Links

A link with no context is useless — you don’t know when to click it. Every entry below says what the thing is and when to reach for it.

Everything here is a public tool or learning platform. Use it against your lab VM, a CTF box, or anything you are authorized to test — never against a target you do not own or have written permission to touch.

Comprehensive Guide

• CyberSecurity — Berkanktk — a huge, actively maintained security link list covering nearly everything on this page and more. Start here to go broad before you go deep.

Practice Platforms

• TryHackMe — guided rooms with a walkthrough built in. Best first stop if you are new.
• Hack The Box — boxes with no hand-holding. Go here once TryHackMe stops feeling hard.
• OverTheWire — wargames over SSH, starting with Bandit. The best place to get comfortable in a Linux terminal.
• picoCTF — beginner CTF challenges, always open, not just during the yearly competition.
• Root-Me — hundreds of self-contained challenges. Good for drilling one category at a time.
• VulnHub — downloadable vulnerable VMs you run yourself, no time limit, no internet needed.
• PortSwigger Web Security Academy — free, structured web app labs, one vulnerability class at a time. The best single resource for web security.
• pwn.college — a full binary exploitation curriculum with an in-browser environment. Go here once ready for pwn beyond basics.
• CryptoHack — cryptography challenges that teach the math by making you break it.
• crackmes.one — reverse-engineering challenges ranked by difficulty, for practicing on small disposable binaries.
• cypat.guide — the community CyberPatriot prep guide: Linux and Windows hardening, checklists, and scripts. The starting point for the CyberPatriot and CCDC track.

Learning Platforms & Courses

• SANS — the industry-standard training org. Expensive, but the material is real. Watch for their free webcasts.
• Cybrary — free and paid courses across most security domains.
• Professor Messer — free video courses for Security+ and Network+. Start here before paying for anything.
• Cisco Networking Academy — free networking fundamentals, useful before Security+ if ports and subnets still feel shaky.
• Antisyphon Training — pay-what-you-can live training from working practitioners, red and blue both.
• UC Irvine Cyber Bootcamp — a free bootcamp from UCI’s cyber club, shared as a Drive folder. Officers recommend it for getting into cyber and for competition prep.

Reference & Cheat Sheets

• OWASP Cheat Sheet Series — the correct answer to “how do I fix this web vulnerability,” from the people who catalog them.
• PayloadsAllTheThings — a huge payload and bypass-technique repo, organized by vulnerability class.
• GTFOBins — Unix binaries abusable for shell breakout or privilege escalation. Check this the moment sudo -l shows something unexpected.
• LOLBAS — the Windows equivalent of GTFOBins: built-in binaries abusable for the same purpose.
• CyberChef — a drag-and-drop tool for encoding, decoding, and transforming data. Try this before scripting a one-off decode.
• Explainshell — paste any shell command and it breaks down every flag.
• MITRE CVE — the canonical record for any vulnerability. Start here, not a random blog.
• NVD — CVEs with severity scoring layered on top. Use once you’ve found the CVE and need to know how bad it is.
• Exploit-DB — a searchable public exploit archive, mirrored locally by the searchsploit CLI tool.

Tooling — Recon & Web

• Nmap — the port scanner. Everyone’s first move against a target. Learn its flags properly.
• Shodan — a search engine for devices exposed to the internet.
• theHarvester — gathers emails, subdomains, and names for a target domain from public sources. Standard first OSINT step.
• Burp Suite — the standard web traffic interception tool. Free Community edition covers most of what you need to learn.
• OWASP ZAP — a free, open-source alternative to Burp with a built-in automated scanner.
• sqlmap — automates finding and exploiting SQL injection. Use it to confirm and extract, not to find every bug for you.
• ffuf — a fast web fuzzer for hidden directories, files, and parameters.
• gobuster — another fast directory/DNS brute-forcer, similar job to ffuf.

Tooling — Binary & Reverse Engineering

• Ghidra — the NSA’s free disassembler and decompiler. The standard starting point — no license, no excuse.
• IDA Free — the free tier of the other major disassembler. Weaker decompiler, still worth knowing.
• radare2 — a terminal-first reverse engineering framework. Steep curve, fast once it clicks.
• pwntools — a Python library for writing exploits: process interaction, packing, ROP helpers.
• pwndbg — a GDB plugin with far better memory, pointer, and heap views than stock GDB.

Tooling — Forensics & Defense

• Wireshark — packet capture and analysis with a window and color-coded protocols, the easier way to see a handshake.
• Volatility — the standard framework for memory forensics: processes, connections, injected code from a RAM dump.
• Autopsy — a free disk forensics platform: file recovery, timelines, keyword search.
• Zeek — turns raw network traffic into structured logs instead of a wall of packets. Used in production SOCs.
• Suricata — an open-source intrusion detection and prevention engine. Pair with Zeek for a full picture.
• osquery — query a live system’s state — processes, files, connections — with SQL.
• Sysmon — a Sysinternals tool logging detailed process, network, and file activity on Windows. Backbone of most Windows endpoint detection.

Windows & Active Directory

AD runs most corporate networks. Practicing only on Linux boxes means missing half the job.

• Impacket — a Python toolset for working with Windows network protocols directly. Underpins most AD attack tooling.
• Mimikatz — extracts credentials and tickets from Windows memory. Know what it does and how to detect it.
• NetExec — a network protocol swiss-army-knife for AD: auth testing, execution, enumeration, all in one tool. Successor to CrackMapExec.
• Active Directory Domain Services overview — Microsoft Learn — read this before you attack AD. You can’t break what you don’t understand.
• ADSecurity.org — Sean Metcalf’s blog, dense and specific to AD attack and defense. Nothing else free covers AD internals this well.

Blue Team / Defense Resources

• MITRE ATT&CK — the standard taxonomy of attacker tactics and techniques. Most detection and reporting work assumes you already think in these terms.
• MITRE D3FEND — ATT&CK’s defensive counterpart. Maps a detection or control back to the technique it addresses.
• Sigma — a shareable detection-rule format that converts to whatever SIEM you actually run.
• CIS Benchmarks — free, detailed hardening guides per OS and software. Check these when told to “harden this box.”
• NIST Cybersecurity Framework — the framework most US orgs structure their security program around.
• The DFIR Report — detailed writeups of real intrusions, start to finish. See what an actual incident looks like, not the CTF version.

Cryptography

• CryptoHack — see Practice Platforms above. Still the best starting point if crypto is your gap.
• dCode — a huge collection of classical cipher solvers. Use to identify or break a cipher fast; read up separately on how it actually works.
• RsaCtfTool — automates common RSA attacks against CTF-style challenges. Try before hand-rolling your own.
• CyberChef — see Reference above. Also handles most encoding-layer crypto (base64-in-hex-in-rot13) with no code.

Staying Current

Pick a couple of these and actually check them — don’t just bookmark and forget.

• Krebs on Security — Brian Krebs’ investigative reporting on breaches and cybercrime. Slower, deeper than most security news.
• The Hacker News — daily security news, broad coverage, good for a fast scan.
• r/netsec — a curated subreddit for technical writeups and tool releases, less noise than most security subs.
• CTFtime — the CTF calendar and ranking site, and an archive of writeups after events end. Check it to find a CTF to enter this weekend.
• SecLists.org — archives of major security mailing lists, including Full Disclosure. Raw vulnerability disclosures as they happen.

Career & Certifications

Moved to its own page: Certifications — which certs matter, in what order, and the free material to study for them.

FAU / Club

• Club Wiki Repo — the source for this site. Found a broken link or a gap? Open a pull request.
• Discord — where the club actually talks day to day. Join this before anything else on this page.
• Owl Central — the official FAU org page: meeting times, events, and how to officially join.