Resource index

Retired and active machines, Pro Labs, and the HTB Academy course catalog.

Browser-based guided rooms and learning paths for beginners through intermediate.

The best free web hacking curriculum, with hundreds of interactive labs.

Classic SSH wargames. Start with Bandit to learn Linux fundamentals.

Carnegie Mellon's beginner-friendly CTF with a year-round practice gym.

ASU's structured course on binary exploitation and systems security.

Hundreds of challenges across web, crypto, forensics, and app-system.

Exercise-driven web and code review training with badges per topic.

Downloadable vulnerable VMs for offline boot-to-root practice.

HackerOne's free video lessons and CTF that can earn you private program invites.

VMs for learning memory corruption, format strings, and exploit development.

Calendar, team rankings, and writeups for every major CTF.

Modern, deliberately insecure web app covering the full OWASP Top 10.

Damn Vulnerable Web Application. PHP and MySQL with adjustable difficulty.

Completely Ridiculous API, built to teach the OWASP API Security Top 10.

Game of Active Directory. A multi-domain AD lab for attack practice.

Rapid7's intentionally vulnerable Linux VM for exploitation practice.

Vulnerable-by-design AWS scenarios deployed to your own account.

The industry-standard intercepting proxy. Community edition is free.

Open source intercepting proxy and automated scanner.

Fast web fuzzer for content discovery, vhosts, and parameters.

Automatic SQL injection detection and exploitation.

Template-driven vulnerability scanner with a large community template set.

The canonical awareness list of critical web application risks.

Web Security Testing Guide. A complete web pentest methodology.

Lightweight, modern web security auditing toolkit and Burp alternative.

Test and analyze JSON Web Tokens for common misconfigurations.

Payloads and bypasses for every common web vulnerability class.

Network discovery and port scanning, plus the NSE scripting engine.

In-depth attack surface mapping and subdomain enumeration.

Fast passive subdomain discovery from dozens of sources.

Gathers emails, names, hosts, and subdomains from public sources.

Search engine for internet-connected devices and exposed services.

Certificate Transparency log search for finding subdomains.

Fast HTTP prober for titles, status codes, and tech detection across many hosts.

Historical snapshots reveal old endpoints, parameters, and forgotten files.

A browsable tree of OSINT tools organized by data type.

The exploitation framework. Modules, payloads, and post-exploitation.

Archive of public exploits and proof-of-concept code, searchable with searchsploit.

Python classes and scripts for Windows network protocols.

Network execution tool for SMB, LDAP, WinRM, and more. Successor to CrackMapExec.

Graph-based Active Directory and Entra ID attack path analysis.

LinPEAS and WinPEAS privilege escalation enumeration scripts.

Unix binaries that can bypass local security restrictions.

Living Off The Land binaries and scripts for Windows.

NSA's open source reverse engineering suite with a solid decompiler.

Modern RE platform with a clean API. Free cloud version available.

Open source GUI reverse engineering platform powered by Rizin.

Open source x64 and x32 debugger for Windows.

GDB Enhanced Features for exploit development and reversing.

Python CTF framework and exploit development library.

An intro to binary exploitation and RE built around past CTF challenges.

The cyber Swiss army knife for encoding, decoding, and data analysis.

Fun, progressive challenges for learning modern cryptography attacks.

World's fastest GPU password recovery tool.

Versatile password cracker with many format converters (*2john).

The wordlist collection: usernames, passwords, URLs, fuzzing payloads.

Knowledge base of adversary tactics and techniques.

The network protocol analyzer for packet capture and inspection.

Memory forensics framework for Windows, Linux, and macOS images.

Digital forensics platform and GUI for The Sleuth Kit.

Generic detection rule format with a large open rule repository.

Blue team labs for DFIR, threat hunting, and SOC analysis.

Defensive challenges and investigations in a gamified format.

MASVS and MASTG. The mobile app security standard and testing guide.

Dynamic instrumentation toolkit for hooking apps at runtime.

Runtime mobile exploration powered by Frida. No jailbreak required.

Dex to Java decompiler for Android APKs.

Automated static and dynamic analysis for Android and iOS apps.

A series of AWS misconfiguration challenges served from S3.

AWS exploitation framework for offensive cloud assessments.

Open source security auditing for AWS, Azure, GCP, and Kubernetes.

Cloud and CI/CD pentesting techniques across every major provider.

Massive wiki of pentesting techniques organized by service and platform.

Clear, well-sourced recipes, especially strong on Active Directory.

Generate reverse and bind shell one-liners for your engagement.

NIST's National Vulnerability Database for CVE details and scoring.

Detailed writeups for nearly every Hack The Box machine.

Search IppSec's videos by technique to find exactly where it is used.

Largest bug bounty platform. Hacktivity is a goldmine of disclosed reports.

Bug bounty and VDP programs with a published vulnerability taxonomy.

European bug bounty platform, known for its monthly XSS challenges.

Global bug bounty platform with a free training Dojo.

Methodical Hack The Box walkthroughs. The gold standard.

Deep, curious explorations of binary exploitation and web security.

CTF walkthroughs, malware analysis, and security news.

Cutting-edge web attack research from the Burp Suite team.

In-depth vulnerability research from Google's elite team.

Long-running weekly security news podcast for practitioners.

Bug bounty podcast by and for full-time hunters.

True stories from the dark side of the internet.

OffSec's well-known 24-hour practical penetration testing exam.

Course paths leading to the CPTS, CBBH, and CDSA certifications.

TCM Security's practical network pentest exam with a report and debrief.

SANS-aligned certifications across offense, defense, and forensics.

Home of the OWASP Top 10 for LLM Applications and agentic AI guidance.

ATT&CK-style knowledge base of adversary techniques against AI systems.

Game that teaches prompt injection by tricking an LLM into revealing a password.

NVIDIA's LLM vulnerability scanner for probing models you are testing.

Microsoft's framework for red teaming generative AI systems.

Suite for auditing Wi-Fi networks you own: monitoring, capture, and analysis.

Wireless network and device detector, sniffer, and WIDS.

Makers of HackRF One and other open source radio and USB hardware.

Open source toolchain for learning side-channel and fault injection attacks.

Firmware analysis tool for finding and extracting embedded files.

OpenZeppelin's wargame of vulnerable Solidity contracts.

Offensive security challenges for DeFi protocols.

Static analyzer for Solidity from Trail of Bits.

Fast Solidity toolkit for testing, fuzzing, and writing proofs of concept.

Jon Erickson's classic on how exploits really work at the memory level.

Build your own security tools in Python, from sniffers to proxies.

Peter Yaworski walks through paid bug bounty reports by vulnerability class.

The standard text on dissecting malicious software safely.

Beginner-friendly Linux, networking, and scripting with a security focus.

The most widely used penetration testing distribution.

Debian-based security distro with a lighter footprint.

Linux toolkit for reverse engineering and analyzing malware.

Mandiant's Windows setup scripts for malware analysis VMs.