python and pentesting.
youtube.com
HackerSploit
Tutorials on pentesting tools, Linux and red and blue team techniques.
youtube.com
David Bombal
Networking and cybersecurity tutorials and interviews with practitioners.
youtube.com
pwn.college on YouTube
Lecture videos that accompany the pwn.college modules.
youtube.com
Darknet Diaries
A gripping podcast of true stories from the dark side of the internet.
darknetdiaries.com
Risky Business
A long-running weekly podcast on security news and analysis.
risky.biz
tl;dr sec
A weekly newsletter of the best security tools, talks and articles.
tldrsec.com
Krebs on Security
Brian Krebs' investigative journalism on cybercrime and breaches.
krebsonsecurity.com
Phrack
The legendary hacker zine, publishing deep technical articles since 1985.
phrack.org
r/netsec
A subreddit for technical security news, research and tools.
reddit.com
Nothing here matches those filters.