OWASP Top 10 for LLM Applications
genai.owasp.org
the reference list.
Security
AI Security & Red-Teaming
Standards & threat models
unknown
aiai-security-and-red-teamingstandards-and-threat-modelssecurity
Topic
Security
Offensive and defensive security, vulnerability research, threat intelligence, and compliance.
148links
13news items
security
Links
Curated resources grouped by category.
AI Security & Red-Teaming
24 links
MITRE ATLAS
atlas.mitre.org
adversarial threat landscape for AI systems.
Security
AI Security & Red-Teaming
Standards & threat models
unknown
aiai-security-and-red-teamingstandards-and-threat-modelssecurity
NIST AI Risk Management Framework
www.nist.gov
NIST AI Risk Management Framework resource in AI Security & Red-Teaming.
Security
AI Security & Red-Teaming
Standards & threat models
unknown
aiai-security-and-red-teamingstandards-and-threat-modelssecurity
AI Incident Database
incidentdatabase.ai
searchable real-world incidents.
Security
AI Security & Red-Teaming
Standards & threat models
unknown
aiai-security-and-red-teamingstandards-and-threat-modelssecurity
garak
github.com
NVIDIA's LLM vulnerability scanner.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
PyRIT
github.com
Microsoft's Python Risk Identification Toolkit for AI.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
Promptfoo
www.promptfoo.dev
eval + red-team framework, CI-friendly.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
Giskard
www.giskard.ai
open-source LLM testing.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
DeepEval
github.com
pytest-style LLM evals.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
Inspect AI
inspect.aisi.org.uk
UK AISI's eval framework.
Security
AI Security & Red-Teaming
Red-team / scanning tools
unknown
aiai-security-and-red-teamingred-team-scanning-toolssecurity
Lakera Guard
www.lakera.ai
prompt-injection/PII firewall.
Security
AI Security & Red-Teaming
Runtime defense
unknown
aiai-security-and-red-teamingruntime-defensesecurity
Protect AI
protectai.com
ML supply-chain security.
Security
AI Security & Red-Teaming
Runtime defense
unknown
aiai-security-and-red-teamingruntime-defensesecurity
HiddenLayer
hiddenlayer.com
model security platform.
Security
AI Security & Red-Teaming
Runtime defense
unknown
aiai-security-and-red-teamingruntime-defensesecurity
NeMo Guardrails
github.com
NVIDIA, programmable rails.
Security
AI Security & Red-Teaming
Runtime defense
unknown
aiai-security-and-red-teamingruntime-defensesecurity
LLM Guard
llm-guard.com
open-source input/output guard.
Security
AI Security & Red-Teaming
Runtime defense
unknown
aiai-security-and-red-teamingruntime-defensesecurity
Anthropic alignment & red-team research
www.anthropic.com
Anthropic alignment & red-team research resource in AI Security & Red-Teaming.
Security
AI Security & Red-Teaming
Research / labs
unknown
aiai-security-and-red-teamingresearch-labssecurity
Apollo Research
www.apolloresearch.ai
deceptive-alignment evals.
Security
AI Security & Red-Teaming
Research / labs
unknown
aiai-security-and-red-teamingresearch-labssecurity
METR
metr.org
autonomy/capability evaluations.
Security
AI Security & Red-Teaming
Research / labs
unknown
aiai-security-and-red-teamingresearch-labssecurity
UK AI Safety Institute (AISI)
www.aisi.gov.uk
UK AI Safety Institute (AISI) resource in AI Security & Red-Teaming.
Security
AI Security & Red-Teaming
Research / labs
unknown
aiai-security-and-red-teamingresearch-labssecurity
US AISI (at NIST)
www.nist.gov
US AISI (at NIST) resource in AI Security & Red-Teaming.
Security
AI Security & Red-Teaming
Research / labs
unknown
aiai-security-and-red-teamingresearch-labssecurity
Simon Willison — prompt injection tag
simonwillison.net
best running coverage.
Security
AI Security & Red-Teaming
Practitioner reading
unknown
aiai-security-and-red-teamingpractitioner-readingsecurity
Embrace The Red
embracethered.com
Johann Rehberger, AI red-team blog.
Security
AI Security & Red-Teaming
Practitioner reading
unknown
aiai-security-and-red-teamingpractitioner-readingsecurity
HackAPrompt writeups
www.learnprompting.org
Learn Prompting.
Security
AI Security & Red-Teaming
Practitioner reading
unknown
aiai-security-and-red-teamingpractitioner-readingsecurity
DEF CON AI Village
aivillage.org
DEF CON AI Village resource in AI Security & Red-Teaming.
Security
AI Security & Red-Teaming
Practitioner reading
unknown
aiai-security-and-red-teamingpractitioner-readingsecurity
Application Security
10 links
OWASP Foundation
owasp.org
Open community producing free resources, tools, and standards for improving software security worldwide.
Security
Application Security
Standards & references
free
securitywebappsecstandards
PortSwigger Web Security Academy
portswigger.net
Free, world-class web security training with hands-on labs covering every major vulnerability class.
Security
Application Security
Training & labs
free
securityweblearninglabs
CWE — Common Weakness Enumeration
cwe.mitre.org
MITRE's community-developed list of software and hardware weakness types used in vulnerability classification.
Security
Application Security
Standards & references
free
securityappsecweaknessclassification
HackTricks
book.hacktricks.xyz
Continuously updated hacking and pentesting reference covering techniques, tools, and CTF tricks.
Security
Application Security
Training & labs
free
securitypentestingreferencectf
Semgrep
semgrep.dev
Static analysis tool for finding bugs and security issues in source code with a large rule registry.
Security
Application Security
SAST & code scanning
freemium
securitysaststatic-analysisci
OWASP ZAP
zaproxy.org
Open-source DAST scanner and proxy for automatically finding security vulnerabilities in web applications.
Security
Application Security
DAST & scanning
free
securitydastwebscanning
Snyk
snyk.io
Developer security platform for scanning code, dependencies, containers, and IaC for vulnerabilities.
Security
Application Security
SAST & code scanning
freemium
securitysupply-chaindependencydevsecops
SonarQube
sonarqube.org
Continuous code quality and security inspection platform supporting 30+ languages.
Security
Application Security
SAST & code scanning
freemium
securitysastcode-qualityci
Trivy
trivy.dev
Comprehensive open-source security scanner for containers, filesystems, IaC, and git repositories.
Security
Application Security
DAST & scanning
free
securitycontainersiacsupply-chain
Content Security Policy (CSP) Evaluator
csp-evaluator.withgoogle.com
Google tool for analysing CSP header configurations and identifying common misconfigurations and bypasses.
Security
Application Security
Browser & web standards
free
securitycspwebheaders
Cloud Security
9 links
Cloud Security Alliance
cloudsecurityalliance.org
Non-profit defining cloud security best practices through research, certifications (CCSK), and the CCM framework.
Security
Cloud Security
Frameworks & standards
free
securitycloudstandardscompliance
Prowler
prowler.com
Open-source cloud security tool for auditing, hardening, and continuous compliance across AWS, Azure, and GCP.
Security
Cloud Security
Posture management (CSPM)
freemium
securitycloudcspmcompliance
ScoutSuite
github.com
NCC Group's multi-cloud security auditing tool that produces an HTML report of misconfigurations.
Security
Cloud Security
Posture management (CSPM)
free
securitycloudauditopen-source
Trivy
trivy.dev
Comprehensive scanner for container images, IaC files, git repos, and Kubernetes clusters.
Security
Cloud Security
Container & IaC scanning
free
securitycontainersiackubernetes
Checkov
checkov.io
Static analysis tool for Terraform, Kubernetes, Dockerfile, and CloudFormation to catch misconfigurations pre-deploy.
Security
Cloud Security
Container & IaC scanning
free
securityiacterraformkubernetes
Falco
falco.org
CNCF runtime security tool for detecting anomalous behaviour in containers and Kubernetes workloads.
Security
Cloud Security
Runtime security
free
securitykubernetesruntimedetection
AWS Security Hub
aws.amazon.com
Centralised AWS security posture management aggregating findings from GuardDuty, Inspector, Macie, and third-party tools.
Security
Cloud Security
Cloud-native security services
paid
securityawscspmfindings
Steampipe
steampipe.io
Query cloud APIs with SQL; includes prebuilt compliance benchmarks for AWS, Azure, GCP, and Kubernetes.
Security
Cloud Security
Posture management (CSPM)
free
securitycloudcompliancesql
CNAPP landscape — CNCF Security TAG
tag-security.cncf.io
CNCF's Security Technical Advisory Group producing white papers, assessments, and guidance on cloud-native security.
Security
Cloud Security
Frameworks & standards
free
securitycloud-nativecncfkubernetes
Compliance & Standards
9 links
NIST Cybersecurity Framework
nist.gov
Voluntary framework of standards, guidelines, and practices for managing cybersecurity risk, now at version 2.0.
Security
Compliance & Standards
Frameworks
free
securitycomplianceframeworknist
CIS Controls
cisecurity.org
Prioritised set of 18 defensive security controls developed by the Center for Internet Security.
Security
Compliance & Standards
Frameworks
free
securitycomplianceciscontrols
ISO/IEC 27001
www.iso.org
International standard for information security management systems (ISMS) and its certification framework.
Security
Compliance & Standards
International standards
paid
securitycomplianceisoisms
GDPR Info
gdpr-info.eu
Full text of the EU General Data Protection Regulation with recitals and cross-references.
Security
Compliance & Standards
Regulation texts
free
securitygdprprivacyeurope
PCI Security Standards Council
pcisecuritystandards.org
Governing body for PCI DSS, the payment card industry data security standard.
Security
Compliance & Standards
International standards
free
securitypci-dsspaymentcompliance
ENISA
enisa.europa.eu
EU Agency for Cybersecurity publishing threat landscapes, guidelines, and policy recommendations across the EU.
Security
Compliance & Standards
Regulatory bodies
free
securityeuropepolicyenisa
SOC 2 — AICPA
www.aicpa-cima.com
AICPA's Service Organization Control 2 framework for auditing security, availability, and confidentiality of cloud services.
Security
Compliance & Standards
Frameworks
free
securitysoc2compliancecloud
NIS2 Directive
eur-lex.europa.eu
EU Network and Information Security Directive 2 expanding cybersecurity obligations to more sectors.
Security
Compliance & Standards
Regulation texts
free
securitynis2europeregulation
BSI — Federal Office for Information Security
bsi.bund.de
German federal authority for information security, publishing technical guidelines and IT-Grundschutz.
Security
Compliance & Standards
Regulatory bodies
free
securitygermanyit-grundschutzstandards
Cryptography & Protocols
9 links
Cryptopals
cryptopals.com
Series of cryptography challenges teaching practical breaks of real-world crypto constructions.
Security
Cryptography & Protocols
Learning & challenges
free
securitycryptographychallengeslearning
Mozilla SSL Configuration Generator
ssl-config.mozilla.org
Generates secure TLS configurations for nginx, Apache, HAProxy, and other servers based on Mozilla guidelines.
Security
Cryptography & Protocols
TLS & certificates
free
securitytlsconfigurationmozilla
Let's Encrypt
letsencrypt.org
Free, automated, and open certificate authority providing TLS certificates to the public.
Security
Cryptography & Protocols
TLS & certificates
free
securitytlscertificatesca
OpenSSL
openssl.org
The widely-used open-source toolkit for SSL/TLS and general-purpose cryptography.
Security
Cryptography & Protocols
Libraries & tools
free
securitycryptographytlslibrary
Libsodium
doc.libsodium.org
Modern, easy-to-use cryptographic library with opinionated, hard-to-misuse APIs for encryption, signing, and hashing.
Security
Cryptography & Protocols
Libraries & tools
free
securitycryptographylibrarynacl
Age
age-encryption.org
Simple, modern, and secure file encryption tool and library with a clean format specification.
Security
Cryptography & Protocols
Libraries & tools
free
securityencryptionfile-encryptiontools
Sigstore
sigstore.dev
Open-source project for signing, verifying, and protecting software supply chains with keyless code signing.
Security
Cryptography & Protocols
Code signing & supply chain
free
securitysupply-chainsigningopen-source
Have I Been Pwned
haveibeenpwned.com
Check if email addresses or passwords have appeared in known data breaches; free API for developers.
Security
Cryptography & Protocols
Password security
free
securitypasswordsbreachesdata-leak
RFC Editor
rfc-editor.org
Authoritative source for Internet Standards and RFCs, including foundational security protocol specifications.
Security
Cryptography & Protocols
Protocol specifications
free
securityprotocolsrfcstandards
Defensive Security & Blue Team
10 links
MITRE D3FEND
d3fend.mitre.org
Complementary framework to ATT&CK mapping defensive techniques to the offensive tactics they counter.
Security
Defensive Security & Blue Team
Frameworks & knowledge bases
free
securityblue-teamdefensivemitre
Sigma
github.com
Generic signature format for SIEM rules enabling detection content to be shared and converted across platforms.
Security
Defensive Security & Blue Team
Detection engineering
free
securitydetectionsiemrules
YARA
virustotal.github.io
Pattern-matching tool for identifying and classifying malware samples based on textual or binary patterns.
Security
Defensive Security & Blue Team
Detection engineering
free
securitymalwaredetectionpatterns
Wazuh
wazuh.com
Open-source security platform combining SIEM, XDR, and CSPM for endpoint detection and log analysis.
Security
Defensive Security & Blue Team
SIEM & XDR
free
securitysiemxdropen-source
Elastic Security
elastic.co
SIEM and endpoint security built on the Elastic Stack, with free detection rules and prebuilt dashboards.
Security
Defensive Security & Blue Team
SIEM & XDR
freemium
securitysiemelasticdetection
TheHive Project
thehive-project.org
Scalable, open-source security incident response platform with case management and MISP integration.
Security
Defensive Security & Blue Team
Incident response platforms
free
securityincident-responsecase-managementopen-source
Velociraptor
velocidex.com
Advanced DFIR and endpoint monitoring tool for fast artifact collection and threat hunting at scale.
Security
Defensive Security & Blue Team
Threat hunting & DFIR
free
securitydfirthreat-huntingendpoint
OpenVAS / Greenbone
greenbone.net
Open-source vulnerability scanning and management solution with a large continuously updated feed of tests.
Security
Defensive Security & Blue Team
Vulnerability management
free
securityvulnerability-scanningopen-source
Zeek
zeek.org
Powerful network analysis framework that generates rich, structured logs for security monitoring and forensics.
Security
Defensive Security & Blue Team
Network monitoring
free
securitynetworkmonitoringforensics
Atomic Red Team
atomicredteam.io
Library of tests mapped to MITRE ATT&CK for validating defensive controls and detection coverage.
Security
Defensive Security & Blue Team
Detection engineering
free
securitypurple-teamatt&cktesting
Identity & Access Management
9 links
Keycloak
keycloak.org
Open-source identity and access management with SSO, OIDC, SAML, and fine-grained authorisation.
Security
Identity & Access Management
Open-source IAM
free
securityiamssoopen-source
Authentik
goauthentik.io
Self-hosted identity provider supporting OIDC, SAML, LDAP, and Radius with a modern UI.
Security
Identity & Access Management
Open-source IAM
free
securityiamssoself-hosted
Authelia
authelia.com
Open-source authentication and authorisation server providing 2FA and SSO for reverse proxies.
Security
Identity & Access Management
Open-source IAM
free
security2fassoself-hosted
HashiCorp Vault
vaultproject.io
Secrets management, encryption-as-a-service, and dynamic credentials for any infrastructure.
Security
Identity & Access Management
Secrets management
freemium
securitysecretsvaulthashicorp
NIST SP 800-63 Digital Identity Guidelines
pages.nist.gov
NIST's authoritative guidelines for digital identity, authentication levels, and federation.
Security
Identity & Access Management
Standards & frameworks
free
securityidentitystandardsnist
OpenID Connect
openid.net
Identity layer built on top of OAuth 2.0 enabling client applications to verify end-user identity.
Security
Identity & Access Management
Standards & frameworks
free
securityoidcoauthstandards
FIDO Alliance
fidoalliance.org
Industry consortium behind FIDO2, WebAuthn, and passkeys — the standard for passwordless authentication.
Security
Identity & Access Management
Standards & frameworks
free
securitypasskeyswebauthnpasswordless
Zitadel
zitadel.com
Cloud-native, open-source IAM solution with multi-tenancy, passkeys, and audit log out of the box.
Security
Identity & Access Management
Open-source IAM
freemium
securityiammulti-tenantopen-source
OAuth 2.0
oauth.net
The authorisation framework spec and resources — RFCs, security BCP, and implementation guides.
Security
Identity & Access Management
Standards & frameworks
free
securityoauthauthorisationstandards
Incident Response & Forensics
9 links
TheHive Project
thehive-project.org
Scalable, open-source security incident response platform with case and alert management and MISP integration.
Security
Incident Response & Forensics
Case management
free
securityincident-responsecase-managementopen-source
Velociraptor
velocidex.com
Advanced endpoint visibility and DFIR tool for collecting artifacts and hunting at scale across thousands of hosts.
Security
Incident Response & Forensics
Endpoint forensics
free
securitydfirendpointforensics
Autopsy
www.autopsy.com
Open-source digital forensics platform with a GUI front-end to The Sleuth Kit for disk image analysis.
Security
Incident Response & Forensics
Disk & file forensics
free
securityforensicsdisk-analysisdfir
Volatility Framework
volatilityfoundation.org
Leading open-source memory forensics framework for analysing RAM dumps from Windows, Linux, and macOS.
Security
Incident Response & Forensics
Memory forensics
free
securitymemory-forensicsdfirmalware
Eric Zimmerman's Tools
ericzimmerman.github.io
Collection of free Windows forensic tools for registry analysis, prefetch, event logs, shellbags, and more.
Security
Incident Response & Forensics
Disk & file forensics
free
securityforensicswindowsregistry
CyberChef
gchq.github.io
GCHQ's browser-based data analysis "Cyber Swiss Army Knife" for encoding, encryption, and data transformation.
Security
Incident Response & Forensics
Analysis utilities
free
securityanalysisencodingdfir
DFIR.training
dfir.training
Curated directory of DFIR tools, training, and resources maintained by the community.
Security
Incident Response & Forensics
References
free
securitydfirtrainingreference
SANS Incident Handler's Handbook
www.sans.org
SANS guide to the six phases of incident response — preparation, identification, containment, eradication, recovery, lessons learned.
Security
Incident Response & Forensics
References
free
securityincident-responseprocesssans
FTK Imager
www.exterro.com
Free disk imaging and preview tool from Exterro for acquiring forensic images of drives and memory.
Security
Incident Response & Forensics
Disk & file forensics
free
securityforensicsdisk-imagingwindows
Malware & Reverse Engineering
9 links
Ghidra
ghidra-sre.org
NSA-developed free and open-source reverse engineering tool suite with a decompiler for major architectures.
Security
Malware & Reverse Engineering
Reverse engineering tools
free
securityreverse-engineeringmalwarensa
Radare2
rada.re
Portable reverse engineering framework and disassembler with scripting, debugging, and binary patching capabilities.
Security
Malware & Reverse Engineering
Reverse engineering tools
free
securityreverse-engineeringdisassembleropen-source
x64dbg
x64dbg.com
Open-source x64/x32 debugger for Windows focused on malware analysis and reverse engineering.
Security
Malware & Reverse Engineering
Reverse engineering tools
free
securitydebuggerwindowsmalware
Binary Ninja
binary.ninja
Commercial binary analysis platform with a powerful API and collaborative features for reverse engineering.
Security
Malware & Reverse Engineering
Reverse engineering tools
paid
securityreverse-engineeringbinary-analysiscommercial
any.run
any.run
Interactive online malware sandbox for analysing suspicious files and URLs with real-time process monitoring.
Security
Malware & Reverse Engineering
Sandboxes & dynamic analysis
freemium
securitysandboxmalwaredynamic-analysis
Hybrid Analysis
hybrid-analysis.com
Free malware analysis service powered by CrowdStrike Falcon with YARA rule matching and network indicators.
Security
Malware & Reverse Engineering
Sandboxes & dynamic analysis
free
securitysandboxmalwarecrowdstrike
Unpac.me
unpac.me
Automated malware unpacking service supporting 100+ packers and protectors.
Security
Malware & Reverse Engineering
Sandboxes & dynamic analysis
freemium
securitymalwareunpackinganalysis
REMnux
remnux.org
Linux distribution curated for reverse engineering and malware analysis, with 150+ pre-installed tools.
Security
Malware & Reverse Engineering
Analysis environments
free
securitymalwarelinuxreverse-engineering
Awesome Malware Analysis
github.com
Curated list of malware analysis tools, resources, and guides maintained by the community.
Security
Malware & Reverse Engineering
References
free
securitymalwarereferencetools
Network Security
10 links
Wireshark
wireshark.org
The world's most widely-used network protocol analyser for packet capture and deep inspection.
Security
Network Security
Packet analysis
free
securitynetworkpacket-captureprotocol-analysis
Suricata
suricata.io
High-performance, open-source network IDS, IPS, and network security monitoring engine.
Security
Network Security
IDS & IPS
free
securitynetworkidsips
Snort
snort.org
Pioneering open-source network intrusion detection and prevention system maintained by Cisco.
Security
Network Security
IDS & IPS
free
securitynetworkidscisco
pfSense
pfsense.org
Open-source firewall and router platform based on FreeBSD with enterprise-grade features.
Security
Network Security
Firewalls & perimeter
free
securityfirewallrouterfreebsd
OPNsense
opnsense.org
FreeBSD-based open-source firewall and routing platform with modern UI and active development community.
Security
Network Security
Firewalls & perimeter
free
securityfirewallrouteropen-source
Pi-hole
pi-hole.net
Network-wide DNS sinkhole that blocks ads and tracking domains before they reach any device on the LAN.
Security
Network Security
DNS & filtering
free
securitydnsad-blockingprivacy
MXToolbox
mxtoolbox.com
Suite of DNS, MX, DMARC, SPF, and blacklist lookup tools for diagnosing email and domain security.
Security
Network Security
DNS & filtering
free
securitydnsemaildmarc
SSL Labs
ssllabs.com
Qualys free tool for deep analysis of SSL/TLS server configurations, graded A to F.
Security
Network Security
TLS & certificates
free
securitytlssslcertificates
Cloudflare
cloudflare.com
Global network providing DDoS protection, WAF, CDN, Zero Trust access, and DNS security at scale.
Security
Network Security
Firewalls & perimeter
freemium
securityddoswafcdn
Netbird
netbird.io
Open-source, WireGuard-based overlay network for zero-config secure peer-to-peer connectivity.
Security
Network Security
VPN & secure connectivity
freemium
securityvpnwireguardzero-trust
News, Blogs & Communities
10 links
Krebs on Security
krebsonsecurity.com
Brian Krebs's investigative security blog known for deep reporting on cybercrime and breach investigations.
Security
News, Blogs & Communities
Blogs & journalism
free
securitynewscybercrimejournalism
Schneier on Security
schneier.com
Bruce Schneier's blog on security, privacy, and technology policy — one of the most respected voices in security.
Security
News, Blogs & Communities
Blogs & journalism
free
securityprivacypolicyblog
Dark Reading
darkreading.com
Enterprise security news covering vulnerabilities, threats, and security strategy for IT professionals.
Security
News, Blogs & Communities
Blogs & journalism
free
securitynewsenterprisevulnerabilities
SecurityWeek
securityweek.com
Security industry news covering breaches, vulnerabilities, malware, and enterprise security market.
Security
News, Blogs & Communities
Blogs & journalism
free
securitynewsindustrybreaches
The Hacker News
thehackernews.com
High-volume cybersecurity news site covering CVEs, breaches, hacking campaigns, and security tools.
Security
News, Blogs & Communities
Blogs & journalism
free
securitynewscvebreaches
Risky Biz
risky.biz
Weekly information security podcast and news site with high-quality interviews and briefings.
Security
News, Blogs & Communities
Podcasts & media
free
securitypodcastnewsinterviews
SANS Internet Storm Center
isc.sans.edu
Daily threat intelligence updates and diary posts from SANS handlers tracking live internet threats.
Security
News, Blogs & Communities
Threat feeds & intel
free
securitythreat-intelligencedailysans
/r/netsec
reddit.com
Reddit community for technical information security content — high quality signal, minimal noise.
Security
News, Blogs & Communities
Communities
free
securitycommunityredditdiscussion
DEF CON
defcon.org
The world's largest underground hacking conference, with talks published free and a year-round community.
Security
News, Blogs & Communities
Conferences & events
free
securityconferencecommunitytalks
Black Hat
blackhat.com
Technical security conference series focused on advanced research, with free Briefings archives.
Security
News, Blogs & Communities
Conferences & events
free
securityconferenceresearchenterprise
Offensive Tools & Pentesting
10 links
Kali Linux
kali.org
Debian-based Linux distribution maintained by Offensive Security and pre-loaded with hundreds of pentesting tools.
Security
Offensive Tools & Pentesting
Platforms & distributions
free
securitypentestingkalilinux
Metasploit Framework
metasploit.com
World's most used penetration testing framework; exploit modules, payloads, and post-exploitation tools.
Security
Offensive Tools & Pentesting
Frameworks
free
securitypentestingexploitationmetasploit
Burp Suite
portswigger.net
Industry-standard web application security testing platform with proxy, scanner, and intruder modules.
Security
Offensive Tools & Pentesting
Web application testing
freemium
securitywebpentestingproxy
HackTheBox
hackthebox.com
Online platform with intentionally vulnerable machines, labs, and Pro Labs for practising real-world attack techniques.
Security
Offensive Tools & Pentesting
Practice platforms
freemium
securityctfpracticelabs
TryHackMe
tryhackme.com
Browser-based learning platform with guided pentesting labs covering beginner to advanced topics.
Security
Offensive Tools & Pentesting
Practice platforms
freemium
securitylearningctfbeginner-friendly
Offensive Security (OffSec)
offsec.com
Training and certification provider behind OSCP, OSEP, and other hands-on security certifications.
Security
Offensive Tools & Pentesting
Certifications & training
paid
securitycertificationoscptraining
PayloadsAllTheThings
github.com
Comprehensive collection of payloads and bypasses for web app security, useful during CTFs and penetration tests.
Security
Offensive Tools & Pentesting
References & cheatsheets
free
securitypayloadswebreference
SecLists
github.com
Curated collection of wordlists for usernames, passwords, URLs, fuzzing payloads, and more.
Security
Offensive Tools & Pentesting
References & cheatsheets
free
securitywordlistsfuzzingbrute-force
PentesterLab
pentesterlab.com
Hands-on web pentesting training with real exercises, from SQL injection to deserialization.
Security
Offensive Tools & Pentesting
Practice platforms
freemium
securitywebpentestinglearning
nmap
nmap.org
Network discovery and security auditing tool — port scanning, OS fingerprinting, and service version detection.
Security
Offensive Tools & Pentesting
Frameworks
free
securitynetworkscanningreconnaissance
Threat Intelligence
10 links
MITRE ATT&CK
attack.mitre.org
Globally-accessible knowledge base of adversary tactics, techniques, and procedures based on real observations.
Security
Threat Intelligence
Frameworks & taxonomies
free
securitythreat-intelligencettpmitre
VirusTotal
virustotal.com
Multi-engine file and URL scanner aggregating results from 70+ antivirus engines and threat intelligence feeds.
Security
Threat Intelligence
Analysis & scanning
freemium
securitymalwareanalysisioc
Shodan
shodan.io
Search engine for internet-connected devices — servers, IoT, industrial systems — with banner and vulnerability data.
Security
Threat Intelligence
Internet scanning
freemium
securitythreat-intelligenceosintiot
Censys
censys.io
Internet-wide scanning service for attack surface management; maps exposed services, certs, and misconfigurations.
Security
Threat Intelligence
Internet scanning
freemium
securityattack-surfaceosintscanning
GreyNoise
greynoise.io
Filters internet background noise from real threats by categorising mass-scanning and exploit-broadcasting IPs.
Security
Threat Intelligence
Analysis & scanning
freemium
securitythreat-intelligencenoise-reductionip-reputation
AlienVault OTX
otx.alienvault.com
Open Threat Exchange — community-driven threat intelligence sharing platform with millions of indicators.
Security
Threat Intelligence
Sharing platforms
free
securitythreat-intelligenceioccommunity
abuse.ch
abuse.ch
Non-profit running MalwareBazaar, URLhaus, Feodo Tracker, and ThreatFox for free threat intelligence feeds.
Security
Threat Intelligence
Sharing platforms
free
securitymalwarethreat-intelligencefeeds
CIRCL
circl.lu
Computer Incident Response Center Luxembourg — publishes free threat intelligence feeds, MISP, and CVE tools.
Security
Threat Intelligence
CSIRTs & national bodies
free
securitythreat-intelligencecsirteurope
CISA Known Exploited Vulnerabilities
www.cisa.gov
US CISA's authoritative catalog of CVEs actively exploited in the wild, with required remediation dates for federal agencies.
Security
Threat Intelligence
CSIRTs & national bodies
free
securitycvethreat-intelligencecisa
MISP Project
misp-project.org
Open-source threat intelligence sharing platform and format standard used by hundreds of organisations globally.
Security
Threat Intelligence
Sharing platforms
free
securitythreat-intelligencesharingopen-source
Vulnerability Research
10 links
National Vulnerability Database
nvd.nist.gov
NIST's authoritative CVE database with CVSS scores, references, and patch advisories.
Security
Vulnerability Research
Databases & registries
free
securitycvevulnerabilitynist
CVE Details
cvedetails.com
CVE browsing interface with per-vendor and per-product statistics and trend charts.
Security
Vulnerability Research
Databases & registries
free
securitycvevulnerabilitystatistics
Google's open database for vulnerabilities in open-source software, queryable by package.
Security
Vulnerability Research
Databases & registries
free
securityopen-sourcevulnerabilitysupply-chain
GitHub Advisory Database
github.com
Security advisories for packages on npm, PyPI, Maven, RubyGems, and more, curated by GitHub.
Security
Vulnerability Research
Databases & registries
free
securityadvisorysupply-chaingithub
Exploit Database
exploit-db.com
Offensive Security's archive of public exploits and shellcode, searchable by CVE or platform.
Security
Vulnerability Research
Exploit archives
free
securityexploitspenetration-testingoffensive
Packet Storm Security
packetstormsecurity.com
Long-running archive of exploits, advisories, tools, and whitepapers.
Security
Vulnerability Research
Exploit archives
free
securityexploitsadvisoriestools
HackerOne
hackerone.com
Leading bug bounty platform connecting security researchers with program-running companies.
Security
Vulnerability Research
Bug bounty platforms
free
securitybug-bountyresponsible-disclosure
Bugcrowd
bugcrowd.com
Crowdsourced security platform for bug bounty programs and vulnerability disclosure.
Security
Vulnerability Research
Bug bounty platforms
free
securitybug-bountyresponsible-disclosure
Snyk Vulnerability DB
security.snyk.io
Developer-focused database of open-source package vulnerabilities with fix guidance.
Security
Vulnerability Research
Databases & registries
free
securityopen-sourcedependencysupply-chain
VulnHub
vulnhub.com
Downloadable intentionally vulnerable VMs for hands-on vulnerability practice.
Security
Vulnerability Research
Practice environments
free
securityctfpracticelabs
Security
News
Generated digest items for this topic.
2026-05-27
CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA syste
Security
securitycybercrimebreaches
Alleged Kimwolf Botmaster 'Dort' Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS)
Security
securitycybercrimebreaches
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of ot
Security
securitycybercrimebreaches
2026-05-26
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two
Security
securitycybercrimebreaches
On AI Security
Good report : Executive Summary: Let's say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don't actually work for measuring AI capabilities (even when they ar
Security
securitycryptographypolicy
macOS Kernel Memory Corruption Exploit
A group used Anthropic's Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple's M5. News article .
Security
securitycryptographypolicy
CISA Security Leak
Crazy story : Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of inter
Security
securitycryptographypolicy
2026-05-25
Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with
Security
securitycybercrimebreaches
Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of th
Security
securitycybercrimebreaches
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy
Security
securitycryptographypolicy
2026-05-24
CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA syste
Security
securitycybercrimebreaches
Alleged Kimwolf Botmaster 'Dort' Arrested, Charged in U.S. and Canada
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS)
Security
securitycybercrimebreaches
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of ot
Security
securitycybercrimebreaches