Bookmarks

Curated links and external resources

Curated Collection: Unique and valuable resources for security research, infrastructure, and systems engineering. No fluff - just the tools and sites that actually matter.

No-Cost Security Services (CISA curated)

Cloudflare DDoS Protection

Free edge protection against volumetric and L7 attacks

Cloudflare Zero Trust

Access proxy, DNS filtering, and identity-aware controls

Project Shield

Google's free DDoS protection for news, human rights, and elections sites

Quad9

Anycast DNS filtering with malware blocking (free)

Let's Encrypt

Automated free TLS certificates

Zed Attack Proxy (ZAP)

Open-source web application security testing proxy

Burp Suite Community

Free edition of the Burp interception proxy for web testing

Semgrep

Lightweight static analysis for code and IaC

Checkov

IaC security scanning for Terraform, K8s, CloudFormation, ARM/Bicep

Tsunami Security Scanner

Automated network vulnerability scanner with plugin system

runZero Community

Asset discovery without agents

OpenVAS / Greenbone

Open-source vulnerability scanning platform

Nessus Essentials

Free vulnerability scanner for up to 16 IPs

Grype

SBOM-aware vulnerability scanner for container images

Syft

SBOM generator for images, directories, and archives

Blumira Free SIEM

Cloud SIEM with detections and alerting for small environments

Elastic Security

Free tier for SIEM detections and endpoint integrations

Security Onion

Network security monitoring and log analysis distro

Clear NDR Community (SELKS)

Suricata-centered IDS/NSM stack

UTMStack Open Source

SIEM/XDR platform with free tier

Velociraptor

Endpoint visibility, hunting, and IR at scale

Timesketch

Collaborative digital forensics timeline analysis

Turbinia

Scalable digital forensics and incident response automation

dfTimewolf

DFIR data acquisition and processing automation

GRR Rapid Response

Remote live forensics framework

CISA Free Tools (Full List)

Complete list of free cybersecurity services from CISA

Security Research

Wireless Security

Will Hack For SUSHI

Josh Wright's wireless security research and tools

Wigle.net

Worldwide wireless network mapping

Kismet Wireless

Wireless network detector and sniffer

Security Tools & Resources

GTFOBins

Unix binaries for bypassing local security restrictions

LOLBAS

Living Off The Land Binaries (Windows)

HackTricks

Massive collection of hacking tricks

PayloadsAllTheThings

Payloads and bypasses for web security

CyberChef

Encryption, encoding, and data analysis

Cover Your Tracks

Browser fingerprinting test

Objective-See

Free macOS security tools

GreyNoise

Internet threat intelligence

Shodan

Search engine for IoT devices

Censys

Internet-wide scanning

Test My NIDS

Test intrusion detection systems

Active Directory

BloodHound

AD attack path mapping and privilege escalation analysis

PingCastle

AD security assessment with risk scoring

Purple Knight

Community AD security assessment from Semperis

Threat Intelligence

VirusTotal

Multi-engine file and URL scanner

AbuseIPDB

IP address abuse reporting and lookup database

URLScan.io

URL scanning and website analysis

AlienVault OTX

Open threat intelligence community and indicators

DFIR & Forensics

Autopsy

Open-source digital forensics platform

Eric Zimmerman Tools

Free forensic tools for registry, MFT, shellbags, timeline analysis

KAPE

Kroll Artifact Parser and Extractor target and module files

Bug Bounty

HackerOne

Bug bounty and vulnerability disclosure platform

Bugcrowd

Crowdsourced security testing and bug bounty programs

Intigriti

European bug bounty and responsible disclosure platform

Exploits & Learning

Exploit Database

Archive of exploits

Packet Storm

Security tools and advisories

Web Security Academy

Free online security training

SANS Reading Room

Free security research papers

Krebs on Security

In-depth security news

SkullSecurity

Security research and tutorials

Hackaday

Hardware hacking and maker news

3Blue1Brown

Math and CS education videos

Cloud & Infrastructure

AWS Architecture Center

Reference architectures

AWS Health Dashboard

Real-time service status

Instance.fyi

EC2 instance comparison

Prowler

AWS security assessment

Homelab & Self-Hosting

Awesome Self-Hosted

Curated list of self-hostable software across every category

LinuxServer.io

Well-maintained Docker images for self-hosted apps

Docker Hub

Container image registry and discovery

Linux, macOS & Systems

macOS

Homebrew

Package manager for macOS and Linux

mas-cli

Mac App Store command line interface

Tools You Should Know

ExplainShell

Parse shell commands

ShellCheck

Script static analysis

regex101

Regex tester

Crontab Guru

Cron schedule editor

SSL Labs

TLS configuration analyzer

Mozilla Observatory

Website security scanner

CIS Benchmarks

Security configuration guides

Ninite

Install and update multiple Windows applications at once

Ubuntu Keyserver

OpenPGP public key server

Networking

icanhazip

Simple public IP lookup (ipv4/ipv6 subdomains available)

MXToolbox

DNS and email diagnostics

AdGuard DNS

Privacy-focused public DNS

NTP Pool Project

Public NTP time servers

ntop

Network traffic monitoring and analysis tools

Wireshark Docs

Official Wireshark documentation and user guide

PacketTotal

PCAP analysis and threat detection

Development & Scripting

Learning

The Missing Semester

MIT course on shell, vim, git, debugging and other tools CS classes skip

Build Your Own X

Tutorials for building your own database, OS, shell, game engine, etc.

Learn X in Y Minutes

Quick syntax overviews for dozens of languages

Roadmap.sh

Developer roadmaps for backend, frontend, DevOps, and more

12 Factor App

Methodology for building modern, deployable applications

Python

Python Docs

Official Python 3 documentation

Real Python

Tutorials and guides beyond the basics

Python Module of the Week

In-depth standard library guides

Full Stack Python

Comprehensive guide to Python web development

PyPI

Python Package Index

JavaScript & Web

MDN Web Docs

The definitive web development reference

JavaScript.info

Modern JavaScript tutorial from basics to advanced

npm

Node.js package registry

Bundlephobia

Check the size cost of adding an npm package

Other Languages

Go by Example

Hands-on introduction to Go with annotated examples

The Rust Book

Official Rust programming language book

crates.io

Rust package registry

pkg.go.dev

Go package discovery and documentation

CLI Tools Worth Installing

jq

Command-line JSON processor

fzf

Fuzzy finder for the terminal

ripgrep

Fast recursive search that respects .gitignore

bat

cat with syntax highlighting and git integration

fd

Fast, user-friendly alternative to find

zoxide

Smarter cd that learns your most-used directories

Starship

Fast, customizable cross-shell prompt

HTTPie

Human-friendly HTTP client for the terminal

Hurl

Run and test HTTP requests from plain text files

API Testing

Postman

API development and testing platform

Git & Version Control

Oh Shit, Git!?!

Fix common Git mistakes

Git Flight Rules

What to do when things go wrong

Conventional Commits

Commit message specification

Semantic Versioning

Version numbering standard (MAJOR.MINOR.PATCH)

Keep a Changelog

Guidelines for maintaining a changelog

pre-commit

Framework for managing git pre-commit hooks

Task Runners & CI

Taskfile

Task runner written in Go, simpler alternative to Make

just

Command runner like make but focused on running commands

act

Run GitHub Actions locally for testing

AI & LLM Tools

Ollama

Run open-source LLMs locally

LM Studio

Desktop app for running local LLMs with a chat UI

OpenRouter

Unified API for multiple LLM providers

Anthropic Docs

Claude API documentation and guides

Privacy

Privacy Guides

Recommendations for privacy-respecting tools and services

EFF Tools

Electronic Frontier Foundation's privacy and security tools

Data & Visualization

JSON Crack

Visualize JSON as graphs

Transform

Transform JSON, GraphQL, XML

Research & Analytics

Google Trends

Explore search trends and interest over time

Wayback Machine

Internet Archive's historical website snapshots

Archive.is

Take permanent snapshots of web pages

Wolfram Alpha

Computational knowledge engine

Standards & References

Vulnerability & Threat Databases

NIST NVD

National Vulnerability Database

CVE MITRE

Common Vulnerabilities and Exposures

CWE MITRE

Common Weakness Enumeration - software flaw categories

CPE MITRE

Common Platform Enumeration - product naming standard

CISA KEV Catalog

Known exploited vulnerabilities that require action

CVSS Calculator

FIRST's official CVSS v4.0 scoring calculator

EPSS

Exploit Prediction Scoring System - probability a CVE will be exploited

Frameworks & Threat Models

MITRE ATT&CK

Adversary tactics, techniques, and procedures knowledge base

MITRE D3FEND

Defensive technique knowledge base - countermeasures to ATT&CK

CAPEC

Common Attack Pattern Enumeration and Classification

STIX/TAXII

Structured threat information expression and exchange standards

OWASP Top 10

Web application security risks

NIST CSF Tools

Interactive Cybersecurity Framework browser and mapper

Compliance & Governance

NIST SP 800 Series

Security and privacy guidelines (800-53, 800-171, etc.)

ISO 27001

Information security management standard

PCI Security Standards

Payment Card Industry data security standards

Internet Standards & Protocols

RFC Editor

Internet standards documentation

IETF RFCs

Internet Engineering Task Force standards

IANA

Internet Assigned Numbers Authority - IP, DNS, protocol assignments

IANA Port Numbers

Official service name and port number registry

HTTP Status Codes

Complete HTTP status code reference with explanations

Command & API References

SS64

Command line reference for Windows, macOS, Linux, SQL, and more

PowerShell Docs

Official Microsoft PowerShell documentation

Windows Registry Reference

Official Windows registry documentation