Resources

Cybersecurity Resources

A curated collection of cybersecurity ethics, law, privacy, compliance, and governance references; certification and guided-learning materials; educators and video channels; security and analysis tools—including mobile, wireless, radio, embedded, and automotive security—and hands-on labs, practice environments, and CTF challenges.

Use security-testing and password-auditing resources only with systems, accounts, and data you own or have explicit permission to test. Some resources provide real malware samples; treat all downloaded files as potentially dangerous and handle them only in an appropriately isolated environment.

Ethics, Law, Privacy, and Governance

These resources provide useful professional and educational references; they are not a substitute for legal advice.

Professional Codes of Ethics

• ACM Code of Ethics and Professional Conduct — Ethical principles and professional responsibilities for computing practitioners, educators, students, and technology leaders.
• ISC2 Code of Ethics — Mandatory ethical canons and professional-conduct guidance for ISC2 members and certification holders.
• ISACA Code of Professional Ethics — Professional expectations concerning governance, audit, control, security, risk management, privacy, and competent service.
• IEEE Code of Ethics — Ethical commitments for engineers and technology professionals concerning public welfare, honesty, competence, fairness, and responsible conduct.

Cyberlaw and Responsible Disclosure

• DOJ — Computer Fraud and Abuse Act Guidance (Justice Manual 9-48.000) — Department of Justice charging and prosecution guidance for the CFAA, including considerations for good-faith security research.
• DOJ — Electronic Communications Privacy Act of 1986 — Overview of the federal law governing interception of communications and access to stored electronic communications.
• Stored Communications Act: Overview of Governmental Action — Congressional Research Service overview of governmental access to stored communications under the SCA.
• CISA Vulnerability Disclosure Policy Template — Template for defining authorized security research, reporting procedures, scope, expectations, and safe-harbor commitments.

NIST Frameworks and Technical Guidance

• NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response — Guidance for incorporating computer and network forensics into incident-response processes.
• NIST AI Risk Management Framework — Voluntary framework for managing risks to individuals, organizations, and society arising from artificial-intelligence systems.
  • NIST AI RMF 1.0 Explainer Video — Official introduction to the purpose and structure of the AI RMF.
• NIST Cybersecurity Framework 2.0 — Risk-management framework organized around the Govern, Identify, Protect, Detect, Respond, and Recover functions.
• NIST Privacy Framework — Voluntary framework for identifying and managing privacy risk through enterprise risk-management processes.
• NIST SP 800-63-4 — Digital Identity Guidelines — Requirements and recommendations for identity proofing, authentication, federation, security, and privacy.
• NIST Face Technology Evaluations (FRTE/FATE; formerly FRVT) — Independent evaluations of face-recognition and face-analysis technologies, including accuracy and demographic-performance research.

Security Testing Frameworks and Methodologies

• OWASP Web Security Testing Guide — Structured guidance for planning, performing, and reporting web-application security tests.
• Penetration Testing Execution Standard (PTES) — Penetration-testing lifecycle covering pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
• NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment — Guidance for planning assessments, reviewing systems, discovering targets, identifying vulnerabilities, validating findings, and reporting results.
• MITRE ATT&CK — Knowledge base of adversary tactics, techniques, procedures, software, groups, mitigations, and defensive data sources.
• Lockheed Martin Cyber Kill Chain — Model describing seven stages of a targeted intrusion, from reconnaissance through actions on objectives.

Privacy and Consumer Protection

• FTC Privacy and Security Resources — Business guidance concerning data security, privacy practices, breach response, and compliance with consumer-protection law.

Compliance and Regulatory References

Applicability depends on an organization’s industry, location, services, customers, and the data it handles. PCI DSS and the legal requirements below are not interchangeable with voluntary security frameworks such as the NIST Cybersecurity Framework.

Regulatory and Industry Requirements

• PCI Data Security Standard (PCI DSS) — Global payment-card industry standard establishing technical and operational requirements for entities that store, process, transmit, or can affect the security of cardholder data. The PCI SSC Document Library provides the current PCI DSS v4.0.1 standard, supporting guidance, and assessment documents. PCI DSS is an industry standard enforced contractually through the payment-card ecosystem rather than a statute.
• General Data Protection Regulation (GDPR) — Official text of European Union Regulation 2016/679 governing the processing of personal data and the rights of individuals whose data is processed.
• Family Educational Rights and Privacy Act (FERPA) — U.S. federal law protecting the privacy of student education records and providing eligible students and parents with defined access and amendment rights.
• HIPAA Security Rule — U.S. requirements for covered entities and business associates to protect electronic protected health information through administrative, physical, and technical safeguards.
• Gramm-Leach-Bliley Act (GLBA) Safeguards Rule — FTC requirements for covered financial institutions to develop, implement, and maintain safeguards for customer information and oversee relevant service providers.
• California Consumer Privacy Act (CCPA), as amended by the CPRA — California privacy law and implementing regulations governing covered businesses, consumer privacy rights, data practices, risk assessments, and cybersecurity obligations. The CPRA amended the CCPA rather than creating a separate privacy law.
• Children’s Online Privacy Protection Act (COPPA) Rule — U.S. requirements for covered websites and online services—including some applications and Internet of Things devices—that collect personal information from children under 13.

Assurance and Information-Security Management Standards

• ISO/IEC 27001:2022 — International requirements standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Organizations may implement it with or without pursuing accredited certification; the complete standard generally requires purchase.
• AICPA System and Organization Controls (SOC), including SOC 2 — Independent CPA assurance reporting for service organizations. SOC 2 examinations address controls relevant to security, availability, processing integrity, confidentiality, or privacy; SOC 2 is an attestation report, not a government regulation or conventional product certification.

Learning, Training, and Educators

Certification Preparation

The paths below branch by career direction. They are suggested progressions, not checklists; certifications at the same stage are often alternatives rather than requirements.

Certification Roadmap

• Security Certification Roadmap — Visual guide to cybersecurity certifications by domain and experience level.

Foundation: Core IT and Security

Suggested progression: A+ → Network+ → Security+

• Professor Messer — Free video training and study resources for CompTIA certifications.
  • Professor Messer — YouTube
  • CompTIA A+ Core 1 (220-1201)
  • CompTIA A+ Core 2 (220-1202)
  • CompTIA Network+ (N10-009)
  • CompTIA Security+ (SY0-701)

Defensive Security Analysis

Suggested progression: Security+ → CySA+ → BTL1 → CISSP after gaining qualifying experience

• CompTIA CySA+ — Analyst-focused certification covering security operations, vulnerability management, incident response, reporting, and communication.
  • Pluralsight — CompTIA CySA+ (CS0-004) — Current-version video courses and exam-preparation material; subscription required after any trial period.
  • LinkedIn Learning — CompTIA CySA+ (CS0-004) Cert Prep — Current-version video course covering all four examination domains; subscription or eligible library access may be required.
• Blue Team Level 1 (BTL1) — Practical junior-level defensive certification covering incident response, SIEM investigations, digital forensics, phishing analysis, threat intelligence, and network-traffic analysis.

Systems and Security Operations

Suggested progression: Security+ → SSCP → CISSP after gaining qualifying experience

• ISC2 Systems Security Certified Practitioner (SSCP) — Security-administration and operations certification focused on implementing, monitoring, and maintaining secure infrastructure.
  • Current SSCP Exam Outline — Official examination domains, objectives, weights, and experience requirements.
  • SSCP Self-Study Resources — Official training links, flash cards, study tools, and preparation guidance.

Offensive Security and Penetration Testing

Suggested progression: Security+ → PenTest+ or eJPT → PNPT or CPTS → OSCP+

• CompTIA PenTest+ — Vendor-neutral penetration-testing certification covering engagement management, reconnaissance, vulnerability discovery, exploitation, post-exploitation, and reporting. Study for the current PT0-003 exam.
• INE Junior Penetration Tester (eJPT) — Hands-on, entry-level alternative to PenTest+ covering assessment methodology, network and host testing, exploitation, and web-application testing.
• TCM Security Practical Network Penetration Tester (PNPT) — Practical professional-level examination involving OSINT, network and Active Directory testing, a written report, and a live findings presentation.
• HTB Certified Penetration Testing Specialist (CPTS) — Practical penetration-testing certification supported by Hack The Box Academy’s Penetration Tester path.

• Hack The Box Academy — Penetration Tester Path — Hands-on curriculum covering the complete penetration-testing process and preparation for CPTS.

• OffSec Certified Professional Plus (OSCP+) — Practical penetration-testing certification focused on identifying and exploiting vulnerabilities, privilege escalation, Active Directory compromise, and professional documentation. PEN-200: Penetration Testing with Kali Linux is OffSec’s official preparation course.
  • PEN-200 Course Syllabus — Current topics, modules, exercises, and learning objectives.
  • PEN-200 Learner Onboarding Guide — Official guidance for approaching the course and labs.
  • PEN-200 24-Week Learning Plan — A structured study schedule from OffSec.
  • OffSec Proving Grounds — Practice environments including free Linux machines and paid labs designed to supplement OSCP+ preparation.

Advanced Security Practice and Architecture

Long-term destination for experienced security practitioners; not an immediate follow-up examination for most students.

• ISC2 CISSP Preparation — Official study resources for the Certified Information Systems Security Professional examination.
  • Current CISSP Exam Outline — Official domains, objectives, weights, and examination details.
  • ISC2TV — YouTube — ISC2’s official cybersecurity and certification channel.
  • Pete Zerger’s CISSP Exam Cram 2026 — YouTube Playlist — Free review material covering all eight CISSP domains and current exam updates.
  • Destination Certification CISSP MindMaps — YouTube Playlist — Visual, domain-by-domain CISSP concept reviews.

Guided Learning

API Security

• APIsec University — Free courses focused on API security and secure development.

Mobile Application Security

• OWASP Mobile Application Security Verification Standard (MASVS) — Security requirements for mobile applications covering storage, cryptography, authentication, network communications, platform interaction, code quality, resilience, and privacy.
• OWASP Mobile Application Security Testing Guide (MASTG) — Comprehensive testing and reverse-engineering guidance for Android and iOS applications, mapped to the MASVS and OWASP Mobile Application Security Weakness Enumeration.

Wireless and Software-Defined Radio

• GNU Radio Tutorials — Official beginner through advanced tutorials covering flowgraphs, signal processing, modulation, demodulation, SDR hardware, and custom blocks.
• Software Defined Radio with HackRF — Michael Ossmann — Free course from Great Scott Gadgets teaching SDR and digital-signal-processing fundamentals through GNU Radio and practical exercises.

Amateur Radio Licensing and RF Fundamentals

For learners in the United States, the Technician license is the entry point into amateur radio. It provides a structured foundation in radio theory, electronics, antennas, operating practices, RF exposure safety, and FCC regulations that complements software-defined-radio study.

• ARRL — Getting Licensed Step by Step — Overview of the three U.S. amateur-radio license classes, registration, study, examination, and application process. The entry-level Technician examination contains 35 questions.
• ARRL — Studying for a Technician License — Official ARRL Technician study materials, manuals, classes, and examination-preparation resources.
• HamStudy.org — Free adaptive study mode, explanations, flash cards, and practice examinations using the current public question pools.
  • HamStudy — Find an Exam Session — Search for available in-person and remote examination sessions.
  • HamStudy License Manuals — GitHub — Open-source project containing beginner-oriented amateur-radio license learning material.
• NCVEC 2026–2030 Technician Question Pool — Current public Technician examination pool, syllabus, diagrams, and errata from the National Conference of Volunteer Examiner Coordinators.
• ARRL — Find an Amateur Radio License Exam — Search for in-person and remote Volunteer Examiner sessions and review examination-day requirements.
• FCC Amateur Radio Service Rules — 47 CFR Part 97 — Current federal rules governing U.S. amateur-radio licensing, station operation, permitted communications, technical standards, and prohibited transmissions.

An amateur-radio license grants specific transmitting privileges within the amateur service; it does not authorize jamming, unauthorized interception, access to other systems, or security testing without the system owner’s permission.

LoRa and Resilient Mesh Networking

LoRa is a long-range, low-power radio modulation rather than a complete networking system. Several distinct protocols and software ecosystems can operate over LoRa, but they are not automatically interoperable. LoRaWAN typically connects low-power devices through gateways to network servers; Meshtastic and MeshCore provide their own off-grid mesh systems; Reticulum is a broader, hardware-independent networking stack that can use LoRa through an RNode interface.

• Semtech — LoRa and LoRaWAN Technical Overview — Technical introduction to LoRa modulation, LoRa radios, LoRaWAN architecture, device classes, security, and common IoT deployments.
• LoRaWAN for Developers — LoRa Alliance overview of the standardized LoRaWAN link layer, network architecture, regional parameters, backend interfaces, and certification ecosystem.
• Reticulum Network Stack Manual — Authoritative guide to Reticulum concepts, installation, interfaces, routing, network construction, cryptography, utilities, and application development.
  • Reticulum — Getting Started Fast — Practical introduction to installing Reticulum, trying an application, configuring interfaces, and joining or building a network.
• Meshtastic — Getting Started — Official guide to building an off-grid LoRa mesh and connecting supported radios to a phone or computer.
• MeshCore Documentation — Guides and protocol references for MeshCore’s lightweight, multi-hop packet-radio network.

Reticulum uses encryption by default. In the United States, ordinary encrypted Reticulum or LXMF traffic should not be transmitted under amateur-radio Part 97 privileges because 47 CFR § 97.113 generally prohibits messages encoded to obscure their meaning, apart from limited exceptions. Operation on license-exempt spectrum must instead comply with the applicable equipment, frequency, power, bandwidth, and duty-cycle rules; requirements differ by country and region.

Automotive and CAN Bus Security

• The Car Hacker’s Handbook — Craig Smith — Practical introduction to vehicle architecture, CAN bus analysis, ECU testing, diagnostic systems, and automotive penetration testing.
• Car Hacking Village — Community providing automotive-security education, conference presentations, hands-on activities, and CTF events.

AWS Skill Builder

• AWS Skill Builder — Official self-paced training for AWS cloud, security, architecture, operations, artificial intelligence, and certification preparation; hundreds of resources are available free.
  • AWS Cloud Practitioner Learning — Beginner learning plan covering cloud concepts, core AWS services, pricing, and security.
  • AWS Security Learning Plan — Courses and guided training covering AWS security processes, services, and best practices.
  • AWS Training by Role or Solution — Learning paths for cloud practitioners, architects, developers, operations, networking, security, and other specialties.

Malware Traffic Analysis

• Brad Duncan — Malware-Traffic-Analysis.net — Packet captures, tutorials, workshops, and exercises for investigating malicious network traffic.

Educators and Video Channels

• John Strand and Black Hills Information Security — YouTube — Educational webcasts, security news, demonstrations, and practical guidance from John Strand and other working cybersecurity professionals at BHIS.
  • Black Hills Information Security — GitHub — Training labs, security tools, event-logging resources, and other materials from BHIS.
• Chris Greer of Packet Pioneer — YouTube — Wireshark instruction, packet analysis, protocol fundamentals, and practical network troubleshooting.
  • Chris Greer (Packet Pioneer) — GitHub — Packet captures, Wireshark profiles, and companion files used in his videos and courses.
• John Hammond — YouTube — Malware analysis, CTF walkthroughs, ethical hacking, threat research, and practical cybersecurity demonstrations.
  • John Hammond — GitHub — CTF helpers, security research, proof-of-concept code, and utilities featured in his work.
• David Bombal — YouTube — Cybersecurity, networking, Linux, automation, technical interviews, and ethical-hacking demonstrations.
  • David Bombal — GitHub — Networking, Python, security, and automation scripts accompanying his videos.
• Philip Young (“Soldier of FORTRAN”) — Mainframe Hacking playlist — Mainframe penetration testing and security research covering IBM z/OS and MVS, RACF, TN3270, and related tooling. Young collaborated with Cyber Skyline on NCL mainframe challenges. This material concerns IBM mainframes rather than the separate IBM i/AS/400 platform.
  • Philip Young (mainframed) — GitHub — Open-source mainframe penetration-testing tools, Nmap scripts, protocol libraries, and research projects.
• IppSec — YouTube — Detailed Hack The Box walkthroughs emphasizing enumeration, penetration-testing methodology, problem-solving, and alternative attack paths.
  • IppSec — GitHub — Penetration-testing scripts, lab automation, shell utilities, and supporting projects.
• LiveOverflow — YouTube — Carefully explained videos about vulnerability research, binary exploitation, web security, CTFs, and the underlying mechanics of attacks.
  • LiveOverflow — GitHub — Source code and practice material accompanying vulnerability-research and exploitation videos.
• Heath Adams and The Cyber Mentor — YouTube — Practical ethical-hacking, penetration-testing, Linux, networking, privilege-escalation, and career-development instruction from the founder of TCM Security.
  • Heath Adams (hmaverickadams) — GitHub — Course notes, pentesting checklists, a sample professional report, and security utilities.
• OALabs — YouTube — Malware analysis, reverse engineering, debugging, unpacking, and practical investigation techniques.
  • OALabs — GitHub — Open-source malware-analysis, configuration-extraction, and reverse-engineering tools.
• Hocking Playlist

Tools and Reference Sites

The tools below are arranged broadly in assessment-lifecycle order: intelligence gathering, discovery, vulnerability analysis, specialized technical assessment, exploitation, detection, analysis, and incident response. Framework tags identify direct relationships rather than implying that every tool belongs to every framework.

Intelligence Gathering: OSINT and Passive Reconnaissance

Framework alignment: PTES — Intelligence Gathering · NIST SP 800-115 — Target Identification and Network Discovery · Cyber Kill Chain — Reconnaissance

• Malfrat’s OSINT Map — Maintained visual directory of tools and resources for open-source intelligence investigations.
• OSINT Framework — Influential visual directory of OSINT resources; reportedly no longer actively maintained, but retained here for reference and comparison.
• Robtex — DNS, IP address, autonomous system, WHOIS, passive DNS, and network-infrastructure research tools.

Intelligence Gathering: Active Reconnaissance and Network Discovery

Nmap

Open-source network discovery, port scanning, service identification, operating-system detection, and security-auditing tool.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Network Discovery and Port/Service Identification · Cyber Kill Chain — Reconnaissance

• Nmap Source — GitHub — GitHub mirror of Nmap’s official source repository, including the Nmap Scripting Engine libraries and scripts.
• Official Nmap Network Scanning Guide — Authoritative guide covering introductory through advanced Nmap usage; approximately half is available free online.
• Quick Port Scanning Tutorial — Official walkthrough of common scans and how to interpret their results.

ProjectDiscovery Open-Source Suite

Modular collection of command-line security tools for discovering internet-facing assets, identifying reachable services, crawling web applications, enriching results, and detecting known vulnerabilities and misconfigurations. The tools are designed to work independently or as composable pipelines; ProjectDiscovery also offers a separate cloud-based interface for asset management, scanning, and continuous monitoring.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Target Identification, Network Discovery, Port/Service Identification, and Vulnerability Scanning · Cyber Kill Chain — Reconnaissance · OWASP WSTG — Information Gathering and Automated Testing Support

• Subfinder — Passive subdomain-enumeration tool that gathers hostnames from public data sources.
• dnsx — DNS toolkit for resolving, validating, and enriching discovered domain names at scale.
• httpx — HTTP probing toolkit for identifying reachable web services and collecting status codes, titles, technologies, and other metadata; it is unrelated to the Python HTTPX library.
• Naabu — Fast port-discovery tool optimized for scanning multiple authorized hosts and passing discovered ports to deeper assessment tools such as Nmap.
• Katana — Web crawler for discovering pages, endpoints, forms, parameters, JavaScript-linked resources, and other application content.
• Nuclei — Template-based detection engine for known vulnerabilities, exposures, misconfigurations, and technology fingerprints; it is also listed under Vulnerability Analysis below.
• PDTM — ProjectDiscovery Tool Manager for installing and updating the suite’s command-line tools.
• ProjectDiscovery Open-Source Documentation — Official overview of the suite’s Discover, Enrich, Detect, and Utility categories.
• ProjectDiscovery Quick Start — Introductory guide to the command-line tools and optional cloud platform.

Vulnerability Analysis and Security Assessment

Tenable Nessus

Commercial vulnerability-assessment platform for identifying software flaws, missing patches, insecure configurations, and other weaknesses across authorized systems.

Alignment: PTES — Vulnerability Analysis · NIST SP 800-115 — Vulnerability Scanning and Configuration Review

• Tenable Nessus Learning Resources — Official training for installing, configuring, and using Nessus.
• Getting Started with Nessus — Video — Official introductory video series.
• Getting Started with Nessus — User Guide — Official setup and first-scan documentation.
• Nessus for Education — Verified students and instructors can request a free one-year Nessus Essentials Plus license.
• Nessus Fundamentals Course — Paid course with targeted videos and demonstrations.

Greenbone Community Edition / OpenVAS

Open-source vulnerability-management platform built around the OpenVAS scanner. OpenVAS began in 2006 as a fork of the last open-source Nessus codebase after Nessus adopted a proprietary model; it has since evolved independently as part of the Greenbone ecosystem.

Alignment: PTES — Vulnerability Analysis · NIST SP 800-115 — Vulnerability Scanning and Configuration Review

• OpenVAS Scanner — GitHub — Official source repository for the scanning engine used by Greenbone Community Edition.
• Greenbone Community Getting Started — Official starting point for Greenbone Community Edition and OpenVAS.
• History of OpenVAS — Greenbone’s account of the project’s origins as a Nessus fork and its subsequent independent development.
• Greenbone Community Edition Documentation — Maintained installation, architecture, administration, and troubleshooting documentation.
• Install with Greenbone Community Containers — Guided installation using Docker or Podman containers.
• Install on Kali Linux — Distribution-specific installation and setup guide.
• Perform Your First OpenVAS Scan — Community video walkthrough covering login, the scan wizard, and basic report results.

Nuclei

ProjectDiscovery’s fast, template-based scanner for finding known vulnerabilities, exposures, technology fingerprints, and configuration problems across authorized targets.

Alignment: PTES — Vulnerability Analysis · NIST SP 800-115 — Vulnerability Scanning · OWASP WSTG — Automated Testing Support

• ProjectDiscovery Quick Start — Official introduction to asset discovery and vulnerability scanning with ProjectDiscovery tools.
• Running Nuclei — Official usage examples, inputs, templates, output formats, and scanning options.

Nikto

Open-source web-server scanner for dangerous files, outdated components, and configuration problems.

Alignment: PTES — Vulnerability Analysis · NIST SP 800-115 — Vulnerability Scanning · OWASP WSTG — Configuration and Deployment Testing

• Nikto Documentation — Official installation, usage, tuning, and reporting reference.
• Nikto Basic Testing — Introductory examples for scanning hosts, ports, HTTPS services, and lists of targets.

Lynis

Open-source security-auditing and hardening tool for Linux, BSD, macOS, and other UNIX-like systems.

Alignment: PTES — Vulnerability Analysis · NIST SP 800-115 — Configuration Review and Security Testing

• Lynis Source — GitHub — Official source code, installation files, issue tracker, and contribution information.
• Getting Started with Lynis — Official installation and first-audit tutorial.
• Lynis Documentation — Commands, options, reports, profiles, automation, and configuration guidance.

Technical Assessment: Wireless Security

Wireless assessment generally requires a compatible Wi-Fi adapter whose Linux driver supports monitor mode; active testing and packet injection must be limited to networks and devices you own or are explicitly authorized to assess.

Aircrack-ng

Open-source suite for auditing Wi-Fi networks. Its tools cover monitor-mode interface management, 802.11 packet capture, access-point and client discovery, packet injection testing, and authorized WPA/WPA2 key auditing.

Alignment: PTES — Intelligence Gathering, Vulnerability Analysis, and Exploitation · NIST SP 800-115 — Wireless Scanning, Network Sniffing, and Password Cracking

• Aircrack-ng Documentation — Official documentation, individual tool references, tutorials, and troubleshooting material.
• Aircrack-ng — GitHub — Official source, build instructions, releases, manual pages, and issue tracker.

Kismet

Open-source passive wireless detector, packet-capture platform, wardriving tool, and wireless intrusion-detection system. In addition to Wi-Fi, it can support Bluetooth and selected software-defined-radio data sources.

Alignment: PTES — Intelligence Gathering · NIST SP 800-115 — Wireless Scanning and Network Sniffing · Cyber Kill Chain — Reconnaissance

• Kismet Documentation — Official installation, data-source, capture, logging, alerting, wardriving, and web-interface guidance.
• Kismet — GitHub — Official GitHub mirror of the project source.

WiGLE WiFi Wardriving FOSS

Open-source Android application for geolocated discovery and logging of Wi-Fi, Bluetooth, and cellular signals. WiGLE supports wireless-network mapping, observation exports, route tracking, and Wi-Fi site surveys; it identifies the surrounding wireless landscape but does not provide access to networks.

Alignment: PTES — Intelligence Gathering · NIST SP 800-115 — Wireless Scanning · Cyber Kill Chain — Reconnaissance

• WiGLE — Collaborative wireless-network mapping and visualization service.
• WiGLE WiFi Wardriving FOSS — F-Droid — Free and open-source Android build distributed through F-Droid.
• WiGLE WiFi Wardriving — GitHub — Official source, feature documentation, releases, and issue tracker.

hcxdumptool and hcxtools

Linux tools for capturing and processing authorized WPA/WPA2/WPA3 assessment data. hcxdumptool writes modern .pcapng captures, while utilities such as hcxpcapngtool can prepare supported material for analysis with tools including Hashcat.

Alignment: PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Network Sniffing, Password Cracking, and Penetration Testing

• hcxdumptool — GitHub — Official source, hardware requirements, build instructions, operating guidance, and safety considerations.
• hcxtools — GitHub — Companion conversion, filtering, and analysis utilities for wireless capture files.

bettercap

Open-source network reconnaissance and assessment framework supporting Wi-Fi, Bluetooth Low Energy, Ethernet, IPv4/IPv6, HID, and other interfaces. It includes wireless discovery, packet capture, programmable modules, and a web interface.

Alignment: PTES — Intelligence Gathering and Exploitation · NIST SP 800-115 — Network Discovery, Sniffing, and Penetration Testing · MITRE ATT&CK — Adversary-in-the-Middle (T1557)

• bettercap Wi-Fi Documentation — Official wireless module commands, configuration options, requirements, and output formats.
• bettercap — GitHub — Official source, releases, installation guidance, modules, and issue tracker.

Technical Assessment: Mobile Application Security

Mobile application testing examines client-side storage, authentication, platform interaction, network communication, APIs, code, and resistance to tampering. Test only applications and accounts you own or are explicitly authorized to assess.

Mobile Security Framework (MobSF)

Open-source mobile security research platform for automated static and dynamic analysis of Android, iOS, and Windows mobile applications. It supports application-security assessment, malware analysis, privacy analysis, and integration with development workflows.

Alignment: OWASP MASVS and MASTG · PTES — Vulnerability Analysis · NIST SP 800-115 — Application Security Testing

• MobSF — GitHub — Official source, installation instructions, releases, documentation, and issue tracker.

Frida

Open-source dynamic instrumentation toolkit used to inspect and modify application behavior at runtime. It supports Android, iOS, Linux, macOS, Windows, and other platforms and is widely used for authorized mobile testing and reverse engineering.

Alignment: OWASP MASTG — Dynamic Analysis and Reverse Engineering · PTES — Vulnerability Analysis and Exploitation

• Frida Documentation — Official installation, quick-start, operating-mode, API, and example guidance.
• Frida — GitHub — Official source and build information.

JADX

Open-source command-line and graphical decompiler for producing readable Java source from Android APK and DEX files. It also decodes application manifests and resources and includes code search, deobfuscation, and debugging features.

Alignment: OWASP MASTG — Static Analysis and Reverse Engineering · PTES — Vulnerability Analysis

• JADX — GitHub — Official source, releases, installation instructions, usage reference, and troubleshooting guidance.

Apktool

Open-source tool for decoding and rebuilding Android application packages, including resources, manifests, and smali code. It complements JADX when examining an application’s packaged structure and lower-level bytecode representation.

Alignment: OWASP MASTG — Static Analysis and Reverse Engineering · PTES — Vulnerability Analysis

• Apktool Documentation — Official installation, command, build, and troubleshooting guidance.
• Apktool — GitHub — Official source, releases, and issue tracker.

Burp Suite and OWASP ZAP, listed under Web Application Security, can also inspect authorized mobile applications’ HTTP and API traffic when the test environment is configured appropriately.

Technical Assessment: Software-Defined Radio and RFID/NFC

Radio work spans receive-only spectrum observation, digital-signal processing, and authorized testing of wireless protocols. Transmitting, replaying, or intercepting signals may be regulated and must be limited to lawful laboratory conditions and explicitly authorized systems.

GNU Radio

Open-source software-defined-radio toolkit for constructing signal-processing flowgraphs and learning how radio signals are received, filtered, decoded, generated, and analyzed.

• GNU Radio Tutorials — Official beginner, intermediate, and advanced learning material.
• GNU Radio — GitHub — Official source, releases, documentation, and issue tracker.

HackRF

Open-source SDR hardware and software platform from Great Scott Gadgets. Unlike inexpensive receive-only SDR devices, HackRF hardware can both receive and transmit, so transmission exercises require particular care and compliance with applicable radio regulations.

• HackRF Documentation — Official installation, hardware, software, firmware, and usage documentation.
• HackRF — GitHub — Official software, firmware, hardware designs, releases, and issue tracker.
• Software Defined Radio with HackRF — Michael Ossmann’s free SDR and GNU Radio course.

RTL-SDR

Open-source software that repurposes compatible RTL2832-based USB television tuners as inexpensive, receive-only software-defined radios. It provides a comparatively safe and affordable entry point for observing and learning about radio signals without transmitting.

• Osmocom rtl-sdr — GitHub Mirror — Source code and build information for the RTL-SDR library and command-line utilities.

Proxmark3

Open-source hardware, firmware, and client software for authorized RFID and NFC research across low- and high-frequency technologies. It supports tag identification, protocol analysis, reading, emulation, and security testing in controlled environments.

• Proxmark3 Iceman Repository — Actively developed community firmware, client, installation documentation, command references, scripts, and research notes.

Resilient Mesh Networking: LoRa and Reticulum

The projects below illustrate several different layers and approaches to low-bandwidth networking. LoRa supplies the radio modulation; LoRaWAN, Reticulum, Meshtastic, and MeshCore define different higher-level networking systems. LXMF and LXST are application protocols built on Reticulum. They should not be treated as interchangeable or assumed to communicate with one another without a purpose-built bridge.

LoRa and LoRaWAN

LoRa is a long-range, low-power radio modulation developed by Semtech. LoRaWAN is a standardized low-power wide-area networking architecture maintained by the LoRa Alliance, commonly used to connect battery-powered IoT devices through gateways to network servers. LoRaWAN is normally a star-of-stars network rather than a peer-to-peer mesh.

• Semtech — LoRa and LoRaWAN Technical Overview — Physical-layer, architecture, device-class, security, and deployment overview.
• LoRaWAN for Developers — Official standards overview and links to link-layer, backend-interface, regional-parameter, and certification documents.
• LoRaWAN 1.0.4 Specification Package — LoRa Alliance link-layer specification, certification protocol, requirements, and reference material.

Reticulum Network Stack

Open-source, cryptography-based networking stack created and maintained by Mark Qvist for building decentralized networks across LoRa, packet radio, serial links, Wi-Fi, Ethernet, the Internet, and other media. Reticulum is designed for high-latency and very-low-bandwidth links, uses cryptographic identities and destinations instead of conventional IP addresses, and does not require every node to know the complete route to a destination.

Reticulum’s reference LoRa setup uses RNode and a custom link layer over plain LoRa modulation. It does not use the LoRaWAN protocol.

• Reticulum Manual — Authoritative architecture, installation, configuration, interface, routing, cryptography, utility, and development documentation.
• Getting Started Fast — Installation and first-network walkthrough.
• Building Networks with Reticulum — Guidance for nodes, transport instances, paths, interfaces, and network design.
• Reticulum API Reference — Python API for creating Reticulum-aware applications.
• Reticulum — GitHub — Public source mirror, utilities, examples, releases, and issue tracker.

RNode

Open hardware and firmware ecosystem providing a LoRa radio interface for Reticulum. An RNode handles the radio and link-layer functions while a connected computer, phone, or embedded host runs Reticulum and its applications.

• RNode Firmware — GitHub — Stable upstream reference, firmware, supported-board information, build files, and hardware documentation.
• RNode Firmware Community Edition — GitHub — Actively developed community edition with expanded hardware support, maintained by Liberated Embedded Systems.

LXMF — Lightweight Extensible Message Format

Distributed messaging format and delivery protocol built on Reticulum. LXMF provides signed, end-to-end encrypted, store-and-forward-capable messaging that can operate over extremely low-bandwidth links including LoRa and packet radio.

• LXMF — GitHub — Reference implementation, protocol structure, delivery modes, examples, and compatible-client links.

LXST — Lightweight Extensible Signal Transport

Experimental real-time streaming and signaling protocol built on Reticulum. LXST is intended for applications such as encrypted voice calls, two-way radio systems, telephony, and low-bandwidth audio. The project describes itself as early alpha software, so its interfaces should not yet be considered stable.

• LXST — GitHub — Reference implementation, supported codecs, installation guidance, and current project status.

Sideband

Graphical Reticulum client for Android, Linux, macOS, and Windows. Sideband uses LXMF for messaging and LXST for supported voice communication and also provides file transfer, telemetry, offline mapping, and situation-awareness features across LoRa and other Reticulum interfaces.

• Sideband — GitHub — Public source mirror, downloads, documentation, features, and compatible-system information.

Nomad Network

Terminal-based Reticulum and LXMF client for messaging, information pages, file resources, and node-hosted services. Nomad Network can also operate an LXMF propagation node for store-and-forward message delivery.

• Nomad Network — GitHub — Source, installation instructions, configuration, operation, and node-hosting documentation.

Meshtastic

Open-source off-grid communication platform that creates a decentralized mesh using supported LoRa radios. Phones and computers connect to nodes through Bluetooth, Wi-Fi, or USB for text messaging, position sharing, telemetry, and related applications without cellular service or Internet access.

• Meshtastic Documentation — Official hardware, installation, configuration, radio, channel, application, and developer guidance.
• Meshtastic — GitHub — Firmware, applications, libraries, protobuf definitions, documentation, and supporting projects.

MeshCore

Open-source lightweight multi-hop packet-routing system for LoRa and other packet radios. MeshCore emphasizes embedded operation and supports companion-radio, repeater, room-server, sensor, and developer-oriented use cases.

• MeshCore Documentation — Getting-started material, CLI commands, packet and payload formats, companion protocol, KISS modem protocol, and implementation details.
• MeshCore — GitHub — Firmware, supported hardware, example applications, protocol source, releases, and development guidance.

Technical Assessment: Automotive and CAN Bus Security

Automotive security extends beyond CAN bus to CAN FD, OBD-II, UDS diagnostics, ECUs, infotainment, telematics, keyless-entry radio, Bluetooth, cellular connectivity, firmware, and automotive Ethernet. Begin with a virtual CAN interface and simulator rather than a live vehicle; transmitting untested frames on a real vehicle can affect safety-critical systems.

SocketCAN and can-utils

SocketCAN is the Linux kernel networking framework for CAN protocols. The accompanying open-source can-utils suite provides tools for capturing, displaying, generating, filtering, replaying, and analyzing CAN, CAN FD, ISO-TP, and J1939 traffic.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Network Discovery, Network Sniffing, and Penetration Testing

• Linux Kernel SocketCAN Documentation — Official overview of the SocketCAN architecture, protocols, interfaces, and programming model.
• can-utils — GitHub — Official user-space utilities, source, command documentation, and releases.

SavvyCAN

Free and open-source graphical CAN bus analysis and reverse-engineering tool. It supports capture visualization, filtering, graphing, frame comparison, DBC signal definitions, scripting, and UDS scanning and decoding.

• SavvyCAN — GitHub — Official source, releases, documentation, and community discussions maintained by Collin Kidder.

comma.ai Panda and OpenDBC

Panda is open-source hardware and firmware for interfacing with CAN and CAN FD networks, with safety controls designed for vehicle research. OpenDBC provides an open Python API, CAN definitions, safety models, and supporting tools for understanding vehicle messages.

• Panda — GitHub — Official firmware, Python interface, examples, tests, and hardware information.
• OpenDBC — GitHub — Official vehicle definitions, Python tools, safety code, documentation, and research resources.

Technical Assessment: Identity, Authentication, and File Services

These resources cover both legitimate administration and authorized security assessment of LDAP directories, Kerberos authentication, and SMB/Samba file and identity services.

OpenLDAP Utilities

OpenLDAP includes command-line utilities such as ldapsearch for querying directory entries, ldapwhoami for checking the authenticated identity, and ldapadd, ldapmodify, and ldapdelete for authorized directory administration.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Configuration Review and Account Examination

• OpenLDAP Administrator’s Guide — Official concepts, installation, configuration, access control, security, replication, maintenance, and troubleshooting guidance.
• OpenLDAP Source — Official project source repository; OpenLDAP hosts its source on its own Git service rather than GitHub.

MIT Kerberos Tools

The MIT Kerberos client and administrative tools include kinit for obtaining a ticket-granting ticket, klist for inspecting credential caches and keytabs, kvno for requesting service tickets, and kdestroy for removing cached credentials.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Configuration and Authentication Review · MITRE ATT&CK — Credential Access and Valid Accounts analysis

• MIT Kerberos User Commands — Official references for ticket, password, configuration, and user-session commands.
• MIT Kerberos — GitHub — Official GitHub mirror of the MIT Kerberos source repository.

Samba Administration and Client Tools

The Samba suite includes smbclient for accessing and testing SMB shares, rpcclient, nmblookup, and net for service and identity operations, samba-tool for administration, and testparm for validating smb.conf configuration.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Network Discovery and Configuration Review · MITRE ATT&CK — Network Service Discovery and Remote Services analysis

• smbclient Manual — Official command and option reference for connecting to SMB/CIFS services.
• samba-tool Manual — Official reference for Samba identity, domain, DNS, group, user, policy, and service administration.
• testparm Manual — Official guidance for checking the internal correctness of Samba configuration files.
• Samba Source — GitLab — Official source mirror; the Samba project uses GitLab rather than GitHub.

Impacket

Open-source Python classes and example tools for working with network protocols including SMB, Kerberos, LDAP, MS-RPC, NTLM, and others. It is widely used for protocol research, interoperability testing, CTFs, and authorized security assessments.

Alignment: PTES — Intelligence Gathering, Exploitation, and Post-Exploitation · NIST SP 800-115 — Penetration Testing · MITRE ATT&CK — Credential Access, Discovery, and Lateral Movement

• Impacket Documentation — Official installation, library, protocol, and example-tool documentation.
• Impacket — GitHub — Official source, releases, example scripts, and issue tracker.

enum4linux-ng

Open-source Windows and Samba enumeration tool that coordinates Samba client utilities to inspect authorized SMB targets for shares, users, groups, policies, services, operating-system information, and supported SMB dialects.

Alignment: PTES — Intelligence Gathering · NIST SP 800-115 — Network Discovery and Service Identification · MITRE ATT&CK — Account, Permission Group, Network Share, and System Discovery

• enum4linux-ng — GitHub — Official source, installation instructions, usage examples, feature documentation, and structured JSON/YAML output guidance.

Kerbrute

Kerberos pre-authentication testing tool for authorized Active Directory environments and CTF labs. It can enumerate accounts and audit credentials, but authentication attempts can generate security events and cause account lockouts.

Alignment: PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Password Cracking and Penetration Testing · MITRE ATT&CK — Account Discovery and Brute Force (T1110)

• Kerbrute — GitHub — Official source, releases, command documentation, examples, and operational warnings.

Technical Assessment: Password Auditing

Hashcat

High-performance password-recovery and auditing tool supporting CPUs, GPUs, numerous hash formats, and multiple attack modes.

Alignment: PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Password Cracking · MITRE ATT&CK — Password Cracking (T1110.002)

• Hashcat Source — GitHub — Official source repository, releases, issue tracker, and contribution history.
• Official Hashcat Wiki — Documentation covering hash identification, attack modes, masks, rules, examples, and frequently asked questions.
• Example Hashes — Reference mapping Hashcat modes to supported hash formats and safe example values.

John the Ripper

Open-source password-security auditing and recovery tool with broad support for hashes, encrypted archives, keys, and documents.

Alignment: PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Password Cracking · MITRE ATT&CK — Password Cracking (T1110.002)

• John the Ripper Jumbo — GitHub — Official community-enhanced source repository supporting hundreds of hash and cipher formats.
• John the Ripper Documentation — Official installation, options, cracking modes, rules, and configuration reference.
• John the Ripper Usage Examples — Practical examples covering wordlists, rules, sessions, restoration, and result review.

THC Hydra

Online credential-auditing tool for testing authentication against authorized network services.

Alignment: PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Password Cracking and Penetration Testing · MITRE ATT&CK — Password Guessing (T1110.001) and Password Spraying (T1110.003)

• Hydra Documentation and Examples — Official installation, command syntax, supported protocols, and usage examples.

Technical Assessment: Web Application Security

Burp Suite

Integrated web-application security testing platform featuring an intercepting proxy and tools for examining, modifying, and testing web traffic.

Alignment: OWASP WSTG — Web Application Security Testing · PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Application Testing and Penetration Testing

• PortSwigger — GitHub — Public Burp extensions, examples, APIs, and supporting projects; Burp Suite itself is proprietary and its core source is not published here.
• PortSwigger Web Security Academy — Free learning material and interactive web-application security labs.
• Getting Started with Burp Suite — Official interactive tutorial covering Burp Proxy, scope, Repeater, and basic scanning.
• PortSwigger — YouTube — Official Burp Suite demonstrations, web-security research, and tutorials.
• TryHackMe Burp Suite Training — Guided lessons covering Burp Suite basics, Repeater, Intruder, extensions, and other tools; some content may require paid access.

OWASP ZAP

Free, open-source intercepting proxy and web-application vulnerability scanner.

Alignment: OWASP WSTG — Web Application Security Testing · PTES — Vulnerability Analysis · NIST SP 800-115 — Application Testing and Vulnerability Scanning

• OWASP ZAP Source — GitHub — Official source repository for ZAP’s core application.
• ZAP Getting Started Guide — Beginner-oriented introduction to proxying, crawling, passive analysis, and authorized active scanning.
• Official ZAP Videos — Demonstrations and tutorials maintained by the ZAP project.

ffuf

Fast web fuzzer for discovering content, virtual hosts, parameters, and other hidden attack surface.

Alignment: OWASP WSTG — Information Gathering, Configuration, and Input Testing · PTES — Intelligence Gathering and Vulnerability Analysis · NIST SP 800-115 — Application Testing

• ffuf Documentation and Examples — Installation and practical examples for content, virtual-host, parameter, and POST-data fuzzing.
• ffufme Local Practice Environment — Purpose-built Docker targets for practicing ffuf legally on a local system.

Gobuster

Command-line tool for discovering directories, files, DNS names, virtual hosts, and cloud-storage names.

Alignment: OWASP WSTG — Information Gathering and Content Discovery · PTES — Intelligence Gathering · NIST SP 800-115 — Network and Application Discovery

• Gobuster Quick Start — Official installation and introductory examples for its principal operating modes.

sqlmap

Open-source tool that automates detection and validation of SQL-injection vulnerabilities.

Alignment: OWASP WSTG — Injection Testing · PTES — Vulnerability Analysis and Exploitation · NIST SP 800-115 — Application Testing and Penetration Testing

• sqlmap Source — GitHub — Official source repository, releases, issue tracker, and contribution history.
• Official sqlmap Usage Guide — Comprehensive option reference and practical usage examples.
• sqlmap FAQ — Introduction, installation guidance, terminology, and common troubleshooting questions.

Exploitation and Post-Exploitation

Metasploit Framework

Open-source penetration-testing framework for developing, validating, and using exploit modules and security-testing payloads in authorized environments.

Alignment: PTES — Exploitation and Post-Exploitation · NIST SP 800-115 — Penetration Testing · MITRE ATT&CK — technique emulation across multiple tactics · Cyber Kill Chain — Exploitation and Installation

• Metasploit Framework — GitHub — Official framework source, modules, plugins, documentation, issue tracker, and contribution history.
• Metasploit Documentation — Official installation, usage, module-development, and API documentation.

Detection and Security Monitoring

Wireshark

Packet capture and protocol-analysis platform for troubleshooting, traffic analysis, and security investigations.

Alignment: NIST SP 800-115 — Network Sniffing and Log Review · NIST SP 800-86 — Network Forensics · MITRE ATT&CK — Network Traffic data sources · Cyber Kill Chain — detection across multiple stages

• Wireshark Source — GitLab — Wireshark’s official code repository; the project uses GitLab rather than GitHub.
• Wireshark User’s Guide — Official installation, capture, filtering, analysis, and troubleshooting documentation.
• Chris Greer — YouTube — Practical Wireshark instruction and packet-analysis demonstrations.

Zeek

Network-security monitoring platform that converts traffic into detailed, searchable logs and events.

Alignment: NIST SP 800-115 — Network Sniffing and Log Review · NIST SP 800-86 — Network Forensics · MITRE ATT&CK — Network Traffic data sources and behavior detection · Cyber Kill Chain — detection across multiple stages

• Zeek Source — GitHub — Official source repository for Zeek’s engine, analyzers, scripts, documentation, and development tools.
• Zeek Quick Start — Analyze a supplied packet capture, examine the resulting logs, and begin using Zeek scripts.
• Interactive Zeek Tutorial — Guided setup, deployment, log analysis, packages, and scripting.

Suricata

Open-source intrusion-detection, intrusion-prevention, and network-security monitoring engine.

Alignment: NIST SP 800-115 — Network Sniffing and Log Review · MITRE ATT&CK — Network Traffic data sources and behavior detection · Cyber Kill Chain — detection and disruption across multiple stages

• Suricata Source — GitHub — Official source repository maintained by OISF and the Suricata community.
• Suricata Quick Start — Official introduction to installation, configuration, rules, alerts, and EVE JSON output.
• Suricata User Guide — Complete official documentation.

Detection and Malware Analysis

YARA

Rule-based pattern-matching tool used to identify and classify malware and other files or processes through text strings, byte sequences, regular expressions, metadata, and logical conditions. Classic YARA remains widely used but is now maintained primarily for compatibility and critical fixes.

Alignment: NIST SP 800-86 — File and Malware Analysis · MITRE ATT&CK — software and technique-informed detection · Cyber Kill Chain — Delivery, Installation, and Command-and-Control analysis

• YARA Getting Started Guide — Official installation instructions and a first command-line rule-matching example.
• Writing YARA Rules — Official guide to strings, conditions, regular expressions, metadata, tags, and modules.
• Running YARA from the Command Line — Command syntax and options for scanning files, directories, and processes.

YARA-X

VirusTotal’s modern, Rust-based successor to YARA, designed for improved reliability, performance, and developer integration while retaining a familiar rule language.

Alignment: NIST SP 800-86 — File and Malware Analysis · MITRE ATT&CK — software and technique-informed detection · Cyber Kill Chain — Delivery, Installation, and Command-and-Control analysis

• YARA-X Documentation — Official installation, command-line, rule-writing, integration, and migration documentation.
• YARA-X Playground — Local-first browser environment for safely experimenting with rules and sample text or files.
• YARA-X versus YARA — Official comparison and compatibility guidance.

Analysis: Debugging and Reverse Engineering

WinDbg

Microsoft’s Windows debugger for analyzing crash dumps and debugging live user-mode programs, kernel-mode code, and drivers. Common inputs include .dmp crash-dump files, matching .exe, .dll, or .sys modules, and .pdb symbol files. Microsoft’s public symbol server supplies public Windows symbols automatically; symbols for third-party or privately built software must come from that software’s developer or build process.

Alignment: NIST SP 800-86 — Forensic and Malware Analysis · MITRE ATT&CK — analysis of Execution, Persistence, Privilege Escalation, and Defense Evasion behaviors · Cyber Kill Chain — Exploitation and Installation analysis

• Install WinDbg — Official download, installation, requirements, and update instructions.
• Getting Started with WinDbg — Introductory user-mode debugging exercise explaining breakpoints, modules, symbols, and commands.
• Symbols and Symbol Files — Explanation of Program Database (.pdb) files and why symbols must match the exact binary being examined.
• Microsoft Public Symbol Server — Official service for downloading and locally caching matching Windows symbols.
• Windows Symbol Packages and Their Deprecation — Microsoft formerly published downloadable offline symbol packages as MSI files but discontinued them in favor of its online symbol server. This history can matter when analyzing an older Windows build that requires an exact matching PDB.
• Configure the WinDbg Symbol Path — Symbol-path syntax and cache configuration. A typical setup uses .symfix C:\Symbols followed by .reload.
• WinDbg Samples — GitHub — Microsoft’s public debugger-extension, scripting, Time Travel Debugging, and API examples; this is a samples repository, not WinDbg’s core source code.

x64dbg

Free, open-source Windows user-mode debugger designed for reverse engineering, malware analysis, and examining 32-bit and 64-bit executables without source code.

Alignment: NIST SP 800-86 — Forensic and Malware Analysis · MITRE ATT&CK — analysis of Execution and Defense Evasion behaviors · Cyber Kill Chain — Exploitation and Installation analysis

• x64dbg — GitHub — Official source, releases, documentation, plugins, and issue tracker.

GNU Debugger (GDB)

Open-source command-line debugger commonly used on Linux and UNIX-like systems for source-level and assembly-level analysis, process inspection, core dumps, and remote debugging.

Alignment: NIST SP 800-86 — Forensic and Malware Analysis · MITRE ATT&CK — analysis of Execution and Defense Evasion behaviors · Cyber Kill Chain — Exploitation and Installation analysis

• GDB Documentation — Official user manual, internals documentation, downloads, and reference material.
• GDB Source Repository — Official Git repository hosted by Sourceware rather than GitHub.

Ghidra

Open-source software reverse-engineering framework providing disassembly, decompilation, scripting, binary analysis, and integrated debugging capabilities.

Alignment: NIST SP 800-86 — File and Malware Analysis · MITRE ATT&CK — adversary software and behavior analysis · Cyber Kill Chain — Weaponization, Exploitation, and Installation analysis

• Ghidra — GitHub — Official source repository, releases, extensions, development documentation, and issue tracker.

Response: Digital Forensics and Incident Response

Forensic tools commonly work with raw disk images (.dd, .raw, or .img), Expert Witness images (.E01), memory captures (.raw, .mem, or .dmp), and collected operating-system artifacts such as Windows Event Logs (.evtx), Registry hives, the NTFS Master File Table ($MFT), Prefetch files, and browser databases. Work only with evidence that you are authorized to examine, preserve the original, and verify working copies with cryptographic hashes.

Autopsy and The Sleuth Kit

Open-source disk-forensics platform for examining file systems and storage images, recovering deleted files, searching content, building timelines, and organizing findings. Autopsy provides the graphical interface; The Sleuth Kit supplies the underlying forensic libraries and command-line tools.

Alignment: NIST SP 800-86 — Collection, Examination, Analysis, and Reporting · NIST SP 800-115 — Post-Testing Analysis and Reporting · MITRE ATT&CK — incident investigation and technique reconstruction

• Autopsy User Guide — Official documentation for creating cases, adding data sources, running ingest modules, reviewing results, and producing reports.
• Autopsy — GitHub — Official application source, releases, development documentation, and issue tracker.
• The Sleuth Kit — GitHub — Official source for the file-system and disk-image analysis libraries and command-line utilities used by Autopsy.

FTK Imager

Free proprietary evidence-acquisition and preview tool from Exterro. It can create forensic disk images, capture memory, preview files and file systems, export selected evidence, and calculate hashes without requiring the full commercial FTK suite.

Alignment: NIST SP 800-86 — Evidence Collection and Preservation · NIST SP 800-115 — Post-Testing Evidence Handling

• FTK Downloads — Official current and legacy downloads for FTK Imager and the broader FTK family.

Volatility 3

Open-source memory-forensics framework for extracting processes, network activity, command history, loaded modules, malware indicators, and other runtime artifacts from RAM captures.

Alignment: NIST SP 800-86 — Memory Examination and Analysis · MITRE ATT&CK — incident investigation and technique reconstruction · Cyber Kill Chain — post-incident analysis across multiple stages

• Volatility 3 Documentation — Official concepts, installation guidance, plugins, command structure, and development documentation.
• Volatility 3 — GitHub — Official source, installation instructions, releases, plugins, and issue tracker.

KAPE

Kroll Artifact Parser and Extractor is a free Windows forensic-triage tool by Eric Zimmerman. It rapidly collects selected artifacts and can run processing modules against them, making it useful for prioritizing systems and beginning an investigation before full-disk imaging is complete.

Alignment: NIST SP 800-86 — Collection, Examination, and Analysis · MITRE ATT&CK — endpoint artifact collection and technique reconstruction · Cyber Kill Chain — post-incident analysis

• KAPE Documentation — Official explanation of Targets, Modules, collection, processing, and practical workflows.
• KAPE Files — GitHub — Community-maintained Target and Module configurations used by KAPE; KAPE itself is freeware rather than an open-source application.
• Eric Zimmerman’s Forensic Tools — Windows artifact parsers for event logs, Registry data, the MFT, Prefetch, Jump Lists, link files, and other evidence sources.

Plaso (log2timeline)

Open-source timeline-generation framework that extracts timestamped events from disk images, directories, logs, browser data, Registry files, and many other sources so investigators can correlate activity chronologically.

Alignment: NIST SP 800-86 — Examination, Analysis, and Reporting · MITRE ATT&CK — chronological technique reconstruction · Cyber Kill Chain — intrusion-stage reconstruction

• Plaso User Documentation — Official guidance for installation, collection, filtering, analysis, and the log2timeline, pinfo, psort, and psteal tools.
• Plaso — GitHub — Official source, releases, supported formats, parsers, and issue tracker.

Velociraptor

Open-source endpoint collection, visibility, threat-hunting, and incident-response platform. It can query and collect forensic artifacts from one system or across an authorized fleet using the Velociraptor Query Language (VQL).

Alignment: NIST SP 800-86 — Collection, Examination, and Incident Response · MITRE ATT&CK — threat hunting, data collection, and technique detection · Cyber Kill Chain — detection and response across multiple stages

• Velociraptor Training — Free official course covering deployment, artifact collection, VQL, hunting, and forensic analysis.
• Velociraptor — GitHub — Official source, releases, documentation, deployment examples, and issue tracker.

ExifTool

Cross-platform metadata reader and writer by Phil Harvey. It is useful for examining timestamps, camera information, GPS data, document properties, and embedded metadata across a large range of media and file formats.

Alignment: NIST SP 800-86 — File Examination and Metadata Analysis · PTES — Intelligence Gathering support

• ExifTool Application Documentation — Official command reference, options, examples, supported operations, and cautions.
• ExifTool — GitHub — Official source repository and development history.

Encoding, Ciphers, and Analysis

• Rumkin Cipher Tools — Classical cipher, encoding, and puzzle-solving tools.
• Ciphey — Automated decoding and decryption tool for common encodings and classical ciphers.
• CyberChef — Browser-based toolkit for encoding, decoding, encryption, compression, and data analysis.
  • CyberChef Source — GitHub — Official source code with instructions for running the application locally.
• Base64 Decode — Online Base64 encoder and decoder.
• quipqiup — Automated solver for simple substitution ciphers.
• Boxentriq Cryptogram Solver — Interactive cryptogram and substitution-cipher solver.
• dCode — Collection of cipher, mathematics, encoding, and puzzle-solving tools.
• RsaCtfTool — Toolkit for analyzing weak RSA keys in authorized CTF and research environments.
• Cryptii Caesar Cipher — Interactive Caesar-cipher encoder and decoder.
  • Cryptii Source — GitHub — Official source for the browser-based modular encoding and encryption application.
• Omniglot — Reference for writing systems, alphabets, and languages.

Hash Identification and Lookup Services

• HashMob — Community platform for authorized hash research and password recovery.
• Hashes.com — Hash identification and lookup tools.
• MD5Decrypt — Lookup and educational reference for common hash formats.
• dCode MD5 Tool — MD5 hashing, identification, and reference tool.
• PasswordRecovery.io SHA-1 Tool — SHA-1 lookup and password-recovery utility.
• Rainbow Tables — Legacy reference and lookup resource for rainbow-table-based password recovery.

Hands-On Labs and CTF Practice

General Platforms

• Hack The Box — Hands-on cybersecurity labs, machines, challenges, and learning paths.
• TryHackMe — Guided, browser-based cybersecurity training and practice labs.
• picoCTF — Beginner-friendly cybersecurity education and jeopardy-style challenges.
• OverTheWire — Security wargames; Bandit is a good starting point for Linux fundamentals.
• Root Me — Challenges and virtual environments covering a broad range of security topics.
• RingZer0 CTF — Jeopardy-style challenges across multiple cybersecurity categories.
• Net-Force Challenges — Security challenges covering cryptography, programming, networking, and related topics.
• CSAW — Student-focused cybersecurity competitions, challenges, and educational events.
• CTFlearn — Community-driven jeopardy-style cybersecurity challenges.
• Hacking-Lab — Cybersecurity exercises, competitions, and training environments.
• AttackDefense Labs — Browser-accessible, hands-on cybersecurity labs.
• W3Challs — Jeopardy-style security challenges with beginner material.
• echoCTF — Online platform for practicing offensive and defensive security skills.
• Hack This Site — Security missions and challenges for learning web and application security.
• HBH — Community-based cybersecurity challenges and learning material.
• Hacker Gateway — Jeopardy-style security challenges.
• Suninatas — Korean jeopardy-style security challenge platform.
• BlockCTF — Capture-the-flag competition and challenge platform formerly hosted as Square CTF.

Vulnerable Machines and Practice Environments

• VulnHub — Downloadable, intentionally vulnerable virtual machines for hands-on practice.
• HackMyVM — Boot-to-root virtual machines and online labs.
• Exploit Education — Vulnerable virtual machines for learning memory corruption, exploitation, and debugging.
• Pwn Adventure 3 — Intentionally vulnerable multiplayer game designed for security experimentation.
• HPAndro Android CTF — Beginner-oriented Android security challenges.

Mobile Application Security Practice

• OWASP MAS Crackmes — Intentionally vulnerable Android and iOS applications designed for practicing OWASP MASTG testing and reverse-engineering techniques.
• Damn Insecure and Vulnerable App (DIVA) — Intentionally insecure Android application for practicing common mobile application vulnerabilities in an authorized lab.
• InsecureShop — Intentionally vulnerable Android application for learning mobile testing, reverse engineering, and exploitation techniques.

Automotive and CAN Bus Practice

• ICSim — Instrument Cluster Simulator — Open-source simulated vehicle instrument cluster for safely learning CAN bus capture, replay, filtering, and signal identification through SocketCAN.
• ICSim++ — Expanded Linux-based CAN bus simulator from the University of Adelaide Cyber Security Lab, supporting multiple virtual CAN interfaces and additional instrument-cluster exercises.
• Car Hacking Village — Automotive-security community offering educational material, conference activities, and hands-on CTF events.

Web and Application Security Challenges

• Defend the Web — Interactive web-security challenges and learning material.
• Webhacking.kr — Web-exploitation challenges.
• Lord of SQLInjection — Challenges focused on SQL injection techniques.
• XSS Game — Cross-site scripting challenges.
• Google XSS Game — Interactive lessons and challenges covering cross-site scripting.
• PromptRiddle — Prompt-based security puzzles and challenges.

Binary Exploitation and Reverse Engineering

• pwnable.kr — Binary-exploitation wargames presented with playful themes.
• pwnable.tw — Advanced binary-exploitation challenges.
• pwnable.xyz — Binary-exploitation wargames.
• Smash the Stack — Wargames focused on exploitation and low-level security concepts.
• Microcorruption — Embedded-security challenges involving assembly, debugging, and lock firmware.
• Reversing.kr — Reverse-engineering challenges.
• Crackmes.one — Community collection of programs created for reverse-engineering practice.

Cryptography Challenges

• CryptoHack — Interactive cryptography courses and challenges.
• Cryptopals — Practical programming challenges based on real-world cryptographic weaknesses.
• id0-rsa — Cryptography challenges with an emphasis on RSA.
• TryToDecrypt — Online cryptography puzzles and challenges.

Command-Line Practice

• UnderTheWire — PowerShell-focused wargames.
• CMD Challenge — Short command-line exercises for practicing shell skills.