Resources
.NET
MvvmCross (label: first-timers-only) The .NET MVVM framework for cross-platform solutions, including Xamarin.iOS, Xamarin.Android, Windows and Mac.
RawCMS (label: good first issue) RawCMS is a headless CMS written in ASP.NET Core, built for developers that embrace API-first technology.
Shouldly (label: Jump-In) Should testing for .NET - the way Asserting Should be!
C
Neovim (label: good-first-issue) Vim-fork focused on extensibility and agility.
C#
grok.net (label: good first issue) Cross platform .NET grok implementation
OpenRA (label: Easy) A Real Time Strategy game engine supporting early Westwood classics such as Command & Conquer: Red Alert.
osu! (label: good-first-issue) Music game. Rhythm is just a click away!
Uno Platform (label: good first issue) OSS project for creating pixel-perfect, single-source C# and XAML apps which run natively on iOS, Android, macOS, Linux and Web via WebAssembly.
Cake (label: Good first issue) Cake (C# Make) is a free and open source cross-platform build automation system with a C# DSL for tasks such as compiling code, copying files and folders, running unit tests, compressing files and building NuGet packages.
C++
electron (label: good first issue) Build cross platform desktop apps with JavaScript, HTML, and CSS
Godot Engine (label: junior job) 2D and 3D cross-platform game engine. Also has C# and Python code.
projectM (label: good first issue) A music visualizer library using OpenGL and GLSL. Has applications using Qt5, SDL, emscripten, iTunes, Kodi.
Roc Toolkit (label: help wanted) A toolkit for real-time audio streaming over the network.
tensorflow (label: stat:contributions welcome) Computation using data flow graphs for scalable machine learning
Yugabyte DB (label: good first issue) Distributed SQL database.
MoveIt (label: good first issue) Easy-to-use open source robotics manipulation platform for developing commercial applications, prototyping designs, and benchmarking algorithms.
Clojure
ClojureScript
LightTable (label: good first issue) The Next Generation code editor! One of the top funded projects on KickStarter.
CSS
sButtons (label: good first issue) Simple buttons you can easily use for your next project.
Dart
dart.dev (label: beginner) A website covering Dart language and common libraries, for developers of Dart libraries, web apps, server-side code, and mobile (Flutter) apps.
Elixir
Ecto (label: Level:Starter) Ecto is a database wrapper and language integrated query for Elixir
Elixir (label: Level:Starter) Elixir is a dynamic, functional language designed for building scalable and maintainable applications
Go
CockroachDB (label: good first issue) The Scalable, Survivable, Strongly-Consistent SQL Database
Docker/CLI (label: exp/beginner) The Docker CLI
Helm (label: good first issue) The Kubernetes Package Manager
Hugo (label: exp/beginner) A Fast and Flexible Static Site Generator built with love in GoLang
Kubernetes (label: good first issue) Production-Grade Container Scheduling and Management System
Mattermost (label: Up For Grabs, Difficulty/1:Easy, Tech/Go) Open source Slack-alternative in Golang and React
Moby (label: exp/beginner) Open-source application container engine
Terraform (label: good first issue) A tool for building, changing, and versioning infrastructure safely and efficiently.
TiDB (label: for new contributors) A distributed scalable Hybrid Transactional and Analytical Processing (HTAP) database
script (label: good first issue) A Go library for doing the kind of tasks that shell scripts are good at: reading files, executing subprocesses, counting lines, matching strings, and so on. Beginners are very welcome and will get detailed code review and help through the PR process.
httpexpect (label: help wanted) End-to-end HTTP and REST API testing for Go.
Killgrave (label: good first issue) Simple way to generate mock servers in Go.
lxd (label: easy) System container and virtual machine manager.
PureLB (label: GoodFirstIssue) Load-balancer orchestrator for Kubernetes that uses standard Linux networking and routing protocols.
containerd (label: exp/beginner) Industry-standard container runtime with an emphasis on simplicity, robustness and portability.
Meshery (label: good first issue) Meshery, the service mesh management plane.
Java
Strongbox (label: good first issue) Strongbox is an artifact repository manager written in Java.
TEAMMATES (label: good first issue) TEAMMATES is a free online tool for managing peer evaluations and other feedback paths of your students.
elasticsearch (label: good first issue) Open Source, Distributed, RESTful Search Engine.
JabRef (label: good first issue) Desktop application for managing literature references using modern Java features including JavaFX. Dedicated to code quality and constructive feedback: Each Pull Request is reviewed by two developers to provide high-quality feedback and to ensure high quality of new contributions.
Wikimedia Commons Android App (label: good first issue) Allows users to upload pictures from their Android phone/tablet to Wikimedia Commons.
XWiki (label: Onboarding) XWiki is a free wiki software platform written in Java with a design emphasis on extensibility. Beginners should follow the onboarding wiki.
zerocode (label: good first issue) API Automation without coding, easy JSON response assertions, Testing REST, SOAP, Kafka and Java/DB APIs, CI/Jenkins Friendly.
SirixDB (label: good first issue) SirixDB is an evolutionary, versioned NoSQL document store (XML and JSON) written (mostly) in Java. It stores compact snapshots during commits with many concepts borrowed from ZFS and Git. Each revision is indexed and the document store can be queried with temporal queries. It's especially well suited for modern hardware.
Images-to-PDF (label: good first issue) An android app to convert images to PDF file.
Trino (formerly Presto SQL) (label: good first issue) A distributed SQL query engine for big data. Ask for guidance on project's Slack.
appsmith (label: good first issue) Drag & Drop internal tool builder
JavaScript
name-suggestion-index (label: good first issue) Canonical common brand names for OpenStreetMap
iD (label: good first issue) The easy-to-use OpenStreetMap editor in JavaScript.
missioncontrol (label: first-timers-only) Mission Control is a free and open marketplace connecting autonomous vehicles (e.g., drones) with users looking for services such as package deliveries.
missions (label: first-timers-only) Missions is a mobile web app connecting DAV users looking to ship packages with autonomous drones looking for work in an open and free marketplace.
annyang (label: first-timers-only) A popular Speech Recognition library used to communicate with everything from websites to smart mirrors to flying drones.
PouchDB (label: first time only) PouchDB is a pocket-sized database.
Leaflet (label: good first issue) JavaScript library for mobile-friendly interactive maps.
Dragula (label: first-timers-only) Drag and drop so simple it hurts.
history (label: good-for-beginner) A minimal, functional history library for JavaScript.
TodoMVC (label: first time contributor) Helping you select an MV* framework by implementing Todo in lots of JavaScript apps.
AVA (label: good for beginner) Futuristic test runner.
ESLint (label: good first issue) A fully pluggable tool for identifying and reporting on patterns in JavaScript.
Webpack (label: D0: My First Commit (Contrib. Difficulty)) A bundler for JavaScript and friends.
Tessel 2 CLI (label: contribution-starter) Command line interface to Tessel 2.
Ember.js (label: Good for New Contributors) A JavaScript framework for creating ambitious web applications.
Ember.js Data (label: Good for New Contributors) A data persistence library for Ember.js.
freeCodeCamp (label: first timers only) Open source codebase and curriculum. Learn to code and help nonprofits.
Ghost (label: good first issue) Just a blogging platform
eslint-plugin-unicorn (label: good for beginner) Awesome ESLint rules.
Hyper (label: good first issue) JS/HTML/CSS Terminal
pdf.js (label: 5-good-beginner-bug) PDF Reader in JavaScript
Moment.js (label: Up-For-Grabs) A lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.
serverless (label: good first issue) The Serverless Framework
Hoodie Camp (label: first-timers-only) Hoodie Camp is a space for new and existing contributors.
React (label: good first issue) A declarative, efficient, and flexible JavaScript library for building user interfaces.
React Native (label: Good first issue) A framework for building native apps with React.
React server (label: good-first-contribution) React framework with server render for blazing fast page load and seamless transitions between pages in the browser.
Yarn (label: good first issue) Fast, reliable, and secure dependency management.
pixi.js (label: Difficulty: Easy) A 2D JavaScript Renderer
Next.js (label: good first issue) A minimalistic framework for universal server-rendered React applications
keystonejs (label: good first issue) The open source framework for developing database-driven websites, applications and APIs in Node.js. Built on Express and MongoDB.
Semantic-UI-React (label: good first issue) The official React integration for Semantic UI.
electron (label: good first issue) Build cross platform desktop apps with JavaScript, HTML, and CSS
Botpress (label: good first issue) The only sane way to build great bots.
Atom (label: beginner) The hackable text editor
cdnjs (label: good first issue) The best FOSS web front-end resource CDN
Video.js (label: first-timers-only) The player framework
stryker (label: beginner friendly) The JavaScript mutation testing framework
Kap (label: good first issue) An open-source screen recorder built with web technology
Reddit Enhancement Suite (label: help wanted) A browser extension to enhance the Reddit browsing experience.
Brave Browser (label: good first issue) Desktop browser for macOS, Windows, and Linux.
Fastify (label: good first issue) Fast and low overhead web framework, for Node.js.
Node.js core (label: good first issue) JavaScript runtime built on Chrome's V8 JavaScript engine
Jest (label: good first issue) A complete and easy to set up JavaScript testing solution.
Mattermost (label: Up For Grabs, Difficulty:1/Easy, Tech/JavaScript) Open source Slack-alternative in Golang and React
p5.js (label: good first issue) p5.js is a client-side JS platform that empowers artists, designers, students, and anyone to learn to code and express themselves creatively on the web.
squirrelly (label: good first issue) Squirrelly is a lightweight template engine that supports helpers, filters, partials, and more.
NativeScript (label: good first issue) NativeScript is an open source framework for building truly native mobile apps with JavaScript. Use web skills, like Angular and Vue.js, FlexBox and CSS, and get native UI and performance on iOS and Android.
Gatsby.js (label: good first issue) Build blazing fast, modern apps and websites with React.
Vue.js (label: good first issue) The Progressive JavaScript Framework.
md-page (label: good first issue) Create a webpage with just markdown.
Check It Out (label: good first issue) Check It Out is an ncurses-like CLI to let the user interactively navigate and select a git branch to check out.
nuclear (label: good first issue) Multiplatform music player that streams from free sources.
material-ui (label: good first issue) React components for faster and easier web development. Build your own design system, or start with Material Design.
Meteor (label: good first issue) Meteor is an ultra-simple environment for building modern web applications.
Mocha (label: good first issue) Javascript test framework for Node.js and the browser.
Babel (label: good first issue) A compiler for writing next generation JavaScript.
React-content-loader (label: good first issue) Tool to create your own react-content-loader easily.
netlify-cms (label: good first issue) Open source content management for your git workflow.
altair (label: good first issue) A beautiful feature-rich GraphQL Client for all platforms.
Video Hub App (label: good first issue) Angular & Electron app for browsing and searching videos on your PC.
Ancient Beast (label: easy) Turn based strategy game where you 3d print a squad of creatures with unique abilities in order to defeat your enemies.
ramda-adjunct (label: help wanted) Ramda Adjunct is the most popular and most comprehensive set of functional utilities for use with Ramda, providing a variety of useful, well tested functions with excellent documentation.
Binari (label: up for grabs) Interactive code editor with a live binary tree visual designed to teach new developers the fundementals of dynamic programming.
SirixDB (label: good first issue) A Svelte/Sapper based web front-end for SirixDB, which is a versioned NoSQL document store (XML and JSON) written in Java.
json-editor (label: good first issue) JSON Schema Based Editor. JSON Editor takes a JSON Schema and uses it to generate an HTML form. It has full support for JSON Schema version 3 and 4 and can integrate with several popular CSS frameworks (bootstrap, spectre, tailwind).
Habitica (label: good first issue) Habitica is a gamified task manager, webapp and android/ios app, really wonderful atmosphere. Guidance for contributing here (mongo, express, vue, node stack for webapp)
reactjs.org (label: good first issue) The documenation website for reactjs
Vest (label: good first issue) Validations framework inspired by unit testing frameworks.
Hoppscotch (label: good first issue) A free, fast and beautiful API request builder.
Predator (label: good first issue) A powerful open-source platform for load testing APIs.
Time to Leave (label: good first issue) Working hours time tracker app based on Electron and Javascript.
cypress (label: first-timers-only) Fast, easy and reliable testing for anything that runs in a browser.
Vue CLI (label: good first issue) Standard Tooling for Vue.js Development
Vue Router (label: good first issue) The official router for Vue.js.
VuePress (label: good first issue) Minimalistic Vue-powered static site generator
appsmith (label: good first issue) Drag & Drop internal tool builder
Letra Extension (label: good first issue) Passively learn a new language every time you open a new tab.
swag-for-dev (label: good first issue) Swag opportunities for developers.
webdriver.io (label: first-timers-only) Next-gen browser and mobile automation test framework for Node.js
SimplQ (label: good first issue) Free online queue manager for easy and instant crowd control. Contributing Guidelines
ReactiveSearch (label: good first issue) A UI components library for Elasticsearch: Available for React, Vue and React Native.
Create React App (label: good-first-issue) Create React apps with no build configuration.
Svelte (label: good first issue) Component framework that runs at build time, converting your components into highly efficient imperative code that surgically updates the DOM.
Julia
Julia Language: Help wanted (label: help wanted) "Move like Python, Run like C" - A fresh approach to technical computing!
Julia Language: Good first issue (label: good first issue ) "Move like Python, Run like C" - A fresh approach to technical computing!
Kotlin
Atrium (label: good first issue) Multiplatform assertion library for Kotlin
Hexagon (label: help wanted) A microservices toolkit written in Kotlin
Non-Blocking SirixDB HTTP(S)-Server (label: good first issue) A non-blocking HTTP(S)-Server for SirixDB, a temporal, evolutionary NoSQL document store for XML and JSON.
Kotlin Libraries Playground (label: good first issue) A playground to gain a wider and deeper knowledge of the libraries in the Kotlin ecosystem. Also the official sample for gradle refreshVersions.
LaTeX
Algorithmic Pseudocode (label: good first issue) A collection of language independent pseudocodes (pdf) for interview preparation and competitive programming.
Markdown
tldr-pages (label: help wanted) Collaborative cheatsheets for console commands.
Perl
Ravada (label: good first issue) Remote Virtual Desktops Manager.
PHP
phpMyAdmin (label: newbie) Admin interface for MySQL written in PHP.
Deployer (label: good for beginner) A deployment tool written in PHP with support for popular frameworks out of the box.
Matomo (label: help wanted) Matomo is the leading Free/Libre open analytics platform.
OrgManager (label: beginners-only) Supercharge your GitHub organizations!
PHP Censor (label: good-for-beginner) Open source self-hosted continuous integration server for PHP projects.
Drupal (label: N/A, link to external website) Leading open-source CMS for ambitious digital experiences that reach your audience across multiple channels.
Symfony (label: good first issue) Symfony is a PHP framework for web applications and a set of reusable PHP components.
Laravel Newsletters (label: good first issue) A package that provides an easy way to integrate MailChimp with Laravel 5.
Appwrite (label: good first issue) An End-to-end backend server for frontend and mobile developers. 🚀
NextCloud Server (label: good first issue) Nextcloud server, a safe home for all your data.
PrestaShop (label: good first issue) The open source ecommerce solution to start your online business and start selling online.
Flarum (label: good first issue) Simple forum software for building great communities.
MediaWiki (label: good first task) The free and open-source wiki software package that powers Wikipedia.
Python
CiviWiki (Good First Issue) Building a Better Democracy for the Internet Age
Python Babel (label: difficulty/low) The Python Internationalization Library.
Kinto (label: easy-pick) A lightweight JSON storage service with synchronisation and sharing abilities.
Kinto.sh (label: first-timers-only) Make Linux & Windows type like a mac.
BorgBackup (label: easy) Deduplicating backup program with compression and authenticated encryption.
scrapy (label: good first issue) A fast high-level web crawling & scraping framework for Python.
mitmproxy (label: help wanted) An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers
Mailpile (label: low hanging fruit) A free & open modern, fast email client with user-friendly encryption and privacy features
coala (label: difficulty/newcomer) A unified command-line interface for linting and fixing all your code, regardless of the programming languages you use.
jarvis (label: difficulty/newcomer) A personal assistant for Linux, MacOs and Windows based on Command line Interface.
Pytest (label: status: easy) The pytest framework makes it easy to write small tests, yet scales to support complex functional testing.
Fabric (label: Low-hanging fruit) Pythonic remote execution and deployment.
Jupyter notebook (label: good first issue) Jupyter interactive notebook.
Zulip (label: good first issue) Powerful open source group chat.
cookiecutter (label: low-hanging-fruit) A command-line utility that creates projects from cookiecutters (project templates). E.g. Python package projects, jQuery plugin projects.
django cookiecutter (label: django hacktober special) An implementation of Python for backend web development.
wemake-python-styleguide (label: level:starter) The strictest and most opinionated python linter ever!
Ansible (label:easyfix) A simple IT automation platform
Create aio app (label: good first issue) A command line utility that creates the aiohttp template with the best practices.
opsdroid (label: good first issue) An open source chat-ops bot framework.
pandas (label: good first issue) Flexible and powerful data analysis / manipulation library for Python, providing labeled data structures similar to R data.frame objects, statistical functions, and much more
SaltStack (label: good first issue) Software to automate the management and configuration of any infrastructure or application at scale.
mygpo (label: starter-issue) The webservice for gpodder.net, a libre web service that allows users to manage their podcast subscriptions and discover new content.
tree-sitter-legesher-python (label: Good First Issue) Learn and code in Python using your native language.
mypy (label: good-first-issue) An optional static typing for python.
numpy (label: good first issue) It is the core library for scientific computing, which contains a powerful n-dimensional array object.
matplotlib (label: good first issue) Matplotlib is a comprehensive library for creating static, animated, and interactive visualizations in Python.
datascience (label: good first issue) A Jupyter notebook Python library for introductory data science.
ArviZ (label: Beginner) Exploratory Anaylsis of Bayesian Models.
MindsDB (label: good first issue) MindsDB is an open source AI layer for existing databases.
Bokeh (label: good first issue) Bokeh is an interactive visualization library for modern web browsers.
SymPy (label: Easy to Fix) A Python library for symbolic mathematics.
Pytorch (label: Good first issue) PyTorch is an open source machine learning library based on the Torch library, used for applications such as computer vision and natural language processing.
Sorting-Algorithms-Visualizer (label: good first issue) A tool for visualizing sorting algorithms with a educational Wiki Page.
scikit-learn (label: good first issue) Scikit-learn is a machine learning library for Python.
Ruby
JRuby (label: beginner) An implementation of Ruby on the Java Virtual Machine.
Sinatra (label: good first issue) Classy web-development dressed in a DSL.
Goby (label: beginner) Framework for developing text-RPGs.
Hanami (label: easy) A modern framework for Ruby.
chef (label: Type: Jump In) A systems integration framework, built to bring the benefits of configuration management to your entire infrastructure
ohai (label: Type: Jump In) Ohai profiles your system and emits JSON
PublicLab.org (label: first-timers-only) An open source publishing platform for environmental projects. Check out new contributors welcome page.
Discourse (tag: #starter-task) Civilized discussion platform. See "How to contribute to Discourse".
osem (label: good first issue) Open Source Event Manager. An event management tool tailored to Free and Open Source Software conferences See "How to contribute to osem"
open-build-service (label: good first issue) A generic system to build and distribute packages from sources in an automatic, consistent and reproducible way. See "How to contribute to open build service"
bolt (label: Beginner Friendly) Bolt is a Ruby command-line tool for executing commands, scripts, and tasks on remote systems using SSH and WinRM.
chatwoot (label: good first issue) Opensource customer support platform which can be an alternative to Intercom, Zendesk, Drift, Crisp etc.
mapknitter (label: first-timers-only) Upload your own aerial images, position (rubbersheet) them in a web interface over existing map data, and share via web or composite and export for print.
Ruby on Rails (label: good first issue) Ruby on Rails (Rails) is an open source web application framework written in Ruby.
Faker (label: good first issue) Faker is a Ruby library for generating fake data such as names, addresses, and phone numbers.
Matestack (label: good first issue) Write dynamic User Interfaces in pure Ruby. Rails engine built on top of Vue.js
Rust
Servo (label: E-easy) A browser engine designed for applications including embedded use.
Rust-Clippy (label: good first issue) A bunch of lints to catch common mistakes and improve Rust code
Rustfmt (label: good first issue) A tool for formatting Rust code according to style guidelines.
Iron (label: easy) An extensible, concurrent web framework for Rust
TiKV (label: D: difficulty/easy) A distributed transactional key-value database
nushell (label: good first issue) A modern shell for the GitHub era written in Rust.
Hyper (label: E-easy) A fast, safe and correct low-level HTTP library for Rust.
dotenv-linter (label: good first issue) ⚡️Lightning-fast linter for
.envfiles. Written in Rust 🦀Veloren (label: beginner and difficulty::easy) Veloren is a multiplayer voxel RPG written in Rust.
Scala
Twitter Util (label: good first issue) Wonderful reusable code from Twitter
playframework (label: good first issue) The High Velocity Web Framework
Smalltalk
Pharo (label: good first issue) A dynamic reflective pure object-oriented language supporting live programming inspired by Smalltalk.
Swift
OpenFoodFacts-iOS (label: help wanted) Collaborative, free and open database of food products from around the world. Scan barcode to get info or add a product
TypeScript
TypeScript (label: good first issue) A superset of JavaScript that compiles to clean JavaScript output.
Visual Studio Code (label: good first issue) A new type of tool that combines the simplicity of a code editor with what developers need for their core edit-build-debug cycle.
tslint-eslint-rules (label: nice first contribution) ESLint rules for TSLint.
reatom (label: good first issue) Reatom is declarative and reactive state manager, designed for both simple and complex applications.
game-of-life (label: good first issue) Conway's Game of Life web version!
Graphback (label: good first issue) A CLI and runtime framework to generate a GraphQL API in seconds.
LitmusChaos (label: good first issue) Litmus is a toolset to do cloud-native chaos engineering.
Booster (label: good first issue) A truly serverless framework, write your code and deploy it in seconds without any server configuration files.
tinyhttp (label: good first issue) A 0-legacy, tiny & fast web framework as a replacement of Express.
jupyterlab-lsp (label: good first issue) Coding assistance for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename)
CLI Tools [TOC]
:small_orange_diamond: GNU Bash - is an sh-compatible shell that incorporates useful features from the Korn shell and C shell. :small_orange_diamond: Zsh - is a shell designed for interactive use, although it is also a powerful scripting language. :small_orange_diamond: tclsh - is a very powerful cross-platform shell, suitable for a huge range of uses. :small_orange_diamond: bash-it - is a framework for using, developing and maintaining shell scripts and custom commands. :small_orange_diamond: Oh My ZSH! - is the best framework for managing your Zsh configuration. :small_orange_diamond: Oh My Fish - the Fishshell framework. :small_orange_diamond: Starship - the cross-shell prompt written in Rust. :small_orange_diamond: powerlevel10k - is a fast reimplementation of Powerlevel9k ZSH theme.
:small_orange_diamond: z - tracks the folder you use the most and allow you to jump, without having to type the whole path. :small_orange_diamond: fzf - is a general-purpose command-line fuzzy finder. :small_orange_diamond: zsh-autosuggestions - Fish-like autosuggestions for Zsh. :small_orange_diamond: zsh-syntax-highlighting - Fish shell like syntax highlighting for Zsh. :small_orange_diamond: Awesome ZSH Plugins - A list of frameworks, plugins, themes and tutorials for ZSH.
:small_orange_diamond: Midnight Commander - is a visual file manager, licensed under GNU General Public License. :small_orange_diamond: ranger - is a VIM-inspired filemanager for the console. :small_orange_diamond: nnn - is a tiny, lightning fast, feature-packed file manager. :small_orange_diamond: screen - is a full-screen window manager that multiplexes a physical terminal. :small_orange_diamond: tmux - is a terminal multiplexer, lets you switch easily between several programs in one terminal. :small_orange_diamond: tmux-cssh - is a tool to set comfortable and easy to use functionality, clustering and synchronizing tmux-sessions.
:small_orange_diamond: vi - is one of the most common text editors on Unix. :small_orange_diamond: vim - is a highly configurable text editor. :small_orange_diamond: emacs - is an extensible, customizable, free/libre text editor, and more. :small_orange_diamond: micro - is a modern and intuitive terminal-based text editor. :small_orange_diamond: neovim - is a free open source, powerful, extensible and usable code editor. :small_orange_diamond: spacemacs - a community-driven Emacs distribution. :small_orange_diamond: spacevim - a community-driven vim distribution.
:small_orange_diamond: fd - is a simple, fast and user-friendly alternative to find. :small_orange_diamond: ncdu - is an easy to use, fast disk usage analyzer.
:small_orange_diamond: PuTTY - is an SSH and telnet client, developed originally by Simon Tatham. :small_orange_diamond: Mosh - is a SSH wrapper designed to keep a SSH session alive over a volatile connection. :small_orange_diamond: Eternal Terminal - enables mouse-scrolling and tmux commands inside the SSH session. :small_orange_diamond: nmap - is a free and open source (license) utility for network discovery and security auditing. :small_orange_diamond: zmap - is a fast single packet network scanner designed for Internet-wide network surveys. :small_orange_diamond: Rust Scan - to find all open ports faster than Nmap. :small_orange_diamond: masscan - is the fastest Internet port scanner, spews SYN packets asynchronously. :small_orange_diamond: pbscan - is a faster and more efficient stateless SYN scanner and banner grabber. :small_orange_diamond: hping - is a command-line oriented TCP/IP packet assembler/analyzer. :small_orange_diamond: mtr - is a tool that combines the functionality of the 'traceroute' and 'ping' programs in a single tool. :small_orange_diamond: mylg - utility which combines the functions of the different network probes in one diagnostic tool. :small_orange_diamond: netcat - utility which reads and writes data across network connections, using the TCP/IP protocol. :small_orange_diamond: socat - utility which transfers data between two objects. :small_orange_diamond: tcpdump - is a powerful command-line packet analyzer. :small_orange_diamond: tshark - is a tool that allows us to dump and analyze network traffic (wireshark cli). :small_orange_diamond: Termshark - is a simple terminal user-interface for tshark. :small_orange_diamond: ngrep - is like GNU grep applied to the network layer. :small_orange_diamond: netsniff-ng - is a Swiss army knife for your daily Linux network plumbing if you will. :small_orange_diamond: sockdump - dump unix domain socket traffic. :small_orange_diamond: stenographer - is a packet capture solution which aims to quickly spool all packets to disk. :small_orange_diamond: tcpterm - visualize packets in TUI. :small_orange_diamond: bmon - is a monitoring and debugging tool to capture networking related statistics and prepare them visually. :small_orange_diamond: iptraf-ng - is a console-based network monitoring program for Linux that displays information about IP traffic. :small_orange_diamond: vnstat - is a network traffic monitor for Linux and BSD. :small_orange_diamond: iPerf3 - is a tool for active measurements of the maximum achievable bandwidth on IP networks. :small_orange_diamond: ethr - is a Network Performance Measurement Tool for TCP, UDP & HTTP. :small_orange_diamond: Etherate - is a Linux CLI based Ethernet and MPLS traffic testing tool. :small_orange_diamond: echoip - is a IP address lookup service. :small_orange_diamond: Nemesis - packet manipulation CLI tool; craft and inject packets of several protocols. :small_orange_diamond: packetfu - a mid-level packet manipulation library for Ruby. :small_orange_diamond: Scapy - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols. :small_orange_diamond: impacket - is a collection of Python classes for working with network protocols. :small_orange_diamond: ssh-audit - is a tool for SSH server auditing. :small_orange_diamond: aria2 - is a lightweight multi-protocol & multi-source command-line download utility. :small_orange_diamond: iptables-tracer - observe the path of packets through the iptables chains. :small_orange_diamond: inception - a highly configurable tool to check for whatever you like against any number of hosts.
:small_orange_diamond: dnsdiag - is a DNS diagnostics and performance measurement tools. :small_orange_diamond: fierce - is a DNS reconnaissance tool for locating non-contiguous IP space. :small_orange_diamond: subfinder - is a subdomain discovery tool that discovers valid subdomains for websites. :small_orange_diamond: sublist3r - is a fast subdomains enumeration tool for penetration testers. :small_orange_diamond: amass - is tool that obtains subdomain names by scraping data sources, crawling web archives, and more. :small_orange_diamond: namebench - provides personalized DNS server recommendations based on your browsing history. :small_orange_diamond: massdns - is a high-performance DNS stub resolver for bulk lookups and reconnaissance. :small_orange_diamond: knock - is a tool to enumerate subdomains on a target domain through a wordlist. :small_orange_diamond: dnsperf - DNS performance testing tools. :small_orange_diamond: dnscrypt-proxy 2 - a flexible DNS proxy, with support for encrypted DNS protocols. :small_orange_diamond: dnsdbq - API client providing access to passive DNS database systems. :small_orange_diamond: grimd - fast dns proxy, built to black-hole internet advertisements and malware servers.
:small_orange_diamond: curl - is a command line tool and library for transferring data with URLs. :small_orange_diamond: kurly - is an alternative to the widely popular curl program, written in Golang. :small_orange_diamond: HTTPie - is an user-friendly HTTP client. :small_orange_diamond: wuzz - is an interactive cli tool for HTTP inspection. :small_orange_diamond: h2spec - is a conformance testing tool for HTTP/2 implementation. :small_orange_diamond: h2t - is a simple tool to help sysadmins to hardening their websites. :small_orange_diamond: htrace.sh - is a simple Swiss Army knife for http/https troubleshooting and profiling. :small_orange_diamond: httpstat - is a tool that visualizes curl statistics in a way of beauty and clarity. :small_orange_diamond: httplab - is an interactive web server. :small_orange_diamond: Lynx - is a text browser for the World Wide Web. :small_orange_diamond: Browsh - is a fully interactive, real-time, and modern text-based browser. :small_orange_diamond: HeadlessBrowsers - a list of (almost) all headless web browsers in existence. :small_orange_diamond: ab - is a single-threaded command line tool for measuring the performance of HTTP web servers. :small_orange_diamond: siege - is an http load testing and benchmarking utility. :small_orange_diamond: wrk - is a modern HTTP benchmarking tool capable of generating significant load. :small_orange_diamond: wrk2 - is a constant throughput, correct latency recording variant of wrk. :small_orange_diamond: vegeta - is a constant throughput, correct latency recording variant of wrk. :small_orange_diamond: bombardier - is a fast cross-platform HTTP benchmarking tool written in Go. :small_orange_diamond: gobench - http/https load testing and benchmarking tool. :small_orange_diamond: hey - HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom. :small_orange_diamond: boom - is a script you can use to quickly smoke-test your web app deployment. :small_orange_diamond: SlowHTTPTest - is a tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP. :small_orange_diamond: gobuster - is a free and open source directory/file & DNS busting tool written in Go. :small_orange_diamond: ssllabs-scan - command-line reference-implementation client for SSL Labs APIs. :small_orange_diamond: http-observatory - Mozilla HTTP Observatory cli version.
:small_orange_diamond: openssl - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols. :small_orange_diamond: gnutls-cli - client program to set up a TLS connection to some other computer. :small_orange_diamond: sslyze - fast and powerful SSL/TLS server scanning library. :small_orange_diamond: sslscan - tests SSL/TLS enabled services to discover supported cipher suites. :small_orange_diamond: testssl.sh - testing TLS/SSL encryption anywhere on any port. :small_orange_diamond: cipherscan - a very simple way to find out which SSL ciphersuites are supported by a target. :small_orange_diamond: spiped - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses. :small_orange_diamond: Certbot - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. :small_orange_diamond: mkcert - simple zero-config tool to make locally trusted development certificates with any names you'd like. :small_orange_diamond: certstrap - tools to bootstrap CAs, certificate requests, and signed certificates. :small_orange_diamond: Sublert - is a security and reconnaissance tool to automatically monitor new subdomains. :small_orange_diamond: mkchain - open source tool to help you build a valid SSL certificate chain.
:small_orange_diamond: SELinux - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel. :small_orange_diamond: AppArmor - proactively protects the operating system and applications from external or internal threats. :small_orange_diamond: grapheneX - Automated System Hardening Framework. :small_orange_diamond: DevSec Hardening Framework - Security + DevOps: Automatic Server Hardening.
:small_orange_diamond: ossec - actively monitoring all aspects of system activity with file integrity monitoring. :small_orange_diamond: auditd - provides a way to track security-relevant information on your system. :small_orange_diamond: Tiger - is a security tool that can be use both as a security audit and intrusion detection system. :small_orange_diamond: Lynis - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system. :small_orange_diamond: LinEnum - scripted Local Linux Enumeration & Privilege Escalation Checks. :small_orange_diamond: Rkhunter - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems. :small_orange_diamond: PE-sieve - is a light-weight tool that helps to detect malware running on the system.
:small_orange_diamond: strace - diagnostic, debugging and instructional userspace utility for Linux. :small_orange_diamond: DTrace - is a performance analysis and troubleshooting tool. :small_orange_diamond: ltrace - is a library call tracer, used to trace calls made by programs to library functions. :small_orange_diamond: ptrace-burrito - is a friendly wrapper around ptrace. :small_orange_diamond: perf-tools - performance analysis tools based on Linux perf_events (aka perf) and ftrace. :small_orange_diamond: bpftrace - high-level tracing language for Linux eBPF. :small_orange_diamond: sysdig - system exploration and troubleshooting tool with first class support for containers. :small_orange_diamond: Valgrind - is an instrumentation framework for building dynamic analysis tools. :small_orange_diamond: gperftools - high-performance multi-threaded malloc() implementation, plus some performance analysis tools. :small_orange_diamond: glances - cross-platform system monitoring tool written in Python. :small_orange_diamond: htop - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'. :small_orange_diamond: bashtop - Linux resource monitor written in pure Bash. :small_orange_diamond: nmon - a single executable for performance monitoring and data analysis. :small_orange_diamond: atop - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes. :small_orange_diamond: lsof - displays in its output information about files that are opened by processes. :small_orange_diamond: FlameGraph - stack trace visualizer. :small_orange_diamond: lsofgraph - convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication. :small_orange_diamond: rr - is a lightweight tool for recording, replaying and debugging execution of applications. :small_orange_diamond: Performance Co-Pilot - a system performance analysis toolkit. :small_orange_diamond: hexyl - a command-line hex viewer.
:small_orange_diamond: angle-grinder - slice and dice log files on the command line. :small_orange_diamond: lnav - log file navigator with search and automatic refresh. :small_orange_diamond: GoAccess - real-time web log analyzer and interactive viewer that runs in a terminal. :small_orange_diamond: ngxtop - real-time metrics for nginx server.
:small_orange_diamond: usql - universal command-line interface for SQL databases. :small_orange_diamond: pgcli - postgres CLI with autocompletion and syntax highlighting. :small_orange_diamond: mycli - terminal client for MySQL with autocompletion and syntax highlighting. :small_orange_diamond: litecli - SQLite CLI with autocompletion and syntax highlighting. :small_orange_diamond: mssql-cli - SQL Server CLI with autocompletion and syntax highlighting. :small_orange_diamond: OSQuery - is a SQL powered operating system instrumentation, monitoring, and analytics framework. :small_orange_diamond: pgsync - sync data from one Postgres database to another. :small_orange_diamond: iredis - a terminal client for redis with autocompletion and syntax highlighting.
:small_orange_diamond: Nipe - script to make Tor Network your default gateway. :small_orange_diamond: multitor - a tool that lets you create multiple TOR instances with a load-balancing.
:small_orange_diamond: Irssi - is a free open source terminal based IRC client. :small_orange_diamond: WeeChat - is an extremely extensible and lightweight IRC client.
:small_orange_diamond: taskwarrior - task management system, todo list
:small_orange_diamond: sysadmin-util - tools for Linux/Unix sysadmins. :small_orange_diamond: incron - is an inode-based filesystem notification technology. :small_orange_diamond: lsyncd - synchronizes local directories with remote targets (Live Syncing Daemon). :small_orange_diamond: GRV - is a terminal based interface for viewing Git repositories. :small_orange_diamond: Tig - text-mode interface for Git. :small_orange_diamond: tldr - simplified and community-driven man pages. :small_orange_diamond: archiver - easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar. :small_orange_diamond: commander.js - minimal CLI creator in JavaScript. :small_orange_diamond: gron - make JSON greppable! :small_orange_diamond: bed - binary editor written in Go.
GUI Tools [TOC]
:small_orange_diamond: Guake - is a dropdown terminal made for the GNOME desktop environment. :small_orange_diamond: Terminator - is based on GNOME Terminal, useful features for sysadmins and other users. :small_orange_diamond: Kitty - is a GPU based terminal emulator that supports smooth scrolling and images. :small_orange_diamond: Alacritty - is a fast, cross-platform, OpenGL terminal emulator.
:small_orange_diamond: Wireshark - is the world’s foremost and widely-used network protocol analyzer. :small_orange_diamond: Ettercap - is a comprehensive network monitor tool. :small_orange_diamond: EtherApe - is a graphical network monitoring solution. :small_orange_diamond: Packet Sender - is a networking utility for packet generation and built-in UDP/TCP/SSL client and servers. :small_orange_diamond: Ostinato - is a packet crafter and traffic generator. :small_orange_diamond: JMeter™ - open source software to load test functional behavior and measure performance. :small_orange_diamond: locust - scalable user load testing tool written in Python.
:small_orange_diamond: TOR Browser - protect your privacy and defend yourself against network surveillance and traffic analysis.
:small_orange_diamond: KeePassXC - store your passwords safely and auto-type them into your everyday websites and apps. :small_orange_diamond: Bitwarden - open source password manager with built-in sync.
:small_orange_diamond: HexChat - is an IRC client based on XChat. :small_orange_diamond: Pidgin - is an easy to use and free chat client used by millions.
:small_orange_diamond: Signal - is an encrypted communications app. :small_orange_diamond: Wire - secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end encryption. :small_orange_diamond: TorChat - decentralized anonymous instant messenger on top of Tor Hidden Services. :small_orange_diamond: Matrix - an open network for secure, decentralized, real-time communication.
:small_orange_diamond: Sublime Text - is a lightweight, cross-platform code editor known for its speed, ease of use. :small_orange_diamond: Visual Studio Code - an open-source and free source code editor developed by Microsoft. :small_orange_diamond: Atom - a hackable text editor for the 21st Century.
Web Tools [TOC]
:small_orange_diamond: SSL/TLS Capabilities of Your Browser - test your browser's SSL implementation. :small_orange_diamond: Can I use - provides up-to-date browser support tables for support of front-end web technologies. :small_orange_diamond: Panopticlick 3.0 - is your browser safe against tracking? :small_orange_diamond: Privacy Analyzer - see what data is exposed from your browser. :small_orange_diamond: Web Browser Security - it's all about Web Browser fingerprinting. :small_orange_diamond: How's My SSL? - help a web server developer learn what real world TLS clients were capable of. :small_orange_diamond: sslClientInfo - client test (incl TLSv1.3 information).
:small_orange_diamond: SSLLabs Server Test - performs a deep analysis of the configuration of any SSL web server. :small_orange_diamond: SSLLabs Server Test (DEV) - performs a deep analysis of the configuration of any SSL web server. :small_orange_diamond: ImmuniWeb® SSLScan - test SSL/TLS (PCI DSS, HIPAA and NIST). :small_orange_diamond: SSL Check - scan your website for non-secure content. :small_orange_diamond: SSL Scanner - analyze website security. :small_orange_diamond: CryptCheck - test your TLS server configuration (e.g. ciphers). :small_orange_diamond: urlscan.io - service to scan and analyse websites. :small_orange_diamond: Report URI - monitoring security policies like CSP and HPKP. :small_orange_diamond: CSP Evaluator - allows developers and security experts to check if a Content Security Policy. :small_orange_diamond: Useless CSP - public list about CSP in some big players (might make them care a bit more). :small_orange_diamond: Why No HTTPS? - top 100 websites by Alexa rank not automatically redirecting insecure requests. :small_orange_diamond: TLS Cipher Suite Search- cipher suite search engine. :small_orange_diamond: cipherli.st - strong ciphers for Apache, Nginx, Lighttpd, and more.* :small_orange_diamond: dhtool - public Diffie-Hellman parameter service/tool. :small_orange_diamond: badssl.com - memorable site for testing clients against bad SSL configs. :small_orange_diamond: tlsfun.de - registered for various tests regarding the TLS/SSL protocol. :small_orange_diamond: CAA Record Helper - generate a CAA policy. :small_orange_diamond: Common CA Database - repository of information about CAs, and their root and intermediate certificates. :small_orange_diamond: CERTSTREAM - real-time certificate transparency log update stream. :small_orange_diamond: crt.sh - discovers certificates by continually monitoring all of the publicly known CT. :small_orange_diamond: Hardenize - deploy the security standards. :small_orange_diamond: Cipher suite compatibility - test TLS cipher suite compatibility. :small_orange_diamond: urlvoid - this service helps you detect potentially malicious websites. :small_orange_diamond: security.txt - a proposed standard (generator) which allows websites to define security policies. :small_orange_diamond: ssl-config-generator - help you follow the Mozilla Server Side TLS configuration guidelines.
:small_orange_diamond: Security Headers - analyse the HTTP response headers (with rating system to the results). :small_orange_diamond: Observatory by Mozilla - set of tools to analyze your website. :small_orange_diamond: webhint - is a linting tool that will help you with your site's accessibility, speed, security, and more.
:small_orange_diamond: ViewDNS - one source for free DNS related tools and information. :small_orange_diamond: DNSLookup - is an advanced DNS lookup tool. :small_orange_diamond: DNSlytics - online DNS investigation tool. :small_orange_diamond: DNS Spy - monitor, validate and verify your DNS configurations. :small_orange_diamond: Zonemaster - helps you to control how your DNS works. :small_orange_diamond: Leaf DNS - comprehensive DNS tester. :small_orange_diamond: Find subdomains online - find subdomains for security assessment penetration test. :small_orange_diamond: DNSdumpster - dns recon & research, find & lookup dns records. :small_orange_diamond: DNS Table online - search for DNS records by domain, IP, CIDR, ISP. :small_orange_diamond: intoDNS - DNS and mail server health checker. :small_orange_diamond: DNS Bajaj - check the delegation of your domain. :small_orange_diamond: BuddyDNS Delegation LAB - check, trace and visualize delegation of your domain. :small_orange_diamond: dnssec-debugger - DS or DNSKEY records validator. :small_orange_diamond: PTRarchive.com - this site is responsible for the safekeeping of historical reverse DNS records. :small_orange_diamond: xip.io - wildcard DNS for everyone. :small_orange_diamond: nip.io - dead simple wildcard DNS for any IP Address. :small_orange_diamond: dnslookup (ceipam) - one of the best DNS propagation checker (and not only). :small_orange_diamond: What's My DNS - DNS propagation checking tool. :small_orange_diamond: DNSGrep - quickly searching large DNS datasets.
:small_orange_diamond: smtp-tls-checker - check an email domain for SMTP TLS support. :small_orange_diamond: MX Toolbox - all of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool. :small_orange_diamond: Secure Email - complete email test tools for email technicians. :small_orange_diamond: blacklistalert - checks to see if your domain is on a Real Time Spam Blacklist. :small_orange_diamond: MultiRBL - complete IP check for sending Mailservers. :small_orange_diamond: DKIM SPF & Spam Assassin Validator - checks mail authentication and scores messages with Spam Assassin.
:small_orange_diamond: URL Encode/Decode - tool from above to either encode or decode a string of text. :small_orange_diamond: Uncoder - the online translator for search queries on log data. :small_orange_diamond: Regex101 - online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript. :small_orange_diamond: RegExr - online tool to learn, build, & test Regular Expressions (RegEx / RegExp). :small_orange_diamond: RegEx Testing - online regex testing tool. :small_orange_diamond: RegEx Pal - online regex testing tool + other tools. :small_orange_diamond: The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.
:small_orange_diamond: Netcraft - detailed report about the site, helping you to make informed choices about their integrity.* :small_orange_diamond: RIPE NCC Atlas - a global, open, distributed Internet measurement platform. :small_orange_diamond: Robtex - uses various sources to gather public information about IP numbers, domain names, host names, etc. :small_orange_diamond: Security Trails - APIs for Security Companies, Researchers and Teams. :small_orange_diamond: Online Curl - curl test, analyze HTTP Response Headers. :small_orange_diamond: Online Tools for Developers - HTTP API tools, testers, encoders, converters, formatters, and other tools. :small_orange_diamond: Ping.eu - online Ping, Traceroute, DNS lookup, WHOIS and others. :small_orange_diamond: Network-Tools - network tools for webmasters, IT technicians & geeks. :small_orange_diamond: BGPview - search for any ASN, IP, Prefix or Resource name. :small_orange_diamond: Is BGP safe yet? - check BGP (RPKI) security of ISPs and other major Internet players. :small_orange_diamond: Riseup - provides online communication tools for people and groups working on liberatory social change. :small_orange_diamond: VirusTotal - analyze suspicious files and URLs to detect types of malware.
:small_orange_diamond: privacytools.io - provides knowledge and tools to protect your privacy against global mass surveillance. :small_orange_diamond: DNS Privacy Test Servers - DNS privacy recursive servers list (with a 'no logging' policy).
:small_orange_diamond: ShellCheck - finds bugs in your shell scripts. :small_orange_diamond: explainshell - get interactive help texts for shell commands. :small_orange_diamond: jsbin - live pastebin for HTML, CSS & JavaScript, and more. :small_orange_diamond: CodeSandbox - online code editor for web application development. :small_orange_diamond: PHP Sandbox - test your PHP code with this code tester. :small_orange_diamond: Repl.it - an instant IDE to learn, build, collaborate, and host all in one place. :small_orange_diamond: vclFiddle - is an online tool for experimenting with the Varnish Cache VCL.
:small_orange_diamond: GTmetrix - analyze your site’s speed and make it faster. :small_orange_diamond: Sucuri loadtimetester - test here the performance of any of your sites from across the globe. :small_orange_diamond: Pingdom Tools - analyze your site’s speed around the world. :small_orange_diamond: PingMe.io - run website latency tests across multiple geographic regions. :small_orange_diamond: PageSpeed Insights - analyze your site’s speed and make it faster. :small_orange_diamond: web.dev - helps developers like you learn and apply the web's modern capabilities to your own sites and apps. :small_orange_diamond: Lighthouse - automated auditing, performance metrics, and best practices for the web.
:small_orange_diamond: Censys - platform that helps information security practitioners discover, monitor, and analyze devices. :small_orange_diamond: Shodan - the world's first search engine for Internet-connected devices. :small_orange_diamond: Shodan 2000 - this tool looks for randomly generated data from Shodan. :small_orange_diamond: GreyNoise - mass scanner such as Shodan and Censys. :small_orange_diamond: ZoomEye - search engine for cyberspace that lets the user find specific network components. :small_orange_diamond: netograph - tools to monitor and understand deep structure of the web. :small_orange_diamond: FOFA - is a cyberspace search engine. :small_orange_diamond: onyphe - is a search engine for open-source and cyber threat intelligence data collected. :small_orange_diamond: IntelligenceX - is a search engine and data archive. :small_orange_diamond: binaryedge - it scan the entire internet space and create real-time threat intelligence streams and reports. :small_orange_diamond: Spyse - Internet assets registry: networks, threats, web objects, etc. :small_orange_diamond: wigle - is a submission-based catalog of wireless networks. All the networks. Found by Everyone. :small_orange_diamond: PublicWWW - find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code. :small_orange_diamond: IntelTechniques - this repository contains hundreds of online search utilities. :small_orange_diamond: hunter - lets you find email addresses in seconds and connect with the people that matter for your business. :small_orange_diamond: GhostProject? - search by full email address or username. :small_orange_diamond: databreaches - was my email affected by data breach? :small_orange_diamond: We Leak Info - world's fastest and largest data breach search engine. :small_orange_diamond: Pulsedive - scans of malicious URLs, IPs, and domains, including port scans and web requests. :small_orange_diamond: Buckets by Grayhatwarfar - database with public search for Open Amazon S3 Buckets and their contents. :small_orange_diamond: Vigilante.pw - the breached database directory. :small_orange_diamond: builtwith - find out what websites are built with. :small_orange_diamond: NerdyData - search the web's source code for technologies, across millions of sites. :small_orange_diamond: zorexeye - search for sites, images, apps, softwares & more. :small_orange_diamond: Mamont's open FTP Index - if a target has an open FTP site with accessible content it will be listed here. :small_orange_diamond: OSINT Framework - focused on gathering information from free tools or resources. :small_orange_diamond: maltiverse - is a service oriented to cybersecurity analysts for the advanced analysis of indicators of compromise. :small_orange_diamond: Leaked Source - is a collaboration of data found online in the form of a lookup. :small_orange_diamond: We Leak Info - to help everyday individuals secure their online life, avoiding getting hacked. :small_orange_diamond: pipl - is the place to find the person behind the email address, social username or phone number. :small_orange_diamond: abuse.ch - is operated by a random swiss guy fighting malware for non-profit. :small_orange_diamond: malc0de - malware search engine. :small_orange_diamond: Cybercrime Tracker - monitors and tracks various malware families that are used to perpetrate cyber crimes. :small_orange_diamond: shhgit - find GitHub secrets in real time. :small_orange_diamond: searchcode - helping you find real world examples of functions, API's and libraries. :small_orange_diamond: Insecam - the world biggest directory of online surveillance security cameras. :small_orange_diamond: index-of - contains great stuff like: security, hacking, reverse engineering, cryptography, programming etc. :small_orange_diamond: Rapid7 Labs Open Data - is a great resources of datasets from Project Sonar. :small_orange_diamond: Common Response Headers - the largest database of HTTP response headers.
:small_orange_diamond: thispersondoesnotexist - generate fake faces in one click - endless possibilities. :small_orange_diamond: AI Generated Photos - 100.000 AI generated faces. :small_orange_diamond: fakenamegenerator - your randomly generated identity. :small_orange_diamond: Intigriti Redirector - open redirect/SSRF payload generator.
:small_orange_diamond: have i been pwned? - check if you have an account that has been compromised in a data breach. :small_orange_diamond: dehashed - is a hacked database search engine. :small_orange_diamond: Leaked Source - is a collaboration of data found online in the form of a lookup.
:small_orange_diamond: CVE Mitre - list of publicly known cybersecurity vulnerabilities. :small_orange_diamond: CVE Details - CVE security vulnerability advanced database. :small_orange_diamond: Exploit DB - CVE compliant archive of public exploits and corresponding vulnerable software. :small_orange_diamond: 0day.today - exploits market provides you the possibility to buy/sell zero-day exploits. :small_orange_diamond: sploitus - the exploit and tools database. :small_orange_diamond: cxsecurity - free vulnerability database. :small_orange_diamond: Vulncode-DB - is a database for vulnerabilities and their corresponding source code if available. :small_orange_diamond: cveapi - free API for CVE data.
:small_orange_diamond: ImmuniWeb® Mobile App Scanner - test security and privacy of mobile apps (iOS & Android). :small_orange_diamond: Quixxi - free Mobile App Vulnerability Scanner for Android & iOS. :small_orange_diamond: Ostorlab - analyzes mobile application to identify vulnerabilities and potential weaknesses.
:small_orange_diamond: Startpage - the world's most private search engine. :small_orange_diamond: searX - a privacy-respecting, hackable metasearch engine. :small_orange_diamond: darksearch - the 1st real Dark Web search engine. :small_orange_diamond: Qwant - the search engine that respects your privacy. :small_orange_diamond: DuckDuckGo - the search engine that doesn't track you. :small_orange_diamond: Swisscows - privacy safe web search :small_orange_diamond: Disconnect - the search engine that anonymizes your searches. :small_orange_diamond: MetaGer - the search engine that uses anonymous proxy and hidden Tor branches.
:small_orange_diamond: CounterMail - online email service, designed to provide maximum security and privacy. :small_orange_diamond: Mail2Tor - is a Tor Hidden Service that allows anyone to send and receive emails anonymously. :small_orange_diamond: Tutanota - is the world's most secure email service and amazingly easy to use. :small_orange_diamond: Protonmail - is the world's largest secure email service, developed by CERN and MIT scientists. :small_orange_diamond: Startmail - private & encrypted email made easy.
:small_orange_diamond: Keybase - it's open source and powered by public-key cryptography.
:small_orange_diamond: SKS OpenPGP Key server - services for the SKS keyservers used by OpenPGP.
Systems/Services [TOC]
:small_orange_diamond: Slackware - the most "Unix-like" Linux distribution. :small_orange_diamond: OpenBSD - multi-platform 4.4BSD-based UNIX-like operating system. :small_orange_diamond: HardenedBSD - HardenedBSD aims to implement innovative exploit mitigation and security solutions. :small_orange_diamond: Kali Linux - Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. :small_orange_diamond: Parrot Security OS - cyber security GNU/Linux environment. :small_orange_diamond: Backbox Linux - penetration test and security assessment oriented Ubuntu-based Linux distribution. :small_orange_diamond: BlackArch - is an Arch Linux-based penetration testing distribution for penetration testers. :small_orange_diamond: Pentoo - is a security-focused livecd based on Gentoo. :small_orange_diamond: Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management. :small_orange_diamond: Tails - is a live system that aims to preserve your privacy and anonymity. :small_orange_diamond: vedetta - OpenBSD router boilerplate. :small_orange_diamond: Qubes OS - is a security-oriented OS that uses Xen-based virtualization.
:small_orange_diamond: Varnish Cache - HTTP accelerator designed for content-heavy dynamic web sites. :small_orange_diamond: Nginx - open source web and reverse proxy server that is similar to Apache, but very light weight. :small_orange_diamond: OpenResty - is a dynamic web platform based on NGINX and LuaJIT. :small_orange_diamond: Tengine - a distribution of Nginx with some advanced features. :small_orange_diamond: Caddy Server - is an open source, HTTP/2-enabled web server with HTTPS by default. :small_orange_diamond: HAProxy - the reliable, high performance TCP/HTTP load balancer.
:small_orange_diamond: Unbound - validating, recursive, and caching DNS resolver (with TLS). :small_orange_diamond: Knot Resolver - caching full resolver implementation, including both a resolver library and a daemon. :small_orange_diamond: PowerDNS - is an open source authoritative DNS server, written in C++ and licensed under the GPL.
:small_orange_diamond: 3proxy - tiny free proxy server.
:small_orange_diamond: Emerald Onion - is a 501(c)(3) nonprofit organization and transit internet service provider (ISP). :small_orange_diamond: pi-hole - the Pi-hole® is a DNS sinkhole that protects your devices from unwanted content. :small_orange_diamond: maltrail - malicious traffic detection system. :small_orange_diamond: security_monkey - monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time. :small_orange_diamond: firecracker - secure and fast microVMs for serverless computing. :small_orange_diamond: streisand - sets up a new server running your choice of WireGuard, OpenSSH, OpenVPN, and more.
Networks [TOC]
:small_orange_diamond: CapAnalysis - web visual tool to analyze large amounts of captured network traffic (PCAP analyzer). :small_orange_diamond: netbox - IP address management (IPAM) and data center infrastructure management (DCIM) tool.
:small_orange_diamond: NRE Labs - learn automation by doing it. Right now, right here, in your browser.
:small_orange_diamond: LBNL's Network Research Group - home page of the Network Research Group (NRG).
Containers/Orchestration [TOC]
:small_orange_diamond: gvisor - container runtime sandbox. :small_orange_diamond: ctop - top-like interface for container metrics.
:small_orange_diamond: Moby - a collaborative project for the container ecosystem to assemble container-based system. :small_orange_diamond: Traefik - open source reverse proxy/load balancer provides easier integration with Docker and Let's encrypt. :small_orange_diamond: kong - The Cloud-Native API Gateway. :small_orange_diamond: rancher - complete container management platform. :small_orange_diamond: portainer - making Docker management easy. :small_orange_diamond: nginx-proxy - automated nginx proxy for Docker containers using docker-gen.
:small_orange_diamond: docker-bench-security - checks for dozens of common best-practices around deploying Docker. :small_orange_diamond: trivy - vulnerability scanner for containers, suitable for CI. :small_orange_diamond: Harbor - cloud native registry project that stores, signs, and scans content.
:small_orange_diamond: docker-cheat-sheet - a quick reference cheat sheet on Docker. :small_orange_diamond: awesome-docker - a curated list of Docker resources and projects. :small_orange_diamond: docker_practice - learn and understand Docker technologies, with real DevOps practice! :small_orange_diamond: labs - is a collection of tutorials for learning how to use Docker with various tools. :small_orange_diamond: dockerfiles - various Dockerfiles I use on the desktop and on servers. :small_orange_diamond: kubernetes-the-hard-way - bootstrap Kubernetes the hard way on Google Cloud Platform. No scripts. :small_orange_diamond: kubernetes-the-easy-way - bootstrap Kubernetes the easy way on Google Cloud Platform. No scripts. :small_orange_diamond: cheatsheet-kubernetes-A4 - Kubernetes CheatSheets in A4. :small_orange_diamond: k8s-security - kubernetes security notes and best practices. :small_orange_diamond: kubernetes-production-best-practices - checklists with best-practices for production-ready Kubernetes. :small_orange_diamond: kubernetes-production-best-practices - kubernetes security - best practice guide. :small_orange_diamond: kubernetes-failure-stories - is a compilation of public failure/horror stories related to Kubernetes.
Manuals/Howtos/Tutorials [TOC]
:small_orange_diamond: pure-bash-bible - is a collection of pure bash alternatives to external processes. :small_orange_diamond: pure-sh-bible - is a collection of pure POSIX sh alternatives to external processes. :small_orange_diamond: bash-guide - is a guide to learn bash. :small_orange_diamond: bash-handbook - for those who wanna learn Bash. :small_orange_diamond: The Bash Hackers Wiki - hold documentation of any kind about GNU Bash. :small_orange_diamond: Shell & Utilities - describes the commands offered to application programs by POSIX-conformant systems. :small_orange_diamond: the-art-of-command-line - master the command line, in one page. :small_orange_diamond: Shell Style Guide - a shell style guide for Google-originated open-source projects.
:small_orange_diamond: Vim Cheat Sheet - great multi language vim guide.
:small_orange_diamond: Awesome Python - a curated list of awesome Python frameworks, libraries, software and resources. :small_orange_diamond: python-cheatsheet - comprehensive Python cheatsheet. :small_orange_diamond: pythoncheatsheet.org - basic reference for beginner and advanced developers.
:small_orange_diamond: F’Awk Yeah! - advanced sed and awk usage (Parsing for Pentesters 3).
:small_orange_diamond: nixCraft - linux and unix tutorials for new and seasoned sysadmin. :small_orange_diamond: TecMint - the ideal Linux blog for Sysadmins & Geeks. :small_orange_diamond: Omnisecu - free Networking, System Administration and Security tutorials. :small_orange_diamond: linux-cheat - Linux tutorials and cheatsheets. Minimal examples. Mostly user-land CLI utilities. :small_orange_diamond: linuxupskillchallenge - learn the skills required to sysadmin. :small_orange_diamond: Unix Toolbox - Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users. :small_orange_diamond: Linux Kernel Teaching - is a collection of lectures and labs Linux kernel topics. :small_orange_diamond: htop explained - explanation of everything you can see in htop/top on Linux. :small_orange_diamond: Linux Guide and Hints - tutorials on system administration in Fedora and CentOS. :small_orange_diamond: strace-little-book - a little book which introduces strace. :small_orange_diamond: linux-tracing-workshop - examples and hands-on labs for Linux tracing tools workshops. :small_orange_diamond: http2-explained - a detailed document explaining and documenting HTTP/2. :small_orange_diamond: http3-explained - a document describing the HTTP/3 and QUIC protocols. :small_orange_diamond: HTTP/2 in Action - an excellent introduction to the new HTTP/2 standard. :small_orange_diamond: Let's code a TCP/IP stack - great stuff to learn network and system programming at a deeper level. :small_orange_diamond: Nginx Admin's Handbook - how to improve NGINX performance, security and other important things. :small_orange_diamond: nginxconfig.io - NGINX config generator on steroids. :small_orange_diamond: openssh guideline - is to help operational teams with the configuration of OpenSSH server and client. :small_orange_diamond: SSH Handshake Explained - is a relatively brief description of the SSH handshake. :small_orange_diamond: ISC's Knowledgebase - you'll find some general information about BIND 9, ISC DHCP, and Kea DHCP. :small_orange_diamond: PacketLife.net - a place to record notes while studying for Cisco's CCNP certification.
:small_orange_diamond: AD-Attack-Defense - attack and defend active directory using modern post exploitation activity.
:small_orange_diamond: The System Design Primer - learn how to design large-scale systems. :small_orange_diamond: Awesome Scalability - best practices in building High Scalability, High Availability, High Stability, and more. :small_orange_diamond: Web Architecture 101 - the basic architecture concepts.
:small_orange_diamond: CIS Benchmarks - secure configuration settings for over 100 technologies, available as a free PDF. :small_orange_diamond: Security Harden CentOS 7 - this walks you through the steps required to security harden CentOS. :small_orange_diamond: CentOS 7 Server Hardening Guide - great guide for hardening CentOS; familiar with OpenSCAP. :small_orange_diamond: awesome-security-hardening - is a collection of security hardening guides, tools and other resources. :small_orange_diamond: The Practical Linux Hardening Guide - provides a high-level overview of hardening GNU/Linux systems. :small_orange_diamond: Linux Hardening Guide - how to harden Linux as much as possible for security and privacy.
:small_orange_diamond: Hacking Articles - LRaj Chandel's Security & Hacking Blog. :small_orange_diamond: AWS security tools - make your AWS cloud environment more secure. :small_orange_diamond: Rawsec's CyberSecurity Inventory - an inventory of tools and resources about CyberSecurity. :small_orange_diamond: The Illustrated TLS Connection - every byte of a TLS connection explained and reproduced. :small_orange_diamond: SSL Research - SSL and TLS Deployment Best Practices by SSL Labs. :small_orange_diamond: SELinux Game - learn SELinux by doing. Solve Puzzles, show skillz. :small_orange_diamond: Certificates and PKI - everything you should know about certificates and PKI but are too afraid to ask. :small_orange_diamond: The Art of Subdomain Enumeration - a reference for subdomain enumeration techniques. :small_orange_diamond: Quitting Google - the comprehensive guide to quitting Google.
:small_orange_diamond: OWASP - worldwide not-for-profit charitable organization focused on improving the security of software. :small_orange_diamond: OWASP ASVS 3.0.1 - OWASP Application Security Verification Standard Project. :small_orange_diamond: OWASP ASVS 3.0.1 Web App - simple web app that helps developers understand the ASVS requirements. :small_orange_diamond: OWASP ASVS 4.0 - is a list of application security requirements or tests. :small_orange_diamond: OWASP Testing Guide v4 - includes a "best practice" penetration testing framework. :small_orange_diamond: OWASP Dev Guide - this is the development version of the OWASP Developer Guide. :small_orange_diamond: OWASP WSTG - is a comprehensive open source guide to testing the security of web apps. :small_orange_diamond: OWASP API Security Project - focuses specifically on the top ten vulnerabilities in API security. :small_orange_diamond: Mozilla Web Security - help operational teams with creating secure web applications. :small_orange_diamond: security-bulletins - security bulletins that relate to Netflix Open Source. :small_orange_diamond: API-Security-Checklist - security countermeasures when designing, testing, and releasing your API. :small_orange_diamond: Enable CORS - enable cross-origin resource sharing. :small_orange_diamond: Application Security Wiki - is an initiative to provide all application security related resources at one place. :small_orange_diamond: Weird Proxies - reverse proxy related attacks; it is a result of analysis of various proxies. :small_orange_diamond: Webshells - great series about malicious payloads. :small_orange_diamond: Practical Web Cache Poisoning - show you how to compromise websites by using esoteric web features. :small_orange_diamond: Hidden directories and files - as a source of sensitive information about web application. :small_orange_diamond: Explosive blog - great blog about cybersec and pentests. :small_orange_diamond: Security Cookies - this paper will take a close look at cookie security. :small_orange_diamond: APISecurityBestPractices - help you keep secrets (API keys, db credentials, certificates) out of source code.
:small_orange_diamond: LZone Cheat Sheets - all cheat sheets. :small_orange_diamond: Dan’s Cheat Sheets’s - massive cheat sheets documentation. :small_orange_diamond: Rico's cheatsheets - this is a modest collection of cheatsheets. :small_orange_diamond: DevDocs API - combines multiple API documentations in a fast, organized, and searchable interface. :small_orange_diamond: cheat.sh - the only cheat sheet you need. :small_orange_diamond: gnulinux.guru - collection of cheat sheets about bash, vim and networking.
:small_orange_diamond: free-programming-books - list of free learning resources in many languages.
:small_orange_diamond: CTF Series : Vulnerable Machines - the steps below could be followed to find vulnerabilities and exploits. :small_orange_diamond: 50M_CTF_Writeup - $50 million CTF from Hackerone - writeup. :small_orange_diamond: ctf-tasks - an archive of low-level CTF challenges developed over the years. :small_orange_diamond: How to start RE/malware analysis? - collection of some hints and useful links for the beginners. :small_orange_diamond: The C10K problem - it's time for web servers to handle ten thousand clients simultaneously, don't you think? :small_orange_diamond: How 1500 bytes became the MTU of the internet - great story about the Maximum Transmission Unit. :small_orange_diamond: poor man's profiler - like dtrace's don't really provide methods to see what programs are blocking on. :small_orange_diamond: HTTPS on Stack Overflow - this is the story of a long journey regarding the implementation of SSL. :small_orange_diamond: Julia's Drawings - some drawings about programming and unix world, zines about systems & debugging tools. :small_orange_diamond: Hash collisions - this great repository is focused on hash collisions exploitation. :small_orange_diamond: sha256-animation - animation of the SHA-256 hash function in your terminal. :small_orange_diamond: BGP Meets Cat - after 3072 hours of manipulating BGP, Job Snijders has succeeded in drawing a Nyancat. :small_orange_diamond: bgp-battleships - playing battleships over BGP. :small_orange_diamond: What happens when... - you type google.com into your browser and press enter? :small_orange_diamond: how-web-works - based on the 'What happens when...' repository. :small_orange_diamond: HTTPS in the real world - great tutorial explain how HTTPS works in the real world. :small_orange_diamond: Gitlab and NFS bug - how we spent two weeks hunting an NFS bug in the Linux kernel. :small_orange_diamond: Gitlab melts down - postmortem on the database outage of January 31 2017 with the lessons we learned. :small_orange_diamond: How To Become A Hacker - if you want to be a hacker, keep reading. :small_orange_diamond: Operation Costs in CPU - should help to estimate costs of certain operations in CPU clocks. :small_orange_diamond: Let's Build a Simple Database - writing a sqlite clone from scratch in C. :small_orange_diamond: simple-computer - great resource to understand how computers work under the hood. :small_orange_diamond: The story of "Have I been pwned?" - working with 154 million records on Azure Table Storage. :small_orange_diamond: TOP500 Supercomputers - shows the 500 most powerful commercially available computer systems known to us. :small_orange_diamond: How to build a 8 GPU password cracker - any "black magic" or hours of frustration like desktop components do. :small_orange_diamond: CERN Data Centre - 3D visualizations of the CERN computing environments (and more). :small_orange_diamond: How fucked is my database - evaluate how fucked your database is with this handy website. :small_orange_diamond: Linux Troubleshooting 101 , 2016 Edition - everything is a DNS Problem... :small_orange_diamond: Five Whys - you know what the problem is, but you cannot solve it? :small_orange_diamond: Maersk, me & notPetya - how did ransomware successfully hijack hundreds of domain controllers? :small_orange_diamond: howhttps.works - how HTTPS works ...in a comic! :small_orange_diamond: howdns.works - a fun and colorful explanation of how DNS works. :small_orange_diamond: POSTGRESQLCO.NF - your postgresql.conf documentation and recommendations.
Inspiring Lists [TOC]
:small_orange_diamond: Awesome Sysadmin - amazingly awesome open source sysadmin resources. :small_orange_diamond: Awesome Shell - awesome command-line frameworks, toolkits, guides and gizmos. :small_orange_diamond: Command-line-text-processing - finding text to search and replace, sorting to beautifying, and more. :small_orange_diamond: Awesome Pcaptools - collection of tools developed by other researchers to process network traces. :small_orange_diamond: awesome-ebpf - a curated list of awesome projects related to eBPF. :small_orange_diamond: Linux Network Performance - where some of the network sysctl variables fit into the Linux/Kernel network flow. :small_orange_diamond: Awesome Postgres - list of awesome PostgreSQL software, libraries, tools and resources. :small_orange_diamond: quick-SQL-cheatsheet - a quick reminder of all SQL queries and examples on how to use them. :small_orange_diamond: Awesome-Selfhosted - list of Free Software network services and web applications which can be hosted locally. :small_orange_diamond: List of applications - huge list of apps sorted by category, as a reference for those looking for packages. :small_orange_diamond: CS-Interview-Knowledge-Map - build the best interview map. :small_orange_diamond: DevOps-Guide - DevOps Guide from basic to advanced with Interview Questions and Notes. :small_orange_diamond: FreeBSD Journal - it is a great list of periodical magazines about FreeBSD and other important things. :small_orange_diamond: devops-interview-questions - contains interview questions on various DevOps and SRE related topics.
:small_orange_diamond: Web Developer Roadmap - roadmaps, articles and resources to help you choose your path, learn and improve. :small_orange_diamond: Front-End-Checklist - the perfect Front-End Checklist for modern websites and meticulous developers. :small_orange_diamond: Front-End-Performance-Checklist - Front-End Performance Checklist that runs faster than the others. :small_orange_diamond: Python's Magic Methods - what are magic methods? They're everything in object-oriented Python. :small_orange_diamond: wtfpython - a collection of surprising Python snippets and lesser-known features. :small_orange_diamond: js-dev-reads - a list of books and articles for the discerning web developer to read. :small_orange_diamond: Commit messages guide - a guide to understand the importance of commit messages.
:small_orange_diamond: Awesome Web Security - a curated list of Web Security materials and resources. :small_orange_diamond: awesome-cyber-skills - a curated list of hacking environments where you can train your cyber skills. :small_orange_diamond: awesome-devsecops - an authoritative list of awesome devsecops tools. :small_orange_diamond: awesome-osint - is a curated list of amazingly awesome OSINT. :small_orange_diamond: HolyTips - tips and tutorials on Bug Bounty Hunting and Web App Security. :small_orange_diamond: awesome-threat-intelligence - a curated list of Awesome Threat Intelligence resources. :small_orange_diamond: Red-Teaming-Toolkit - a collection of open source and commercial tools that aid in red team operations. :small_orange_diamond: awesome-burp-extensions - a curated list of amazingly awesome Burp Extensions. :small_orange_diamond: Free Security eBooks - list of a Free Security and Hacking eBooks. :small_orange_diamond: Hacking-Security-Ebooks - top 100 Hacking & Security E-Books. :small_orange_diamond: privacy-respecting - curated list of privacy respecting services and software. :small_orange_diamond: reverse-engineering - list of awesome reverse engineering resources. :small_orange_diamond: linux-re-101 - a collection of resources for linux reverse engineering. :small_orange_diamond: reverseengineering-reading-list - a list of Reverse Engineering articles, books, and papers. :small_orange_diamond: Awesome-WAF - a curated list of awesome web-app firewall (WAF) stuff. :small_orange_diamond: awesome-shodan-queries - interesting, funny, and depressing search queries to plug into shodan.io. :small_orange_diamond: RobotsDisallowed - a curated list of the most common and most interesting robots.txt disallowed directories. :small_orange_diamond: HackingNeuralNetworks - is a small course on exploiting and defending neural networks. :small_orange_diamond: wildcard-certificates - why you probably shouldn't use a wildcard certificate. :small_orange_diamond: Don't use VPN services - which is what every third-party "VPN provider" does. :small_orange_diamond: awesome-yara - a curated list of awesome YARA rules, tools, and people. :small_orange_diamond: macOS-Security-and-Privacy-Guide - guide to securing and improving privacy on macOS. :small_orange_diamond: macos_security - macOS Security Compliance Project. :small_orange_diamond: awesome-sec-talks - is a collected list of awesome security talks. :small_orange_diamond: Movies for Hackers - list of movies every hacker & cyberpunk must watch. :small_orange_diamond: Cryptography_1 - materials used whilst taking Prof. Dan Boneh Stanford Crypto course. :small_orange_diamond: Crypton - library to learn and practice Offensive and Defensive Cryptography.
:small_orange_diamond: Cheatography - over 3,000 free cheat sheets, revision aids and quick references. :small_orange_diamond: awesome-static-analysis - static analysis tools for all programming languages. :small_orange_diamond: computer-science - path to a free self-taught education in Computer Science. :small_orange_diamond: post-mortems - is a collection of postmortems (config errors, hardware failures, and more). :small_orange_diamond: build-your-own-x - build your own (insert technology here). :small_orange_diamond: Project-Based-Tutorials-in-C - is a curated list of project-based tutorials in C. :small_orange_diamond: The-Documentation-Compendium - various README templates & tips on writing high-quality documentation. :small_orange_diamond: awesome-python-applications - free software that works great, and also happens to be open-source Python. :small_orange_diamond: awesome-public-datasets - a topic-centric list of HQ open datasets. :small_orange_diamond: machine-learning-algorithms - a curated list of all machine learning algorithms and concepts.
Blogs/Podcasts/Videos [TOC]
:small_orange_diamond: Varnish for PHP developers - very interesting presentation of Varnish by Mattias Geniar. :small_orange_diamond: A Netflix Guide to Microservices - talks about the chaotic and vibrant world of microservices at Netflix.
:small_orange_diamond: Comparing C to machine lang - compare a simple C app with the compiled machine code of that program.
:small_orange_diamond: Brendan Gregg's Blog - is an industry expert in computing performance and cloud computing. :small_orange_diamond: Gynvael "GynDream" Coldwind - is a IT security engineer at Google. :small_orange_diamond: Michał "lcamtuf" Zalewski - white hat hacker, computer security expert. :small_orange_diamond: Mattias Geniar - developer, sysadmin, blogger, podcaster and public speaker. :small_orange_diamond: Nick Craver - software developer and systems administrator for Stack Exchange. :small_orange_diamond: Scott Helme - security researcher, speaker and founder of securityheaders.com and report-uri.com. :small_orange_diamond: Brian Krebs - The Washington Post and now an Independent investigative journalist. :small_orange_diamond: Bruce Schneier - is an internationally renowned security technologist, called a "security guru". :small_orange_diamond: Chrissy Morgan - advocate of practical learning, Chrissy also takes part in bug bounty programs. :small_orange_diamond: Andy Gill - is a hacker at heart who works as a senior penetration tester. :small_orange_diamond: Daniel Miessler - cybersecurity expert and writer. :small_orange_diamond: Samy Kamkar - is an American privacy and security researcher, computer hacker. :small_orange_diamond: Javvad Malik - is a security advocate at AlienVault, a blogger event speaker and industry commentator. :small_orange_diamond: Graham Cluley - public speaker and independent computer security analyst. :small_orange_diamond: Kacper Szurek - detection engineer at ESET. :small_orange_diamond: Troy Hunt - web security expert known for public education and outreach on security topics. :small_orange_diamond: raymii.org - sysadmin specializing in building high availability cloud environments. :small_orange_diamond: Robert Penz - IT security expert.
:small_orange_diamond: Linux Audit - the Linux security blog about auditing, hardening and compliance by Michael Boelen. :small_orange_diamond: Linux Security Expert - trainings, howtos, checklists, security tools, and more. :small_orange_diamond: The Grymoire - collection of useful incantations for wizards, be you computer wizards, magicians, or whatever. :small_orange_diamond: Secjuice - is the only non-profit, independent and volunteer led publication in the information security space. :small_orange_diamond: Decipher - security news that informs and inspires.
:small_orange_diamond: Tenable Podcast - conversations and interviews related to Cyber Exposure, and more. :small_orange_diamond: Sophos - threat news room, giving you news, opinion, advice and research on computer security issues. :small_orange_diamond: Tripwire State of Security - blog featuring the latest news, trends and insights on current security issues. :small_orange_diamond: Malwarebytes Labs Blog - security blog aims to provide insider news about cybersecurity. :small_orange_diamond: TrustedSec - latest news, and trends about cybersecurity. :small_orange_diamond: PortSwigger Web Security Blog - about web app security vulns and top tips from our team of web security. :small_orange_diamond: AT&T Cybersecurity blog - news on emerging threats and practical advice to simplify threat detection. :small_orange_diamond: Thycotic - where CISOs and IT Admins come to learn about industry trends, IT security, and more.
:small_orange_diamond: Risky Business - is a weekly information security podcast featuring news and in-depth interviews. :small_orange_diamond: Cyber, by Motherboard - stories, and focus on the ideas about cybersecurity. :small_orange_diamond: Tenable Podcast - conversations and interviews related to Cyber Exposure, and more. :small_orange_diamond: Cybercrime Investigations - podcast by Geoff White about cybercrimes. :small_orange_diamond: The many hats club - featuring stories from a wide range of Infosec people (Whitehat, Greyhat and Blackhat). :small_orange_diamond: Darknet Diaries - true stories from the dark side of the Internet. :small_orange_diamond: OSINTCurious Webcasts - is the investigative curiosity that helps people be successful in OSINT. :small_orange_diamond: Security Weekly - the latest information security and hacking news.
:small_orange_diamond: rev3rse security - offensive, binary exploitation, web app security, hardening, red team, blue team. :small_orange_diamond: LiveOverflow - a lot more advanced topics than what is typically offered in paid online courses - but for free. :small_orange_diamond: J4vv4D - the important information regarding our internet security. :small_orange_diamond: CyberTalks - talks, interviews, and article about cybersecurity.
:small_orange_diamond: @blackroomsec - a white-hat hacker/pentester. Intergalactic Minesweeper Champion 1990. :small_orange_diamond: @MarcoCiappelli - Co-Founder @ITSPmagazine, at the intersection of IT security and society. :small_orange_diamond: @binitamshah - Linux Evangelist. Malwares. Kernel Dev. Security Enthusiast. :small_orange_diamond: @joe_carson - an InfoSec Professional and Tech Geek. :small_orange_diamond: @mikko - CRO at F-Secure, Reverse Engineer, TED Speaker, Supervillain. :small_orange_diamond: @esrtweet - often referred to as ESR, is an American software developer, and open-source software advocate. :small_orange_diamond: @gynvael - security researcher/programmer, @DragonSectorCTF founder/player, technical streamer. :small_orange_diamond: @x0rz - Security Researcher & Cyber Observer. :small_orange_diamond: @hasherezade - programmer, malware analyst. Author of PEbear, PEsieve, libPeConv. :small_orange_diamond: @TinkerSec - tinkerer, cypherpunk, hacker. :small_orange_diamond: @alisaesage - independent hacker and researcher. :small_orange_diamond: @SwiftOnSecurity - systems security, industrial safety, sysadmin, author of decentsecurity.com. :small_orange_diamond: @dakami - is one of just seven people with the authority to restore the DNS root keys. :small_orange_diamond: @samykamkar - is a famous "grey hat" hacker, security researcher, creator of the MySpace "Samy" worm. :small_orange_diamond: @securityweekly - founder & CTO of Security Weekly podcast network. :small_orange_diamond: @jack_daniel - @SecurityBSides co-founder. :small_orange_diamond: @thegrugq - Security Researcher. :small_orange_diamond: @matthew_d_green - a cryptographer and professor at Johns Hopkins University.
:small_orange_diamond: @haveibeenpwned - check if you have an account that has been compromised in a data breach. :small_orange_diamond: @bugcrowd - trusted by more of the Fortune 500 than any other crowdsourced security platform. :small_orange_diamond: @Malwarebytes - most trusted security company. Unmatched threat visibility. :small_orange_diamond: @sansforensics - the world's leading Digital Forensics and Incident Response provider. :small_orange_diamond: @attcyber - AT&T Cybersecurity’s Edge-to-Edge technologies provide threat intelligence, and more. :small_orange_diamond: @TheManyHatsClub - an information security focused podcast and group of individuals from all walks of life. :small_orange_diamond: @hedgehogsec - Hedgehog Cyber. Gibraltar and Manchester's top boutique information security firm. :small_orange_diamond: @NCSC - the National Cyber Security Centre. Helping to make the UK the safest place to live and work online. :small_orange_diamond: @Synacktiv - IT security experts.
:small_orange_diamond: How to Do Things at ARL - how to configure modems, scan images, record CD-ROMs, and other.*
:small_orange_diamond: Diffie-Hellman Key Exchange (short version) - how Diffie-Hellman Key Exchange worked.
Hacking/Penetration Testing [TOC]
:small_orange_diamond: Sandcat Browser - a penetration-oriented browser with plenty of advanced functionality already built in. :small_orange_diamond: Metasploit - tool and framework for pentesting system, web and many more, contains a lot a ready to use exploit. :small_orange_diamond: Burp Suite - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz. :small_orange_diamond: OWASP Zed Attack Proxy - intercepting proxy to replay, inject, scan and fuzz HTTP requests. :small_orange_diamond: w3af - is a Web Application Attack and Audit Framework. :small_orange_diamond: mitmproxy - an interactive TLS-capable intercepting HTTP proxy for penetration testers. :small_orange_diamond: Nikto2 - web server scanner which performs comprehensive tests against web servers for multiple items. :small_orange_diamond: sqlmap - tool that automates the process of detecting and exploiting SQL injection flaws. :small_orange_diamond: Recon-ng - is a full-featured Web Reconnaissance framework written in Python. :small_orange_diamond: AutoRecon - is a network reconnaissance tool which performs automated enumeration of services. :small_orange_diamond: Faraday - an Integrated Multiuser Pentest Environment. :small_orange_diamond: Photon - incredibly fast crawler designed for OSINT. :small_orange_diamond: XSStrike - most advanced XSS detection suite. :small_orange_diamond: Sn1per - automated pentest framework for offensive security experts. :small_orange_diamond: vuls - is an agent-less vulnerability scanner for Linux, FreeBSD, and other. :small_orange_diamond: tsunami - is a general purpose network security scanner with an extensible plugin system. :small_orange_diamond: aquatone - a tool for domain flyovers. :small_orange_diamond: BillCipher - information gathering tool for a website or IP address. :small_orange_diamond: WhatWaf - detect and bypass web application firewalls and protection systems. :small_orange_diamond: Corsy - CORS misconfiguration scanner. :small_orange_diamond: Raccoon - is a high performance offensive security tool for reconnaissance and vulnerability scanning. :small_orange_diamond: dirhunt - find web directories without bruteforce. :small_orange_diamond: John The Ripper - is a fast password cracker, currently available for many flavors of Unix, Windows, and other. :small_orange_diamond: hashcat - world's fastest and most advanced password recovery utility. :small_orange_diamond: p0f - is a tool to identify the players behind any incidental TCP/IP communications. :small_orange_diamond: ssh_scan - a prototype SSH configuration and policy scanner. :small_orange_diamond: LeakLooker - find open databases - powered by Binaryedge.io :small_orange_diamond: exploitdb - searchable archive from The Exploit Database. :small_orange_diamond: getsploit - is a command line utility for searching and downloading exploits. :small_orange_diamond: ctf-tools - some setup scripts for security research tools. :small_orange_diamond: pwntools - CTF framework and exploit development library. :small_orange_diamond: security-tools - collection of small security tools created mostly in Python. CTFs, pentests and so on. :small_orange_diamond: pentestpackage - is a package of Pentest scripts. :small_orange_diamond: python-pentest-tools - python tools for penetration testers. :small_orange_diamond: fuzzdb - dictionary of attack patterns and primitives for black-box application fault injection. :small_orange_diamond: AFL - is a free software fuzzer maintained by Google. :small_orange_diamond: AFL++ - is AFL with community patches. :small_orange_diamond: syzkaller - is an unsupervised, coverage-guided kernel fuzzer. :small_orange_diamond: pwndbg - exploit development and reverse engineering with GDB made easy. :small_orange_diamond: GDB PEDA - Python Exploit Development Assistance for GDB. :small_orange_diamond: IDA - multi-processor disassembler and debugger useful for reverse engineering malware. :small_orange_diamond: radare2 - framework for reverse-engineering and analyzing binaries. :small_orange_diamond: routersploit - exploitation framework for embedded devices. :small_orange_diamond: Ghidra - is a software reverse engineering (SRE) framework. :small_orange_diamond: Cutter - is an SRE platform integrating Ghidra's decompiler. :small_orange_diamond: Vulnreport - open-source pentesting management and automation platform by Salesforce Product Security. :small_orange_diamond: Mentalist - is a graphical tool for custom wordlist generation. :small_orange_diamond: archerysec - vulnerability assessment and management helps to perform scans and manage vulnerabilities. :small_orange_diamond: Osmedeus - fully automated offensive security tool for reconnaissance and vulnerability scanning. :small_orange_diamond: beef - the browser exploitation framework project. :small_orange_diamond: AutoSploit - automated mass exploiter. :small_orange_diamond: SUDO_KILLER - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities. :small_orange_diamond: yara - the pattern matching swiss knife. :small_orange_diamond: mimikatz - a little tool to play with Windows security. :small_orange_diamond: sherlock - hunt down social media accounts by username across social networks. :small_orange_diamond: OWASP Threat Dragon - is a tool used to create threat model diagrams and to record possible threats.
:small_orange_diamond: PTES - the penetration testing execution standard. :small_orange_diamond: Pentests MindMap - amazing mind map with vulnerable apps and systems. :small_orange_diamond: WebApps Security Tests MindMap - incredible mind map for WebApps security tests. :small_orange_diamond: Brute XSS - master the art of Cross Site Scripting. :small_orange_diamond: XSS cheat sheet - contains many vectors that can help you bypass WAFs and filters. :small_orange_diamond: Offensive Security Bookmarks - security bookmarks collection, all things that author need to pass OSCP. :small_orange_diamond: Awesome Pentest Cheat Sheets - collection of the cheat sheets useful for pentesting. :small_orange_diamond: Awesome Hacking by HackWithGithub - awesome lists for hackers, pentesters and security researchers. :small_orange_diamond: Awesome Hacking by carpedm20 - a curated list of awesome hacking tutorials, tools and resources. :small_orange_diamond: Awesome Hacking Resources - collection of hacking/penetration testing resources to make you better. :small_orange_diamond: Awesome Pentest - collection of awesome penetration testing resources, tools and other shiny things. :small_orange_diamond: Awesome-Hacking-Tools - is a curated list of awesome Hacking Tools. :small_orange_diamond: Hacking Cheat Sheet - author hacking and pentesting notes. :small_orange_diamond: blackhat-arsenal-tools - official Black Hat arsenal security tools repository. :small_orange_diamond: Penetration Testing and WebApp Cheat Sheets - the complete list of Infosec related cheat sheets. :small_orange_diamond: Cyber Security Resources - includes thousands of cybersecurity-related references and resources. :small_orange_diamond: Pentest Bookmarks - there are a LOT of pentesting blogs. :small_orange_diamond: Cheatsheet-God - Penetration Testing Reference Bank - OSCP/PTP & PTX Cheatsheet. :small_orange_diamond: ThreatHunter-Playbook - to aid the development of techniques and hypothesis for hunting campaigns. :small_orange_diamond: Beginner-Network-Pentesting - notes for beginner network pentesting course. :small_orange_diamond: OSCPRepo - is a list of resources that author have been gathering in preparation for the OSCP. :small_orange_diamond: PayloadsAllTheThings - a list of useful payloads and bypass for Web Application Security and Pentest/CTF. :small_orange_diamond: payloads - git all the Payloads! A collection of web attack payloads. :small_orange_diamond: command-injection-payload-list - command injection payload list. :small_orange_diamond: Awesome Shodan Search Queries - great search queries to plug into Shodan. :small_orange_diamond: AwesomeXSS - is a collection of Awesome XSS resources. :small_orange_diamond: php-webshells - common php webshells. :small_orange_diamond: Pentesting Tools Cheat Sheet - a quick reference high level overview for typical penetration testing. :small_orange_diamond: OWASP Cheat Sheet Series - is a collection of high value information on specific application security topics. :small_orange_diamond: OWASP dependency-check - is an open source solution the OWASP Top 10 2013 entry. :small_orange_diamond: OWASP ProActive Controls - OWASP Top 10 Proactive Controls 2018. :small_orange_diamond: PENTESTING-BIBLE - hacking & penetration testing & red team & cyber security resources. :small_orange_diamond: pentest-wiki - is a free online security knowledge library for pentesters/researchers. :small_orange_diamond: DEF CON Media Server - great stuff from DEFCON. :small_orange_diamond: Awesome Malware Analysis - a curated list of awesome malware analysis tools and resources. :small_orange_diamond: SQL Injection Cheat Sheet - detailed technical stuff about the many different variants of the SQL Injection. :small_orange_diamond: Entersoft Knowledge Base - great and detailed reference about vulnerabilities. :small_orange_diamond: HTML5 Security Cheatsheet - a collection of HTML5 related XSS attack vectors. :small_orange_diamond: XSS String Encoder - for generating XSS code to check your input validation filters against XSS. :small_orange_diamond: GTFOBins - list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. :small_orange_diamond: Guifre Ruiz Notes - collection of security, system, network and pentest cheatsheets. :small_orange_diamond: SSRF Tips - a collection of SSRF Tips. :small_orange_diamond: shell-storm repo CTF - great archive of CTFs. :small_orange_diamond: ctf - CTF (Capture The Flag) writeups, code snippets, notes, scripts. :small_orange_diamond: My-CTF-Web-Challenges - collection of CTF Web challenges. :small_orange_diamond: MSTG - The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing. :small_orange_diamond: Internal-Pentest-Playbook - notes on the most common things for an Internal Network Penetration Test. :small_orange_diamond: KeyHacks - shows quick ways in which API keys leaked by a bug bounty program can be checked. :small_orange_diamond: securitum/research - various Proof of Concepts of security research performed by Securitum. :small_orange_diamond: public-pentesting-reports - is a list of public pentest reports released by several consulting security groups. :small_orange_diamond: awesome-bug-bounty - is a comprehensive curated list of available Bug Bounty. :small_orange_diamond: bug-bounty-reference - is a list of bug bounty write-ups. :small_orange_diamond: Awesome-Bugbounty-Writeups - is a curated list of bugbounty writeups. :small_orange_diamond: Bug bounty writeups - list of bug bounty writeups (2012-2020). :small_orange_diamond: hackso.me - a great journey into security.
:small_orange_diamond: PHP-backdoors - a collection of PHP backdoors. For educational or testing purposes only.
:small_orange_diamond: Weakpass - for any kind of bruteforce find wordlists or unleash the power of them all at once! :small_orange_diamond: Hashes.org - is a free online hash resolving service incorporating many unparalleled techniques. :small_orange_diamond: SecLists - collection of multiple types of lists used during security assessments, collected in one place. :small_orange_diamond: Probable-Wordlists - sorted by probability originally created for password generation and testing. :small_orange_diamond: skullsecurity passwords - password dictionaries and leaked passwords repository. :small_orange_diamond: Polish PREMIUM Dictionary - official dictionary created by the team on the forum bezpieka.org.* 1 :small_orange_diamond: statistically-likely-usernames - wordlists for creating statistically likely username lists.
:small_orange_diamond: YesWeHack - bug bounty platform with infosec jobs. :small_orange_diamond: Openbugbounty - allows any security researcher reporting a vulnerability on any website. :small_orange_diamond: hackerone - global hacker community to surface the most relevant security issues. :small_orange_diamond: bugcrowd - crowdsourced cybersecurity for the enterprise. :small_orange_diamond: Crowdshield - crowdsourced security & bug bounty management. :small_orange_diamond: Synack - crowdsourced security & bug bounty programs, crowd security intelligence platform, and more. :small_orange_diamond: Hacktrophy - bug bounty platform.
:small_orange_diamond: OWASP-VWAD - comprehensive and well maintained registry of all known vulnerable web applications. :small_orange_diamond: DVWA - PHP/MySQL web application that is damn vulnerable. :small_orange_diamond: metasploitable2 - vulnerable web application amongst security researchers. :small_orange_diamond: metasploitable3 - is a VM that is built from the ground up with a large amount of security vulnerabilities. :small_orange_diamond: DSVW - is a deliberately vulnerable web application written in under 100 lines of code. :small_orange_diamond: OWASP Mutillidae II - free, open source, deliberately vulnerable web-application. :small_orange_diamond: OWASP Juice Shop Project - the most bug-free vulnerable application in existence. :small_orange_diamond: OWASP Node js Goat Project - OWASP Top 10 security risks apply to web apps developed using Node.js. :small_orange_diamond: juicy-ctf - run Capture the Flags and Security Trainings with OWASP Juice Shop. :small_orange_diamond: SecurityShepherd - web and mobile application security training platform. :small_orange_diamond: Security Ninjas - open source application security training program. :small_orange_diamond: hackazon - a modern vulnerable web app. :small_orange_diamond: dvna - damn vulnerable NodeJS application. :small_orange_diamond: django-DefectDojo - is an open-source application vulnerability correlation and security orchestration tool. :small_orange_diamond: Google Gruyere - web application exploits and defenses. :small_orange_diamond: Bodhi - is a playground focused on learning the exploitation of client-side web vulnerabilities. :small_orange_diamond: Websploit - single vm lab with the purpose of combining several vulnerable appliations in one environment. :small_orange_diamond: vulhub - pre-built Vulnerable Environments based on docker-compose. :small_orange_diamond: CloudGoat 2 - the new & improved "Vulnerable by Design" AWS deployment tool. :small_orange_diamond: secDevLabs - is a laboratory for learning secure web development in a practical manner. :small_orange_diamond: CORS-vulnerable-Lab - sample vulnerable code and its exploit code. :small_orange_diamond: RootTheBox - a Game of Hackers (CTF Scoreboard & Game Manager). :small_orange_diamond: KONTRA - application security training (OWASP Top Web & Api).
:small_orange_diamond: Offensive Security - true performance-based penetration testing training for over a decade. :small_orange_diamond: Hack The Box - online platform allowing you to test your penetration testing skills. :small_orange_diamond: Hacking-Lab - online ethical hacking, computer network and security challenge platform. :small_orange_diamond: pwnable.kr - non-commercial wargame site which provides various pwn challenges. :small_orange_diamond: Pwnable.tw - is a wargame site for hackers to test and expand their binary exploiting skills. :small_orange_diamond: picoCTF - is a free computer security game targeted at middle and high school students. :small_orange_diamond: CTFlearn - is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge. :small_orange_diamond: ctftime - CTF archive and a place, where you can get some another CTF-related info. :small_orange_diamond: Silesia Security Lab - high quality security testing services. :small_orange_diamond: Practical Pentest Labs - pentest lab, take your Hacking skills to the next level. :small_orange_diamond: Root Me - the fast, easy, and affordable way to train your hacking skills. :small_orange_diamond: rozwal.to - a great platform to train your pentesting skills. :small_orange_diamond: TryHackMe - learning Cyber Security made easy. :small_orange_diamond: hackxor - is a realistic web application hacking game, designed to help players of all abilities develop their skills. :small_orange_diamond: Hack Yourself First - it's full of nasty app sec holes. :small_orange_diamond: OverTheWire - can help you to learn and practice security concepts in the form of fun-filled games. :small_orange_diamond: Wizard Labs - is an online Penetration Testing Lab. :small_orange_diamond: PentesterLab - provides vulnerable systems that can be used to test and understand vulnerabilities. :small_orange_diamond: RingZer0 - tons of challenges designed to test and improve your hacking skills. :small_orange_diamond: try2hack - several security-oriented challenges for your entertainment. :small_orange_diamond: Ubeeri - preconfigured lab environments. :small_orange_diamond: Pentestit - emulate IT infrastructures of real companies for legal pen testing and improving pentest skills. :small_orange_diamond: Microcorruption - reversal challenges done in the web interface. :small_orange_diamond: Crackmes - download crackmes to help improve your reverse engineering skills. :small_orange_diamond: DomGoat - DOM XSS security learning and practicing platform. :small_orange_diamond: Stereotyped Challenges - upgrade your web hacking techniques today! :small_orange_diamond: Vulnhub - allows anyone to gain practical 'hands-on' experience in digital security. :small_orange_diamond: W3Challs - is a penetration testing training platform, which offers various computer challenges. :small_orange_diamond: RingZer0 CTF - offers you tons of challenges designed to test and improve your hacking skills. :small_orange_diamond: Hack.me - a platform where you can build, host and share vulnerable web apps for educational purposes. :small_orange_diamond: HackThis! - discover how hacks, dumps and defacements are performed and secure your website. :small_orange_diamond: Enigma Group WebApp Training - these challenges cover the exploits listed in the OWASP Top 10 Project. :small_orange_diamond: Reverse Engineering Challenges - challenges, exercises, problems and tasks - by level, by type, and more. :small_orange_diamond: 0x00sec - the home of the Hacker - Malware, Reverse Engineering, and Computer Science. :small_orange_diamond: We Chall - there are exist a lots of different challenge types. :small_orange_diamond: Hacker Gateway - is the go-to place for hackers who want to test their skills. :small_orange_diamond: Hacker101 - is a free class for web security. :small_orange_diamond: contained.af - a stupid game for learning about containers, capabilities, and syscalls. :small_orange_diamond: flAWS challenge! - a series of levels you'll learn about common mistakes and gotchas when using AWS. :small_orange_diamond: CyberSec WTF - provides web hacking challenges derived from bounty write-ups. :small_orange_diamond: CTF Challenge - CTF Web App challenges. :small_orange_diamond: gCTF - most of the challenges used in the Google CTF 2017. :small_orange_diamond: Hack This Site - is a free, safe and legal training ground for hackers. :small_orange_diamond: Attack & Defense - is a browser-based cloud labs. :small_orange_diamond: Cryptohack - a fun platform for learning modern cryptography. :small_orange_diamond: Cryptopals - the cryptopals crypto challenges.
:small_orange_diamond: fbctf - platform to host Capture the Flag competitions. :small_orange_diamond: ctfscoreboard - scoreboard for Capture The Flag competitions.
:small_orange_diamond: Bugcrowd University - open source education content for the researcher community. :small_orange_diamond: OSCPRepo - a list of resources and scripts that I have been gathering in preparation for the OSCP. :small_orange_diamond: OWASP Top 10: Real-World Examples - test your web apps with real-world examples (two-part series). :small_orange_diamond: phrack.org - an awesome collection of articles from several respected hackers and other thinkers. :small_orange_diamond: Practical-Ethical-Hacking-Resources - compilation of resources from TCM's Udemy Course.
Your daily knowledge and news [TOC]
:small_orange_diamond: Feedly - organize, read and share what matters to you. :small_orange_diamond: Inoreader - similar to feedly with a support for filtering what you fetch from rss.
:small_orange_diamond: #hackerspaces - hackerspace IRC channels.
:small_orange_diamond: The Hacker News - leading news source dedicated to promoting awareness for security experts and hackers. :small_orange_diamond: Latest Hacking News - provides the latest hacking news, exploits and vulnerabilities for ethical hackers. :small_orange_diamond: Security Newsletter - security news as a weekly digest (email notifications). :small_orange_diamond: Google Online Security Blog - the latest news and insights from Google on security and safety on the Internet. :small_orange_diamond: Qualys Blog - expert network security guidance and news. :small_orange_diamond: DARKReading - connecting the Information Security Community. :small_orange_diamond: Darknet - latest hacking tools, hacker news, cybersecurity best practices, ethical hacking & pen-testing. :small_orange_diamond: publiclyDisclosed - public disclosure watcher who keeps you up to date about the recently disclosed bugs. :small_orange_diamond: Reddit - Hacking - a subreddit dedicated to hacking and hackers. :small_orange_diamond: Packet Storm - information security services, news, files, tools, exploits, advisories and whitepapers. :small_orange_diamond: Sekurak - about security, penetration tests, vulnerabilities and many others (PL/EN). :small_orange_diamond: nf.sec - basic aspects and mechanisms of Linux operating system security (PL).
:small_orange_diamond: Changelog - is a community of hackers; news & podcasts for developers and hackers.
Other Cheat Sheets [TOC]
Build your own DNS Servers
:small_orange_diamond: Unbound DNS Tutorial - a validating, recursive, and caching DNS server. :small_orange_diamond: Knot Resolver on Fedora - how to get faster and more secure DNS resolution with Knot Resolver on Fedora. :small_orange_diamond: DNS-over-HTTPS - tutorial to setup your own DNS-over-HTTPS (DoH) server. :small_orange_diamond: dns-over-https - a cartoon intro to DNS over HTTPS. :small_orange_diamond: DNS-over-TLS - following to your DoH server, setup your DNS-over-TLS (DoT) server. :small_orange_diamond: DNS Servers - how (and why) i run my own DNS Servers.
Build your own Certificate Authority
:small_orange_diamond: OpenSSL Certificate Authority - build your own certificate authority (CA) using the OpenSSL tools. :small_orange_diamond: step-ca Certificate Authority - build your own certificate authority (CA) using open source step-ca.
Build your own System/Virtual Machine
:small_orange_diamond: os-tutorial - how to create an OS from scratch. :small_orange_diamond: Write your Own Virtual Machine - how to write your own virtual machine (VM). :small_orange_diamond: x86 Bare Metal Examples - dozens of minimal operating systems to learn x86 system programming. :small_orange_diamond: simple-computer - the scott CPU from "But How Do It Know?" by J. Clark Scott. :small_orange_diamond: littleosbook - the little book about OS development.
DNS Servers list (privacy)
TOP Browser extensions
TOP Burp extensions
Hack Mozilla Firefox address bar
In Firefox's address bar, you can limit results by typing special characters before or after your term:
^- for matches in your browsing history*- for matches in your bookmarks.%- for matches in your currently open tabs.#- for matches in page titles.@- for matches in web addresses.
Chrome hidden commands
chrome://chrome-urls- list of all commandschrome://flags- enable experiments and development featureschrome://interstitials- errors and warningschrome://net-internals- network internals (events, dns, cache)chrome://network-errors- network errorschrome://net-export- start logging future network activity to a filechrome://safe-browsing- safe browsing optionschrome://user-actions- record all user actionschrome://restart- restart chromechrome://dino- ERR_INTERNET_DISCONNECTED...cache:<website-address>- view the cached version of the web page
Bypass WAFs by Shortening IP Address (by 0xInfection)
IP addresses can be shortened by dropping the zeroes:
This bypasses WAF filters for SSRF, open-redirect, etc where any IP as input gets blacklisted.
For more information please see How to Obscure Any URL and Magic IP Address Shortcuts.
Hashing, encryption and encoding (by Michal Špaček)
Hashing
Symmetric encryption
Asymmetric encryption
Encoding
One-liners [TOC]
Table of Contents
terminal
busybox
mount
fuser
lsof
ps
top
vmstat
iostat
strace
kill
find
diff
vimdiff
tail
cpulimit
pwdx
tr
chmod
who
last
screen
script
du
inotifywait
openssl
secure-delete
dd
gpg
system-other
curl
httpie
ssh
linux-dev
tcpdump
tcpick
ngrep
hping3
nmap
netcat
socat
p0f
gnutls-cli
netstat
rsync
host
dig
certbot
network-other
git
awk
sed
grep
perl
Tool: terminal
Reload shell without exit
Close shell keeping all subprocess running
Exit without saving shell history
Perform a branching conditional
Pipe stdout and stderr to separate commands
Redirect stdout and stderr each to separate files and print both to the screen
List of commands you use most often
Sterilize bash history
Look also: A naive utility to censor credentials in command history.
Quickly backup a file
Empty a file (truncate to 0 size)
Delete all files in a folder that don't match a certain file extension
Pass multi-line string to a file
Edit a file on a remote host using vim
Create a directory and change into it at the same time
Convert uppercase files to lowercase files
Print a row of characters across the terminal
Show shell history without line numbers
Run command(s) after exit session
Generate a sequence of numbers
Simple Bash filewatching
Tool: busybox
Static HTTP web server
Tool: mount
Mount a temporary ram partition
-t- filesystem type-o- mount options
Remount a filesystem as read/write
Tool: fuser
Show which processes use the files/directories
Kills a process that is locking a file
-i- interactive option
Kills a process that is locking a file with specific signal
--list-signals- list available signal names
Show what PID is listening on specific port
Show all processes using the named filesystems or block device
Tool: lsof
Show process that use internet connection at the moment
Show process that use specific port number
Lists all listening ports together with the PID of the associated process
List all open ports and their owning executables
Show all open ports
Show open ports (LISTEN)
List all files opened by a particular command
View user activity per directory
Show 10 largest open files
Show current working directory of a process
Tool: ps
Show a 4-way scrollable process tree with full details
Processes per user counter
Show all processes by name with main header
Tool: find
Find files that have been modified on your system in the past 60 minutes
Find all files larger than 20M
Find duplicate files (based on MD5 hash)
Change permission only for files
Change permission only for directories
Find files and directories for specific user/group
Find files and directories for all without specific user/group
Looking for files/directories that only have certain permission
Delete older files than 60 days
Recursively remove all empty sub-directories from a directory
How to find all hard links to a file
Recursively find the latest modified files
Recursively find/replace of a string with sed
Recursively find/replace of a string in directories and file names
Recursively find suid executables
Tool: top
Use top to monitor only all processes with the specific string
<str>- process containing string (eg. nginx, worker)
Tool: vmstat
Show current system utilization (fields in kilobytes)
2- number of times with a defined time interval (delay)20- each execution of the command (count)-t- show timestamp-w- wide output-S M- output of the fields in megabytes instead of kilobytes
Show current system utilization will get refreshed every 5 seconds
Display report a summary of disk operations
Display report of event counters and memory stats
Display report about kernel objects stored in slab layer cache
Tool: iostat
Show information about the CPU usage, and I/O statistics about all the partitions
2- number of times with a defined time interval (delay)10- each execution of the command (count)-t- show timestamp-m- fields in megabytes (-k- in kilobytes, default)
Show information only about the CPU utilization
Show information only about the disk utilization
Show information only about the LVM utilization
Tool: strace
Track with child processes
Track process with 30 seconds limit
Track processes and redirect output to a file
Track with print time spent in each syscall and limit length of print strings
Track the open request of a network port
Track the open request of a network port (show TCP/UDP)
Tool: kill
Kill a process running on port
Tool: diff
Compare two directory trees
Compare output of two commands
Tool: vimdiff
Highlight the exact differences, based on characters and words
Compare two JSON files
Compare Hex dump
diffchar
Save diffchar @ ~/.vim/plugins
Click F7 to switch between diff modes
Usefull vimdiff commands:
qato exit all windows:vertical resize 70to resize windowset window width
Ctrl+W [N columns]+(Shift+)<\>
Tool: tail
Annotate tail -f with timestamps
Analyse an Apache access log for the most common IP addresses
Analyse web server log and show only 5xx http codes
Tool: tar
System backup with exclude specific directories
System backup with exclude specific directories (pigz)
Tool: dump
System backup to file
Restore system from lzo file
Tool: cpulimit
Limit the cpu usage of a process
Tool: pwdx
Show current working directory of a process
Tool: taskset
Start a command on only one CPU core
Tool: tr
Show directories in the PATH, one per line
Tool: chmod
Remove executable bit from all files in the current directory
Restore permission for /bin/chmod
Tool: who
Find last reboot time
Detect a user sudo-su'd into the current shell
Tool: last
Was the last reboot a panic?
Tool: screen
Start screen in detached mode
Attach to an existing screen session
Tool: script
Record and replay terminal session
Tool: du
Show 20 biggest directories with 'K M G'
Tool: inotifywait
Init tool everytime a file in a directory is modified
Tool: openssl
Testing connection to the remote host
Testing connection to the remote host (debug mode)
Testing connection to the remote host (with SNI support)
Testing connection to the remote host with specific ssl version
Testing connection to the remote host with specific ssl cipher
Verify 0-RTT
Generate private key without passphrase
Generate private key with passphrase
Remove passphrase from private key
Encrypt existing private key with a passphrase
Check private key
Get public key from private key
Generate private key and CSR
Generate CSR
Generate CSR (metadata from existing certificate)
Where
private.keyis the existing private key. As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.
Generate CSR with -config param
Other values in [ dn ]:
Example of oids (you'll probably also have to make OpenSSL know about the new fields required for EV by adding the following under [new_oids]):
Full example:
For more information please look at these great explanations:
List available EC curves
Print ECDSA private and public keys
Generate ECDSA private key
Generate private key and CSR (ECC)
Generate self-signed certificate
Generate self-signed certificate from existing private key
Generate self-signed certificate from existing private key and csr
Generate DH public parameters
Display DH public parameters
Extract private key from pfx
Extract private key and certs from pfx
Extract certs from p7b
Convert DER to PEM
Convert PEM to DER
Verification of the private key
Verification of the public key
Verification of the certificate
Verification of the CSR
Check the private key and the certificate are match
Check the private key and the CSR are match
Tool: secure-delete
Secure delete with shred
Secure delete with scrub
Secure delete with badblocks
Secure delete with secure-delete
Tool: dd
Show dd status every so often
Redirect output to a file with dd
Tool: gpg
Export public key
--export- export all keys from all keyrings or specific key-a|--armor- create ASCII armored output
Encrypt file
-e|--encrypt- encrypt data-r|--recipient- encrypt for specific
Decrypt file
-o|--output- use as output file-d|--decrypt- decrypt data (default)
Search recipient
--keyserver- set specific key server--search-keys- search for keys on a key server
List all of the packets in an encrypted file
Tool: system-other
Reboot system from init
Init system from single user mode
Show current working directory of a process
Show actual pathname of the executed command
Tool: curl
-I- show response headers only-k- insecure connection when using ssl-s- silent mode (not display body)
--location- follow redirects-X- set method-A- set user-agent
--proxy [socks5://|http://]- set proxy server
-o- write output to file-C- resume the transfer
Find your external IP address (external services)
Repeat URL request
Check DNS and HTTP trace with headers for specific domains
Tool: httpie
-p- print request and response headersH- request headersB- request bodyh- response headersb- response body
-F, --follow- follow redirects--verify no- skip SSL verification
--proxy [http:]- set proxy server
Tool: ssh
Escape Sequence
Compare a remote file with a local file
SSH connection through host in the middle
Run command over SSH on remote host
Get public key from private key
Get all fingerprints
SSH authentication with user password
SSH authentication with publickey
Simple recording SSH session
Using Keychain for SSH logins
SSH login without processing any login scripts
SSH local port forwarding
Example 1:
Example 2:
-n- redirects stdin from/dev/null-N- do not execute a remote command-T- disable pseudo-terminal allocation
SSH remote port forwarding
Tool: linux-dev
Testing remote connection to port
<proto- set protocol (tcp/udp)<host>- set remote host<port>- set destination port
Read and write to TCP or UDP sockets with common bash tools
Tool: tcpdump
Filter incoming (on interface) traffic (specific ip:port)
-n- don't convert addresses (-nnwill not resolve hostnames or ports)-e- print the link-level headers-i [iface|any]- set interface-Q|-D [in|out|inout]- choose send/receive direction (-D- for old tcpdump versions)host [ip|hostname]- set host, also[host not][and|or]- set logicport [1-65535]- set port number, also[port not]
Filter incoming (on interface) traffic (specific ip:port) and write to a file
-c [num]- capture only num number of packets-w [filename]- write packets to file,-r [filename]- reading from file
Capture all ICMP packets
Check protocol used (TCP or UDP) for service
Display ASCII text (to parse the output using grep or other)
Grab everything between two keywords
Grab user and pass ever plain http
Extract HTTP User Agent from HTTP request header
Capture only HTTP GET and POST packets
or simply:
Rotate capture files
-G <num>- pcap will be created every<num>seconds-C <size>- close the current pcap and open a new one if is larger than<size>
Top hosts by packets
Excludes any RFC 1918 private address
Tool: tcpick
Analyse packets in real-time
Tool: ngrep
-d [iface|any]- set interface[domain]- set hostnameport [1-65535]- set port number
(host [ip|hostname])- filter by ip or hostname(port [1-65535])- filter by port number
-q- quiet mode (only payloads)-t- added timestamps-O [filename]- save output to file,-I [filename]- reading from file
HTTP- show http headerstcp|udp- set protocol[src|dst] host [ip|hostname]- set direction for specific node
-l- stdout line buffered-i- case-insensitive search
Tool: hping3
-V|--verbose- verbose mode-p|--destport- set destination port-s|--baseport- set source port<scan_type>- set scan type-F|--fin- set FIN flag, port open if no reply-S|--syn- set SYN flag-P|--push- set PUSH flag-A|--ack- set ACK flag (use when ping is blocked, RST response back if the port is open)-U|--urg- set URG flag-Y|--ymas- set Y unused flag (0x80 - nullscan), port open if no reply-M 0 -UPF- set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply
-c [num]- packet count-1- set ICMP mode-C|--icmptype [icmp-num]- set icmp type (default icmp-echo = 8)
--flood- sent packets as fast as possible (don't show replies)--rand-source- random source address mode-d --data- data size-w|--win- winsize (default 64)
Tool: nmap
Ping scans the network
Show only open ports
Full TCP port scan using with service version detection
Nmap scan and pass output to Nikto
Recon specific ip:service with Nmap NSE scripts stack
Tool: netcat
-l- listen for an incoming connection-k- listening after client has disconnected>filename.out- save receive data to file (optional)
< filename.in- send data to remote host
-v- verbose output-z- scan for listening daemons
-u- scan only udp ports
Transfer data file (archive)
Launch remote shell
Simple file server
Simple minimal HTTP Server
Simple HTTP Server
Restarts web server after each request - remove
whilecondition for only single connection.
-p- port number
Simple HTTP Proxy (single connection)
Create a single-use TCP or UDP proxy
Tool: gnutls-cli
Testing connection to remote host (with SNI support)
Testing connection to remote host (without SNI support)
Tool: socat
Testing remote connection to port
-- standard input (STDIO)TCP4:<params>- set tcp4 connection with specific params[hostname|ip]- set hostname/ip[1-65535]- set port number
Redirecting TCP-traffic to a UNIX domain socket under Linux
TCP-LISTEN:<params>- set tcp listen with specific params[1-65535]- set port numberbind=[hostname|ip]- set bind hostname/ipreuseaddr- allows other sockets to bind to an addressfork- keeps the parent process attempting to produce more connectionssu=nobody- set userrange=[ip-range]- ip range
UNIX-CLIENT:<params>- communicates with the specified peer socketfilename- define socket
Tool: p0f
Set iface in promiscuous mode and dump traffic to the log file
-i- listen on the specified interface-p- set interface in promiscuous mode-d- fork into background-o- output file
Tool: netstat
Graph # of connections for each hosts
Monitor open connections for specific port including listen, count and sort it per IP
Grab banners from local IPv4 listening ports
Tool: rsync
Rsync remote data as root using sudo
Tool: host
Resolves the domain name (using external dns server)
Checks the domain administrator (SOA record)
Tool: dig
Resolves the domain name (short output)
Lookup NS record for specific domain
Query only answer section
Query ALL DNS Records
DNS Reverse Look-up
Tool: certbot
Generate multidomain certificate
Generate wildcard certificate
Generate certificate with 4096 bit private key
Tool: network-other
Get all subnets for specific AS (Autonomous system)
Resolves domain name from dns.google.com with curl and jq
Tool: git
Log alias for a decent view of your repo
Tool: python
Static HTTP web server
Static HTTP web server with SSL support
Encode base64
Decode base64
Tool: awk
Search for matching lines
Search non matching lines
Print matching lines with numbers
Print the last column
Find all the lines longer than 80 characters
Print only lines of less than 80 characters
Print double new lines a file
Print line numbers
Print line numbers for only non-blank lines
Print the line and the next two (i=5) lines after the line matching regexp
Print the lines starting at the line matching 'server {' until the line matching '}'
Print multiple columns with separators
Remove empty lines
Delete trailing white space (spaces, tabs)
Delete leading white space
Remove duplicate consecutive lines
Remove duplicate entries in a file without sorting
Exclude multiple columns
Substitute foo for bar on lines matching regexp
Add some characters at the beginning of matching lines
Get the last hour of Apache logs
Tool: sed
Print a specific line from a file
Remove a specific line from a file
Remove a range of lines from a file
Replace newline(s) with a space
:acreate a labelaNappend the next line to the pattern space$!if not the last line, ba branch (go to) labelassubstitute,/\n/regex for new line,/ /by a space,/gglobal match (as many times as it can)
Alternatives:
Delete string +N next lines
Tool: grep
Search for a "pattern" inside all files in the current directory
Show only for multiple patterns
Except multiple patterns
Show data from file without comments
Show data from file without comments and new lines
Show strings with a dash/hyphen
Remove blank lines from a file and save output to new file
Tool: perl
Search and replace (in place)
Edit of *.conf files changing all foo to bar (and backup original)
Prints the first 20 lines from *.conf files
Search lines 10 to 20
Delete first 10 lines (and backup original)
Delete all but lines between foo and bar (and backup original)
Reduce multiple blank lines to a single line
Convert tabs to spaces (1t = 2sp)
Read input from a file and report number of lines and characters
Shell functions [TOC]
Table of Contents
Domain resolve
Get ASN
Domain resolve
Example:
Get ASN
Example:
Last updated