RESOURCES

portswigger.net · VERIFIED 2026-08-24

TECHNIQUE LIBRARY

PortSwigger Web Security Topics

Research-backed explanations and exploitation methodology for modern web vulnerabilities, from foundational injection to advanced request and browser attacks.

WEBAPIOSWA

PAYLOAD LIBRARY

PayloadsAllTheThings

Curated payloads, bypasses, methodology, and references for web application testing, privilege escalation, Active Directory, and shells.

WEBINTERNALPAYLOADS

thehacker.recipes · VERIFIED 2026-08-24

TECHNIQUE LIBRARY

The Hacker Recipes

Detailed attack recipes with particularly strong coverage of Active Directory, Kerberos, NTLM, certificates, and Windows movement.

ADINTERNALWINDOWS

CHEAT SHEETS

PentestMonkey Cheat Sheets

Compact command references for reverse shells, database-specific SQL injection, and common penetration-testing tasks.

WEBDATABASESHELLS

wadcoms.github.io · VERIFIED 2026-08-24

INTERACTIVE CHEAT SHEET

WADComs

Searchable Windows and Active Directory commands organized by what you have, where you are, and what action you need next.

ADWINDOWSINTERNAL

FIELD NOTES

ired.team Offensive Notes

Technique-focused notes for Windows, Active Directory, Kerberos, lateral movement, persistence, and adversary simulation.

ADWINDOWSRED-TEAM

ired.team · VERIFIED 2026-08-24

Active Directory Exploitation Cheat Sheet

Command-heavy reference for domain enumeration, credential attacks, movement, delegation, ACL abuse, and persistence.

ADINTERNALOSCP

gtfobins.github.io · VERIFIED 2026-08-24

LIVING OFF THE LAND

GTFOBins

Curated Unix binaries that can be used to escape restrictions, elevate privileges, transfer files, or obtain shell behavior when misconfigured.

LINUXPRIVESCPOST-EXPLOIT

LIVING OFF THE LAND

LOLBAS

Documented Windows binaries, scripts, and libraries with execution, download, bypass, and alternate-use behaviors.

WINDOWSPOST-EXPLOITDEFENSE

lolbas-project.github.io · VERIFIED 2026-08-24

DRIVER REFERENCE

LOLDrivers

Curated Windows drivers known to be abused for defense evasion and privilege-related attack paths, with hashes and detection context.

WINDOWSDRIVERSDEFENSE

loldrivers.io · VERIFIED 2026-08-24

SHELL GENERATOR

Reverse Shell Generator

Searchable reverse-shell, bind-shell, listener, encoding, and payload-generation reference for multiple runtimes and operating systems.

SHELLSWINDOWSLINUX

revshells.com · VERIFIED 2026-08-24

FUZZING DATA

fuzzdb

Predictable attack strings, discovery patterns, regexes, and response-analysis material for testing application inputs.

WEBFUZZINGPAYLOADS

SQL Injection

Detection, UNION and blind techniques, database enumeration, file access, command execution, and dialect-specific payload families.

WEBSQLIDATABASEOSWA

Cross-Site Scripting

Context-specific XSS payloads, encodings, filter bypasses, CSP considerations, data access, and browser execution techniques.

WEBXSSCLIENT-SIDEOSWA

Cross-Site Request Forgery

Request construction, token weaknesses, SameSite behavior, method variations, content types, and cross-origin delivery patterns.

WEBCSRFAUTHOSWA

Server-Side Request Forgery

Callback validation, localhost and private-network targeting, parser bypasses, alternate schemes, metadata, and blind SSRF.

WEBSSRFCLOUDOSWA

Server-Side Template Injection

Template-engine fingerprinting and sandbox-escape references for Jinja, Twig, FreeMarker, Pug, Handlebars, and other engines.

WEBSSTIRCEOSWA

WEBCOMMAND-INJECTIONRCEOSWA

OS Command Injection

Unix and Windows separators, blind timing, out-of-band confirmation, whitespace bypasses, and command-execution payloads.

XML External Entity Injection

In-band, error-based, blind, external-DTD, parameter-entity, file-read, and SSRF-oriented XXE techniques.

WEBXXEXMLOSWA

WEBTRAVERSALFILE-READOSWA

Directory Traversal and File Read

Linux and Windows traversal sequences, encoding, normalization bypasses, wrappers, file targets, and source disclosure.

IDOR and Broken Object Authorization

Object discovery, identifier substitution, UUID collection, parameter pollution, method switching, and authorization testing.

WEBAPIIDOROSWA

CORS Misconfiguration

Reflected origins, credentialed requests, null origins, parser mistakes, allowlist bypasses, and exploitation examples.

WEBAPICORS

Insecure File Upload

Extension, MIME, magic-byte, parser, filename, archive, and web-shell techniques for upload validation testing.

WEBFILE-UPLOADRCE

NoSQL Injection

MongoDB and operator injection, authentication bypass, blind extraction, JavaScript execution, and syntax references.

WEBAPINOSQL

LDAP Injection

LDAP filter manipulation, authentication bypass, attribute discovery, blind extraction, escaping, and syntax differences.

WEBLDAPAD

XPath Injection

Authentication bypass, boolean discovery, blind extraction, and XPath syntax for XML-backed applications.

WEBXPATHXML

HTTP Request Smuggling

CL.TE, TE.CL, TE.TE, HTTP/2 downgrade, response queue poisoning, and front-end/back-end parsing discrepancies.

WEBHTTPEXTERNAL

HTTP Parameter Pollution

Duplicate parameter behavior across server technologies, client-side pollution, and filter-versus-backend parsing differences.

WEBAPIHTTP

Open Redirect

Parser edge cases, encoding, scheme-relative URLs, validation bypasses, and redirect chaining.

WEBREDIRECTAUTH

OAuth Misconfiguration

Redirect URI weaknesses, state and PKCE problems, token leakage, account linking, and provider/application trust failures.

WEBAPIOAUTHIDENTITY

JSON Web Token Attacks

Algorithm confusion, missing verification, key injection, JWK/JWKS abuse, claim manipulation, and cracking workflows.

WEBAPIJWTAUTH

Insecure Deserialization

Serialization formats, gadget chains, detection markers, tooling, and language-specific exploitation references.

WEBDESERIALIZATIONRCE

Prototype Pollution

Client- and server-side JavaScript prototype manipulation, source/sink discovery, gadgets, and filter bypasses.

WEBJAVASCRIPTAPI

Web Cache Poisoning and Deception

Cache-key analysis, unkeyed input, path confusion, delimiter differences, poisoning, and private-content deception.

WEBCACHEHTTP

Race Conditions

Limit-overrun, state-transition, single-packet, session, and time-of-check/time-of-use testing patterns.

WEBAPIBUSINESS-LOGIC

WebSocket Vulnerabilities

Handshake manipulation, message tampering, cross-site WebSocket hijacking, authentication, and origin testing.

WEBWEBSOCKETAPI

GraphQL Injection and Abuse

Introspection, field suggestion, batching, alias abuse, authorization, injection, denial-of-service, and schema discovery.

WEBAPIGRAPHQL

CRLF Injection

Header injection, response splitting, log injection, encoding variants, and downstream proxy behavior.

WEBHTTPINJECTION

Server-Side Include Injection

SSI directive detection, environment disclosure, file inclusion, and command execution on supported servers.

WEBSSIRCE

XSLT Injection

Processor fingerprinting, file access, SSRF, extension functions, and code-execution paths in XSLT transformations.

WEBXSLTXML

CSV and Formula Injection

Spreadsheet formula execution, exfiltration patterns, delimiters, encoding, and application export testing.

WEBCSVCLIENT-SIDE

SAML Injection and Signature Attacks

XML signature wrapping, assertion manipulation, identity-provider confusion, and SAML response testing.

WEBSAMLIDENTITY

MySQL Injection Cheat Sheet

MySQL syntax for versioning, comments, string concatenation, conditional responses, timing, files, and command execution.

WEBSQLIMYSQL

MSSQL Injection Cheat Sheet

Microsoft SQL Server syntax for metadata, timing, errors, file access, linked servers, and operating-system interaction.

WEBSQLIMSSQL

PostgreSQL Injection Cheat Sheet

PostgreSQL syntax for metadata, type conversion, timing, files, stacked queries, and command-execution primitives.

WEBSQLIPOSTGRESQL

Oracle Injection Cheat Sheet

Oracle-specific comments, dual-table behavior, metadata views, timing, errors, network access, and file techniques.

WEBSQLIORACLE

DB2 Injection Cheat Sheet

DB2 query syntax, metadata enumeration, comments, concatenation, conditional responses, and timing reference.

WEBSQLIDB2

Informix Injection Cheat Sheet

Informix syntax for version discovery, users, schemas, tables, comments, strings, and conditional behavior.

WEBSQLIINFORMIX

blog.ropnop.com · VERIFIED 2026-08-24

SHELL CHEAT SHEET

Upgrading Simple Shells

Reliable PTY upgrade patterns, terminal settings, job control, and practical shell stabilization steps.

LINUXSHELLSPOST-EXPLOIT

CHECKLIST

OWASP WSTG Checklist

Spreadsheet and checklist artifacts mapped to Web Security Testing Guide identifiers for planning and coverage tracking.

WEBCHECKLISTREPORTING

portswigger.net · VERIFIED 2026-08-24

PRACTICE INDEX

PortSwigger Complete Lab Index

Every Web Security Academy lab in one index, including mystery labs for methodology practice without knowing the vulnerability first.

WEBAPITRAININGOSWA

API STANDARD

OWASP API Security Top 10

Risk categories and assessment guidance for broken object authorization, authentication, resource consumption, business flows, SSRF, and API inventory.

APIWEBMETHODOLOGY

VERIFICATION STANDARD

OWASP ASVS

Detailed application-security requirements useful for building test cases, remediation guidance, and coverage beyond vulnerability names.

WEBAPIDEFENSE

OWASP GraphQL Cheat Sheet

GraphQL input, authorization, query complexity, batching, introspection, error, and transport security guidance.

APIGRAPHQLDEFENSE

developer.mozilla.org · VERIFIED 2026-08-24

PROTOCOL REFERENCE

MDN HTTP Reference

Authoritative browser-oriented reference for HTTP methods, status codes, headers, cookies, caching, authentication, and cross-origin behavior.

WEBHTTPPROTOCOL

OWASP Web Service Security

Security guidance for REST and SOAP services, transport, schemas, message size, authentication, authorization, and content handling.

APISOAPRESTDEFENSE

learn.microsoft.com · VERIFIED 2026-08-24

IDENTITY / WINDOWS

DOCUMENTATION

BloodHound Documentation

Official documentation for BloodHound Community Edition, collection, analysis, and identity attack-path concepts.

ADINTERNALIDENTITY

specterops.io

PLATFORM DOCS

Microsoft Active Directory DS

Primary documentation for Active Directory Domain Services concepts and administration.

ADINTERNALIDENTITY

learn.microsoft.com

PROTOCOL DOCS

Microsoft Kerberos Overview

Windows Kerberos components, ticket flow, delegation, authentication, and security behavior from the platform vendor.

ADKERBEROSIDENTITY

ADCS RESEARCH

Certified Pre-Owned

Foundational SpecterOps research describing Active Directory Certificate Services escalation and persistence attack paths.

ADADCSINTERNAL

specterops.io · VERIFIED 2026-08-24

RESEARCH

ADSecurity.org

Sean Metcalf's research and defensive material on Active Directory, Kerberos, trusts, credentials, detection, and enterprise identity.

ADKERBEROSDEFENSE

adsecurity.org · VERIFIED 2026-08-24

netexec.wiki · VERIFIED 2026-08-24

NetExec Wiki

Protocol modules, authentication, enumeration, credential validation, databases, and command usage for NetExec.

ADINTERNALTOOL-DOCS

Certipy Wiki

Enumeration and exploitation documentation for Active Directory Certificate Services using Certipy.

ADADCSTOOL-DOCS

Impacket Examples

Canonical example scripts for SMB, Kerberos, NTLM, WMI, secrets, delegation, remote execution, and Windows protocols.

ADINTERNALTOOL-DOCS

bloodhound.specterops.io · VERIFIED 2026-08-24

COLLECTOR DOCS

AzureHound Documentation

Collection setup, permissions, authentication, and data gathering for Microsoft Entra ID attack-path analysis.

ENTRACLOUDIDENTITY

ROADtools Wiki

Authentication, token, directory-data, and exploration documentation for Microsoft Entra ID research and assessment.

ENTRACLOUDTOOL-DOCS

first.org · VERIFIED 2026-08-24

NETWORK / EXTERNAL

KNOWLEDGE BASE

MITRE ATT&CK

A common knowledge base for adversary tactics and techniques used to map and discuss observed behavior.

REPORTINGDEFENSERISK

attack.mitre.org

FRAMEWORK

NIST Cybersecurity Framework

High-level cybersecurity risk-management guidance and supporting implementation resources.

REPORTINGDEFENSERISK

nist.gov

SCORING STANDARD

FIRST CVSS v4.0

Official CVSS v4 specification, calculator, metrics, supplemental guidance, and scoring resources.

REPORTINGCVSSRISK

WEAKNESS TAXONOMY

MITRE CWE

Software and hardware weakness definitions, relationships, consequences, mitigations, examples, and mappings.

REPORTINGCWEDEFENSE

cwe.mitre.org · VERIFIED 2026-08-24

RISK LIST

CWE Top 25

Data-driven list of widespread and consequential software weaknesses with scoring and mapping context.

REPORTINGCWERISK

cwe.mitre.org · VERIFIED 2026-08-24

ATTACK PATTERNS

MITRE CAPEC

Attack-pattern descriptions with prerequisites, execution flow, consequences, mitigations, and related weaknesses.

REPORTINGATTACK-PATHDEFENSE

capec.mitre.org · VERIFIED 2026-08-24

PRIORITIZATION

CISA Known Exploited Vulnerabilities

Authoritative catalog of vulnerabilities with evidence of exploitation and remediation due-date context.

CVEEXTERNALPRIORITIZATION

cisa.gov · VERIFIED 2026-08-24

LIKELIHOOD MODEL

FIRST EPSS

Daily probability estimates for whether published CVEs will be exploited in the wild within the next 30 days.

CVERISKPRIORITIZATION

first.org · VERIFIED 2026-08-24

VULNERABILITY DATA

National Vulnerability Database

NIST vulnerability records, CVE enrichment, affected configurations, CVSS vectors, references, and search.

CVERESEARCHREPORTING

nvd.nist.gov · VERIFIED 2026-08-24

SEVERITY TAXONOMY

Bugcrowd Vulnerability Rating Taxonomy

Living priority taxonomy for common web, API, mobile, infrastructure, hardware, and AI vulnerability classes.

BUG-BOUNTYREPORTINGRISK

bugcrowd.com · VERIFIED 2026-08-24

SEVERITY GUIDANCE

HackerOne Severity Guidance

Platform guidance on report severity, qualitative ratings, CVSS calculator options, and program-specific scoring.

BUG-BOUNTYREPORTINGRISK

docs.hackerone.com · VERIFIED 2026-08-24

RISK METHOD

OWASP Risk Rating Methodology

Structured likelihood and impact estimation for applications when a raw technical score does not tell the full story.

REPORTINGWEBRISK

METHODOLOGYREPORTINGDEFENSE

TESTING STANDARD

NIST SP 800-115

Technical guide for planning, conducting, analyzing, and reporting security testing and assessment work.

csrc.nist.gov · VERIFIED 2026-08-24

METHODOLOGY

Penetration Testing Execution Standard

Engagement phases covering pre-engagement, intelligence, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.

METHODOLOGYREPORTINGPENTEST

pentest-standard.org · VERIFIED 2026-08-24

TOOLS / PLATFORMS

REFERENCE

HackTricks

A resource to help hack almost anything.

INTERNALEXTERNALTOOL-DOCS

hacktricks.wiki

REFERENCE

Kali Linux Tools

An indexed reference for tools packaged with Kali, including descriptions, commands, and links.

INTERNALEXTERNALTOOL-DOCS

kali.org

REFERENCE

Nmap Reference Guide

Primary reference for Nmap scanning behavior, options, output, and scripting capabilities.

INTERNALEXTERNALTOOL-DOCS

nmap.org

CLOUD TECHNIQUES

Hacking the Cloud

Cloud penetration-testing and red-team tradecraft for AWS, Azure, GCP, Terraform, containers, and identity.

CLOUDAWSAZUREGCP

hackingthe.cloud · VERIFIED 2026-08-24

CLOUD PLAYBOOKS

HackTricks Cloud

Provider and service-oriented enumeration, privilege escalation, persistence, and post-exploitation notes.

CLOUDAWSAZUREGCP

cloud.hacktricks.wiki · VERIFIED 2026-08-24

CloudFox

Situational-awareness and attack-path discovery tool for unfamiliar cloud environments, with scoped enumeration workflows.

CLOUDAWSGCPTOOL-DOCS

stratus-red-team.cloud · VERIFIED 2026-08-24

ATTACK EMULATION

Stratus Red Team

Granular, reproducible cloud attack techniques mapped to providers and MITRE ATT&CK tactics.

CLOUDAWSAZUREGCP

IAM ANALYSIS

Principal Mapper

Models AWS IAM principals and permissions to identify privilege escalation and access relationships.

CLOUDAWSIAM

ATTACK PATHS

KubeHound

Kubernetes attack-path graphing for relationships between identities, workloads, permissions, and cluster resources.

CLOUDKUBERNETESCONTAINER

KUBERNETESCONTAINERDEFENSE

RISK STANDARD

OWASP Kubernetes Top 10

Prioritized Kubernetes risks covering workload configuration, authorization, secrets, segmentation, components, and cloud movement.

KUBERNETESCONTAINERMETHODOLOGY

TESTING GUIDE

OWASP Kubernetes Security Testing Guide

Top-down methodology for architecture review, discovery, cluster assessment, container testing, and benchmark auditing.

KUBERNETESCONTAINERDEFENSE

OWASP Kubernetes Security Cheat Sheet

Practical cluster, workload, authorization, networking, secret, and runtime security checks.

OWASP Docker Security Cheat Sheet

Common Docker security errors and controls for hosts, images, users, capabilities, sockets, secrets, and runtimes.

DOCKERCONTAINERDEFENSE

MOBILEANDROIDIOSMETHODOLOGY

TESTING GUIDE

OWASP Mobile Application Security Testing Guide

Comprehensive Android and iOS security testing and reverse-engineering techniques mapped to mobile weaknesses and controls.

mas.owasp.org · VERIFIED 2026-08-24

VERIFICATION STANDARD

OWASP MASVS

Mobile application security requirements covering storage, cryptography, authentication, networking, platform, code, resilience, and privacy.

MOBILEANDROIDIOSDEFENSE

mas.owasp.org · VERIFIED 2026-08-24

Mobile App Pentest Cheat Sheet

Compact Android and iOS test checklist with commands and references mapped to common mobile-security risk areas.

MOBILEANDROIDIOS

MOBILEANDROIDIOSTOOL-DOCS

MobSF Documentation

Static and dynamic analysis setup, APIs, analyzers, reports, and operational guidance for the Mobile Security Framework.

mobsf.github.io · VERIFIED 2026-08-24

INSTRUMENTATION DOCS

Frida Documentation

Dynamic instrumentation concepts, JavaScript APIs, Android, iOS, tracing, messages, modes, and examples.

MOBILERUNTIMETOOL-DOCS

frida.re · VERIFIED 2026-08-24

MOBILEANDROIDIOSTOOL-DOCS

Objection Wiki

Runtime mobile exploration workflows powered by Frida, including files, memory, storage, platform interaction, and patching.

developer.android.com · VERIFIED 2026-08-24

PLATFORM DOCS

Android Security Best Practices

Vendor guidance for permissions, networking, WebView, storage, authentication, cryptography, and component exposure.

MOBILEANDROIDDEFENSE

WIRELESS DOCS

Aircrack-ng Documentation

Official suite reference for monitor mode, capture, packet injection, replay, access points, and WPA/WPA2 assessment.

WIRELESSWIFITOOL-DOCS

aircrack-ng.org · VERIFIED 2026-08-24

WIRELESS TOOLING

hcxtools

Packet-capture conversion and processing tools designed for Hashcat and John the Ripper wireless workflows.

WIRELESSWIFIHASHES

PASSWORDSWIRELESSADTOOL-DOCS

HASH REFERENCE

Hashcat Example Hashes

Canonical mode identifiers and test hashes for NTLM, Kerberos, WPA, archives, databases, applications, and other formats.

hashcat.net · VERIFIED 2026-08-24

RADIO TOOL DOCS

Bettercap Modules

Official module documentation for Wi-Fi, BLE, network discovery, proxies, packet streams, and event-driven assessment.

WIRELESSWIFIBLETOOL-DOCS

bettercap.org · VERIFIED 2026-08-24

WIRELESS DOCS

Kismet Documentation

Wireless discovery, capture sources, channel handling, logging, remote capture, alerts, and device tracking.

WIRELESSWIFIRECON

kismetwireless.net · VERIFIED 2026-08-24

DEVICE DOCS

Hak5 WiFi Pineapple Documentation

Official WiFi Pineapple setup, campaigns, recon, captures, modules, storage, networking, and recovery documentation.

WIRELESSWIFIHARDWARE

docs.hak5.org · VERIFIED 2026-08-24

TESTING GUIDE

OWASP IoT Security Testing Guide

Methodology for IoT architecture, firmware, interfaces, communications, mobile companions, hardware, and privacy testing.

IOTFIRMWAREHARDWARE

FIRMWARE GUIDE

OWASP Firmware Security Testing Methodology

Structured firmware assessment methodology covering acquisition, analysis, emulation, filesystem review, and dynamic testing.

IOTFIRMWAREMETHODOLOGY

FIRMWARE TOOL DOCS

Binwalk

Firmware signature scanning, embedded-file identification, extraction, entropy analysis, and reverse-engineering support.

FIRMWAREIOTTOOL-DOCS

FIRMWARE EMULATION

FirmAE

Automated Linux-based firmware emulation and analysis for supported embedded device images.

FIRMWAREIOTEMULATION

EMBEDDED FRAMEWORK

RouterSploit

Open-source exploitation framework for authorized assessment of embedded devices, routers, services, and credentials.

IOTHARDWAREEXTERNAL

osintframework.com · VERIFIED 2026-08-24

OSINT INDEX

OSINT Framework

A categorized map of public-source research tools for domains, usernames, people, infrastructure, files, images, and metadata.

OSINTRECONEXTERNAL

SEARCH TOOLS

IntelTechniques Search Tools

Centralized forms for public records, usernames, domains, email, social platforms, maps, and general OSINT pivots.

OSINTRECON

inteltechniques.com · VERIFIED 2026-08-24

help.shodan.io · VERIFIED 2026-08-24

Shodan Search Query Fundamentals

Official filters and query behavior for finding exposed internet services, products, certificates, ports, networks, and organizations.

OSINTEXTERNALRECON

docs.censys.com · VERIFIED 2026-08-24

Censys Search Language

Official field, boolean, range, existence, and structured-search syntax for hosts, certificates, and web properties.

OSINTEXTERNALRECON

support.google.com · VERIFIED 2026-08-24

Google Search Operators

Primary reference for exact phrases, exclusions, site restrictions, file types, and other search refinements.

OSINTRECON

docs.github.com · VERIFIED 2026-08-24

GitHub Code Search Syntax

Official syntax for literal, regex, path, language, symbol, repository, organization, and boolean code searches.

OSINTCODESECRETS

CERTIFICATE SEARCH

Certificate Transparency Search

Public certificate-transparency lookup useful for discovering issued names, wildcard scope, and historical certificate data.

OSINTDNSRECON

crt.sh · VERIFIED 2026-08-24

WEB INTELLIGENCE

urlscan.io

Historical and current page scans with requests, hosts, certificates, technologies, screenshots, and observed relationships.

OSINTWEBRECON

urlscan.io · VERIFIED 2026-08-24

WEB ARCHIVE

Internet Archive Wayback Machine

Historical page, path, script, documentation, and asset snapshots useful for understanding earlier attack surface.

OSINTWEBRECON

web.archive.org · VERIFIED 2026-08-24

ENUMERATION DOCS

OWASP Amass Documentation

Asset-discovery concepts and configuration for DNS enumeration, graphing, data sources, tracking, and attack-surface mapping.

RECONDNSEXTERNAL

owasp-amass.github.io · VERIFIED 2026-08-24

ENUMERATION DOCS

Subfinder Documentation

Passive subdomain discovery configuration, providers, inputs, outputs, recursion, filtering, and workflow integration.

RECONDNSEXTERNAL

docs.projectdiscovery.io · VERIFIED 2026-08-24

WORDLISTS

Assetnote Wordlists

Continuously generated content-discovery and technology-specific wordlists derived from real-world web data.

RECONWEBFUZZING

wordlists.assetnote.io · VERIFIED 2026-08-24

SCRIPT INDEX

Nmap NSE Documentation

Searchable documentation for Nmap Scripting Engine categories, arguments, outputs, and protocol-specific checks.

EXTERNALNETWORKNSE

nmap.org · VERIFIED 2026-08-24

SERVICE PLAYBOOKS

HackTricks Network Services

Enumeration and testing notes organized by common TCP and UDP services and their usual weaknesses.

EXTERNALNETWORKINTERNAL

hacktricks.wiki · VERIFIED 2026-08-24

WORDLIST COLLECTION

SecLists

Discovery, fuzzing, usernames, passwords, URLs, patterns, payloads, and protocol wordlists for authorized assessment work.

RECONFUZZINGEXTERNAL

EXTERNALEXPLOIT-RESEARCHTOOL-DOCS

EXPLOIT SEARCH

SearchSploit Manual

Local Exploit-DB searching, path copying, mirror inspection, Nmap XML integration, and result filtering.

exploit-db.com · VERIFIED 2026-08-24

EXPLOIT DATABASE

Exploit Database

Public proof-of-concept archive and searchable vulnerability research maintained by OffSec.

EXTERNALEXPLOIT-RESEARCHCVE

exploit-db.com · VERIFIED 2026-08-24

FRAMEWORK DOCS

Metasploit Documentation

Modules, payloads, sessions, workspaces, databases, development, and safe framework usage documentation.

EXTERNALINTERNALTOOL-DOCS

docs.metasploit.com · VERIFIED 2026-08-24

TEMPLATE LIBRARY

Nuclei Templates

Community-curated vulnerability, exposure, misconfiguration, technology, and DAST templates for the Nuclei engine.

EXTERNALWEBSCANNING

TLS REFERENCE

testssl.sh

Command documentation and test coverage for TLS protocols, ciphers, certificates, vulnerabilities, and HTTP security headers.

EXTERNALTLSTOOL-DOCS

SSH REFERENCE

ssh-audit

SSH server and client auditing for algorithms, key sizes, versions, security recommendations, and known weaknesses.

EXTERNALSSHTOOL-DOCS

FUZZER DOCS

ffuf

Fast web fuzzing syntax for paths, virtual hosts, parameters, POST bodies, recursion, matchers, filters, and replay proxies.

WEBFUZZINGEXTERNAL

epi052.github.io · VERIFIED 2026-08-24

DISCOVERY DOCS

Feroxbuster Documentation

Recursive content discovery, filters, collection methods, configuration, state, proxying, and wordlist usage.

WEBRECONEXTERNAL

HTTP CLIENT DOCS

curl Manual

Complete request construction reference for headers, cookies, authentication, proxies, certificates, uploads, protocols, and debugging.

WEBHTTPTOOL-DOCS

curl.se · VERIFIED 2026-08-24

FILTER REFERENCE

Wireshark Display Filter Reference

Searchable protocol-field reference for precise display filters and packet-analysis evidence.

NETWORKTRAFFICTOOL-DOCS

wireshark.org · VERIFIED 2026-08-24

TRAINING / REFERENCES

HANDS ON

TryHackMe

Hands-on cyber security training through real-world scenarios.

TRAININGLABS

tryhackme.com

HANDS ON

Hack The Box Academy

Develop your skills with guided training and prove your expertise with industry certifications. Become a market-ready cybersecurity professional.

TRAININGLABS

hackthebox.com/

HANDS ON

Web Security Academy

Free, online web security training from the creators of Burp Suite.

TRAININGLABS

portswigger.net

FIELD MANUAL

HISYD OSWA Field Manual

Online WEB-200 methodology, nine vulnerability playbooks, searchable notes, downloadable Markdown checklists, evidence guidance, and reporting references.

OSWAWEBTRAINING

WEB TRAINING

PentesterLab

Focused web-security exercises organized around specific vulnerability classes and code-level understanding.

TRAININGWEBAPI

pentesterlab.com · VERIFIED 2026-08-24

PRACTICE RANGE

OffSec Proving Grounds

Standalone penetration-testing machines for enumeration, exploitation, privilege escalation, and exam-style practice.

TRAININGOSCPEXTERNAL

offsec.com · VERIFIED 2026-08-24

VULNERABLE VMS

VulnHub

Downloadable intentionally vulnerable virtual machines for local, isolated penetration-testing practice.

TRAININGOSCPLAB

vulnhub.com · VERIFIED 2026-08-24

WARGAMES

OverTheWire

Progressive command-line, Linux, web, cryptography, and exploitation challenges delivered as focused wargames.

TRAININGLINUXWEB

overthewire.org · VERIFIED 2026-08-24

HANDS-ON COURSES

pwn.college

Browser-accessible technical modules covering computing foundations, system security, web, software exploitation, and defense.

TRAININGLINUXEXPLOITATION

pwn.college · VERIFIED 2026-08-24

VULNERABLE APP

OWASP Juice Shop

Modern intentionally insecure application with broad OWASP coverage, challenges, score tracking, and multiple deployment options.

TRAININGWEBLAB

VULNERABLE APP

OWASP WebGoat

Guided lessons demonstrating common application vulnerabilities and their defensive fixes in a controlled environment.

TRAININGWEBLAB

VULNERABLE API

OWASP crAPI

Intentionally vulnerable API application designed around modern API-security risks and realistic business flows.

TRAININGAPILAB

VULNERABLE APP

DVWA

Compact PHP and MariaDB application for practicing common web vulnerabilities at configurable difficulty levels.

TRAININGWEBLAB

orange-cyberdefense.github.io · VERIFIED 2026-08-24

VULNERABLE AD LAB

Game of Active Directory

Free multi-domain Active Directory lab designed for practicing common domain, trust, delegation, ADCS, and movement techniques.

TRAININGADLAB

VULNERABLE CLOUD LAB

CloudFoxable

Terraform-deployed AWS environment with gamified attack paths for learning cloud enumeration and privilege relationships.

TRAININGAWSCLOUD

flaws.cloud · VERIFIED 2026-08-24

CLOUD CHALLENGES

flaws.cloud

AWS security challenge series built around common storage, identity, metadata, and service misconfigurations.

TRAININGAWSCLOUD

VULNERABLE K8S LAB

Kubernetes Goat

Intentionally vulnerable Kubernetes environment with scenarios covering workloads, secrets, RBAC, networking, and cluster risks.

TRAININGKUBERNETESCONTAINER

WRITEUPS / NOTES

VM-Notes

Notes for setting up and managing my virtual machines

HISYD / IDENTITY

BloodHound

Attack-path analysis, collection concepts, graph thinking, and practical notes for reviewing Active Directory relationships.

HISYD / IDENTITY

Burp Suite

Proxy-driven web testing workflow, request inspection, Repeater habits, scope control, and keeping evidence organized.

HISYD / WEB

Nmap

Host and service discovery, scan planning, output formats, and turning raw enumeration into useful testing notes.

HISYD / NETWORK

Wireshark

Packet-analysis workflow, display-filter habits, capture review, and extracting evidence without getting lost in the noise.

HISYD / TRAFFIC

WEBPROXYFUZZINGTOOL-NOTES

OWASP ZAP

My ZAP workflow for manual request testing, fuzzing, session handling, evidence capture, and using automation without letting it replace analysis.

ACTIVE DIRECTORYSMBLDAPTOOL-NOTES

NetExec

My NetExec notes for scoped protocol enumeration, credential validation, parsing results, and avoiding unnecessary authentication noise.

ACTIVE DIRECTORYADCSCERTIFICATESTOOL-NOTES

Certipy and ADCS

My Certipy notes for enumerating Active Directory Certificate Services, validating ESC paths, requesting certificates, and preserving the evidence that proves the issue.

SMBKERBEROSNTLMTOOL-NOTES

Impacket

My Impacket notes for choosing the right example script, handling credential formats, troubleshooting Kerberos, and documenting remote-protocol activity.