master
master
Code
Open with GitHub Desktop
Download ZIP
Launching GitHub Desktop
If nothing happens, download GitHub Desktop and try again.
Launching GitHub Desktop
If nothing happens, download GitHub Desktop and try again.
Launching Xcode
If nothing happens, download Xcode and try again.
Launching Visual Studio Code
Your codespace will open once ready.
There was a problem preparing your codespace, please try again.
"Knowledge is powerful, be careful how you use it!"
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more.
📔 What is it?
This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful information gathered in one piece. It is an invaluable source of knowledge for me that I often look back on.
🚻 For whom?
For everyone, really. Here everyone can find their favourite tastes. But to be perfectly honest, it is aimed towards System and Network administrators, DevOps, Pentesters, and Security Researchers.
ℹ️ Contributing
If you find something which doesn't make sense, or something doesn't seem right, please make a pull request and please add valid and well-reasoned explanations about your changes or comments.
A few simple rules for this project:
inviting and clear
not tiring
useful
These below rules may be better:
easy to contribute to (Markdown + HTML ...)
easy to find (simple TOC, maybe it's worth extending them?)
Url marked * is temporary unavailable. Please don't delete it without confirming that it has permanently expired.
Before adding a pull request, please see the contributing guidelines. You should also remember about this:
+ This repository is not meant to contain everything but only good quality stuff.
All suggestions/PR are welcome!
Code Contributors
This project exists thanks to all the people who contribute.
Financial Contributors
📰 RSS Feed & Updates
GitHub exposes an RSS/Atom feed of the commits, which may also be useful if you want to be kept informed about all changes.
Add new stuff...
Add useful shell functions
Add one-liners for collection tools (eg. CLI Tools)
Sort order in lists
New items are also added on a regular basis.
💢 Table of Contents
Only main chapters:
CLI Tools
GUI Tools
Web Tools
Systems/Services
Networks
Containers/Orchestration
Manuals/Howtos/Tutorials
Inspiring Lists
Blogs/Podcasts/Videos
Hacking/Penetration Testing
Your daily knowledge and news
Other Cheat Sheets
One-liners
Shell functions
🔱 The Book of Secret Knowledge (Chapters)
CLI Tools [TOC]
▪️ Shells
🔸 GNU Bash - is an sh-compatible shell that incorporates useful features from the Korn shell and C shell.
🔸 Zsh - is a shell designed for interactive use, although it is also a powerful scripting language.
🔸 tclsh - is a very powerful cross-platform shell, suitable for a huge range of uses.
🔸 bash-it - is a framework for using, developing and maintaining shell scripts and custom commands.
🔸 Oh My ZSH! - is the best framework for managing your Zsh configuration.
🔸 Oh My Fish - the Fishshell framework.
🔸 Starship - the cross-shell prompt written in Rust.
🔸 powerlevel10k - is a fast reimplementation of Powerlevel9k ZSH theme.
▪️ Shell plugins
🔸 z - tracks the folder you use the most and allow you to jump, without having to type the whole path.
🔸 fzf - is a general-purpose command-line fuzzy finder.
🔸 zsh-autosuggestions - Fish-like autosuggestions for Zsh.
🔸 zsh-syntax-highlighting - Fish shell like syntax highlighting for Zsh.
🔸 Awesome ZSH Plugins - A list of frameworks, plugins, themes and tutorials for ZSH.
▪️ Managers
🔸 Midnight Commander - is a visual file manager, licensed under GNU General Public License.
🔸 ranger - is a VIM-inspired filemanager for the console.
🔸 nnn - is a tiny, lightning fast, feature-packed file manager.
🔸 screen - is a full-screen window manager that multiplexes a physical terminal.
🔸 tmux - is a terminal multiplexer, lets you switch easily between several programs in one terminal.
🔸 tmux-cssh - is a tool to set comfortable and easy to use functionality, clustering and synchronizing tmux-sessions.
▪️ Text editors
🔸 vi - is one of the most common text editors on Unix.
🔸 vim - is a highly configurable text editor.
🔸 emacs - is an extensible, customizable, free/libre text editor, and more.
🔸 micro - is a modern and intuitive terminal-based text editor.
🔸 neovim - is a free open source, powerful, extensible and usable code editor.
🔸 spacemacs - a community-driven Emacs distribution.
🔸 spacevim - a community-driven vim distribution.
▪️ Files and directories
🔸 fd - is a simple, fast and user-friendly alternative to find.
🔸 ncdu - is an easy to use, fast disk usage analyzer.
▪️ Network
🔸 PuTTY - is an SSH and telnet client, developed originally by Simon Tatham.
🔸 Mosh - is a SSH wrapper designed to keep a SSH session alive over a volatile connection.
🔸 Eternal Terminal - enables mouse-scrolling and tmux commands inside the SSH session.
🔸 nmap - is a free and open source (license) utility for network discovery and security auditing.
🔸 zmap - is a fast single packet network scanner designed for Internet-wide network surveys.
🔸 Rust Scan - to find all open ports faster than Nmap.
🔸 masscan - is the fastest Internet port scanner, spews SYN packets asynchronously.
🔸 pbscan - is a faster and more efficient stateless SYN scanner and banner grabber.
🔸 hping - is a command-line oriented TCP/IP packet assembler/analyzer.
🔸 mtr - is a tool that combines the functionality of the 'traceroute' and 'ping' programs in a single tool.
🔸 mylg - utility which combines the functions of the different network probes in one diagnostic tool.
🔸 netcat - utility which reads and writes data across network connections, using the TCP/IP protocol.
🔸 tcpdump - is a powerful command-line packet analyzer.
🔸 tshark - is a tool that allows us to dump and analyze network traffic (wireshark cli).
🔸 Termshark - is a simple terminal user-interface for tshark.
🔸 ngrep - is like GNU grep applied to the network layer.
🔸 netsniff-ng - is a Swiss army knife for your daily Linux network plumbing if you will.
🔸 sockdump - dump unix domain socket traffic.
🔸 stenographer - is a packet capture solution which aims to quickly spool all packets to disk.
🔸 tcpterm - visualize packets in TUI.
🔸 bmon - is a monitoring and debugging tool to capture networking related statistics and prepare them visually.
🔸 iptraf-ng - is a console-based network monitoring program for Linux that displays information about IP traffic.
🔸 vnstat - is a network traffic monitor for Linux and BSD.
🔸 iPerf3 - is a tool for active measurements of the maximum achievable bandwidth on IP networks.
🔸 ethr - is a Network Performance Measurement Tool for TCP, UDP & HTTP.
🔸 Etherate - is a Linux CLI based Ethernet and MPLS traffic testing tool.
🔸 echoip - is a IP address lookup service.
🔸 Nemesis - packet manipulation CLI tool; craft and inject packets of several protocols.
🔸 packetfu - a mid-level packet manipulation library for Ruby.
🔸 Scapy - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols.
🔸 impacket - is a collection of Python classes for working with network protocols.
🔸 ssh-audit - is a tool for SSH server auditing.
🔸 aria2 - is a lightweight multi-protocol & multi-source command-line download utility.
🔸 iptables-tracer - observe the path of packets through the iptables chains.
🔸 inception - a highly configurable tool to check for whatever you like against any number of hosts.
▪️ Network (DNS)
🔸 dnsdiag - is a DNS diagnostics and performance measurement tools.
🔸 fierce - is a DNS reconnaissance tool for locating non-contiguous IP space.
🔸 subfinder - is a subdomain discovery tool that discovers valid subdomains for websites.
🔸 sublist3r - is a fast subdomains enumeration tool for penetration testers.
🔸 amass - is tool that obtains subdomain names by scraping data sources, crawling web archives, and more.
🔸 namebench - provides personalized DNS server recommendations based on your browsing history.
🔸 massdns - is a high-performance DNS stub resolver for bulk lookups and reconnaissance.
🔸 knock - is a tool to enumerate subdomains on a target domain through a wordlist.
🔸 dnsperf - DNS performance testing tools.
🔸 dnscrypt-proxy 2 - a flexible DNS proxy, with support for encrypted DNS protocols.
🔸 dnsdbq - API client providing access to passive DNS database systems.
🔸 grimd - fast dns proxy, built to black-hole internet advertisements and malware servers.
▪️ Network (HTTP)
🔸 curl - is a command line tool and library for transferring data with URLs.
🔸 kurly - is an alternative to the widely popular curl program, written in Golang.
🔸 HTTPie - is an user-friendly HTTP client.
🔸 wuzz - is an interactive cli tool for HTTP inspection.
🔸 h2spec - is a conformance testing tool for HTTP/2 implementation.
🔸 h2t - is a simple tool to help sysadmins to hardening their websites.
🔸 htrace.sh - is a simple Swiss Army knife for http/https troubleshooting and profiling.
🔸 httpstat - is a tool that visualizes curl statistics in a way of beauty and clarity.
🔸 httplab - is an interactive web server.
🔸 Lynx - is a text browser for the World Wide Web.
🔸 Browsh - is a fully interactive, real-time, and modern text-based browser.
🔸 HeadlessBrowsers - a list of (almost) all headless web browsers in existence.
🔸 ab - is a single-threaded command line tool for measuring the performance of HTTP web servers.
🔸 siege - is an http load testing and benchmarking utility.
🔸 wrk - is a modern HTTP benchmarking tool capable of generating significant load.
🔸 wrk2 - is a constant throughput, correct latency recording variant of wrk.
🔸 vegeta - is a constant throughput, correct latency recording variant of wrk.
🔸 bombardier - is a fast cross-platform HTTP benchmarking tool written in Go.
🔸 gobench - http/https load testing and benchmarking tool.
🔸 hey - HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom.
🔸 boom - is a script you can use to quickly smoke-test your web app deployment.
🔸 SlowHTTPTest - is a tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP.
🔸 gobuster - is a free and open source directory/file & DNS busting tool written in Go.
🔸 ssllabs-scan - command-line reference-implementation client for SSL Labs APIs.
🔸 http-observatory - Mozilla HTTP Observatory cli version.
▪️ SSL
🔸 openssl - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols.
🔸 gnutls-cli - client program to set up a TLS connection to some other computer.
🔸 sslyze
- fast and powerful SSL/TLS server scanning library.
🔸 sslscan - tests SSL/TLS enabled services to discover supported cipher suites.
🔸 testssl.sh - testing TLS/SSL encryption anywhere on any port.
🔸 cipherscan - a very simple way to find out which SSL ciphersuites are supported by a target.
🔸 spiped - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.
🔸 Certbot - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.
🔸 mkcert - simple zero-config tool to make locally trusted development certificates with any names you'd like.
🔸 certstrap - tools to bootstrap CAs, certificate requests, and signed certificates.
🔸 Sublert - is a security and reconnaissance tool to automatically monitor new subdomains.
🔸 mkchain - open source tool to help you build a valid SSL certificate chain.
▪️ Security
🔸 SELinux - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel.
🔸 AppArmor - proactively protects the operating system and applications from external or internal threats.
🔸 grapheneX - Automated System Hardening Framework.
🔸 DevSec Hardening Framework - Security + DevOps: Automatic Server Hardening.
▪️ Auditing Tools
🔸 ossec - actively monitoring all aspects of system activity with file integrity monitoring.
🔸 auditd - provides a way to track security-relevant information on your system.
🔸 Tiger - is a security tool that can be use both as a security audit and intrusion detection system.
🔸 Lynis - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system.
🔸 LinEnum - scripted Local Linux Enumeration & Privilege Escalation Checks.
🔸 Rkhunter - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems.
🔸 PE-sieve - is a light-weight tool that helps to detect malware running on the system.
▪️ System Diagnostics/Debuggers
🔸 strace - diagnostic, debugging and instructional userspace utility for Linux.
🔸 DTrace - is a performance analysis and troubleshooting tool.
🔸 ltrace - is a library call tracer, used to trace calls made by programs to library functions.
🔸 ptrace-burrito - is a friendly wrapper around ptrace.
🔸 perf-tools - performance analysis tools based on Linux perf_events (aka perf) and ftrace.
🔸 bpftrace - high-level tracing language for Linux eBPF.
🔸 sysdig - system exploration and troubleshooting tool with first class support for containers.
🔸 Valgrind - is an instrumentation framework for building dynamic analysis tools.
🔸 gperftools - high-performance multi-threaded malloc() implementation, plus some performance analysis tools.
🔸 glances - cross-platform system monitoring tool written in Python.
🔸 htop - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'.
🔸 bashtop - Linux resource monitor written in pure Bash.
🔸 nmon - a single executable for performance monitoring and data analysis.
🔸 atop - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes.
🔸 lsof - displays in its output information about files that are opened by processes.
🔸 FlameGraph - stack trace visualizer.
🔸 lsofgraph - convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication.
🔸 rr - is a lightweight tool for recording, replaying and debugging execution of applications.
🔸 Performance Co-Pilot - a system performance analysis toolkit.
🔸 hexyl - a command-line hex viewer.
▪️ Log Analyzers
🔸 angle-grinder - slice and dice log files on the command line.
🔸 lnav - log file navigator with search and automatic refresh.
🔸 GoAccess - real-time web log analyzer and interactive viewer that runs in a terminal.
🔸 ngxtop - real-time metrics for nginx server.
▪️ Databases
🔸 usql - universal command-line interface for SQL databases.
🔸 pgcli - postgres CLI with autocompletion and syntax highlighting.
🔸 mycli - terminal client for MySQL with autocompletion and syntax highlighting.
🔸 litecli - SQLite CLI with autocompletion and syntax highlighting.
🔸 OSQuery - is a SQL powered operating system instrumentation, monitoring, and analytics framework.
🔸 pgsync - sync data from one Postgres database to another.
🔸 iredis - a terminal client for redis with autocompletion and syntax highlighting.
▪️ TOR
🔸 Nipe - script to make Tor Network your default gateway.
🔸 multitor - a tool that lets you create multiple TOR instances with a load-balancing.
▪️ Messengers/IRC Clients
🔸 Irssi - is a free open source terminal based IRC client.
🔸 WeeChat - is an extremely extensible and lightweight IRC client.
▪️ Productivity
🔸 taskwarrior - task management system, todo list
▪️ Other
🔸 sysadmin-util - tools for Linux/Unix sysadmins.
🔸 incron - is an inode-based filesystem notification technology.
🔸 lsyncd - synchronizes local directories with remote targets (Live Syncing Daemon).
🔸 GRV - is a terminal based interface for viewing Git repositories.
🔸 Tig - text-mode interface for Git.
🔸 tldr - simplified and community-driven man pages.
🔸 archiver - easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar.
🔸 commander.js - minimal CLI creator in JavaScript.
🔸 gron - make JSON greppable!
🔸 bed - binary editor written in Go.
GUI Tools [TOC]
▪️ Terminal emulators
🔸 Guake - is a dropdown terminal made for the GNOME desktop environment.
🔸 Terminator - is based on GNOME Terminal, useful features for sysadmins and other users.
🔸 Kitty - is a GPU based terminal emulator that supports smooth scrolling and images.
🔸 Alacritty - is a fast, cross-platform, OpenGL terminal emulator.
▪️ Network
🔸 Wireshark - is the world’s foremost and widely-used network protocol analyzer.
🔸 Ettercap - is a comprehensive network monitor tool.
🔸 EtherApe - is a graphical network monitoring solution.
🔸 Packet Sender - is a networking utility for packet generation and built-in UDP/TCP/SSL client and servers.
🔸 Ostinato - is a packet crafter and traffic generator.
🔸 JMeter™ - open source software to load test functional behavior and measure performance.
🔸 locust - scalable user load testing tool written in Python.
▪️ Browsers
🔸 TOR Browser - protect your privacy and defend yourself against network surveillance and traffic analysis.
▪️ Password Managers
🔸 KeePassXC - store your passwords safely and auto-type them into your everyday websites and apps.
🔸 Bitwarden - open source password manager with built-in sync.
▪️ Messengers/IRC Clients
🔸 HexChat - is an IRC client based on XChat.
🔸 Pidgin - is an easy to use and free chat client used by millions.
▪️ Messengers (end-to-end encryption)
🔸 Signal - is an encrypted communications app.
🔸 Wire - secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end encryption.
🔸 TorChat - decentralized anonymous instant messenger on top of Tor Hidden Services.
🔸 Matrix - an open network for secure, decentralized, real-time communication.
▪️ Text editors
🔸 Sublime Text - is a lightweight, cross-platform code editor known for its speed, ease of use.
🔸 Visual Studio Code - an open-source and free source code editor developed by Microsoft.
🔸 Atom - a hackable text editor for the 21st Century.
Web Tools [TOC]
▪️ Browsers
🔸 SSL/TLS Capabilities of Your Browser - test your browser's SSL implementation.
🔸 Can I use - provides up-to-date browser support tables for support of front-end web technologies.
🔸 - is your browser safe against tracking?
🔸 Privacy Analyzer - see what data is exposed from your browser.
🔸 Web Browser Security - it's all about Web Browser fingerprinting.
🔸 How's My SSL? - help a web server developer learn what real world TLS clients were capable of.
🔸 sslClientInfo - client test (incl TLSv1.3 information).
▪️ SSL/Security
🔸 SSLLabs Server Test - performs a deep analysis of the configuration of any SSL web server.
🔸 SSLLabs Server Test (DEV) - performs a deep analysis of the configuration of any SSL web server.
🔸 ImmuniWeb® SSLScan - test SSL/TLS (PCI DSS, HIPAA and NIST).
🔸 SSL Check - scan your website for non-secure content.
🔸 SSL Scanner - analyze website security.
🔸 CryptCheck - test your TLS server configuration (e.g. ciphers).
🔸 urlscan.io - service to scan and analyse websites.
🔸 Report URI - monitoring security policies like CSP and HPKP.
🔸 CSP Evaluator - allows developers and security experts to check if a Content Security Policy.
🔸 Useless CSP - public list about CSP in some big players (might make them care a bit more).
🔸 Why No HTTPS? - top 100 websites by Alexa rank not automatically redirecting insecure requests.
🔸 TLS Cipher Suite Search- cipher suite search engine.
🔸 cipherli.st - strong ciphers for Apache, Nginx, Lighttpd, and more.*
🔸 dhtool - public Diffie-Hellman parameter service/tool.
🔸 badssl.com - memorable site for testing clients against bad SSL configs.
🔸 tlsfun.de - registered for various tests regarding the TLS/SSL protocol.
🔸 CAA Record Helper - generate a CAA policy.
🔸 Common CA Database - repository of information about CAs, and their root and intermediate certificates.
🔸 CERTSTREAM - real-time certificate transparency log update stream.
🔸 crt.sh - discovers certificates by continually monitoring all of the publicly known CT.
🔸 Hardenize - deploy the security standards.
🔸 Cipher suite compatibility - test TLS cipher suite compatibility.
🔸 urlvoid - this service helps you detect potentially malicious websites.
🔸 security.txt - a proposed standard (generator) which allows websites to define security policies.
🔸 ssl-config-generator - help you follow the Mozilla Server Side TLS configuration guidelines.
▪️ HTTP Headers & Web Linters
🔸 Security Headers - analyse the HTTP response headers (with rating system to the results).
🔸 Observatory by Mozilla - set of tools to analyze your website.
🔸 webhint - is a linting tool that will help you with your site's accessibility, speed, security, and more.
▪️ DNS
🔸 ViewDNS - one source for free DNS related tools and information.
🔸 DNSLookup - is an advanced DNS lookup tool.
🔸 DNSlytics - online DNS investigation tool.
🔸 DNS Spy - monitor, validate and verify your DNS configurations.
🔸 Zonemaster - helps you to control how your DNS works.
🔸 Leaf DNS - comprehensive DNS tester.
🔸 Find subdomains online - find subdomains for security assessment penetration test.
🔸 DNSdumpster - dns recon & research, find & lookup dns records.
🔸 DNS Table online - search for DNS records by domain, IP, CIDR, ISP.
🔸 intoDNS - DNS and mail server health checker.
🔸 DNS Bajaj - check the delegation of your domain.
🔸 BuddyDNS Delegation LAB - check, trace and visualize delegation of your domain.
🔸 dnssec-debugger - DS or DNSKEY records validator.
🔸 PTRarchive.com - this site is responsible for the safekeeping of historical reverse DNS records.
🔸 xip.io - wildcard DNS for everyone.
🔸 nip.io - dead simple wildcard DNS for any IP Address.
🔸 dnslookup (ceipam) - one of the best DNS propagation checker (and not only).
🔸 What's My DNS - DNS propagation checking tool.
🔸 DNSGrep - quickly searching large DNS datasets.
▪️ Mail
🔸 smtp-tls-checker - check an email domain for SMTP TLS support.
🔸 MX Toolbox - all of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool.
🔸 Secure Email - complete email test tools for email technicians.
🔸 blacklistalert - checks to see if your domain is on a Real Time Spam Blacklist.
🔸 MultiRBL - complete IP check for sending Mailservers.
🔸 DKIM SPF & Spam Assassin Validator - checks mail authentication and scores messages with Spam Assassin.
▪️ Encoders/Decoders and Regex testing
🔸 URL Encode/Decode - tool from above to either encode or decode a string of text.
🔸 Uncoder - the online translator for search queries on log data.
🔸 Regex101 - online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript.
🔸 RegExr - online tool to learn, build, & test Regular Expressions (RegEx / RegExp).
🔸 RegEx Testing - online regex testing tool.
🔸 RegEx Pal - online regex testing tool + other tools.
🔸 The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.
▪️ Net-tools
🔸 Netcraft - detailed report about the site, helping you to make informed choices about their integrity.*
🔸 RIPE NCC Atlas - a global, open, distributed Internet measurement platform.
🔸 Robtex - uses various sources to gather public information about IP numbers, domain names, host names, etc.
🔸 Security Trails - APIs for Security Companies, Researchers and Teams.
🔸 Online Curl - curl test, analyze HTTP Response Headers.
🔸 Online Tools for Developers - HTTP API tools, testers, encoders, converters, formatters, and other tools.
🔸 Ping.eu - online Ping, Traceroute, DNS lookup, WHOIS and others.
🔸 Network-Tools - network tools for webmasters, IT technicians & geeks.
🔸 BGPview - search for any ASN, IP, Prefix or Resource name.
🔸 Is BGP safe yet? - check BGP (RPKI) security of ISPs and other major Internet players.
🔸 Riseup - provides online communication tools for people and groups working on liberatory social change.
🔸 VirusTotal - analyze suspicious files and URLs to detect types of malware.
▪️ Privacy
🔸 privacytools.io - provides knowledge and tools to protect your privacy against global mass surveillance.
🔸 DNS Privacy Test Servers - DNS privacy recursive servers list (with a 'no logging' policy).
▪️ Code parsers/playgrounds
🔸 ShellCheck - finds bugs in your shell scripts.
🔸 explainshell - get interactive help texts for shell commands.
🔸 jsbin - live pastebin for HTML, CSS & JavaScript, and more.
🔸 CodeSandbox - online code editor for web application development.
🔸 PHP Sandbox - test your PHP code with this code tester.
🔸 Repl.it - an instant IDE to learn, build, collaborate, and host all in one place.
🔸 vclFiddle - is an online tool for experimenting with the Varnish Cache VCL.
▪️ Performance
🔸 GTmetrix - analyze your site’s speed and make it faster.
🔸 Sucuri loadtimetester - test here the
performance of any of your sites from across the globe.
🔸 Pingdom Tools - analyze your site’s speed around the world.
🔸 PingMe.io - run website latency tests across multiple geographic regions.
🔸 PageSpeed Insights - analyze your site’s speed and make it faster.
🔸 web.dev - helps developers like you learn and apply the web's modern capabilities to your own sites and apps.
🔸 Lighthouse - automated auditing, performance metrics, and best practices for the web.
▪️ Mass scanners (search engines)
🔸 Censys - platform that helps information security practitioners discover, monitor, and analyze devices.
🔸 Shodan - the world's first search engine for Internet-connected devices.
🔸 Shodan 2000 - this tool looks for randomly generated data from Shodan.
🔸 GreyNoise - mass scanner such as Shodan and Censys.
🔸 ZoomEye - search engine for cyberspace that lets the user find specific network components.
🔸 netograph - tools to monitor and understand deep structure of the web.
🔸 FOFA - is a cyberspace search engine.
🔸 onyphe - is a search engine for open-source and cyber threat intelligence data collected.
🔸 IntelligenceX - is a search engine and data archive.
🔸 binaryedge - it scan the entire internet space and create real-time threat intelligence streams and reports.
🔸 Spyse - Internet assets registry: networks, threats, web objects, etc.
🔸 wigle - is a submission-based catalog of wireless networks. All the networks. Found by Everyone.
🔸 PublicWWW - find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.
🔸 IntelTechniques - this repository contains hundreds of online search utilities.
🔸 hunter - lets you find email addresses in seconds and connect with the people that matter for your business.
🔸 GhostProject? - search by full email address or username.
🔸 databreaches - was my email affected by data breach?
🔸 We Leak Info - world's fastest and largest data breach search engine.
🔸 Pulsedive - scans of malicious URLs, IPs, and domains, including port scans and web requests.
🔸 Buckets by Grayhatwarfar - database with public search for Open Amazon S3 Buckets and their contents.
🔸 Vigilante.pw - the breached database directory.
🔸 builtwith - find out what websites are built with.
🔸 NerdyData - search the web's source code for technologies, across millions of sites.
🔸 zorexeye - search for sites, images, apps, softwares & more.
🔸 Mamont's open FTP Index - if a target has an open FTP site with accessible content it will be listed here.
🔸 OSINT Framework - focused on gathering information from free tools or resources.
🔸 maltiverse - is a service oriented to cybersecurity analysts for the advanced analysis of indicators of compromise.
🔸 Leaked Source - is a collaboration of data found online in the form of a lookup.
🔸 We Leak Info - to help everyday individuals secure their online life, avoiding getting hacked.
🔸 pipl - is the place to find the person behind the email address, social username or phone number.
🔸 abuse.ch - is operated by a random swiss guy fighting malware for non-profit.
🔸 malc0de - malware search engine.
🔸 Cybercrime Tracker - monitors and tracks various malware families that are used to perpetrate cyber crimes.
🔸 shhgit - find GitHub secrets in real time.
🔸 searchcode - helping you find real world examples of functions, API's and libraries.
🔸 Insecam - the world biggest directory of online surveillance security cameras.
🔸 index-of - contains great stuff like: security, hacking, reverse engineering, cryptography, programming etc.
🔸 Rapid7 Labs Open Data - is a great resources of datasets from Project Sonar.
🔸 Common Response Headers - the largest database of HTTP response headers.
▪️ Generators
🔸 thispersondoesnotexist - generate fake faces in one click - endless possibilities.
🔸 AI Generated Photos - 100.000 AI generated faces.
🔸 fakeface - fake faces browser.
🔸 fakenamegenerator - your randomly generated identity.
🔸 Intigriti Redirector - open redirect/SSRF payload generator.
▪️ Passwords
🔸 have i been pwned? - check if you have an account that has been compromised in a data breach.
🔸 dehashed - is a hacked database search engine.
🔸 Leaked Source - is a collaboration of data found online in the form of a lookup.
▪️ CVE/Exploits databases
🔸 CVE Mitre - list of publicly known cybersecurity vulnerabilities.
🔸 CVE Details - CVE security vulnerability advanced database.
🔸 Exploit DB - CVE compliant archive of public exploits and corresponding vulnerable software.
🔸 0day.today - exploits market provides you the possibility to buy/sell zero-day exploits.
🔸 sploitus - the exploit and tools database.
🔸 cxsecurity - free vulnerability database.
🔸 Vulncode-DB - is a database for vulnerabilities and their corresponding source code if available.
🔸 cveapi - free API for CVE data.
▪️ Mobile apps scanners
🔸 ImmuniWeb® Mobile App Scanner - test security and privacy of mobile apps (iOS & Android).
🔸 Quixxi - free Mobile App Vulnerability Scanner for Android & iOS.
🔸 Ostorlab - analyzes mobile application to identify vulnerabilities and potential weaknesses.
▪️ Private Search Engines
🔸 Startpage - the world's most private search engine.
🔸 searX - a privacy-respecting, hackable metasearch engine.
🔸 darksearch - the 1st real Dark Web search engine.
🔸 Qwant - the search engine that respects your privacy.
🔸 DuckDuckGo - the search engine that doesn't track you.
🔸 Swisscows - privacy safe web search
🔸 Disconnect - the search engine that anonymizes your searches.
🔸 MetaGer - the search engine that uses anonymous proxy and hidden Tor branches.
▪️ Secure Webmail Providers
🔸 CounterMail - online email service, designed to provide maximum security and privacy.
🔸 Mail2Tor - is a Tor Hidden Service that allows anyone to send and receive emails anonymously.
🔸 Tutanota - is the world's most secure email service and amazingly easy to use.
🔸 Protonmail - is the world's largest secure email service, developed by CERN and MIT scientists.
🔸 Startmail - private & encrypted email made easy.
▪️ Crypto
🔸 Keybase - it's open source and powered by public-key cryptography.
▪️ PGP Keyservers
🔸 SKS OpenPGP Key server - services for the SKS keyservers used by OpenPGP.
Systems/Services [TOC]
▪️ Operating Systems
🔸 Slackware - the most "Unix-like" Linux distribution.
🔸 OpenBSD - multi-platform 4.4BSD-based UNIX-like operating system.
🔸 HardenedBSD - HardenedBSD aims to implement innovative exploit mitigation and security solutions.
🔸 Kali Linux - Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.
🔸 Parrot Security OS - cyber security GNU/Linux environment.
🔸 Backbox Linux - penetration test and security assessment oriented Ubuntu-based Linux distribution.
🔸 BlackArch - is an Arch Linux-based penetration testing distribution for penetration testers.
🔸 Pentoo - is a security-focused livecd based on Gentoo.
🔸 Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management.
🔸 Tails - is a live system that aims to preserve your privacy and anonymity.
🔸 vedetta - OpenBSD router boilerplate.
🔸 Qubes OS - is a security-oriented OS that uses Xen-based virtualization.
▪️ HTTP(s) Services
🔸 Varnish Cache - HTTP accelerator designed for content-heavy dynamic web sites.
🔸 Nginx - open source web and reverse proxy server that is similar to Apache, but very light weight.
🔸 OpenResty - is a dynamic web platform based on NGINX and LuaJIT.
🔸 Tengine - a distribution of Nginx with some advanced features.
🔸 Caddy Server - is an open source, HTTP/2-enabled web server with HTTPS by default.
🔸 HAProxy - the reliable, high performance TCP/HTTP load balancer.
▪️ DNS Services
🔸 Unbound - validating, recursive, and caching DNS resolver (with TLS).
🔸 Knot Resolver - caching full resolver implementation, including both a resolver library and a daemon.
🔸 PowerDNS - is an open source authoritative DNS server, written in C++ and licensed under the GPL.
▪️ Other Services
🔸 3proxy - tiny free proxy server.
▪️ Security/hardening
🔸 Emerald Onion - is a 501(c)(3) nonprofit organization and transit internet service provider (ISP).
🔸 pi-hole - the Pi-hole® is a DNS sinkhole that protects your devices from unwanted content.
🔸 maltrail - malicious traffic detection system.
🔸 security_monkey - monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
🔸 firecracker - secure and fast microVMs for serverless computing.
🔸 streisand - sets up a new server running your choice of WireGuard, OpenSSH, OpenVPN, and more.
Networks [TOC]
▪️ Tools
🔸 CapAnalysis - web visual tool to analyze large amounts of captured network traffic (PCAP analyzer).
🔸 netbox - IP address management (IPAM) and data center infrastructure management (DCIM) tool.
▪️ Labs
🔸 NRE Labs - learn automation by doing it. Right now, right here, in your browser.
▪️ Other
🔸 LBNL's Network Research Group - home page of the Network Research Group (NRG).
Containers/Orchestration [TOC]
▪️ CLI Tools
🔸 gvisor - container runtime sandbox.
🔸 ctop - top-like interface for container metrics.
▪️ Web Tools
🔸 Moby - a collaborative project for the container ecosystem to assemble container-based system.
🔸 Traefik - open source reverse proxy/load balancer provides easier integration with Docker and Let's encrypt.
🔸 kong - The Cloud-Native API Gateway.
🔸 rancher - complete container management platform.
🔸 portainer - making Docker management easy.
🔸 nginx-proxy - automated nginx proxy for Docker containers using docker-gen.
▪️ Security
🔸 docker-bench-security - checks for dozens of common best-practices around deploying Docker.
🔸 trivy - vulnerability scanner for containers, suitable for CI.
🔸 Harbor - cloud native registry project that stores, signs, and scans content.
▪️ Manuals/Tutorials/Best Practices
🔸 docker-cheat-sheet - a quick reference cheat sheet on Docker.
🔸 awesome-docker - a curated list of Docker resources and projects.
🔸 docker_practice - learn and understand Docker technologies, with real DevOps practice!
🔸 labs
- is a collection of tutorials for learning how to use Docker with various tools.
🔸 dockerfiles - various Dockerfiles I use on the desktop and on servers.
🔸 kubernetes-the-hard-way - bootstrap Kubernetes the hard way on Google Cloud Platform. No scripts.
🔸 kubernetes-the-easy-way - bootstrap Kubernetes the easy way on Google Cloud Platform. No scripts.
🔸 cheatsheet-kubernetes-A4 - Kubernetes CheatSheets in A4.
🔸 k8s-security - kubernetes security notes and best practices.
🔸 kubernetes-production-best-practices - checklists with best-practices for production-ready Kubernetes.
🔸 kubernetes-production-best-practices - kubernetes security - best practice guide.
🔸 kubernetes-failure-stories - is a compilation of public failure/horror stories related to Kubernetes.
Manuals/Howtos/Tutorials [TOC]
▪️ Shell/Command line
🔸 pure-bash-bible - is a collection of pure bash alternatives to external processes.
🔸 pure-sh-bible - is a collection of pure POSIX sh alternatives to external processes.
🔸 bash-guide - is a guide to learn bash.
🔸 bash-handbook - for those who wanna learn Bash.
🔸 The Bash Hackers Wiki - hold documentation of any kind about GNU Bash.
🔸 Shell & Utilities - describes the commands offered to application programs by POSIX-conformant systems.
🔸 the-art-of-command-line - master the command line, in one page.
🔸 Shell Style Guide - a shell style guide for Google-originated open-source projects.
▪️ Text Editors
🔸 Vim Cheat Sheet - great multi language vim guide.
▪️ Python
🔸 Awesome Python - a curated list of awesome Python frameworks, libraries, software and resources.
🔸 python-cheatsheet - comprehensive Python cheatsheet.
🔸 pythoncheatsheet.org - basic reference for beginner and advanced developers.
▪️ Sed & Awk & Other
🔸 F’Awk Yeah! - advanced sed and awk usage (Parsing for Pentesters 3).
▪️ *nix & Network
🔸 nixCraft - linux and unix tutorials for new and seasoned sysadmin.
🔸 TecMint - the ideal Linux blog for Sysadmins & Geeks.
🔸 Omnisecu - free Networking, System Administration and Security tutorials.
🔸 linux-cheat - Linux tutorials and cheatsheets. Minimal examples. Mostly user-land CLI utilities.
🔸 linuxupskillchallenge - learn the skills required to sysadmin.
🔸 Unix Toolbox - Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users.
🔸 Linux Kernel Teaching - is a collection of lectures and labs Linux kernel topics.
🔸 htop explained - explanation of everything you can see in htop/top on Linux.
🔸 Linux Guide and Hints - tutorials on system administration in Fedora and CentOS.
🔸 strace-little-book - a little book which introduces strace.
🔸 linux-tracing-workshop - examples and hands-on labs for Linux tracing tools workshops.
🔸 http2-explained - a detailed document explaining and documenting HTTP/2.
🔸 http3-explained - a document describing the HTTP/3 and QUIC protocols.
🔸 HTTP/2 in Action - an excellent introduction to the new HTTP/2 standard.
🔸 Let's code a TCP/IP stack - great stuff to learn network and system programming at a deeper level.
🔸 Nginx Admin's Handbook - how to improve NGINX performance, security and other important things.
🔸 nginxconfig.io - NGINX config generator on steroids.
🔸 openssh guideline - is to help operational teams with the configuration of OpenSSH server and client.
🔸 SSH Handshake Explained - is a relatively brief description of the SSH handshake.
🔸 ISC's Knowledgebase - you'll find some general information about BIND 9, ISC DHCP, and Kea DHCP.
🔸 PacketLife.net - a place to record notes while studying for Cisco's CCNP certification.
▪️ Microsoft
🔸 AD-Attack-Defense - attack and defend active directory using modern post exploitation activity.
▪️ Large-scale systems
🔸 The System Design Primer - learn how to design large-scale systems.
🔸 Awesome Scalability - best practices in building High Scalability, High Availability, High Stability, and more.
🔸 Web Architecture 101 - the basic architecture concepts.
▪️ System hardening
🔸 CIS Benchmarks - secure configuration settings for over 100 technologies, available as a free PDF.
🔸 Security Harden CentOS 7 - this walks you through the steps required to security harden CentOS.
🔸 CentOS 7 Server Hardening Guide - great guide for hardening CentOS; familiar with OpenSCAP.
🔸 awesome-security-hardening - is a collection of security hardening guides, tools and other resources.
🔸 The Practical Linux Hardening Guide - provides a high-level overview of hardening GNU/Linux systems.
🔸 Linux Hardening Guide - how to harden Linux as much as possible for security and privacy.
▪️ Security & Privacy
🔸 Hacking Articles - LRaj Chandel's Security & Hacking Blog.
🔸 AWS security tools - make your AWS cloud environment more secure.
🔸 Rawsec's CyberSecurity Inventory - an inventory of tools and resources about CyberSecurity.
🔸 The Illustrated TLS Connection - every byte of a TLS connection explained and reproduced.
🔸 SSL Research - SSL and TLS Deployment Best Practices by SSL Labs.
🔸 SELinux Game - learn SELinux by doing. Solve Puzzles, show skillz.
🔸 Certificates and PKI - everything you should know about certificates and PKI but are too afraid to ask.
🔸 The Art of Subdomain Enumeration - a reference for subdomain enumeration techniques.
🔸 Quitting Google - the comprehensive guide to quitting Google.
▪️ Web Apps
🔸 OWASP - worldwide not-for-profit charitable organization focused on improving the security of software.
🔸 OWASP ASVS 3.0.1 - OWASP Application Security Verification Standard Project.
🔸 OWASP ASVS 3.0.1 Web App - simple web app that helps developers understand the ASVS requirements.
🔸 OWASP ASVS 4.0 - is a list of application security requirements or tests.
🔸 OWASP Testing Guide v4 - includes a "best practice" penetration testing framework.
🔸 OWASP Dev Guide - this is the development version of the OWASP Developer Guide.
🔸 OWASP WSTG - is a comprehensive open source guide to testing the security of web apps.
🔸 OWASP API Security Project - focuses specifically on the top ten vulnerabilities in API security.
🔸 Mozilla Web Security - help operational teams with creating secure web applications.
🔸 security-bulletins - security bulletins that relate to Netflix Open Source.
🔸 API-Security-Checklist - security countermeasures when designing, testing, and releasing your API.
🔸 Enable CORS - enable cross-origin resource sharing.
🔸 Application Security Wiki - is an initiative to provide all application security related resources at one place.
🔸 Weird Proxies - reverse proxy related attacks; it is a result of analysis of various proxies.
🔸 Webshells - great series about malicious payloads.
🔸 Practical Web Cache Poisoning - show you how to compromise websites by using esoteric web features.
🔸 Hidden directories and files - as a source of sensitive information about web application.
🔸 Explosive blog - great blog about cybersec and pentests.
🔸 Security Cookies - this paper will take a close look at cookie security.
🔸 APISecurityBestPractices - help you keep secrets (API keys, db credentials, certificates) out of source code.
▪️ All-in-one
🔸 LZone Cheat Sheets - all cheat sheets.
🔸 Dan’s Cheat Sheets’s - massive cheat sheets documentation.
🔸 Rico's cheatsheets - this is a modest collection of cheatsheets.
🔸 DevDocs API - combines multiple API documentations in a fast, organized, and searchable interface.
🔸 cheat.sh - the only cheat sheet you need.
🔸 gnulinux.guru - collection of cheat sheets about bash, vim and networking.
▪️ Ebooks
🔸 free-programming-books - list of free learning resources in many languages.
▪️ Other
🔸 CTF Series : Vulnerable Machines - the steps below could be followed to find vulnerabilities and exploits.
🔸 50M_CTF_Writeup - $50 million CTF from Hackerone - writeup.
🔸 ctf-tasks - an archive of low-level CTF challenges developed over the years.
🔸 How to start RE/malware analysis? - collection of some hints and useful links for the beginners.
🔸 The C10K problem - it's time for web servers to handle ten thousand clients simultaneously, don't you think?
🔸 How 1500 bytes became the MTU of the internet - great story about the Maximum Transmission Unit.
🔸 poor man's profiler - like dtrace's don't really provide methods to see what programs are blocking on.
🔸 HTTPS on Stack Overflow - this is the story of a long journey regarding the implementation of SSL.
🔸 Julia's Drawings - some drawings about programming and unix world, zines about systems & debugging tools.
🔸 Hash collisions - this great repository is focused on hash collisions exploitation.
🔸 sha256-animation - animation of the SHA-256 hash function in your terminal.
🔸 BGP Meets Cat - after 3072 hours of manipulating BGP, Job Snijders has succeeded in drawing a Nyancat.
🔸 bgp-battleships - playing battleships over BGP.
🔸 What happens when... - you type google.com into your browser and press enter?
🔸 how-web-works - based on the 'What happens when...' repository.
🔸 HTTPS in the real world - great tutorial explain how HTTPS works in the real world.
🔸 Gitlab and NFS bug - how we spent two weeks hunting an NFS bug in the Linux kernel.
🔸 Gitlab melts down - postmortem on the database outage of January 31 2017 with the lessons we learned.
🔸 How To Become A Hacker - if you want to be a hacker, keep reading.
🔸 Operation Costs in CPU - should help to estimate costs of certain operations in CPU clocks.
🔸 Let's Build a Simple Database - writing a sqlite clone from scratch in C.
🔸 simple-computer - great resource to understand how computers work under the hood.
🔸 The story of "Have I been pwned?" - working with 154 million records on Azure Table Storage.
🔸 TOP500 Supercomputers - shows the 500 most powerful commercially available computer systems known to us.
🔸 How to build a 8 GPU password cracker - any "black magic" or hours of frustration like desktop components do.
🔸 CERN Data Centre - 3D visualizations of the CERN computing environments (and more).
🔸 How fucked is my database - evaluate how fucked your database is with this handy website.
🔸 Linux Troubleshooting 101 , 2016 Edition - everything is a DNS Problem...
🔸 Five Whys - you know what the problem is, but you cannot solve it?
🔸 Maersk, me & notPetya - how did ransomware successfully hijack hundreds of domain controllers?
🔸 howhttps.works - how HTTPS works ...in a comic!
🔸 howdns.works - a fun and colorful explanation of how DNS works.
🔸 POSTGRESQLCO.NF - your postgresql.conf documentation and recommendations.
Inspiring Lists [TOC]
▪️ SysOps/DevOps
🔸 Awesome Sysadmin - amazingly awesome open source sysadmin resources.
🔸 Awesome Shell - awesome command-line frameworks, toolkits, guides and gizmos.
🔸 Command-line-text-processing - finding text to search and replace, sorting to beautifying, and more.
🔸 Awesome Pcaptools - collection of tools developed by other researchers to process network traces.
🔸 awesome-ebpf - a curated list of awesome projects relat
Code
Open with GitHub Desktop
Download ZIP
Launching GitHub Desktop
If nothing happens, download GitHub Desktop and try again.
Launching GitHub Desktop
If nothing happens, download GitHub Desktop and try again.
Launching Xcode
If nothing happens, download Xcode and try again.
Launching Visual Studio Code
Your codespace will open once ready.
There was a problem preparing your codespace, please try again.
"Knowledge is powerful, be careful how you use it!"
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more.
📔 What is it?
This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful information gathered in one piece. It is an invaluable source of knowledge for me that I often look back on.
🚻 For whom?
For everyone, really. Here everyone can find their favourite tastes. But to be perfectly honest, it is aimed towards System and Network administrators, DevOps, Pentesters, and Security Researchers.
ℹ️ Contributing
If you find something which doesn't make sense, or something doesn't seem right, please make a pull request and please add valid and well-reasoned explanations about your changes or comments.
A few simple rules for this project:
inviting and clear
not tiring
useful
These below rules may be better:
easy to contribute to (Markdown + HTML ...)
easy to find (simple TOC, maybe it's worth extending them?)
Url marked * is temporary unavailable. Please don't delete it without confirming that it has permanently expired.
Before adding a pull request, please see the contributing guidelines. You should also remember about this:
+ This repository is not meant to contain everything but only good quality stuff.
All suggestions/PR are welcome!
Code Contributors
This project exists thanks to all the people who contribute.
Financial Contributors
📰 RSS Feed & Updates
GitHub exposes an RSS/Atom feed of the commits, which may also be useful if you want to be kept informed about all changes.
Add new stuff...
Add useful shell functions
Add one-liners for collection tools (eg. CLI Tools)
Sort order in lists
New items are also added on a regular basis.
💢 Table of Contents
Only main chapters:
CLI Tools
GUI Tools
Web Tools
Systems/Services
Networks
Containers/Orchestration
Manuals/Howtos/Tutorials
Inspiring Lists
Blogs/Podcasts/Videos
Hacking/Penetration Testing
Your daily knowledge and news
Other Cheat Sheets
One-liners
Shell functions
🔱 The Book of Secret Knowledge (Chapters)
CLI Tools [TOC]
▪️ Shells
🔸 GNU Bash - is an sh-compatible shell that incorporates useful features from the Korn shell and C shell.
🔸 Zsh - is a shell designed for interactive use, although it is also a powerful scripting language.
🔸 tclsh - is a very powerful cross-platform shell, suitable for a huge range of uses.
🔸 bash-it - is a framework for using, developing and maintaining shell scripts and custom commands.
🔸 Oh My ZSH! - is the best framework for managing your Zsh configuration.
🔸 Oh My Fish - the Fishshell framework.
🔸 Starship - the cross-shell prompt written in Rust.
🔸 powerlevel10k - is a fast reimplementation of Powerlevel9k ZSH theme.
▪️ Shell plugins
🔸 z - tracks the folder you use the most and allow you to jump, without having to type the whole path.
🔸 fzf - is a general-purpose command-line fuzzy finder.
🔸 zsh-autosuggestions - Fish-like autosuggestions for Zsh.
🔸 zsh-syntax-highlighting - Fish shell like syntax highlighting for Zsh.
🔸 Awesome ZSH Plugins - A list of frameworks, plugins, themes and tutorials for ZSH.
▪️ Managers
🔸 Midnight Commander - is a visual file manager, licensed under GNU General Public License.
🔸 ranger - is a VIM-inspired filemanager for the console.
🔸 nnn - is a tiny, lightning fast, feature-packed file manager.
🔸 screen - is a full-screen window manager that multiplexes a physical terminal.
🔸 tmux - is a terminal multiplexer, lets you switch easily between several programs in one terminal.
🔸 tmux-cssh - is a tool to set comfortable and easy to use functionality, clustering and synchronizing tmux-sessions.
▪️ Text editors
🔸 vi - is one of the most common text editors on Unix.
🔸 vim - is a highly configurable text editor.
🔸 emacs - is an extensible, customizable, free/libre text editor, and more.
🔸 micro - is a modern and intuitive terminal-based text editor.
🔸 neovim - is a free open source, powerful, extensible and usable code editor.
🔸 spacemacs - a community-driven Emacs distribution.
🔸 spacevim - a community-driven vim distribution.
▪️ Files and directories
🔸 fd - is a simple, fast and user-friendly alternative to find.
🔸 ncdu - is an easy to use, fast disk usage analyzer.
▪️ Network
🔸 PuTTY - is an SSH and telnet client, developed originally by Simon Tatham.
🔸 Mosh - is a SSH wrapper designed to keep a SSH session alive over a volatile connection.
🔸 Eternal Terminal - enables mouse-scrolling and tmux commands inside the SSH session.
🔸 nmap - is a free and open source (license) utility for network discovery and security auditing.
🔸 zmap - is a fast single packet network scanner designed for Internet-wide network surveys.
🔸 Rust Scan - to find all open ports faster than Nmap.
🔸 masscan - is the fastest Internet port scanner, spews SYN packets asynchronously.
🔸 pbscan - is a faster and more efficient stateless SYN scanner and banner grabber.
🔸 hping - is a command-line oriented TCP/IP packet assembler/analyzer.
🔸 mtr - is a tool that combines the functionality of the 'traceroute' and 'ping' programs in a single tool.
🔸 mylg - utility which combines the functions of the different network probes in one diagnostic tool.
🔸 netcat - utility which reads and writes data across network connections, using the TCP/IP protocol.
🔸 tcpdump - is a powerful command-line packet analyzer.
🔸 tshark - is a tool that allows us to dump and analyze network traffic (wireshark cli).
🔸 Termshark - is a simple terminal user-interface for tshark.
🔸 ngrep - is like GNU grep applied to the network layer.
🔸 netsniff-ng - is a Swiss army knife for your daily Linux network plumbing if you will.
🔸 sockdump - dump unix domain socket traffic.
🔸 stenographer - is a packet capture solution which aims to quickly spool all packets to disk.
🔸 tcpterm - visualize packets in TUI.
🔸 bmon - is a monitoring and debugging tool to capture networking related statistics and prepare them visually.
🔸 iptraf-ng - is a console-based network monitoring program for Linux that displays information about IP traffic.
🔸 vnstat - is a network traffic monitor for Linux and BSD.
🔸 iPerf3 - is a tool for active measurements of the maximum achievable bandwidth on IP networks.
🔸 ethr - is a Network Performance Measurement Tool for TCP, UDP & HTTP.
🔸 Etherate - is a Linux CLI based Ethernet and MPLS traffic testing tool.
🔸 echoip - is a IP address lookup service.
🔸 Nemesis - packet manipulation CLI tool; craft and inject packets of several protocols.
🔸 packetfu - a mid-level packet manipulation library for Ruby.
🔸 Scapy - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols.
🔸 impacket - is a collection of Python classes for working with network protocols.
🔸 ssh-audit - is a tool for SSH server auditing.
🔸 aria2 - is a lightweight multi-protocol & multi-source command-line download utility.
🔸 iptables-tracer - observe the path of packets through the iptables chains.
🔸 inception - a highly configurable tool to check for whatever you like against any number of hosts.
▪️ Network (DNS)
🔸 dnsdiag - is a DNS diagnostics and performance measurement tools.
🔸 fierce - is a DNS reconnaissance tool for locating non-contiguous IP space.
🔸 subfinder - is a subdomain discovery tool that discovers valid subdomains for websites.
🔸 sublist3r - is a fast subdomains enumeration tool for penetration testers.
🔸 amass - is tool that obtains subdomain names by scraping data sources, crawling web archives, and more.
🔸 namebench - provides personalized DNS server recommendations based on your browsing history.
🔸 massdns - is a high-performance DNS stub resolver for bulk lookups and reconnaissance.
🔸 knock - is a tool to enumerate subdomains on a target domain through a wordlist.
🔸 dnsperf - DNS performance testing tools.
🔸 dnscrypt-proxy 2 - a flexible DNS proxy, with support for encrypted DNS protocols.
🔸 dnsdbq - API client providing access to passive DNS database systems.
🔸 grimd - fast dns proxy, built to black-hole internet advertisements and malware servers.
▪️ Network (HTTP)
🔸 curl - is a command line tool and library for transferring data with URLs.
🔸 kurly - is an alternative to the widely popular curl program, written in Golang.
🔸 HTTPie - is an user-friendly HTTP client.
🔸 wuzz - is an interactive cli tool for HTTP inspection.
🔸 h2spec - is a conformance testing tool for HTTP/2 implementation.
🔸 h2t - is a simple tool to help sysadmins to hardening their websites.
🔸 htrace.sh - is a simple Swiss Army knife for http/https troubleshooting and profiling.
🔸 httpstat - is a tool that visualizes curl statistics in a way of beauty and clarity.
🔸 httplab - is an interactive web server.
🔸 Lynx - is a text browser for the World Wide Web.
🔸 Browsh - is a fully interactive, real-time, and modern text-based browser.
🔸 HeadlessBrowsers - a list of (almost) all headless web browsers in existence.
🔸 ab - is a single-threaded command line tool for measuring the performance of HTTP web servers.
🔸 siege - is an http load testing and benchmarking utility.
🔸 wrk - is a modern HTTP benchmarking tool capable of generating significant load.
🔸 wrk2 - is a constant throughput, correct latency recording variant of wrk.
🔸 vegeta - is a constant throughput, correct latency recording variant of wrk.
🔸 bombardier - is a fast cross-platform HTTP benchmarking tool written in Go.
🔸 gobench - http/https load testing and benchmarking tool.
🔸 hey - HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom.
🔸 boom - is a script you can use to quickly smoke-test your web app deployment.
🔸 SlowHTTPTest - is a tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP.
🔸 gobuster - is a free and open source directory/file & DNS busting tool written in Go.
🔸 ssllabs-scan - command-line reference-implementation client for SSL Labs APIs.
🔸 http-observatory - Mozilla HTTP Observatory cli version.
▪️ SSL
🔸 openssl - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols.
🔸 gnutls-cli - client program to set up a TLS connection to some other computer.
🔸 sslyze
- fast and powerful SSL/TLS server scanning library.
🔸 sslscan - tests SSL/TLS enabled services to discover supported cipher suites.
🔸 testssl.sh - testing TLS/SSL encryption anywhere on any port.
🔸 cipherscan - a very simple way to find out which SSL ciphersuites are supported by a target.
🔸 spiped - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.
🔸 Certbot - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.
🔸 mkcert - simple zero-config tool to make locally trusted development certificates with any names you'd like.
🔸 certstrap - tools to bootstrap CAs, certificate requests, and signed certificates.
🔸 Sublert - is a security and reconnaissance tool to automatically monitor new subdomains.
🔸 mkchain - open source tool to help you build a valid SSL certificate chain.
▪️ Security
🔸 SELinux - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel.
🔸 AppArmor - proactively protects the operating system and applications from external or internal threats.
🔸 grapheneX - Automated System Hardening Framework.
🔸 DevSec Hardening Framework - Security + DevOps: Automatic Server Hardening.
▪️ Auditing Tools
🔸 ossec - actively monitoring all aspects of system activity with file integrity monitoring.
🔸 auditd - provides a way to track security-relevant information on your system.
🔸 Tiger - is a security tool that can be use both as a security audit and intrusion detection system.
🔸 Lynis - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system.
🔸 LinEnum - scripted Local Linux Enumeration & Privilege Escalation Checks.
🔸 Rkhunter - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems.
🔸 PE-sieve - is a light-weight tool that helps to detect malware running on the system.
▪️ System Diagnostics/Debuggers
🔸 strace - diagnostic, debugging and instructional userspace utility for Linux.
🔸 DTrace - is a performance analysis and troubleshooting tool.
🔸 ltrace - is a library call tracer, used to trace calls made by programs to library functions.
🔸 ptrace-burrito - is a friendly wrapper around ptrace.
🔸 perf-tools - performance analysis tools based on Linux perf_events (aka perf) and ftrace.
🔸 bpftrace - high-level tracing language for Linux eBPF.
🔸 sysdig - system exploration and troubleshooting tool with first class support for containers.
🔸 Valgrind - is an instrumentation framework for building dynamic analysis tools.
🔸 gperftools - high-performance multi-threaded malloc() implementation, plus some performance analysis tools.
🔸 glances - cross-platform system monitoring tool written in Python.
🔸 htop - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'.
🔸 bashtop - Linux resource monitor written in pure Bash.
🔸 nmon - a single executable for performance monitoring and data analysis.
🔸 atop - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes.
🔸 lsof - displays in its output information about files that are opened by processes.
🔸 FlameGraph - stack trace visualizer.
🔸 lsofgraph - convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication.
🔸 rr - is a lightweight tool for recording, replaying and debugging execution of applications.
🔸 Performance Co-Pilot - a system performance analysis toolkit.
🔸 hexyl - a command-line hex viewer.
▪️ Log Analyzers
🔸 angle-grinder - slice and dice log files on the command line.
🔸 lnav - log file navigator with search and automatic refresh.
🔸 GoAccess - real-time web log analyzer and interactive viewer that runs in a terminal.
🔸 ngxtop - real-time metrics for nginx server.
▪️ Databases
🔸 usql - universal command-line interface for SQL databases.
🔸 pgcli - postgres CLI with autocompletion and syntax highlighting.
🔸 mycli - terminal client for MySQL with autocompletion and syntax highlighting.
🔸 litecli - SQLite CLI with autocompletion and syntax highlighting.
🔸 OSQuery - is a SQL powered operating system instrumentation, monitoring, and analytics framework.
🔸 pgsync - sync data from one Postgres database to another.
🔸 iredis - a terminal client for redis with autocompletion and syntax highlighting.
▪️ TOR
🔸 Nipe - script to make Tor Network your default gateway.
🔸 multitor - a tool that lets you create multiple TOR instances with a load-balancing.
▪️ Messengers/IRC Clients
🔸 Irssi - is a free open source terminal based IRC client.
🔸 WeeChat - is an extremely extensible and lightweight IRC client.
▪️ Productivity
🔸 taskwarrior - task management system, todo list
▪️ Other
🔸 sysadmin-util - tools for Linux/Unix sysadmins.
🔸 incron - is an inode-based filesystem notification technology.
🔸 lsyncd - synchronizes local directories with remote targets (Live Syncing Daemon).
🔸 GRV - is a terminal based interface for viewing Git repositories.
🔸 Tig - text-mode interface for Git.
🔸 tldr - simplified and community-driven man pages.
🔸 archiver - easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar.
🔸 commander.js - minimal CLI creator in JavaScript.
🔸 gron - make JSON greppable!
🔸 bed - binary editor written in Go.
GUI Tools [TOC]
▪️ Terminal emulators
🔸 Guake - is a dropdown terminal made for the GNOME desktop environment.
🔸 Terminator - is based on GNOME Terminal, useful features for sysadmins and other users.
🔸 Kitty - is a GPU based terminal emulator that supports smooth scrolling and images.
🔸 Alacritty - is a fast, cross-platform, OpenGL terminal emulator.
▪️ Network
🔸 Wireshark - is the world’s foremost and widely-used network protocol analyzer.
🔸 Ettercap - is a comprehensive network monitor tool.
🔸 EtherApe - is a graphical network monitoring solution.
🔸 Packet Sender - is a networking utility for packet generation and built-in UDP/TCP/SSL client and servers.
🔸 Ostinato - is a packet crafter and traffic generator.
🔸 JMeter™ - open source software to load test functional behavior and measure performance.
🔸 locust - scalable user load testing tool written in Python.
▪️ Browsers
🔸 TOR Browser - protect your privacy and defend yourself against network surveillance and traffic analysis.
▪️ Password Managers
🔸 KeePassXC - store your passwords safely and auto-type them into your everyday websites and apps.
🔸 Bitwarden - open source password manager with built-in sync.
▪️ Messengers/IRC Clients
🔸 HexChat - is an IRC client based on XChat.
🔸 Pidgin - is an easy to use and free chat client used by millions.
▪️ Messengers (end-to-end encryption)
🔸 Signal - is an encrypted communications app.
🔸 Wire - secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end encryption.
🔸 TorChat - decentralized anonymous instant messenger on top of Tor Hidden Services.
🔸 Matrix - an open network for secure, decentralized, real-time communication.
▪️ Text editors
🔸 Sublime Text - is a lightweight, cross-platform code editor known for its speed, ease of use.
🔸 Visual Studio Code - an open-source and free source code editor developed by Microsoft.
🔸 Atom - a hackable text editor for the 21st Century.
Web Tools [TOC]
▪️ Browsers
🔸 SSL/TLS Capabilities of Your Browser - test your browser's SSL implementation.
🔸 Can I use - provides up-to-date browser support tables for support of front-end web technologies.
🔸 - is your browser safe against tracking?
🔸 Privacy Analyzer - see what data is exposed from your browser.
🔸 Web Browser Security - it's all about Web Browser fingerprinting.
🔸 How's My SSL? - help a web server developer learn what real world TLS clients were capable of.
🔸 sslClientInfo - client test (incl TLSv1.3 information).
▪️ SSL/Security
🔸 SSLLabs Server Test - performs a deep analysis of the configuration of any SSL web server.
🔸 SSLLabs Server Test (DEV) - performs a deep analysis of the configuration of any SSL web server.
🔸 ImmuniWeb® SSLScan - test SSL/TLS (PCI DSS, HIPAA and NIST).
🔸 SSL Check - scan your website for non-secure content.
🔸 SSL Scanner - analyze website security.
🔸 CryptCheck - test your TLS server configuration (e.g. ciphers).
🔸 urlscan.io - service to scan and analyse websites.
🔸 Report URI - monitoring security policies like CSP and HPKP.
🔸 CSP Evaluator - allows developers and security experts to check if a Content Security Policy.
🔸 Useless CSP - public list about CSP in some big players (might make them care a bit more).
🔸 Why No HTTPS? - top 100 websites by Alexa rank not automatically redirecting insecure requests.
🔸 TLS Cipher Suite Search- cipher suite search engine.
🔸 cipherli.st - strong ciphers for Apache, Nginx, Lighttpd, and more.*
🔸 dhtool - public Diffie-Hellman parameter service/tool.
🔸 badssl.com - memorable site for testing clients against bad SSL configs.
🔸 tlsfun.de - registered for various tests regarding the TLS/SSL protocol.
🔸 CAA Record Helper - generate a CAA policy.
🔸 Common CA Database - repository of information about CAs, and their root and intermediate certificates.
🔸 CERTSTREAM - real-time certificate transparency log update stream.
🔸 crt.sh - discovers certificates by continually monitoring all of the publicly known CT.
🔸 Hardenize - deploy the security standards.
🔸 Cipher suite compatibility - test TLS cipher suite compatibility.
🔸 urlvoid - this service helps you detect potentially malicious websites.
🔸 security.txt - a proposed standard (generator) which allows websites to define security policies.
🔸 ssl-config-generator - help you follow the Mozilla Server Side TLS configuration guidelines.
▪️ HTTP Headers & Web Linters
🔸 Security Headers - analyse the HTTP response headers (with rating system to the results).
🔸 Observatory by Mozilla - set of tools to analyze your website.
🔸 webhint - is a linting tool that will help you with your site's accessibility, speed, security, and more.
▪️ DNS
🔸 ViewDNS - one source for free DNS related tools and information.
🔸 DNSLookup - is an advanced DNS lookup tool.
🔸 DNSlytics - online DNS investigation tool.
🔸 DNS Spy - monitor, validate and verify your DNS configurations.
🔸 Zonemaster - helps you to control how your DNS works.
🔸 Leaf DNS - comprehensive DNS tester.
🔸 Find subdomains online - find subdomains for security assessment penetration test.
🔸 DNSdumpster - dns recon & research, find & lookup dns records.
🔸 DNS Table online - search for DNS records by domain, IP, CIDR, ISP.
🔸 intoDNS - DNS and mail server health checker.
🔸 DNS Bajaj - check the delegation of your domain.
🔸 BuddyDNS Delegation LAB - check, trace and visualize delegation of your domain.
🔸 dnssec-debugger - DS or DNSKEY records validator.
🔸 PTRarchive.com - this site is responsible for the safekeeping of historical reverse DNS records.
🔸 xip.io - wildcard DNS for everyone.
🔸 nip.io - dead simple wildcard DNS for any IP Address.
🔸 dnslookup (ceipam) - one of the best DNS propagation checker (and not only).
🔸 What's My DNS - DNS propagation checking tool.
🔸 DNSGrep - quickly searching large DNS datasets.
▪️ Mail
🔸 smtp-tls-checker - check an email domain for SMTP TLS support.
🔸 MX Toolbox - all of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool.
🔸 Secure Email - complete email test tools for email technicians.
🔸 blacklistalert - checks to see if your domain is on a Real Time Spam Blacklist.
🔸 MultiRBL - complete IP check for sending Mailservers.
🔸 DKIM SPF & Spam Assassin Validator - checks mail authentication and scores messages with Spam Assassin.
▪️ Encoders/Decoders and Regex testing
🔸 URL Encode/Decode - tool from above to either encode or decode a string of text.
🔸 Uncoder - the online translator for search queries on log data.
🔸 Regex101 - online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript.
🔸 RegExr - online tool to learn, build, & test Regular Expressions (RegEx / RegExp).
🔸 RegEx Testing - online regex testing tool.
🔸 RegEx Pal - online regex testing tool + other tools.
🔸 The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.
▪️ Net-tools
🔸 Netcraft - detailed report about the site, helping you to make informed choices about their integrity.*
🔸 RIPE NCC Atlas - a global, open, distributed Internet measurement platform.
🔸 Robtex - uses various sources to gather public information about IP numbers, domain names, host names, etc.
🔸 Security Trails - APIs for Security Companies, Researchers and Teams.
🔸 Online Curl - curl test, analyze HTTP Response Headers.
🔸 Online Tools for Developers - HTTP API tools, testers, encoders, converters, formatters, and other tools.
🔸 Ping.eu - online Ping, Traceroute, DNS lookup, WHOIS and others.
🔸 Network-Tools - network tools for webmasters, IT technicians & geeks.
🔸 BGPview - search for any ASN, IP, Prefix or Resource name.
🔸 Is BGP safe yet? - check BGP (RPKI) security of ISPs and other major Internet players.
🔸 Riseup - provides online communication tools for people and groups working on liberatory social change.
🔸 VirusTotal - analyze suspicious files and URLs to detect types of malware.
▪️ Privacy
🔸 privacytools.io - provides knowledge and tools to protect your privacy against global mass surveillance.
🔸 DNS Privacy Test Servers - DNS privacy recursive servers list (with a 'no logging' policy).
▪️ Code parsers/playgrounds
🔸 ShellCheck - finds bugs in your shell scripts.
🔸 explainshell - get interactive help texts for shell commands.
🔸 jsbin - live pastebin for HTML, CSS & JavaScript, and more.
🔸 CodeSandbox - online code editor for web application development.
🔸 PHP Sandbox - test your PHP code with this code tester.
🔸 Repl.it - an instant IDE to learn, build, collaborate, and host all in one place.
🔸 vclFiddle - is an online tool for experimenting with the Varnish Cache VCL.
▪️ Performance
🔸 GTmetrix - analyze your site’s speed and make it faster.
🔸 Sucuri loadtimetester - test here the
performance of any of your sites from across the globe.
🔸 Pingdom Tools - analyze your site’s speed around the world.
🔸 PingMe.io - run website latency tests across multiple geographic regions.
🔸 PageSpeed Insights - analyze your site’s speed and make it faster.
🔸 web.dev - helps developers like you learn and apply the web's modern capabilities to your own sites and apps.
🔸 Lighthouse - automated auditing, performance metrics, and best practices for the web.
▪️ Mass scanners (search engines)
🔸 Censys - platform that helps information security practitioners discover, monitor, and analyze devices.
🔸 Shodan - the world's first search engine for Internet-connected devices.
🔸 Shodan 2000 - this tool looks for randomly generated data from Shodan.
🔸 GreyNoise - mass scanner such as Shodan and Censys.
🔸 ZoomEye - search engine for cyberspace that lets the user find specific network components.
🔸 netograph - tools to monitor and understand deep structure of the web.
🔸 FOFA - is a cyberspace search engine.
🔸 onyphe - is a search engine for open-source and cyber threat intelligence data collected.
🔸 IntelligenceX - is a search engine and data archive.
🔸 binaryedge - it scan the entire internet space and create real-time threat intelligence streams and reports.
🔸 Spyse - Internet assets registry: networks, threats, web objects, etc.
🔸 wigle - is a submission-based catalog of wireless networks. All the networks. Found by Everyone.
🔸 PublicWWW - find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.
🔸 IntelTechniques - this repository contains hundreds of online search utilities.
🔸 hunter - lets you find email addresses in seconds and connect with the people that matter for your business.
🔸 GhostProject? - search by full email address or username.
🔸 databreaches - was my email affected by data breach?
🔸 We Leak Info - world's fastest and largest data breach search engine.
🔸 Pulsedive - scans of malicious URLs, IPs, and domains, including port scans and web requests.
🔸 Buckets by Grayhatwarfar - database with public search for Open Amazon S3 Buckets and their contents.
🔸 Vigilante.pw - the breached database directory.
🔸 builtwith - find out what websites are built with.
🔸 NerdyData - search the web's source code for technologies, across millions of sites.
🔸 zorexeye - search for sites, images, apps, softwares & more.
🔸 Mamont's open FTP Index - if a target has an open FTP site with accessible content it will be listed here.
🔸 OSINT Framework - focused on gathering information from free tools or resources.
🔸 maltiverse - is a service oriented to cybersecurity analysts for the advanced analysis of indicators of compromise.
🔸 Leaked Source - is a collaboration of data found online in the form of a lookup.
🔸 We Leak Info - to help everyday individuals secure their online life, avoiding getting hacked.
🔸 pipl - is the place to find the person behind the email address, social username or phone number.
🔸 abuse.ch - is operated by a random swiss guy fighting malware for non-profit.
🔸 malc0de - malware search engine.
🔸 Cybercrime Tracker - monitors and tracks various malware families that are used to perpetrate cyber crimes.
🔸 shhgit - find GitHub secrets in real time.
🔸 searchcode - helping you find real world examples of functions, API's and libraries.
🔸 Insecam - the world biggest directory of online surveillance security cameras.
🔸 index-of - contains great stuff like: security, hacking, reverse engineering, cryptography, programming etc.
🔸 Rapid7 Labs Open Data - is a great resources of datasets from Project Sonar.
🔸 Common Response Headers - the largest database of HTTP response headers.
▪️ Generators
🔸 thispersondoesnotexist - generate fake faces in one click - endless possibilities.
🔸 AI Generated Photos - 100.000 AI generated faces.
🔸 fakeface - fake faces browser.
🔸 fakenamegenerator - your randomly generated identity.
🔸 Intigriti Redirector - open redirect/SSRF payload generator.
▪️ Passwords
🔸 have i been pwned? - check if you have an account that has been compromised in a data breach.
🔸 dehashed - is a hacked database search engine.
🔸 Leaked Source - is a collaboration of data found online in the form of a lookup.
▪️ CVE/Exploits databases
🔸 CVE Mitre - list of publicly known cybersecurity vulnerabilities.
🔸 CVE Details - CVE security vulnerability advanced database.
🔸 Exploit DB - CVE compliant archive of public exploits and corresponding vulnerable software.
🔸 0day.today - exploits market provides you the possibility to buy/sell zero-day exploits.
🔸 sploitus - the exploit and tools database.
🔸 cxsecurity - free vulnerability database.
🔸 Vulncode-DB - is a database for vulnerabilities and their corresponding source code if available.
🔸 cveapi - free API for CVE data.
▪️ Mobile apps scanners
🔸 ImmuniWeb® Mobile App Scanner - test security and privacy of mobile apps (iOS & Android).
🔸 Quixxi - free Mobile App Vulnerability Scanner for Android & iOS.
🔸 Ostorlab - analyzes mobile application to identify vulnerabilities and potential weaknesses.
▪️ Private Search Engines
🔸 Startpage - the world's most private search engine.
🔸 searX - a privacy-respecting, hackable metasearch engine.
🔸 darksearch - the 1st real Dark Web search engine.
🔸 Qwant - the search engine that respects your privacy.
🔸 DuckDuckGo - the search engine that doesn't track you.
🔸 Swisscows - privacy safe web search
🔸 Disconnect - the search engine that anonymizes your searches.
🔸 MetaGer - the search engine that uses anonymous proxy and hidden Tor branches.
▪️ Secure Webmail Providers
🔸 CounterMail - online email service, designed to provide maximum security and privacy.
🔸 Mail2Tor - is a Tor Hidden Service that allows anyone to send and receive emails anonymously.
🔸 Tutanota - is the world's most secure email service and amazingly easy to use.
🔸 Protonmail - is the world's largest secure email service, developed by CERN and MIT scientists.
🔸 Startmail - private & encrypted email made easy.
▪️ Crypto
🔸 Keybase - it's open source and powered by public-key cryptography.
▪️ PGP Keyservers
🔸 SKS OpenPGP Key server - services for the SKS keyservers used by OpenPGP.
Systems/Services [TOC]
▪️ Operating Systems
🔸 Slackware - the most "Unix-like" Linux distribution.
🔸 OpenBSD - multi-platform 4.4BSD-based UNIX-like operating system.
🔸 HardenedBSD - HardenedBSD aims to implement innovative exploit mitigation and security solutions.
🔸 Kali Linux - Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.
🔸 Parrot Security OS - cyber security GNU/Linux environment.
🔸 Backbox Linux - penetration test and security assessment oriented Ubuntu-based Linux distribution.
🔸 BlackArch - is an Arch Linux-based penetration testing distribution for penetration testers.
🔸 Pentoo - is a security-focused livecd based on Gentoo.
🔸 Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management.
🔸 Tails - is a live system that aims to preserve your privacy and anonymity.
🔸 vedetta - OpenBSD router boilerplate.
🔸 Qubes OS - is a security-oriented OS that uses Xen-based virtualization.
▪️ HTTP(s) Services
🔸 Varnish Cache - HTTP accelerator designed for content-heavy dynamic web sites.
🔸 Nginx - open source web and reverse proxy server that is similar to Apache, but very light weight.
🔸 OpenResty - is a dynamic web platform based on NGINX and LuaJIT.
🔸 Tengine - a distribution of Nginx with some advanced features.
🔸 Caddy Server - is an open source, HTTP/2-enabled web server with HTTPS by default.
🔸 HAProxy - the reliable, high performance TCP/HTTP load balancer.
▪️ DNS Services
🔸 Unbound - validating, recursive, and caching DNS resolver (with TLS).
🔸 Knot Resolver - caching full resolver implementation, including both a resolver library and a daemon.
🔸 PowerDNS - is an open source authoritative DNS server, written in C++ and licensed under the GPL.
▪️ Other Services
🔸 3proxy - tiny free proxy server.
▪️ Security/hardening
🔸 Emerald Onion - is a 501(c)(3) nonprofit organization and transit internet service provider (ISP).
🔸 pi-hole - the Pi-hole® is a DNS sinkhole that protects your devices from unwanted content.
🔸 maltrail - malicious traffic detection system.
🔸 security_monkey - monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
🔸 firecracker - secure and fast microVMs for serverless computing.
🔸 streisand - sets up a new server running your choice of WireGuard, OpenSSH, OpenVPN, and more.
Networks [TOC]
▪️ Tools
🔸 CapAnalysis - web visual tool to analyze large amounts of captured network traffic (PCAP analyzer).
🔸 netbox - IP address management (IPAM) and data center infrastructure management (DCIM) tool.
▪️ Labs
🔸 NRE Labs - learn automation by doing it. Right now, right here, in your browser.
▪️ Other
🔸 LBNL's Network Research Group - home page of the Network Research Group (NRG).
Containers/Orchestration [TOC]
▪️ CLI Tools
🔸 gvisor - container runtime sandbox.
🔸 ctop - top-like interface for container metrics.
▪️ Web Tools
🔸 Moby - a collaborative project for the container ecosystem to assemble container-based system.
🔸 Traefik - open source reverse proxy/load balancer provides easier integration with Docker and Let's encrypt.
🔸 kong - The Cloud-Native API Gateway.
🔸 rancher - complete container management platform.
🔸 portainer - making Docker management easy.
🔸 nginx-proxy - automated nginx proxy for Docker containers using docker-gen.
▪️ Security
🔸 docker-bench-security - checks for dozens of common best-practices around deploying Docker.
🔸 trivy - vulnerability scanner for containers, suitable for CI.
🔸 Harbor - cloud native registry project that stores, signs, and scans content.
▪️ Manuals/Tutorials/Best Practices
🔸 docker-cheat-sheet - a quick reference cheat sheet on Docker.
🔸 awesome-docker - a curated list of Docker resources and projects.
🔸 docker_practice - learn and understand Docker technologies, with real DevOps practice!
🔸 labs
- is a collection of tutorials for learning how to use Docker with various tools.
🔸 dockerfiles - various Dockerfiles I use on the desktop and on servers.
🔸 kubernetes-the-hard-way - bootstrap Kubernetes the hard way on Google Cloud Platform. No scripts.
🔸 kubernetes-the-easy-way - bootstrap Kubernetes the easy way on Google Cloud Platform. No scripts.
🔸 cheatsheet-kubernetes-A4 - Kubernetes CheatSheets in A4.
🔸 k8s-security - kubernetes security notes and best practices.
🔸 kubernetes-production-best-practices - checklists with best-practices for production-ready Kubernetes.
🔸 kubernetes-production-best-practices - kubernetes security - best practice guide.
🔸 kubernetes-failure-stories - is a compilation of public failure/horror stories related to Kubernetes.
Manuals/Howtos/Tutorials [TOC]
▪️ Shell/Command line
🔸 pure-bash-bible - is a collection of pure bash alternatives to external processes.
🔸 pure-sh-bible - is a collection of pure POSIX sh alternatives to external processes.
🔸 bash-guide - is a guide to learn bash.
🔸 bash-handbook - for those who wanna learn Bash.
🔸 The Bash Hackers Wiki - hold documentation of any kind about GNU Bash.
🔸 Shell & Utilities - describes the commands offered to application programs by POSIX-conformant systems.
🔸 the-art-of-command-line - master the command line, in one page.
🔸 Shell Style Guide - a shell style guide for Google-originated open-source projects.
▪️ Text Editors
🔸 Vim Cheat Sheet - great multi language vim guide.
▪️ Python
🔸 Awesome Python - a curated list of awesome Python frameworks, libraries, software and resources.
🔸 python-cheatsheet - comprehensive Python cheatsheet.
🔸 pythoncheatsheet.org - basic reference for beginner and advanced developers.
▪️ Sed & Awk & Other
🔸 F’Awk Yeah! - advanced sed and awk usage (Parsing for Pentesters 3).
▪️ *nix & Network
🔸 nixCraft - linux and unix tutorials for new and seasoned sysadmin.
🔸 TecMint - the ideal Linux blog for Sysadmins & Geeks.
🔸 Omnisecu - free Networking, System Administration and Security tutorials.
🔸 linux-cheat - Linux tutorials and cheatsheets. Minimal examples. Mostly user-land CLI utilities.
🔸 linuxupskillchallenge - learn the skills required to sysadmin.
🔸 Unix Toolbox - Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users.
🔸 Linux Kernel Teaching - is a collection of lectures and labs Linux kernel topics.
🔸 htop explained - explanation of everything you can see in htop/top on Linux.
🔸 Linux Guide and Hints - tutorials on system administration in Fedora and CentOS.
🔸 strace-little-book - a little book which introduces strace.
🔸 linux-tracing-workshop - examples and hands-on labs for Linux tracing tools workshops.
🔸 http2-explained - a detailed document explaining and documenting HTTP/2.
🔸 http3-explained - a document describing the HTTP/3 and QUIC protocols.
🔸 HTTP/2 in Action - an excellent introduction to the new HTTP/2 standard.
🔸 Let's code a TCP/IP stack - great stuff to learn network and system programming at a deeper level.
🔸 Nginx Admin's Handbook - how to improve NGINX performance, security and other important things.
🔸 nginxconfig.io - NGINX config generator on steroids.
🔸 openssh guideline - is to help operational teams with the configuration of OpenSSH server and client.
🔸 SSH Handshake Explained - is a relatively brief description of the SSH handshake.
🔸 ISC's Knowledgebase - you'll find some general information about BIND 9, ISC DHCP, and Kea DHCP.
🔸 PacketLife.net - a place to record notes while studying for Cisco's CCNP certification.
▪️ Microsoft
🔸 AD-Attack-Defense - attack and defend active directory using modern post exploitation activity.
▪️ Large-scale systems
🔸 The System Design Primer - learn how to design large-scale systems.
🔸 Awesome Scalability - best practices in building High Scalability, High Availability, High Stability, and more.
🔸 Web Architecture 101 - the basic architecture concepts.
▪️ System hardening
🔸 CIS Benchmarks - secure configuration settings for over 100 technologies, available as a free PDF.
🔸 Security Harden CentOS 7 - this walks you through the steps required to security harden CentOS.
🔸 CentOS 7 Server Hardening Guide - great guide for hardening CentOS; familiar with OpenSCAP.
🔸 awesome-security-hardening - is a collection of security hardening guides, tools and other resources.
🔸 The Practical Linux Hardening Guide - provides a high-level overview of hardening GNU/Linux systems.
🔸 Linux Hardening Guide - how to harden Linux as much as possible for security and privacy.
▪️ Security & Privacy
🔸 Hacking Articles - LRaj Chandel's Security & Hacking Blog.
🔸 AWS security tools - make your AWS cloud environment more secure.
🔸 Rawsec's CyberSecurity Inventory - an inventory of tools and resources about CyberSecurity.
🔸 The Illustrated TLS Connection - every byte of a TLS connection explained and reproduced.
🔸 SSL Research - SSL and TLS Deployment Best Practices by SSL Labs.
🔸 SELinux Game - learn SELinux by doing. Solve Puzzles, show skillz.
🔸 Certificates and PKI - everything you should know about certificates and PKI but are too afraid to ask.
🔸 The Art of Subdomain Enumeration - a reference for subdomain enumeration techniques.
🔸 Quitting Google - the comprehensive guide to quitting Google.
▪️ Web Apps
🔸 OWASP - worldwide not-for-profit charitable organization focused on improving the security of software.
🔸 OWASP ASVS 3.0.1 - OWASP Application Security Verification Standard Project.
🔸 OWASP ASVS 3.0.1 Web App - simple web app that helps developers understand the ASVS requirements.
🔸 OWASP ASVS 4.0 - is a list of application security requirements or tests.
🔸 OWASP Testing Guide v4 - includes a "best practice" penetration testing framework.
🔸 OWASP Dev Guide - this is the development version of the OWASP Developer Guide.
🔸 OWASP WSTG - is a comprehensive open source guide to testing the security of web apps.
🔸 OWASP API Security Project - focuses specifically on the top ten vulnerabilities in API security.
🔸 Mozilla Web Security - help operational teams with creating secure web applications.
🔸 security-bulletins - security bulletins that relate to Netflix Open Source.
🔸 API-Security-Checklist - security countermeasures when designing, testing, and releasing your API.
🔸 Enable CORS - enable cross-origin resource sharing.
🔸 Application Security Wiki - is an initiative to provide all application security related resources at one place.
🔸 Weird Proxies - reverse proxy related attacks; it is a result of analysis of various proxies.
🔸 Webshells - great series about malicious payloads.
🔸 Practical Web Cache Poisoning - show you how to compromise websites by using esoteric web features.
🔸 Hidden directories and files - as a source of sensitive information about web application.
🔸 Explosive blog - great blog about cybersec and pentests.
🔸 Security Cookies - this paper will take a close look at cookie security.
🔸 APISecurityBestPractices - help you keep secrets (API keys, db credentials, certificates) out of source code.
▪️ All-in-one
🔸 LZone Cheat Sheets - all cheat sheets.
🔸 Dan’s Cheat Sheets’s - massive cheat sheets documentation.
🔸 Rico's cheatsheets - this is a modest collection of cheatsheets.
🔸 DevDocs API - combines multiple API documentations in a fast, organized, and searchable interface.
🔸 cheat.sh - the only cheat sheet you need.
🔸 gnulinux.guru - collection of cheat sheets about bash, vim and networking.
▪️ Ebooks
🔸 free-programming-books - list of free learning resources in many languages.
▪️ Other
🔸 CTF Series : Vulnerable Machines - the steps below could be followed to find vulnerabilities and exploits.
🔸 50M_CTF_Writeup - $50 million CTF from Hackerone - writeup.
🔸 ctf-tasks - an archive of low-level CTF challenges developed over the years.
🔸 How to start RE/malware analysis? - collection of some hints and useful links for the beginners.
🔸 The C10K problem - it's time for web servers to handle ten thousand clients simultaneously, don't you think?
🔸 How 1500 bytes became the MTU of the internet - great story about the Maximum Transmission Unit.
🔸 poor man's profiler - like dtrace's don't really provide methods to see what programs are blocking on.
🔸 HTTPS on Stack Overflow - this is the story of a long journey regarding the implementation of SSL.
🔸 Julia's Drawings - some drawings about programming and unix world, zines about systems & debugging tools.
🔸 Hash collisions - this great repository is focused on hash collisions exploitation.
🔸 sha256-animation - animation of the SHA-256 hash function in your terminal.
🔸 BGP Meets Cat - after 3072 hours of manipulating BGP, Job Snijders has succeeded in drawing a Nyancat.
🔸 bgp-battleships - playing battleships over BGP.
🔸 What happens when... - you type google.com into your browser and press enter?
🔸 how-web-works - based on the 'What happens when...' repository.
🔸 HTTPS in the real world - great tutorial explain how HTTPS works in the real world.
🔸 Gitlab and NFS bug - how we spent two weeks hunting an NFS bug in the Linux kernel.
🔸 Gitlab melts down - postmortem on the database outage of January 31 2017 with the lessons we learned.
🔸 How To Become A Hacker - if you want to be a hacker, keep reading.
🔸 Operation Costs in CPU - should help to estimate costs of certain operations in CPU clocks.
🔸 Let's Build a Simple Database - writing a sqlite clone from scratch in C.
🔸 simple-computer - great resource to understand how computers work under the hood.
🔸 The story of "Have I been pwned?" - working with 154 million records on Azure Table Storage.
🔸 TOP500 Supercomputers - shows the 500 most powerful commercially available computer systems known to us.
🔸 How to build a 8 GPU password cracker - any "black magic" or hours of frustration like desktop components do.
🔸 CERN Data Centre - 3D visualizations of the CERN computing environments (and more).
🔸 How fucked is my database - evaluate how fucked your database is with this handy website.
🔸 Linux Troubleshooting 101 , 2016 Edition - everything is a DNS Problem...
🔸 Five Whys - you know what the problem is, but you cannot solve it?
🔸 Maersk, me & notPetya - how did ransomware successfully hijack hundreds of domain controllers?
🔸 howhttps.works - how HTTPS works ...in a comic!
🔸 howdns.works - a fun and colorful explanation of how DNS works.
🔸 POSTGRESQLCO.NF - your postgresql.conf documentation and recommendations.
Inspiring Lists [TOC]
▪️ SysOps/DevOps
🔸 Awesome Sysadmin - amazingly awesome open source sysadmin resources.
🔸 Awesome Shell - awesome command-line frameworks, toolkits, guides and gizmos.
🔸 Command-line-text-processing - finding text to search and replace, sorting to beautifying, and more.
🔸 Awesome Pcaptools - collection of tools developed by other researchers to process network traces.
🔸 awesome-ebpf - a curated list of awesome projects relat