#Security list for fun and profit
My initial idea came from this list : http://www.nothink.org/utilities.php
I wanted to update it with my sources, I will probably continue to update and reorganize it in the future.
- Awesome lists
- Books
- Bug bounty
- Cheat sheets
- CTF
- Decoder/Packer/Unpacker
- Domain Research / Analysis / Reputation
- Exercises
- Exploits and vulnerabilities
- Forensic - Network
- Fingerprint
- Free shell
- Fun
- Generic utilities
- GNU/Linux
- Honeypots
- IP Research / Analysis / Investigation
- Leak / Defaced
- Mail utilities
- Malicious traffic detection
- Malware / Botnet sources
- Malware analysis - Sandbox
- Malware analysis - Sandbox - Online
- OS X
- Passwords
- Penetration testing / Tools
- Port scanners
- Search engines
- Security challenges / WarGames
- Social engineering
- SSL
- Tor resources
- VOIP
- VPN
- Vulnerable environments
- Web browser
- Wide Scans
- Windows
- Wireless
| Name | URL |
|---|---|
| Owasp cheat sheet series | https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series |
| Web application cheat sheet | https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet |
| Pentest monkey | http://pentestmonkey.net |
| Packet life | http://packetlife.net/library/cheat-sheets/ |
| Reverse | http://r00ted.com/cheat%20sheet%20reverse%20v5.png |
| SANS Forensic | https://digital-forensics.sans.org/community/cheat-sheets |
| Penetration test | https://github.com/jshaw87/Cheatsheets |
| Penetration Test | https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/ |
| SQL injection | http://websec.ca/kb/sql_injection |
| LFI | https://highon.coffee/blog/lfi-cheat-sheet/ |
| Zeltser's cheat sheets list | https://zeltser.com/cheat-sheets/ |
| General cheat sheets | http://www.cheat-sheets.org/ |
| Name | URL |
|---|---|
| CTFTIME | https://ctftime.org/ |
| Write-ups | https://github.com/ctfs |
| https://www.reddit.com/r/securityctf | |
| Tools list | https://github.com/Laxa/HackingTools |
| Tools list | https://github.com/zardus/ctf-tools |
| Tools list | https://github.com/apsdehal/awesome-ctf |
| Tinyctf platform | https://github.com/balidani/tinyctf-platform |
| Isislab platform | https://github.com/isislab/CTFd |
| Facebook platform | https://github.com/facebook/fbctf |
| Mellivora platform | https://github.com/Nakiami/mellivora |
| Name | URL |
|---|---|
| Essential basics | https://github.com/alex/what-happens-when |
| Reverse - Malware | http://fumalwareanalysis.blogspot.se/p/malware-analysis-tutorials-reverse.html |
| Network - Malware | http://www.malware-traffic-analysis.net/training-exercises.html |
| Network - Forensic | https://www.honeynet.org/node/504 |
| Exploits | https://exploit-exercises.com/ |
| Exploits | https://thesprawl.org/research/ |
| Basics with F-Secure | http://mooc.fi/courses/2016/cybersecurity/ |
| Name | URL |
|---|---|
| Owasp list | https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/Offline |
| Owasp BWA | https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project |
| DVWA | http://www.dvwa.co.uk/ |
| WebGoat | http://code.google.com/p/webgoat |
| Metasploitable 3 | https://github.com/rapid7/metasploitable3/wiki |
| VulnHub | http://vulnhub.com/ |
| LampSecurity | http://sourceforge.net/projects/lampsecurity/ |
| Dragon | https://www.dragonresearchgroup.org/challenges/ |
| Hackademic-RTB1 | http://www.aldeid.com/wiki/Hackademic-RTB1 |
| Moth | http://www.bonsai-sec.com |
| Peruggia | http://sourceforge.net/projects/peruggia/ |
| XSS play ground | http://xssplayground.net23.net/ |
| Name | URL |
|---|---|
| Many books | https://yadi.sk/d/Fkww0QKbuTdVF 🏆 |
| Name | URL |
|---|---|
| Programs and write-ups | https://github.com/djadmin/awesome-bug-bounty |
| Write-ups | https://github.com/ngalongc/bug-bounty-reference |
| HackerOne | https://hackerone.com |
| BugCrowd.com | https://bugcrowd.com/programs |
| Zerodium | https://www.zerodium.com/ |
| Vul box | https://www.vulbox.com/ |
| Open bug bounty | https://www.openbugbounty.org/ |
| BountyFactory | https://bountyfactory.io |
| Firebounty | https://firebounty.com |
| Bugsheet | http://www.bugsheet.com/ |
| BountySource | https://www.bountysource.com/ |
| NewsLetter about bug bounty | http://bugbountyweekly.com |
| Hunter edu | http://www.bountyhunteredu.org/careers/ |
| https://www.google.com/about/appsecurity/reward-program/ | |
| Microsoft | https://technet.microsoft.com/en-us/security/dn425036 |
| More bug bounty | https://bugcrowd.com/list-of-bug-bounty-programs# |
| Name | URL |
|---|---|
| ZoomEye | https://zoomeye.org/ 👍 |
| Shodan | https://www.shodan.io/ |
| Censys | https://censys.io/ |
| Gegereka | http://gegereka.com/ (not always up) |
| https://www.google.com/advanced_search | |
| Google dorks | https://gist.github.com/zbetcheckin/04e6a5d7f2d5ef8cfa3c298701f47f9c |
| List of search engines | https://en.wikipedia.org/wiki/List_of_search_engines |
| Name | URL |
|---|---|
| https://www.reddit.com/r/SocialEngineering/ | |
| List of social network | https://en.wikipedia.org/wiki/List_of_social_networking_websites |
| Hunter | https://hunter.io/ |
| Pipl | https://pipl.com/ |
| Peek you | http://www.peekyou.com/ |
| Yatedo | http://www.yatedo.com/ |
| Lullar | http://com.lullar.com/ |
| Lakako | http://www.lakako.com/ |
| Yasni | http://www.yasni.com/ |
| User search | https://usersearch.org/ |
| https://www.google.com/advanced_search | |
| Google dorks | intext:lastName firstName |
| Google dorks | insubject:lastName firstName |
| Google dorks | `intext:lastName firstName filetype:pdf |
| Bing | https://www.bing.com/ |
| Bing dorks | lastName firstName (filetype:doc OR filetype:ppt OR filetype:pps OR filetype:xls OR filetype:docx OR filetype:pptx OR filetype:ppsx OR filetype:xlsx OR filetype:sxw OR filetype:sxc OR filetype:sxi OR filetype:odt OR filetype:ods OR filetype:odg OR filetype:odp OR filetype:pdf OR filetype:wpd OR filetype:svg OR filetype:svgz OR filetype:indd OR filetype:rdp OR filetype:ica) |
| Yahoo | https://search.yahoo.com/ |
| Duck duck go | https://duckduckgo.com/ |
| Yandex | https://www.yandex.com/ |
| Exa lead | http://www.exalead.com |
| Maltego | https://www.paterva.com/ |
| Osint stalker | https://github.com/milo2012/osintstalker |
| Speed phish framework | https://github.com/tatanus/SPF |
| Browser exploitation framework | https://github.com/beefproject/beef |
| The harvester | https://github.com/laramies/theHarvester |
| Meta goofil | https://github.com/laramies/metagoofil |
| Name | URL |
|---|---|
| Masscan | https://github.com/robertdavidgraham/masscan |
| Nmap | https://nmap.org/7/ |
| Zmap | https://zmap.io/ |
| Zgrab | https://github.com/zmap/zgrab (Banner Grabber) |
| Nscan | https://github.com/OffensivePython/Nscan |
| Scanrand | https://www.sans.org/security-resources/idfaq/scanrand.php |
| PFRing | https://github.com/ntop/PF_RING - High-speed packet processing framework |
| Name | URL |
|---|---|
| Maltrail | https://github.com/stamparm/maltrail 👍 |
| Tsusen | https://github.com/stamparm/tsusen |
| Packetbeat | https://www.elastic.co/products/beats/packetbeat |
| p0f | http://lcamtuf.coredump.cx/p0f3/ |
| Name | URL |
|---|---|
| Scans.io | https://scans.io/ |
| Rapid7 Sonar Labs | https://sonar.labs.rapid7.com/ |
| Similar projects | https://github.com/rapid7/sonar/wiki/Similar-Projects |
| Defcon conference | https://defcon.org/ |
| Blackhat conference | https://www.blackhat.com/ |
| Name | URL |
|---|---|
| Awesome list - All of them ! | https://github.com/paralax/awesome-honeypots#honeypots 🏆 |
| Honeynet | https://honeynet.org/project |
| Live nothink | http://www.nothink.org/honeypots.php |
| Name | URL |
|---|---|
| Code beautifier | http://codebeautify.org/ |
| VB code beautifier | http://warp.senecac.on.ca/timothy.mckenna/CodeFormatter.asp |
| VB code beautifier | http://www.vbindent.com/ |
| PHP formatter | http://beta.phpformatter.com/ |
| PHPdecoder | http://ddecode.com/phpdecoder/ |
| PHP encoding | http://yehg.net/encoding/ |
| SQL formatter | http://dpriver.com/pp/sqlformat.htm |
| XML formatter | http://chris.photobooks.com/xml/default.htm |
| JSDetox | http://www.relentless-coding.com/projects/jsdetox/ |
| JSNice | http://www.jsnice.org/ |
| JSUnpack | https://github.com/urule99/jsunpack-n |
| JSBeautifier | http://jsbeautifier.org/ |
| JavaScript Compressor | http://dean.edwards.name/packer/ |
| Jjencode | http://utf-8.jp/public/jjencode.html |
| JSFuck | http://www.jsfuck.com/ |
| Jsobfuscate | http://www.jsobfuscate.com/ |
| Netteleuthe | http://www.netteleuthe.de/gc/ |
| Colour higlighter | http://quickhighlighter.com/ |
| URL | http://meyerweb.com/eric/tools/dencoder/ |
| HEXdecoder | http://ddecode.com/hexdecoder/ |
| Hackvertor (Tag based decoder/encoder) | https://hackvertor.co.uk/public |
| Name | URL |
|---|---|
| Lynis | https://packages.debian.org/en/jessie/lynis |
| Chkrootkit | https://packages.debian.org/en/jessie/chkrootkit |
| RKhunter | https://packages.debian.org/en/jessie/rkhunter |
| Debsecan | https://packages.debian.org/en/jessie/debsecan |
| Vulnerability scanner | https://github.com/future-architect/vuls |
| GNU/Linux post exploitation | https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List |
| GNU/Linux workstation | https://github.com/lfit/itpol/blob/master/linux-workstation-security.md |
| Securing debian | https://www.debian.org/doc/manuals/securing-debian-howto/ch10.en.html |
| GNU/Linux containers | https://github.com/Friz-zy/awesome-linux-containers#security |
| Command collection | https://github.com/tuwid/GNU-Linux-OpsWiki |
| GNU/Linux executable walkthrough | https://i.imgur.com/q5nyHp7.png |
| Name | URL |
|---|---|
| Windows exploitation | https://github.com/enddo/awesome-windows-exploitation |
| Anti forensic Windows | https://www.reddit.com/r/security/comments/32fb1l/open_guide_to_scrubbing_windows_oss_from_forensic/ |
| Windows executable walkthrough | https://i.imgur.com/pHjcI.png |
| Name | URL |
|---|---|
| Security and privacy guide | https://github.com/drduh/OS-X-Security-and-Privacy-Guide |
| Name | URL |
|---|---|
| BGP Toolkit | http://bgp.he.net/ 🏆 |
| Google dork | "xxx.xxx.xxx.xxx" (replace xxx.xxx.xxx.xxx with the ip you are looking for) |
| Bing dork | ip:xxx.xxx.xxx.xxx |
| Whois | https://whois.domaintools.com/ |
| IP void | http://www.ipvoid.com/ 👍 |
| IPv4 info | http://ipv4info.com/ 👍 |
| TCP utils | http://www.tcpiputils.com/ |
| Virus total | https://www.virustotal.com/en/ip-address/xxx.xxx.xxx.xxx/information/ |
| Multi RBL | http://multirbl.valli.org/lookup/ |
| Black List Alert | http://www.blacklistalert.org/ |
| Whatch Guard | http://www.reputationauthority.org/ |
| Black List Check | http://whatismyipaddress.com/blacklist-check/ |
| Project Honeypot | https://www.projecthoneypot.org/search_ip.php |
| Spamhaus | https://www.spamhaus.org/lookup/ |
| Nirsoft country IP | http://www.nirsoft.net/countryip/ |
| Host file | https://hosts-file.net/ |
| Check host | http://check-host.net/ |
| Host tracker | https://www.host-tracker.com/ |
| Name | URL |
|---|---|
| Checking multiple blocklists | http://rbls.org/ 👍 |
| Into DNS | http://www.intodns.com/intodns.com |
| URL Void | http://www.urlvoid.com/ 👍 |
| urlQuery | http://urlquery.net/search.php 👍 |
| Virus total | https://www.virustotal.com/#url |
| https://www.google.com/transparencyreport/safebrowsing/diagnostic/ | |
| Sucuri | http://sitecheck.sucuri.net/scanner/ |
| RBL | http://rbls.org/ |
| Multi RBL | http://multirbl.valli.org/lookup/ |
| Global DNS checker | https://www.whatsmydns.net/ |
| Trusted source | http://www.trustedsource.org/ |
| Isithacked | http://www.isithacked.com |
| DNS dumpster | https://dnsdumpster.com/ |
| Threat miner | https://www.threatminer.org/ |
| MXToolBox | https://mxtoolbox.com/SuperTool.aspx# |
| Wois | https://whois.domaintools.com/ |
| Build with | https://builtwith.com/ |
| Expired domain | https://www.expireddomains.net/backorder-expired-domains/ |
| Zeltser's list | https://zeltser.com/lookup-malicious-websites/ |
| Domain analysis list | https://github.com/rshipp/awesome-malware-analysis/#domain-analysis |
| Name | URL |
|---|---|
| Awesome wifi tools list | https://github.com/0x90/wifi-arsenal |
| Penetration test | http://0daysecurity.com/penetration-testing/wireless-penetration.html |
| Great wifi map | https://wigle.net/ |
| Wireless in airports | https://www.google.com/maps/d/viewer?mid=1Z1dI8hoBZSJNWFx2xr_MMxSxSxY |
| Name | URL |
|---|---|
| Penetration test | http://0daysecurity.com/penetration-testing/VoIP-security.html |
| Penetration test | http://www.backtrack-linux.org/wiki/index.php/Pentesting_VOIP |
| Name | URL |
|---|---|
| FreeShells list | http://www.freeshells.info/ |
| Devio.us OpenBSD | http://devio.us/ |
| Red-pill | http://shells.red-pill.eu/ |
| Name | URL |
|---|---|
| Yop mail | http://www.yopmail.com/ |
| Mailinator | https://www.mailinator.com/ # https://gist.github.com/nocturnalgeek/1b8fa44283314544c487 |
| Mailnesia | http://mailnesia.com/ |
| Mailcatch | http://mailcatch.com/ |
| Get air mail | http://en.getairmail.com/ |
| 10 Minute Mail | http://10minutemail.com |
| Spam DB | http://www.dnsbl.info/dnsbl-database-check.php |
| Mxtoolbox | http://www.mxtoolbox.com/ |
| Open relay | http://www.mailradar.com |
| Openresolver JP | http://www.openresolver.jp/en/ |
| DKIM validator | http://dkimvalidator.com/ |
| Email recon | https://github.com/laramies/theHarvester |
| Gophish | https://github.com/gophish/gophish |
| SimplyEmail | https://github.com/killswitch-GUI/SimplyEmail |
| SpeedPhish Framework | https://github.com/tatanus/SPF |
| Phishing Framework | https://github.com/pentestgeek/phishing-frenzy |
| Spam encode secret | http://spammimic.com/encode.cgi |
| DNSBL | https://en.wikipedia.org/wiki/DNSBL |
Will be reorganized
| Name | URL |
|---|---|
| Have I been pwned | https://haveibeenpwned.com/ |
| Siph0n | https://twitter.com/datasiph0n |
| Leaked source | https://www.leakedsource.com/ |
| Leak forums | https://leakforums.net/ |
| Leakedin | http://www.leakedin.com/ |
| Zone-H | https://zone-h.org/ |
| Mr white | https://mrwhite.biz/ |
| URL Find | http://urlfind.org/ |
| Isithacked | http://www.isithacked.com |
| Name | URL |
|---|---|
| Comparison | https://thatoneprivacysite.net/vpn-comparison-chart/ |
| Location test | https://www.dnsleaktest.com/ |
| Location test | https://ipleak.net/ |
| Name | URL |
|---|---|
| Browser recommendations | https://gist.github.com/atcuno/3425484ac5cce5298932 |
| Browser exploit | https://github.com/julienbedard/browsersploit |
| Fingerprint | https://amiunique.org/ |
| Amiunique project | https://github.com/DIVERSIFY-project/amiunique |
| Fingerprint | https://panopticlick.eff.org/ |
| Browser info | http://www.browser-info.net/ |
| Browser leaks | https://www.browserleaks.com/ |
| SSL | https://www.ssllabs.com/ssltest/viewMyClient.html |
| User agent | http://whatsmyuseragent.com/ |
| Referer | https://www.whatismyreferer.com/ |
| Flash | http://isflashinstalled.com/ |
| Browserling | https://www.browserling.com/ |
| Name | URL |
|---|---|
| Robtex | https://www.robtex.com/dns/ |
| Netcraft | http://www.netcraft.com/ |
| TCP utils | http://www.tcpiputils.com/ |
| DNS stuff | http://www.dnsstuff.com/ |
| Into dns | http://www.intodns.com/ |
| Web archive | https://web.archive.org/web/*/ |
| Web cookies | http://webcookies.org/cookies/ |
| Name | URL |
|---|---|
| OWASP tests | https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers |
| Testssl.sh | https://github.com/drwetter/testssl.sh |
| O-Saft | https://www.owasp.org/index.php/O-Saft |
| SSLyze | https://github.com/iSECPartners/sslyze |
| SSLscan | https://github.com/rbsec/sslscan |
| Qualys SSL Labs | https://www.ssllabs.com/ssltest/ |
| Htbridge | https://www.htbridge.com/ssl/ |
| SSLAnalyzer Comodoca | https://sslanalyzer.comodoca.com/ |
| Freak | https://freakattack.com/ |
| Heartbleed | http://heartbleed.com/,https://filippo.io/Heartbleed/ |
| Logjam | https://weakdh.org/sysadmin.html |
| Poodle | https://poodle.io/,https://www.poodlescan.com/ |
| Name | URL |
|---|---|
| Pwnie Awards | http://pwnies.com/nominations/ |
| Malware museum | https://archive.org/details/malwaremuseum |
| Dead drops | https://deaddrops.com/db/ |
| Mozilla location service | https://location.services.mozilla.com/map - Thx rawger |
| The cyber shark map | https://lab.thecybershark.com/ |
| Norse map | http://map.norsecorp.com/ |
| Fire eye map | https://www.fireeye.com/cyber-map/threat-map.html |
| Kaspersky AV map | https://cybermap.kaspersky.com/ |
| Kaspersky map | https://apt.securelist.com/ |
| Eset map | http://www.virusradar.com/ |
| Fortinet map | https://threatmap.fortiguard.com/ |
| Blueliv map | https://community.blueliv.com/map/ |
| DDoS attacks | http://www.digitalattackmap.com/ |
| Sub marine cable | http://www.submarinecablemap.com/ |
| Sub marine cable | http://submarine-cable-map-2016.telegeography.com/ |
| Sub marine cable | http://lifewinning.com/submarine-cable-taps/ |
| Flight radar | https://www.flightradar24.com |
| Fligh aware | https://flightaware.com/ |
| World of VNC | https://worldofvnc.net/ |