Darknet Diaries – An excellent bi-weekly podcast about cybersecurity, hackers, the dark web, and much more.
Security Now – A weekly technical cybersecurity podcast (by GRC) available in video and audio.
Grumpy Old Geeks – A weekly humor show on cybersecurity and the Internet. “What went wrong on the Internet and who is to blame!”
The Cyber Wire – A daily source of cyber news and IT career content.
The Social-Engineer Podcast – The title speaks for itself.
Virus Total – A website from a cybersecurity company that provides information about viruses, worms, malware, and more.
Alien Vault – Similar to Virus Total, but claims to be a fully open threat intelligence community.
GrayNoise – Collects, analyzes, and labels data from IPs that scan the internet and saturate security tools with noise.
AntiScan and DynCheck – Free online multi-antivirus scanners.
GTmetrix – Designed to test website loading speed, it also reports on page content and the percentage of each language used.
PageSpeed Insights – Generates performance reports for a page on both mobile and desktop devices, and provides suggestions for improvement.
Web.Dev – Test your pages in a lab environment and get tips and recommendations to improve the user experience.
SEO SiteCheckup – A supercharged analysis and monitoring tool for SEO (Search Engine Optimization).
IPv6 Test – Checks your IPv6 and IPv4 connectivity and speed, and can also test whether your website (DNS and Host) is IPv6-ready.
Security Header – Check the security headers of a website.
Tor Browser – An encrypted browser that routes traffic through relays and proxies around the world to protect user privacy.
Tails Linux – A Linux distribution designed to leave no trace after shutdown.
Kali Linux – A Linux distribution designed for network and system security testing.
Parrot OS – A lightweight but powerful offensive distribution, comparable to Kali. Based on Debian 13 and uses Plasma 6 with Wayland by default.
Pentest.WS – A collaborative interface for working with NMAP scans, inventory, and vulnerabilities. A useful tool for team CTFs.
The PenTesters Framework – Regardless of the distribution, PTF is a toolset that makes it easy to install and keep all the most popular pentesting applications up to date.
CrackStation – A free web-based password hash cracker, and a downloadable password list called RealUniq with over 1.4 billion entries.
TunnelsUp – A source of cybersecurity information and tools, including a web hash analyzer [Link].
SecLists – A collection of multiple types of lists (such as password lists) used during security assessments, all in one place.
Project RainbowCrack – A source of rainbow tables with pre-cracked passwords. It is simply a matter of cross-checking the hashes.
1.4 Billion Text Credentials Analysis (NLP) – Also available to download via torrent.
BYOB – A framework for building command-and-control zombie bots (for educational purposes only).
Eschalot – A tool for generating a vanity .onion address for your service on the Tor network.
Onion.ly – Tor2Web proxy (try *****.onion.ly).
Sn1per – An automated scanner for enumerating and finding vulnerabilities during penetration tests. Also available as a Docker image [Link].
Nessus – A powerful professional vulnerability scanner.
DVWA – Damn Vulnerable Web App is an intentionally vulnerable PHP/MySQL web application. Also available for Docker [Link].
IronWASP – An open-source tool for web application vulnerability testing, crawling, and more.
ReconNess – Helps run and manage all your reconnaissance in one place, focusing on potentially vulnerable targets.
Osmedeus – A collection of tools for reconnaissance and vulnerability scanning against a target.
Netcat – A tool for tunneling connections (file transfers, remote shell, etc).
CVE Details – Security vulnerability database.
Hunter – An information-gathering tool for OSINT.
Metasploit Unleashed – The official Metasploit documentation and manual.
Metasploitable – An intentionally vulnerable target machine for exploitation exercises.
Veil-Evasion – A pentesting framework.
MSFvenom – A combination of Msfpayload and Msfencode in a single framework.
Armitage – A free graphical interface for MSF.
Cobalt Strike – A licensed graphical interface for MSF.
Empire – A Windows and macOS post-exploitation framework featuring a pure PowerShell 2.0 Windows agent and a pure Python 2.6/2.7 Linux/OS X agent.
Jok3r – A framework that assists penetration testers with network infrastructure and web security assessments.
Exploit Database – An archive of public exploits and their corresponding vulnerable software.
HackTheBox – An online platform for practicing penetration testing skills.
VulnHub – Hundreds of pre-configured virtual machines set up for vulnerability and penetration testing exercises.
Command Challenge – Practice commands and learn how to solve problems in the CLI.
picoCFT – Compete or practice using picoGym, a non-competitive space to explore and solve challenges from past picoCTF competitions.
DEFT Linux – DEFT (Digital Evidence & Forensic Toolkit) is a Ubuntu-based live distribution for incident response and computer forensics.
python-cim – A forensics tool for analyzing WMI event logs.
Cloudflare – A free CDN (Content Delivery Network) and web application firewall that uses a proxy network and offers optimization features such as caching, code optimization, and more.
OWASP Broken Web Application Project – A collection of vulnerable web applications distributed as a VMware virtual machine.
OWASP Web Goat – Lets developers test vulnerabilities commonly found in Java-based applications that rely on popular open-source components.
OWASP Juice Shop – Contains vulnerabilities from the entire OWASP Top Ten, along with many other security flaws found in real-world applications.
JSON Web Token and JWT – Encode and decode JSON Web Tokens.
Wappalyzer – A technology profiler that shows you what a website is built with.
Dan’s Tools – Epoch and Unix timestamp conversion tools. Also includes tools for conversion, encoding/decoding, and formatting.
CyberChef – An online encryption and decryption tool.
Outline VPN – An open-source VPN that runs on Docker, created by Google and partners.
Shodan – A search engine for internet-connected devices. A great OSINT source for open ports and exposed services. Also available via the Kali CLI.
Censys – An internet scanner similar to Shodan, but more focused on specific addresses rather than broad searches.
Wigle – A live map of all discovered wireless networks worldwide.
Spyse – A database of port scans with fingerprints that may reveal OS and application versions.
Security Trails – Another database of port scans and domain information.
IntelligenceX – An OSINT tool for retrieving information about data breaches, Bitcoin addresses, domain information, and more.
Payloads All The Things – A large collection of payloads of all types, along with instructions and exercises.
SQL Injection Payload List – A collection of SQL injection exploits with instructions.
XXE Injection Payloads List – A collection of XXE injection exploits with instructions.
XSS Payloads – A collection of XSS payloads.
SSL Server Test – A free web service for evaluating the SSL/TLS configuration of your web server.
Bad SSL – A collection of non-compliant certificate samples for browser and client testing.
ONDMARC – Check the SPF and DKIM configuration of a mail server.
ProtonMail – An encrypted and anonymous email provider.
Tutanota – An encrypted and anonymous email provider.
CoverYourTracks – A browser privacy tester from the EFF.
PrivacyTools.io – Provides services, tools, and knowledge to protect your privacy against global mass surveillance.
JustDeleteMe.xyz – A directory of direct links to delete your account from various web services.
BuiltWith – A free web service for analyzing what framework a website is built with. Alternatively, check out the Wappalyzer browser extension [Link].
Transfer.sh – A CLI tool for uploading and downloading files via their free file-sharing service.
Static-Binaries – A collection of single executable files for various tasks (e.g., nmap, netcat) with no installation required.
Ollama – A single wrapper for running LLMs such as Llama 3.1, Phi 3, Mistral, Gemma 2, and other models.