Awesome-Hacking-Resources

vitalysimGPL-3.0更新放缓 有专家点评

汇集渗透测试与黑客攻防的学习资源清单,涵盖漏洞利用、提权、逆向工程和 CTF 等方向,方便安全从业者按主题查找资料。

A collection of hacking / penetration testing resources to make you better!

暂无版本17,631star +10 / 7 天2,231fork同步于 2026-11-11 05:23 UTC

专家点评

上手难度:入门更新于 2026-11-11

一份按主题索引的渗透测试与红队学习资源清单,用来替代你自己攒的浏览器书签夹

适用场景

  • 新人入门定向:需要一条从缓冲区溢出、逆向到提权的学习路径时,按主题分类的清单能省掉在搜索引擎里筛垃圾链接的时间,代价是链接质量得自己复核。
  • 准备 OSCP/CTF 类考试:找靶场和练习平台入口时,清单里集中了在线课程与练习平台,比逐个社区帖子翻要快。
  • 搭建内部安全培训材料:给团队整理阅读/观看列表时,会议演讲和 YouTube 频道部分可以直接作为候选池,再人工筛。
  • 查 AI 红队方向入口:这块单独成类,省得在通用安全清单里翻找,但收录深度有限。

踩坑

  • 这是纯链接清单,没有代码可装,clone 下来只是拿到一堆 URL;期望 git clone 后能跑东西的人会直接撞墙。
  • 链接腐化是这类仓库的常态:issue 里反复出现失效站点(如 dvwa.co.uk 这类老域名)的报告,用之前要自己点一遍。
  • issue 区混入大量与项目无关的请求(求带、问某应用怎么入侵),说明维护者对新贡献的筛选并不严格,别把清单当权威信源。

同类对比

同类可看 payloadbox、OWASP 官方测试指南、HackTricks;如果你要的是可执行工具而非链接集合,直接去 Kali 工具列表或各工具自己的仓库。

怎么上手

由 README 提炼,执行前请确认
README 未说明
硬件要求按 README 说明

README 未说明

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

由 README 自动翻译提炼

一份精选的黑客、渗透测试与 AI 红队资源清单,帮你快速找到学习与实战入口

汇集渗透测试与黑客攻防的学习资源清单,涵盖漏洞利用、提权、逆向工程和 CTF 等方向,方便安全从业者按主题查找资料。

核心能力

  • 按学习、YouTube、逆向、提权、OSINT 等主题分类整理资源
  • 收录在线课程、靶场与练习平台链接
  • 汇总安全会议演讲与 YouTube 频道视频资源
  • 覆盖 AI 安全与 AI 红队方向资源
  • 附带独立 tools 工具清单,欢迎社区贡献

容易踩的坑

本项目是资源链接清单,不含可安装的代码或工具;部分资源需注册账号或自行部署虚拟机靶场

内容由模型根据 README 生成,可能不完整或不准确,以官方文档为准。看原文 README

最近发版

0 个版本

暂无 release 数据(可能没有发版,或尚未同步)。

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    We also maintain a companion tools list — contributions welcome there too.

    Table of Contents

    📚 Learning the Skills

    NameDescription
    CS 642: Intro to Computer Securityacademic content, full semester course, includes assigned readings, homework and github refs for exploit examples. NO VIDEO LECTURES.
    CyberSec WTFCyberSec WTF Web Hacking Challenges from Bounty write-ups
    Cybrarycoursera style website, lots of user-contributed content, account required, content can be filtered by experience level
    Free Cyber Security TrainingAcademic content, 8 full courses with videos from a quirky instructor sam, links to research, defcon materials and other recommended training/learning
    Hak5podcast-style videos covering various topics, has a forum, "metasploit-minute" video series could be useful
    Hopper's Roppers Security TrainingFour free self-paced courses on Computing Fundamentals, Security, Capture the Flags, and a Practical Skills Bootcamp that help beginners build a strong base of foundational knowledge. Designed to prepare for students for whatever they need to learn next.
    Mind MapsInformation Security related Mind Maps
    MIT OCW 6.858 Computer Systems Securityacademic content, well organized, full-semester course, includes assigned readings, lectures, videos, required lab files.
    OWASP top 10 web security risksfree courseware, requires account
    Seed Labsacademic content, well organized, featuring lab videos, tasks, needed code files, and recommended readings
    TryHackMeDesigned prebuilt challenges which include virtual machines (VM) hosted in the cloud ready to be deployed

    🎥 YouTube Channels

    NameDescription
    0patch by ACROS Securityfew videos, very short, specific to 0patch
    BlackHatfeatures talks from the BlackHat conferences around the world
    Christiaan008hosts a variety of videos on various security topics, disorganized
    Companies
    Detectifyvery short videos, aimed at showing how to use Detictify scanner
    Hak5see Hak5 above
    Kaspersky Lablots of Kaspersky promos, some hidden cybersecurity gems
    Metasploitcollection of medium length metasploit demos, ~25minutes each, instructional
    ntopnetwork monitoring, packet analysis, instructional
    nVisiumSome nVisum promos, a handful of instructional series on Rails vulns and web hacking
    OpenNSMnetwork analysis, lots of TCPDUMP videos, instructional,
    OWASPsee OWASP above
    Rapid7brief videos, promotional/instructional, ~ 5 minutes
    Securelistbrief videos, interviews discussing various cyber security topics
    Segment Securitypromo videos, non-instructional
    SocialEngineerOrgpodcast-style, instructional, lengthy content ~1 hr each
    Sonatypelots of random videos, a good cluster of DevOps related content, large range of lengths, disorganized
    SophosLabslots of brief, news-style content, "7 Deadly IT Sins" segment is of note
    Sourcefirelots of brief videos covering topics like botnets, DDoS ~5 minutes each
    Station Xhandful of brief videos, disorganized, unscheduled content updates
    Synackrandom, news-style videos, disorganized, non-instructional
    TippingPoint Zero Day Initiativevery brief videos ~30 sec, somewhat instructional
    Tripwire, Inc.some tripwire demos, and random news-style videos, non-instructional
    Vincent Yiuhandful of videos from a single hacker, instructional
    Conferences
    44contvin
    MIT OCW 6.858 Computer Systems SecurityInformation security con based in London, lengthy instructional videos
    BruCON Security Conferencesecurity and hacker conference based in b\Belgium, lots of lengthy instructinoal videos
    BSides Manchestersecurity and hacker con based in Mancheseter, lots of lengthy videos
    BSidesAugustasecurity con based in Augusta, Georgia, lots of lengthy instructional videos
    CarolinaConsecurity con based in North Carolina, associated with various 2600 chapters, lots of lengthy instructional content
    Cort Johnsona handful of lengthy con-style talks from Hack Secure Opensec 2017
    DevSecConlenghty con videos covering DevSecOps, making software more secure
    Garage4Hackers - Information Securitya handful of lengthy videos, About section lacks description
    HACKADAYlots of random tech content, not strictly infosec, some instructional
    Hack In The Box Security Conferencelengthy con-style instructional talks from an international security con
    Hack in Parissecurity con based in paris, features lots of instructional talks, slides can be difficult to see.
    Hacklulots of lengthy con-style instructional videos
    Hacktivitylots of lengthy con-style instructional videos from a con in central/eastern europe
    Hardwear.iohandful of lengthy con-style video, emphasis on hardware hacks
    IEEE Symposium on Security and Privacycontent from the symposium; IEEE is a professional association based in the us, they also publish various journals
    LASCONlengthy con-style talks from an OWASP con held in Austin, TX
    leHACKleHACK is the oldest ( 2003 ), leading, security conference in Paris, FR
    Marcus Niemietzlots of instructional content, associated with HACKPRA, an offensive security course from an institute in Germany
    Media.ccc.deThe real official channel of the chaos computer club, operated by the CCC VOC - tons of lengthy con-style vids
    NorthSeclengthy con-style talks from an applied security conference in Canada
    Pancake Nopcodechannel of Radare2 whiz Sergi "pancake" Alvarez, Reverse Engineering Content
    Psiinonmedium length instructional videos, for the OWASP Zed Attack Proxy
    SJSU Infosechandful of lengthy instructional videos from San Jose State university Infosec
    Secappdev.orgtons of lengthy instructional lectures on Secure App Development
    Security Festmedium length con-style talks from a security festival in Sweden
    SecurityTubeConsan assortment of con-style talks from various cons including BlackHat and Shmoocon
    ToorConhandful of medium length con videos from con based in San Diego, CA
    USENIX Enigma Conferencemedium length "round table discussion with leading experts", content starts in 2016
    ZeroNightsa lot of con-style talks from international conference ZeroNights
    News
    0x41414141Channel with couple challenges, well explained
    Adrian Crenshawlots of lengthy con-style talks
    Corey Nachreinersecurity newsbites, 2.7K subscribers, 2-3 videos a week, no set schedule
    BalCCon - Balkan Computer CongressLong con-style talks from the Balkan Computer Congress, doesn't update regularly
    danooct1lots of brief screenshot, how-to vids regarding malware, regular content updates, 186K followerss
    DedSeclots of brief screenshot how-to vids based in Kali, no recent posts.
    DEFCON Conferencelots of lengthy con-style vids from the iconical DEFCON
    DemmSeclots of pen testing vids, somewhat irregular uploads, 44K followers
    Derek Rook - CTF/Boot2root/wargames Walkthroughlots of lengthy screenshot instructional vids, with
    Don Does 30amateur pen-tester posting lots of brief screenshot vids regularly, 9K Followers
    Error 404 Cyber Newsshort screen-shot videos with loud metal, no dialog, bi-weekly
    Geeks Fort - KIFlots of brief screenshot vids, no recent posts
    GynvaelENSecurity streams from Google Researcher. Mainly about CTFs, computer security, programing and similar things.
    HackerSploitregular posts, medium length screenshot vids, with dialog
    HACKING TUTORIALShandful of brief screenshot vids, no recent posts.
    iExplo1tlots of screenshot vids aimed at novices, 5.7K Followers, no recent posts
    JackkTutorialslots of medium length instructional vids with some AskMe vids from the youtuber
    John HammondSolves CTF problems. contains penTesting tips and tricks
    LionSeclots of brief screenshot instructional vids, no dialog
    LiveOverflowLots of brief-to-medium instructional vids, covering things like buffer overflows and exploit writing, regular posts.
    Metasploitationlots of screenshot vids, little to no dialogue, all about using Metasploit, no recent vids.
    NetSecNowchannel of pentesteruniversity.org, seems to post once a month, screenshot instructional vids
    Open SecurityTraininglots of lengthy lecture-style vids, no recent posts, but quality info.
    Pentester Academy TVlots of brief videos, very regular posting, up to +8 a week
    Penetration Testing in LinuxDELETE
    rwbnetseclots of medium length instructional videos covering tools from Kali 2.0, no recent posts.
    Samy Kamkar's Applied Hackingbrief to medium length instructional vids from the creator of PoisonTap for the Raspberry Pi Zero, no recent content, last updated in 2016
    SecureNinjaTVbrief news bites, irregular posting, 18K followers
    Security Weeklyregular updates, lengthy podcast-style interviews with industry pros
    Seytonicvariety of DIY hacking tutorials, hardware hacks, regular updates
    Shozab Haxorlots of screenshot style instructional vids, regular updates, windows CLI tutorial
    SSTec Tutorialslots of brief screenshot vids, regular updates
    Tradecraft Security WeeklyWant to learn about all of the latest security tools and techniques?
    Troy Huntlone youtuber, medium length news videos, 16K followers, regular content
    Waleed Juttlots of brief screenshot vids covering web security and game programming
    webpwnizedlots of brief screenshot vids, some CTF walkthroughs
    Zer0Mem0rylots of brief c++ security videos, programming intensive
    LionSeclots of brief screenshot instructional vids, no dialog
    Adrian Crenshawlots of lengthy con-style talks
    HackerSploitregular posts, medium length screenshot vids, with dialog
    Derek Rook - CTF/Boot2root/wargames Walkthroughlots of lengthy screenshot instructional vids, with
    Tradecraft Security WeeklyWant to learn about all of the latest security tools and techniques?
    IPPSecHackthebox.eu retired machine vulnerable machine walkthroughs to help you learn both basic and advanced processes and techniques
    The Daily SwigLatest Cybersecurity News
    Awesome Worldwide ITSec Specialistscurated index of non-English-speaking IT security YouTubers and creators

    🎯 Sharpening Your Skills

    NameDescription
    The cryptopals crypto challengesA bunch of CTF challenges, all focused on cryptography.
    Crackmes.oneThis is a simple place where you can download crackmes to improve your reverse engineering skills.
    CTFLearnan account-based ctf site, where users can go in and solve a range of challenges
    CTFs write-upsa collection of writeups from various CTFs, organized by
    CTF365account based ctf site, awarded by Kaspersky, MIT, T-Mobile
    The enigma groupweb application security training, account based, video tutorials
    Exploit exerciseshosts 5 fulnerable virtual machines for you to attack, no account required
    Google CTFSource code of Google 2017, 2018 and 2019 CTF
    Google CTF 20192019 edition of the Google CTF contest
    Google's XSS gameXSS challenges, and potentially a chance to get paid!
    Hack The BoxPen testing labs hosting over 39 vulnerable machines with two additional added every month
    Hacker testsimilar to "hackthissite", no account required.
    Hacksplaininga clickthrough security informational site, very good for beginners.
    hackburger.eehosts a number of web hacking challenges, account required
    Hack this site!an oldy but goodie, account required, users start at low levels and progress in difficulty
    Lin.securityPractice your Linux privilege escalation
    Over the wireA CTF that's based on progressive levels for each lab, the users SSH in, no account recquired
    Participating Challenge Sitesaims at creating a universal ranking for CTF participants
    PentesterLabhosts a variety of exercises as well as various "bootcamps" focused on specific activities
    Pentest.traininglots of various labs/VMS for you to try and hack, registry is optional.
    PicoCTFCTF hosted by Carnegie Mellon, occurs yearly, account required.
    pwnable.krDon't let the cartoon characters fool you, this is a serious CTF site that will teach you a lot, account required
    pwnable.twhosts 27 challenges accompanied with writeups, account required
    Ringzer0 Teaman account based CTF site, hosting over 272 challenges
    ROP EmporiumReturn Oriented Programming challenges
    SmashTheStackhosts various challenges, similar to OverTheWire, users must SSH into the machines and progress in levels
    Vulnhubsite hosts a ton of different vulnerable Virtual Machine images, download and get hacking
    websec.frFocused on web challenges, registration is optional.
    tryhackmeAwesome platform to start learning cybersecurity, account is needed
    webhacking.krlots of web security challenges are available, recommended for beginners. You need to solve a simple challenge to sign up.
    Stripe CTF 2.0Past security contest where you can discover and exploit vulnerabilities in mock web applications.
    Windows / Linux Local Privilege Escalation WorkshopPractice your Linux and Windows privilege escalation
    Hacking ArticlesCTF Brief Write up collection with a lot of screenshots good for begginers
    Hacker101 CTFCTF hosted by HackerOne, always online. You will receive invitations to some private programs on HackerOne platform as a reward.
    Hacking LabEuropean platform hosting lots of riddles, challenges and competitions
    Portswigger Web Security AcademyBest free platform for learning web pentesting, account required
    CTF 101Intro guide to CTFs covering common categories (crypto, forensics, web, pwn, RE) with worked examples
    Hopper's Roppers CTFSelf-paced CTF course companion to the Hopper's Roppers training
    HTB WriteupsThe most comprehensive Hack The Box writeup collection with 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, and cheatsheets

    🧬 Reverse Engineering, Buffer Overflow and Exploit Development

    NameDescription
    A Course on Intermediate Level Linux Exploitationas the title says, this course isn't for beginners
    Binary hacking35 "no bullshit" binary videos along with other info
    Corelan tutorialsdetailed tutorial, lots of good information about memory
    Exploit tutorialsa series of 9 exploit tutorials,also features a podcast
    Exploit developmentlinks to the forum's exploit dev posts, quality and post style will vary with each poster
    flAWS challengeThrough a series of levels you'll learn about common mistakes and gotchas when using Amazon Web Services (AWS).
    Introduction to ARM Assembly Basicstons of tutorials from infosec pro Azeria, follow her on twitter
    Introductory Intel x8663 days of OS class materials, 29 classes, 24 instructors, no account required
    Linux (x86) Exploit Development Seriesblog post by sploitfun, has 3 different levels
    Megabeets journey into Radare2one user's radare2 tutorials
    Modern Binary Exploitation - CSCI 4968RE challenges, you can download the files or download the VM created by RPISEC specifically for challenges, also links to their home page with tons of infosec lectures
    Recon.cx - reversing conferencethe conference site contains recordings and slides of all talks!!
    Reverse Engineering for Beginnershuge textbook, created by Dennis Yurichev, open-source
    Reverse engineering reading lista github collection of RE tools and books
    Reverse Engineering challengescollection of challenges from the writer of RE for Beginners
    Reverse Engineering for Beginners (book site)official site for Dennis Yurichev's book, all formats and source available
    Reverse Engineering Malware 101intro course created by Malware Unicorn, complete with material and two VM's
    Reverse Engineering Malware 102the sequel to RE101
    reversing.kr challengesreverse engineering challenges varying in difficulty
    Shell stormBlog style collection with organized info about Rev. Engineering.
    Shellcode Injectiona blog entry from a grad student at SDS Labs
    Micro Corruption — AssemblyCTF designed to learn Assembly by practicing

    ⬆️ Privilege Escalation

    NameDescription
    A GUIDE TO LINUX PRIVILEGE ESCALATIONBasics of Linux privilege escalation
    Abusing SUDO (Linux Privilege Escalation)Abusing SUDO (Linux Privilege Escalation)
    AutoLocalPrivilegeEscalationautomated scripts that downloads and compiles from exploitdb
    Basic linux privilege escalationbasic linux exploitation, also covers Windows
    Windows Local Privilege Escalation (HackTricks)Comprehensive, up-to-date checklist of Windows privilege escalation vectors
    Editing /etc/passwd File for Privilege EscalationEditing /etc/passwd File for Privilege Escalation
    Linux Privilege Escalation Linux Privilege Escalation – Tradecraft Security Weekly (Video)
    Linux Privilege Escalation Check Scripta simple linux PE check script
    Linux Privilege Escalation Scriptsa list of PE checking scripts, some may have already been covered
    Linux Privilege Escalation Using PATH VariableLinux Privilege Escalation Using PATH Variable
    Linux Privilege Escalation using Misconfigured NFSLinux Privilege Escalation using Misconfigured NFS
    Linux Privilege Escalation via Dynamically Linked Shared Object LibraryHow RPATH and Weak File Permissions can lead to a system compromise.
    Local Linux Enumeration & Privilege Escalation Cheatsheetgood resources that could be compiled into a script
    PEASS-ng (Privilege Escalation Awesome Scripts)actively maintained privilege escalation enumeration scripts for Windows, Linux, and macOS
    Linux Privilege Escalation (HackTricks)extensive, maintained reference covering common Linux privilege escalation methods with examples
    RootHelpera tool that runs various enumeration scripts to check for privilege escalation
    Unix privesc checkera script that checks for PE vulnerabilities on a system
    Windows exploits, mostly precompiled.precompiled windows exploits, could be useful for reverse engineering too
    Windows Privilege Escalationcollection of wiki pages covering Windows Privilege escalation
    Windows privilege escalation checkera list of topics that link to pentestlab.blog, all related to windows privilege escalation
    Windows Privilege Escalation Fundamentalscollection of great info/tutorials, option to contribute to the creator through patreon, creator is an OSCP
    Windows Privilege Escalation GuideWindows Privilege Escalation Guide
    Windows Privilege Escalation Methods for PentestersWindows Privilege Escalation Methods for Pentesters

    🕵️ OSINT

    NameDescription
    theHarvesterE-mail, subdomain, host and people-name harvester using public sources
    Maltego CEGraph-based link-analysis platform for OSINT and forensics; Community Edition is free
    Recon-ngFull-featured web reconnaissance framework written in Python
    SpiderFootAutomated OSINT collection with 200+ modules and a web UI
    Intel Techniques ToolsMichael Bazzell's hosted search tools for people, social, images, geo
    Google Hacking DatabaseExploit-DB's curated Google dorks database for recon
    github-dorksCLI tool to scan GitHub repos/orgs for sensitive information leaks
    metagoofilExtracts metadata from public documents (PDF, DOC, XLS) belonging to a target
    SherlockHunt usernames across 400+ social networks
    MaigretSherlock-style username enumeration across 3000+ sites with profile-data extraction
    HoleheCheck if an email is used on 120+ sites via password-reset flows
    GHuntOSINT toolkit for investigating Google accounts (Gmail, Drive, Calendar exposure)
    BlackbirdFast username and email OSINT search across 600+ services
    h8mailEmail OSINT and breach-credential hunting (HIBP, Snusbase, Leak-Lookup integrations)
    PhoneInfogaAdvanced OSINT framework for scanning international phone numbers
    PhotonFast web crawler that extracts URLs, emails, secrets, and intel for recon
    AmassOWASP project for in-depth attack-surface mapping and external asset discovery
    SubfinderFast passive subdomain enumeration using public sources
    cloud_enumEnumerate public resources in AWS, Azure, and GCP for a target keyword
    reconFTWEnd-to-end recon automation chaining 50+ tools for subdomains, vulns, and OSINT
    IntelOwlOSINT solution that aggregates 100+ analyzers (threat intel, malware, observables)
    OSINT FrameworkWeb-based directory of OSINT resources organised by data type
    Bellingcat Online Investigation ToolkitBellingcat's curated, regularly updated toolkit and how-to guides
    Have I Been PwnedCheck whether emails/usernames appear in known data breaches
    Hunter.ioFind and verify professional email addresses tied to a domain
    Carbon14OSINT tool for estimating the age of web pages from HTTP metadata

    🦠 Malware Analysis

    NameDescription
    Malware traffic analysislist of traffic analysis exercises
    Malware Analysis - CSCI 4976another class from the folks at RPISEC, quality content

    🤖 AI Security / AI Red Teaming

    Learning the Skills
    NameDescription
    HTB AI Red Teamer PathHack The Box's offensive AI job-role path (built with Google). Modules on prompt injection, model privacy attacks, adversarial AI, supply chain, deployment threats. Hands-on labs against real systems.
    Offensive Frameworks & Knowledge Bases
    NameDescription
    OWASP Top 10 for LLM ApplicationsCanonical attack-class taxonomy: prompt injection, sensitive info disclosure, supply chain, model poisoning, excessive agency, system prompt leakage, and more.
    OWASP ML Security Top 10Sibling project focused on attacks against ML pipelines.
    MITRE ATLASAdversarial threat matrix for AI systems (16 tactics, 84 techniques, real-world case studies). The ATT&CK for AI.
    Tools (Offensive)
    NameDescription
    GarakMost mature open-source LLM vulnerability scanner. Probes for prompt injection, jailbreaks, data leakage, hallucination, toxicity.
    PyRITMicrosoft's Python Risk Identification Tool for generative AI; supports multi-turn attack orchestration.
    PromptfooLLM red-team + eval framework with 100+ attack types.
    DeepTeamRed-team framework mapped to OWASP LLM Top 10; 50+ vulnerabilities, 20+ adversarial methods.
    LLMFuzzerFuzzing framework specifically for LLM integrations.
    promptmapPrompt-injection vulnerability scanner.
    Adversarial Robustness Toolbox (ART)Linux Foundation library covering evasion, poisoning, extraction, and inference attacks across all major ML frameworks.
    CleverHansClassic library for crafting adversarial examples against image models.
    AI Exploits (Protect AI)Collection of real, working exploits for vulnerabilities found in AI/ML tools and platforms.
    Sharpening Your Skills
    NameDescription
    Gandalf (Lakera)7-level prompt-injection challenge; the "OverTheWire" of LLM hacking.
    HackAPromptCompetitive prompt-injection CTF; dataset of 600k+ real jailbreak submissions.
    Dreadnode CrucibleFree open AI red-team CTF platform with challenges across many difficulties and domains.
    0DIN (Mozilla)Gamified AI CTF training community on prompt injection and jailbreaking against interactive AI characters.
    huntrBug bounty platform with an active AI/ML category targeting real models and CVEs.
    Reading & Research
    NameDescription
    Embrace The RedJohann Rehberger's blog; deep, practical write-ups of real-world LLM and agent exploitation.
    Simon Willison — prompt injectionRunning commentary from the person who coined the term; tracks every novel technique.
    0DIN BlogDisclosures and write-ups of real AI vulnerabilities from Mozilla's bug-bounty program.
    Indirect Prompt Injection (Greshake et al.)Canonical research repo for indirect prompt injection.
    HackerOne x HTB AI Red Team CTF debriefLessons from 200+ players in a live LLM jailbreak CTF, mapped to OWASP LLM Top 10.
    Awesome Lists
    NameDescription
    corca-ai/awesome-llm-securityMost-starred LLM security awesome list.
    PromptLabs/Prompt-Hacking-ResourcesFocused specifically on red teaming, jailbreaks, prompt injection.
    jiep/offensive-ai-compilationOffense-oriented curation: AI-powered attacks, plus attacks against AI.

    🛰️ Network Scanning / Reconnaissance

    NameDescription
    Foot Printing with WhoIS/DNS recordsa white paper from SANS
    Google Dorks/Google Hackinglist of commands for google hacks, unleash the power of the world's biggest search engine

    🌐 Vulnerable Web Application

    NameDescription
    bWAPPcommon buggy web app for hacking, great for beginners, lots of documentation
    Damn Small Vulnerable Webwritten in less than 100 lines of code, this web app has tons of vulns, great for teaching
    Damn Vulnerable Web Application (DVWA)PHP/MySQL web app for testing skills and tools
    Google Gruyerehost of challenges on this cheesy web app
    OWASP Broken Web Applications Projecthosts a collection of broken web apps
    OWASP Hackademic Challenges projectweb hacking challenges
    OWASP Mutillidae IIanother OWASP vulnerable app, lots of documentation.
    OWASP Juice Shopcovers the OWASP top 10 vulns
    WebGoat: A deliberately insecure Web Applicationmaintained by OWASP and designed to to teach web app security

    🖥️ Vulnerable OS

    NameDescription
    General Test Environment Guidancewhite paper from the pros at rapid7
    Metasploitable2 (Linux)vulnerable OS, great for practicing hacking
    Metasploitable3 [Installation]the third installation of this vulnerable OS
    Vulnhubcollection of tons of different vulnerable OS and challenges

    🐧 Linux Penetration Testing OS

    NameDescription
    BackBoxopen source community project, promoting security in IT enivornments
    BlackArchArch Linux based pentesting distro, compatible with Arch installs
    Bugtraqadvanced GNU Linux pen-testing technology
    Docker for pentestImage with the more used tools to create a pentest environment easily and quickly.
    Kalithe infamous pentesting distro from the folks at Offensive Security
    LionSec Linuxpentesting OS based on Ubuntu
    Parrot Debian includes full portable lab for security, DFIR, and development
    Pentoopentesting OS based on Gentoo

    💥 Exploits

    NameDescription
    0day.todayEasy to navigate database of exploits
    Exploit Databasedatabase of a wide variety exploits, CVE compliant archive
    CXsecurityIndie cybersecurity info managed by 1 person
    Snyk Vulnerability DBdetailed info and remediation guidance for known vulns, also allows you to test your code

    💬 Forums

    NameDescription
    0x00sechacker, malware, computer engineering, Reverse engineering
    CODEBY.NEThacker, WAPT, malware, computer engineering, Reverse engineering, forensics - russian based forum
    Greysechacking and security forum
    Hackforumsposting webstite for hacks/exploits/various discussion

    🎬 Archived Security Conference Videos

    NameDescription
    InfoCon.orghosts data from hundreds of cons
    IrongeekWebsite of Adrien Crenshaw, hosts a ton of info.
    infocondb.orga site that aims to catalog and cross-reference all hacker conferences.

    👥 Online Communities

    NameDescription
    Hacktodayrequires an account, covering all kinds of hacking topics
    Hack+link requires telegram to be used
    MPGHcommunity of MultiPlayerGameHacking

    📰 Online News Sources

    NameDescription
    InfoSeccovers all the latest infosec topics
    Hashes.com Hash Lookupgreat place to lookup hashes against known cracked/leaked sets
    Security Intellcovers all kinds of news, great intelligence resources
    Threatpostcovers all the latest threats and breaches
    Secjuice
    The Hacker Newsfeatures a daily stream of hack news, also has an app
    Infostealers by Hudson Rockall-around hub with news and publications about Infostealers

    Contributors

    Thanks to everyone who has contributed resources, fixes, and reviews.

    Star History

    Star History Chart

    License

    Released under GPL-3.0.