InfoSec Learning Resources
General
- https://s3ctur.wordpress.com/2017/06/19/breaking-into-infosec-a-beginners-curriculum/
- https://www.blackhillsinfosec.com/webcast-5-year-plan-infosec/
- https://immersivelabs.com/ : Training platform for CyberSec
- https://netsec.ws/?p=468 : A way to becoming a security "expert"
- http://www.mrjoeyjohnson.com/Google.Hacking.Filters.pdf : How to search effectively on Google
- https://overthewire.org/wargames/bandit/ : Training platform with several levels of difficulty
- https://linuxsurvival.com/linux-tutorial-introduction/ : Learn Linux
- www.tldp.org/guides.html : The Linux Documentation Project Guides
- https://www.explainshell.com/ : Allows you to dissect a shell command line
- https://guide.bash.academy/ : Bash Guide
- https://kali.training/downloads/Kali-Linux-Revealed-1st-edition.pdf : PDF Kali-Linux Revealed 1st Edition
- http://pages.cs.wisc.edu/~remzi/OSTEP/ : Operating Systems: Three Easy Pieces
Offensive
Network Pentesting
- http://howto.hackallthethings.com/2016/07/learning-exploitation-with-offensive.html : FSU Pentesting Course
- https://ch1kpee.com/cns320-intro-to-pentesting/ : CNS320 - Intro to pentesting
- https://github.com/enaqx/awesome-pentest : Awesome Penetration Testing
- https://gist.github.com/jivoi/724e4b4b22501b77ef133edc63eba7b4 : OffSec Workflow
- https://github.com/AonCyberLabs/Windows-Exploit-Suggester : Windows Exploit Suggester
- https://github.com/jivoi/awesome-osint : Awesome OSINT
- https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet : MobileAPP-Pentest-Cheatsheet
- http://opensecuritytraining.info/Training.html
- https://rmusser.net : Musser's infosec Reference (repo)
- https://chryzsh.gitbooks.io/darthsidious/content/ : Creating Windows domain and hacking it
- https://adsecurity.org/ : All things Active Directory
- https://github.com/yeyintminthuhtut/Awesome-Red-Teaming : Awesome Red Teaming
- https://github.com/dloss/python-pentest-tools : Python Pentesting Tools
Pentesting Workshops
- https://github.com/sagishahar/lpeworkshop : Windows/Linux Priv Esc Workshop
WebApp Pentesting
- https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet/blob/master/README.md : Mobile App Pentest Cheatsheet
- https://www.amanhardikar.com/mindmaps/webapptest.html : Web App Testing Mindmap
- https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/ : NetSparker SQL Injection Cheat Sheet
- http://securityidiots.com/Web-Pentest : Security Idiots Guide to Web Pentesting
- https://websec.files.wordpress.com/2010/11/sqli2.pdf : SQLi filter evasion and obfuscation
- https://www.troyhunt.com/owasp-top-10-for-net-developers-part-1/ : Troy Hunt OWASP Top 10 for .net developpers
Vulnerable Web Apps/Labwork
- https://sourceforge.net/projects/mutillidae/ : Mutillidae, OWASP Top 10
- https://github.com/Audi-1/sqli-labs : Audi-1's SQLi Labs
- https://github.com/bkimminich/juice-shop : Juice Shop, Javascript OWASP targets
Exploit Dev
Classes/Guides
- https://github.com/RPISEC/MBE : Course materials for Modern Binary Exploitation by RPISEC
- https://github.com/RPISEC/Malware : Course materials for Malware Analysis by RPISEC
- https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ : Corelan - BOF
- http://www.fuzzysecurity.com/tutorials/mr_me/1.html - Windows Heap Exploitation
- http://www.fuzzysecurity.com/tutorials/expDev/1.html : Windows exploitation series
- https://azeria-labs.com/writing-arm-assembly-part-1/ : Azeria, intro to writing ARM Assembly
- https://www.coursera.org/learn/software-security : Courser - Software Security
Youtube
- https://www.youtube.com/channel/UCCkVMojdBWS-JtH7TliWkVg : GynvaelEN
- https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w : LiveOverflow
Privilege Escalation
- www.greyhathacker.net/?p=738 : Windows: exploiting folder permissions
- http://www.fuzzysecurity.com/tutorials/16.html : Windows: Privilege Escalation Fundamentals
- https://github.com/AonCyberLabs/Windows-Exploit-Suggester : Windows: Windows-Exploit-Suggester
- http://pwnwiki.io/#!privesc/windows/index.md : Windows Privilege Escalation Commands
- https://www.youtube.com/watch?v=PC_iMqiuIRQ : Practical Windows Privilege Escalation
- http://pwnwiki.io/#!presence/windows/blind.md : Windows Blind Files
- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ : Basic Linux Privilege Escalation
- www.securitysift.com/download/linuxprivchecker.py : Linux: linuxprivchecker.py
- https://github.com/rebootuser/LinEnum : Scripted Local Linux Enumeration & Privilege Escalation Checks
- http://pwnwiki.io/#!presence/linux/blind.md : Linux Blind Files
- https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/ : MySQL Root to System Root with UDF
- https://github.com/hfiref0x/UACME : Defeating Windows User Account Control
- https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells : Escape rbash
- https://netsec.ws/?p=337 : Cheatsheet for Spawing TTY Shells
- https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/ : Windows Privilege Escalation Guide
- https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/ : Windows privilege esc
Wireless Pentesting
- https://drive.google.com/drive/folders/0BwFgM9oAhmd_c2JJaG1iUmhkZTg : Advanced Wireless Network Attacks 2018
- https://www.sans.org/blog/wireless-tips-tricks-and-resources/ : Wireless Tips, Tricks and Resources
- https://medium.com/@adam.toscher/new-attack-on-wpa-wpa2-using-pmkid-96c3119f7f99 : WPA/WPA2 PMKID Attacks
Hardware
- https://hackmethod.com/hacking-mifare-rfid/?v=79cba1185463 : Hacking MIFARE & RFID
- https://scund00r.com/all/rfid/2018/06/ : 05/proxmark-cheatsheet.html : scund00r's Proxmark 3 Cheat Sheet
- https://scund00r.com/all/rfid/tutorial/2018/07/12/rfid-theif-v2.html : scund00r's RFID Thief guide
- https://github.com/rfidtool/ESP-RFID-Tool : ESP-RFID-Tool
Cloud Pentesting
- https://rhinosecuritylabs.com/penetration-testing/penetration-testing-aws-cloud-need-know/ : INTRODUCTION TO PENETRATION TESTING IN AWS
Cloud Pentesting Challenges
Public Exploits
- https://www.exploit-db.com/ : Exploit Database
- https://www.exploitee.rs/index.php/Main_Page : IoT and HW security
- arm.ninja : Binary Ninja and ARM
- https://azeria-labs.com/writing-arm-assembly-part-1/ : Azeria-Labs ARM tutorials
ARM RE/Exploit dev
- https://www.root-me.org/en/Challenges/App-System/ELF-ARM-Race-condition : Root-me ARM challenges
- https://github.com/Billy-Ellis/Exploit-Challenges : collection of vulnerable ARM binaries for practicing exploit development
- https://beginners.re/ : Reverse Engineering for Beginners
- https://azeria-labs.com/
Programming
Bash
- https://github.com/g0tmi1k/os-scripts : G0tmi1k OS scripts for bash (Examples)
- https://www.tldp.org/LDP/Bash-Beginners-Guide/html/ : Bash Guide to Beginners
- https://wiki.bash-hackers.org/start : Bash Hackers Wiki page
- https://guide.bash.academy/ : Bash Academy (Exercises)
- https://cmdchallenge.com/ : Cmdchallenge (Bash Challenges)
Python
- https://www.youtube.com/watch?v=cKPlPJyQrt4 : So you want to be a Python expert?
- https://www.youtube.com/user/sentdex/ : Sentdex Python Tutorials
- https://learnxinyminutes.com/docs/python3/ : Beginner's Cheat Sheet
- https://www.cheatography.com/davechild/cheat-sheets/python/ : Intermediate Cheat Sheet/Reference Page
- http://overapi.com/python : Interactive/Advanced Cheat Sheet/Resource Page
- https://exercism.io/tracks/python : Excercism Python Exercises
Powershell
- https://underthewire.tech/ : wargames.htm : Underthewire, overthewire for powershell
- https://www.youtube.com/watch?v=6fbotSZeFkQ&list=PL-giMT7sGCVJQIgB06ock6ptjKvSc-rXc : Mick Douglas, Powershell for Forensic
- https://www.irongeek.com/i.php?page=videos/hack3rcon5/h01-intro-to-powershell-scripting-for-security : Introduction to Powershell for Security
Go
- https://www.youtube.co/watch?v=G3PvTWRIhZAlist=PLQVvvaa0QuDeF3hP0wQoSxpkqgRcgxMqX : Practical Go
- https://tour.golang.org/welcome/1 : Google's official intro"
- https://gobyexample.com/ : Go by Example
- https://awesome-go.com/ : list of awesome Go frameworks, libraries and software
- https://exercism.io/tracks/go : Excercism GoLang Exercise
Misc Resources
- https://www.quandl.com/ : Quandl: Free Data Sample
- http://blog.commandlinekungfu.com/ : Commandline-Kungfu: Bash/Python/PS
- https://www.codecademy.com/catalog/subject/programming :
- archive.ics.uci.edu/ml/index.php : UCI Machine Learning Data Sets
- https://kevinchai.net/datasets : Kevin Chai's datasets
- https://www.datasciencecentral.com/profiles/blogs/great-sensor-datasets-to-prepare-your-next-career-move-in-iot-int : Data Science Central
- https://www.reddit.com/r/datasets/ : r/datasets
- www.dataset.puglia.it/dataset : Open Data (Italian)
- https://ti.arc.nasa.gov/tech/dash/groups/pcoe/prognostic-data-repository/ : NASA datasets
- https://registry.opendata.aws/ : Registry of Open Data on AWS
- https://www.pewresearch.org/download-datasets/ : Pew Research (pewpewpew)
- https://www.kaggle.com/datasets : Kaggle
- https://en.wikipedia.org/wiki/List_of_datasets_for_machine_learning_research : List of datasets for machine-learning research
C/C++
PHP
Assembly
Defense
Endpoints and DFIR
- aboutdfir.com : About DFIR* https://isc.sans.edu/forums/diary/Windows+Events+log+for+IRForensics+Part+2/21501/ : ISC Event Log analysis, IR
- https://www.youtube.com/user/davisrichardg/videos : 13Cubed Forensics videos/playlist
- https://www.botconf.eu/wp-content/uploads/2017/12/2017_tomonaga-muda-Hunting-Attacker-Activities.pdf : Hunting Attacker Activity: Lateral Movement
- http://opensecuritytraining.info/
- https://fl0x2208.wordpress.com/2016/10/03/forensics-where-to-start-and-what-to-know/ : Where to start
- https://countuponsecurity.com/2016/05/18/digital-forensics-shimcache-artifacts/ : Shimcache Artifacts
- https://www.amanhardikar.com/mindmaps/ForensicChallenges.html : Forensic Challenges Mindmap
- journeyintoir.blogspot.com/2011/04/introducing-digital-forensics-search.html : Aggregate Blog List
- https://github.com/meirwah/awesome-incident-response : Meirwah's Awesome Incident Response list
Hardening
- adsecurity.org : All Things Active Directory
- https://github.com/mattdoesinfosec/cis-audit-scripts - CIS Audit Scripts
- https://github.com/future-architect/vuls
- https://github.com/CISOfy/lynis
- https://www.youtube.com/watch?v=UiN4qmGVId0 : BSD - Securing Linux
Network Security Monitoring (NSM)
- http://www.malware-traffic-analysis.net/ : Malware-Traffic-Analysis.net, PCAP Analysis
- https://www.securitywizardry.com/
- https://packetlife.net/blog/2008/oct/18/cheat-sheets-tcpdump-and-wireshark/ : Packetlife TCPDump & Wireshark Cheat Sheets
- https://pcapr.net/home: PCAPr, benign PCAP samples
- https://www.cscan.org/download/?id=918 : Detecting packet fragmentation at the IDS (PDF)
RE and Malware Analysis
- https://www.samsclass.info/126/126_F13.shtml : am Bowne walks through the PMA
- https://zeltser.com/cheat-sheets/ : Zerltser's Cheat Sheets
- https://blog.stillztech.com/?view=sidebar : StillzTech Malware Series
- https://github.com/fdivrp/awesome-reversing : awesome-reversing
- https://forum.tuts4you.com/files/categories/ : Lena
- https://beginners.re/ : RE4B, Dennis Yurichev
- securitytrainings.net
- fumalwareanalysis.blogspot.com/2011/08/malware-analysis-tutorial-reverse.html : DrFu
- https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-crypton.pdf : Crypton: Exposing Malware's Deepest Secrets (PDF)
- https://github.com/RPISEC/Malware : Course materials for Malware Analysis by RPISEC
- https://www.reddit.com/r/ReverseEngineering/ : r/ReverseEngineering
Threat Intelligence
- https://github.com/hslatman/awesome-threat-intelligence : List of Awesome Threat Intelligence resources
Specialist Systems
- https://github.com/hslatman/awesome-industrial-control-system-security : List of resources related to Industrial Control System (ICS) security
- https://www.us-cert.gov/ics/Training-Available-Through-ICS-CERT : ICS CERT Training
- https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 : SANS ICS Kill Chain
- http://podcast.wh1t3rabbit.net/dtsr-episode-254-lowdown-and-dirty-ics : DTSR Podcast Dragos - Sergio
- https://dragos.com/blog.html
- https://scadahacker.com/ : SCADAhacker
- http://podcast.wh1t3rabbit.net/dtsr-episode-269-industrial-internet-of-things-iiot : DTSR Podcast Dragos Robert M Lee
- https://dl-acm-org.ezproxy01.rhul.ac.uk/ft_gateway.cfm?id=2492018&ftid=1384950&dwn=1&CFID=836767600&CFTOKEN=57696313 : The Air Gap: SCADA's Enduring Security Myth
- https://www.sans.org/reading-room/whitepapers/ICS : SANS Reading Room ISC/SCADA
Crypto
Tutorials & Guides
- https://github.com/TunnyTraffic/hashid : Hash Identifier guide by @vcsec
- http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html : Stick Figure Guide to AES
- openwall.info/wiki/john/sample-hashes : Sample hashes
- https://www.crypto101.io/
Challenges
Tools
- https://gchq.github.io/CyberChef/ : GCQH CyberChef Tools
- https://github.com/psypanda/hashID
- https://github.com/Ganapati/RsaCtfTool
- https://hashkiller.io/listmanager
- http://github.com/zardus/ctf-tools
Books
Lists
- https://www.sans.edu/cyber-research/book-reviews/article/security-books-best : SANS Recommend Security Books
Cryptography
- http://cacr.uwaterloo.ca/hac/ : Handbook of Applied Cryptography
Blogs
Learning and Training
- https://bitvijays.github.io/ : The Magic of Learning
Mainly Offensive
- https://blog.harmj0y.net/ : Harmjoy: Powershell & Pentesting
- https://highon.coffee/ : Pentesting & Cheatsheet
Mainly Defensive
- https://malware.dontneedcoffee.com/blog/ : Malware don't need coffee: Attack Breakdowns
- https://resources.digitalshadows.com/podcast-shadow-talk : ShadowTalk by Digital Shadows
General Security & News
- https://isc.sans.edu/ : SANS Internet Storm Center: News, Breakdowns, learnin
- www.irongeek.com : Irongeek's site, Sec Con recordings
- https://administraitor.video/ : Ministraitor's Security Con videos
CTF
Offensive Wargames and CTFs
- https://trailofbits.github.io/ctf/ : CTF Field Guide
- https://overthewire.org/wargames/bandit/ : Wargame: OTW Bandit
- https://overthewire.org/wargames/natas/ : Wargame: OTW Natas
- https://overthewire.org/wargames/leviathan/ :Wargame: OTW Leviatioan
- https://overthewire.org/wargames/narnia/ : Wargame: OTW Narnia
- pwnable.kr
- https://microcorruption.com : Microcorruption, Exercise/CTF
- https://www.root-me.org/
- https://www.wechall.net/active_sites
- https://captf.com/practice-ctf/
- https://crackmes.de/
- https://crackmes.one/
DFIR Challenges and CTFS
- https://picoctf.com/ : Pico CTF
- http://shell-storm.org/repo/CTF/ : CTF List
- aboutdfir.com/challenges-ctfs/ : aboutDFIR CTF Challenges
- https://ctf.wcsc.usf.edu/
- https://ringzer0ctf.com/
- https://www.netresec.com/?page=pcapfiles
- https://defcon2018.ctfd.io/login?next=%2Fchallenges%3F : DEFCON DFIR Challenges
- https://www.malware-traffic-analysis.net/ : PCAPs of ine-the-wild EKs, etc
- https://www.amanhardikar.com/mindmaps/ForensicChallenges.html : A collection of DFIR Challenges
Self Hosted Labs
- https://github.com/Audi-1/sqli-labs : SQLI labs to test error based, Blind boolean based, Time based.
- https://github.com/Sliim/pentest-lab : Pentest Lab on OpenStack with Heat, Chef provisioning and Docker
- https://github.com/bkimminich/juice-shop : OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- https://www.vulnhub.com/
General Labs Building
- https://adsecurity.org/?p=2653 : Building an Effective Active Directory Lab
- http://www.brianlinkletter.com/open-source-network-simulators/ : Open Source Network Simulators
- https://www.youtube.com/watch?v=8jYibgeAV0Y&feature=youtu.be : Whole-network VPN with pfSense Router
- https://www.splunk.com/en_us/blog/security/boss-of-the-soc-scoring-server-questions-and-answers-and-dataset-open-sourced-and-ready-for-download.html : Splunk Boss of the SOC (Blue Team)
OffSec
Other Resources
- https://www.contextis.com/blog/logging-like-a-lumberjack : Logging Like a Lumberjack
- https://gist.github.com/sudomain/d88eef3dde6b174f4176b57aacca8f4d : How to Learn MOOC
-
- https://jivoi.github.io/2015/07/03/offensive-security-bookmarks/ : Offensive Security Bookmarks
OSCP/PWK Preparation
- https://www.abatchy.com/search/label/OSCP%20Prep : A Llama's guide to OSCP Prep
- https://www.abatchy.com/2017/02/oscp-like-vulnhub-vms.html : OSCP-like Vulnhub VMs
- niiconsulting.com/checkmate/2017/06/a-detail-guide-on-oscp-preparation-from-newbie-to-oscp/ : Detailed Guide on OSCP Preparation – From Newbie to OSCP
- https://support.offensive-security.com/#!oscp-exam-guide.md : Offsec OSCP exam guide
- https://www.youtube.com/playlist?list=PLK5YOQDpZKK2GtfxOHw9LQZl3z_f74EoR : OSCP-like VM YouTube playlist
OSWE/AWAE Preparation
- https://github.com/wetw0rk/AWAE-PREP : wetw0rk's prep guide
Pentesting Report Examples
- https://github.com/juliocesarfort/public-pentesting-reports : Public Pentesting Reports
Vetting in progress
- https://postmodernsecurity.com/2015/09/11/malware-analysis-and-incident-response-tools-for-the-frugal-and-lazy/ : Malware Analysis and Incident Response
- https://www.youtube.com/watch?v=6fbotSZeFkQ&list=PL-giMT7sGCVJQIgB06ock6ptjKvSc-rXc : Powershell training