sec-resources

My collection of interesting security resources (tools, training, news feeds, etc).

This is not intended to be a comprehensive list, just some of my favorites. You will surely have your own favorites. Feel free to share them with me :)

---

tools

• pentesting

  • https://www.kali.org/
  • https://offsec.tools/

• dynamic analysis

  • https://portswigger.net/burp/
  • https://www.zaproxy.org/
  • https://securityheaders.com/
  • https://www.ssllabs.com/ssltest/
  • https://testssl.sh/ (like ssltest, but run locally)
  • https://requestbin.net

• static analysis

  • https://semgrep.dev/

• malware analysis

  • https://www.hybrid-analysis.com/
  • scdbg - shellcode debugger

• osint

  • https://securitytrails.com/
  • https://www.shodan.io/
  • https://natlas.io/
  • https://fofa.info/
  • https://fullhunt.io/

• vulnerability search

  • https://nvd.nist.gov/vuln/search
  • https://www.exploit-db.com/
  • https://cve.mitre.org/cve/search_cve_list.html

• decoders

  • https://cyberchef.io/

• active directory

  • https://github.com/BloodHoundAD/BloodHound

---

free training

• security job interview

  • Grace Nolan's Notes

• web application

  • Burp Suite Academy

• binary analysis

  • Do Stack Buffer Overflow Good
  • Reverse Engineering 101

• network and system

  • OverTheWire
  • Hack The Box
  • Vulnhub
  • Metasploitable
  • IppSec
  • fuzzysecurity
  • picoctf
  • tryhackme

---

blogs and news

• All InfoSec News
• Daniel Miessler
• Jason Haddix
• Brian Krebs
• Bruce Schneier
• Scott Helme
• tl;dr sec
• APIsecurity.io
• CloudSecList
• Recorded Future
• Threatpost
• Dark Reading
• Talos
• Fireye
• CISA
• Microsoft Security Response Center
• Microsoft Security Blog
• Google Security
• SANS OUCH
• EFF
• ZDNet
• CIS
• Naked Security
• Tripwire
• Verizon DBIR
• Active Directory