Tools

Bellingcat's public, community-maintained spreadsheet of OSINT tools and resources spanning geolocation, archives, social media and satellite imagery, used in their open-source investigations.

Trail of Bits' long-running reference covering pwn, reversing, crypto and steganography techniques for CTF play — dated in places but still a solid first read for each category.

Enormous library of online solvers and identifiers for classical ciphers, encodings and CTF-favourite puzzle formats — often the fastest way to identify what you are even looking at.

A maintained, searchable reference of default usernames/passwords for hundreds of network appliances, admin panels and IoT devices, saving a wiki-diving detour mid-engagement.

Pastes a shell command and breaks down what every flag and pipe segment does against the real man page — handy for decoding an unfamiliar one-liner found in a writeup or a payload.

Exploit-DB's long-running, categorised archive of Google dorks for finding exposed files, login portals, error messages and vulnerable systems via search-engine indexing.

One loop instead of six separate dig invocations when you want the full picture of a domain's A/AAAA/MX/TXT/NS/SOA/CNAME records.

for t in A AAAA MX TXT NS SOA CNAME; do echo "== $t =="; dig +short example.com "$t"; done

Companion project to GTFOBins cataloguing argument-injection tricks — binaries that can be abused not through their own function but by smuggling attacker-controlled flags into their invocation.

A community-maintained methodology wiki covering pentesting techniques across web, cloud, AD, mobile and binary exploitation — organised as a checklist you actually work through during an engagement.

Shellphish's collection of annotated, runnable examples of glibc heap exploitation techniques (fastbin dup, unsafe unlink, tcache poisoning and more) across libc versions — the standard reference for learning heap pwn.

The Windows counterpart to GTFOBins — signed, native Windows binaries and scripts that can be repurposed to download, execute or exfiltrate without dropping extra tooling on disk.

Catalogue of known vulnerable and malicious signed Windows kernel drivers (the "bring your own vulnerable driver" list) used for EDR-killing and kernel-level attacks.

Not a tool but a curated, clickable index of OSINT tools and resources organised by category — the map most people start from before they know which specific tool they need.

Michael Bazzell's long-running OSINT resource site, companion to the "OSINT Techniques" book, with categorised tool links and methodology notes kept current as sites change.

OWASP's collection of concise, defensive "how to actually do this correctly" references (auth, session management, input validation, crypto storage) rather than attack techniques.

Search-engine dork pattern for finding leaked credentials or source snippets accidentally posted to public paste sites for a target domain.

site:pastebin.com "example.com" (password OR api_key OR secret)
# repeat against site:ghostbin.com, site:paste.ee, site:rentry.co for broader paste-site coverage

A huge, actively maintained collection of payloads and bypass techniques for practically every vulnerability class — the reference every web pentester keeps a tab open to.

The canonical one-page reference of reverse shell one-liners in every language likely to be sitting on a compromised box — old, still correct, still bookmarked by everyone.

Web-based reverse shell generator covering many languages/encodings at once, auto-filling your IP/port and offering URL-encoding and MSFVenom variants without hand-editing a template.

Shodan's own reference for its search filter syntax (product, port, org, ssl.cert, etc.) — essential for turning a vague "find exposed X" into a precise query.

GTFOBins-style interactive cheat sheet for offensive Windows/Active Directory commands (PowerShell, WMI, native binaries) covering recon through lateral movement.