// legal hacking knowledge base
h0m1c1deLearn to break things. Legally.
Hands-on tutorials, a battle-tested methodology, copy-paste cheatsheets, and the field notes nobody puts in the courses. For the curious beginner and the seasoned operator alike.
// ls ~
Where to go
Pick a starting point. Each section stands on its own.
- ~/learnLearnCryptography, web vulnerabilities, auth, APIs, algorithms, and how apps are built.
- ~/tutorialsTutorials18 step-by-step guides you can follow in your own lab.
- ~/roadmapRoadmapA trackable path from first VM to professional work.
- ~/methodologyMethodologyThe phases every engagement and CTF box follows.
- ~/cheatsheetCheatsheetSearchable copy-ready commands for recon, admin, logs, forensics, and cloud.
- ~/field-notesField notesTips most courses never mention.
- ~/resourcesResourcesSearchable index of platforms, tools, and references.
- ~/glossaryGlossarySecurity terms in plain English.
// hands-on guides
Tutorials
Step-by-step guides you can follow in your own lab tonight, from building the lab itself to writing reports clients actually act on.
Build Your Hacking Lab
Set up an isolated virtual lab with an attack box and vulnerable targets so you can practice without breaking the law or your home network.
Linux Command Line for Hackers
The shell skills every security tutorial assumes you already have, from navigation and permissions to pipes, processes, and networking.
Bug Bounty Methodology and Responsible Disclosure
How to pick programs, read scope like a lawyer, find bugs others miss, and write reports that get paid instead of closed.
Operator Tradecraft Nobody Teaches You
The unglamorous habits that separate professionals from hobbyists, including session logging, clean environments, note systems, and safe handling of client data.
Writing a Pentest Report People Act On
Structure, severity rating, evidence, and remediation advice that make a report the most valuable thing you deliver.
Think Like a Defender
How blue teams actually see your activity, using logs, ATT&CK mapping, and detection rules, and why understanding them makes you a far better tester.
// in-browser utilities
Toolkit
The small tools you reach for constantly. Everything runs client-side, nothing you paste leaves your browser.
- $ ./encodeEncoder / Decoder ↗
- $ ./jwt --inspectJWT Decoder ↗
- $ ./hashidHash Identifier ↗
- $ ./cvss --scoreCVSS 3.1 Calculator ↗
- $ ./ipcalcSubnet Calculator ↗
- $ ./dig --explainDNS Lookup ↗
- $ ./headers --gradeSecurity Header Grader ↗
- $ ./hashgenHash Generator ↗
- $ ./epochTimestamp Converter ↗
- $ ./baseNumber Base Converter ↗
- $ ./chmod --explainChmod Calculator ↗
- $ ./passgenPassword Generator & Strength ↗
- $ ./ports --lookupPort Reference ↗
- $ ./urlparseURL Inspector ↗
- $ ./csp --auditCSP Analyzer ↗
- $ ./mailtraceEmail Header Analyzer ↗
- $ ./xor --bruteCipher Workbench ↗
- $ ./x509 --decodeCertificate Decoder ↗