Everything the team reaches for — CTF, red team, blue team, OSINT, forensics, wireless and living-off-the-land, plus the one-liners we retype every engagement. Search, filter by tag, and click any code block to copy it.
Community-reported IP abuse database — checks whether an address has been reported for brute-forcing, spam or scanning, with a confidence score and report history.
Search engine for Tor hidden services that filters out abuse content, one of the few indexing engines that actually crawls .onion sites in a structured way.
Open Threat Exchange — a free, community-driven threat-intelligence sharing platform with searchable "pulses" of IOCs contributed by security researchers.
Python library and CLI for reverse-engineering Android apps programmatically — parses DEX/APK structure, builds call graphs and diffs for scripted analysis rather than manual GUI review.
androguard analyze app.apk
Python binary analysis platform combining symbolic execution, CFG recovery and taint tracking — the go-to for scripting a solve against a stripped pwn or reversing binary.
python3 -c "import angr; p = angr.Project('./chall'); print(p.factory.entry_state())"
Preprint archive listing for the cryptography-and-security category, where much academic security research appears months before formal conference publication.
Bellingcat's public, community-maintained spreadsheet of OSINT tools and resources spanning geolocation, archives, social media and satellite imagery, used in their open-source investigations.
Complete number field sieve implementation for factoring very large RSA moduli — the tool of last resort once yafu/msieve are too slow for the key size involved.
Center for Applied Internet Data Analysis — hosts long-running academic datasets on internet topology, routing and traffic used in network-security research.
Search-results clustering engine that groups a large result set into labelled topic clusters, useful for making sense of a broad OSINT search dump.
Open-source side-channel power analysis and voltage/clock glitching platform (hardware + Python toolchain) for practical hands-on work with fault injection and DPA, not just theory.
The US government's list of CVEs confirmed to be actively exploited in the wild, used to prioritise patching over raw CVSS score alone.
Open, petabyte-scale repository of web crawl data, usable to find historical pages, linking patterns or exposed content at a scale no single scraper could reach.
The UK's official company registry — filings, officers, ownership and accounts for every UK-registered company, free to search and download.
Cloud-hosted virtual iOS and Android devices with full root/jailbreak-equivalent access, used for mobile security research at scale where physical jailbroken hardware does not.
Free US business and officer relationship search, useful for mapping which people sit on multiple company registrations.
Community-maintained repository of "crackmes" — small deliberately-obfuscated binaries for practicing reverse engineering, searchable by language, platform and difficulty.
Gamified platform for learning cryptography by breaking progressively harder CTF-style crypto challenges, from classical ciphers through RSA, ECC and modern primitives.
Visual, drag-and-drop workbench for building cryptanalysis pipelines — includes ready-made attacks on historical ciphers (Enigma, Vigenère, classical substitution) alongside modern crypto demos.
Trail of Bits' long-running reference covering pwn, reversing, crypto and steganography techniques for CTF play — dated in places but still a solid first read for each category.
Browsable, filterable front-end over CVE/NVD data — search by vendor, product, version or vulnerability type, with year-over-year trend statistics per product.
Tracks which CVEs the security community is actively discussing right now, built from monitoring public social chatter rather than official severity scores.
The CVE Program's own record site — the canonical assignment authority database, distinct from NVD's enriched CVSS/CPE layer on top of the same IDs.
Comprehensive bibliography database of computer-science publications, the standard way to trace an author's full publication history or a paper's exact venue and year.
Archive of past DEF CON talk slides, whitepapers and video, going back to the conference's early years — a large chunk of applied security research history.
Paid breach-data search engine indexing leaked credential dumps, searchable by email, username, IP, name or password hash — used for credential-exposure investigations.
Historical passive-DNS database (the former Farsight DNSDB) that tracks every observed DNS record over time, used to see what a domain resolved to in the past.
Decodes common digital voice radio protocols (P25, DMR, D-STAR, NXDN and more) from a demodulated audio stream, typically fed by rtl_fm.
rtl_fm -f 154.6M -s 48000 | dsd -i - -o /dev/null
Email OSINT tool that checks a target address against Google, Skype, Amazon and other services to reveal linked account names, profile photos and registration status.
Series of downloadable VM-based wargames (Phoenix, Nebula, Fusion and others) teaching binary exploitation fundamentals step by step.
Archived mirror of the Full Disclosure mailing list — unmoderated public vulnerability disclosure going back decades, searchable by keyword.
AI-assisted geolocation tool that estimates where a photo was taken from visual cues alone (terrain, signage, architecture) — a modern automation of manual geolocation OSINT.
GitHub's curated database of security advisories for open-source packages across major ecosystems (npm, PyPI, Maven, RubyGems, etc.), backing Dependabot alerts.
Scan a git repository's full history for accidentally committed secrets (API keys, tokens, credentials) rather than just the current checkout.
pip install trufflehog3 trufflehog3 https://github.com/org/repo.git # or the Go rewrite, scanning a local clone including history: trufflehog git file://./repo
Global registry of Legal Entity Identifiers, ties a company name to a verified, internationally standardised legal identity record.
Free monitoring service that emails you whenever a new page matching a search term is indexed, used for ongoing passive monitoring of a target or brand.
General academic search engine widely used to trace citations of a security paper and find who has since built on or broken a given technique.
GNU Radio out-of-tree module for receiving and decoding GSM traffic with an SDR — the standard building block behind most "GSM sniffing with a $20 dongle" demos.
grgsm_livemon_headless -f 935.2M
Fast full-text code search engine across half a million public Git repositories, useful for finding leaked secrets, specific library usage or vulnerable code patterns at scale.
Tracks internet-wide scanning and background noise so a defender can tell "this IP is mass-scanning the whole internet" apart from "this IP is targeting us specifically" — cuts a huge amount of false-positive triage out of alert review.
Curated database of Unix binaries that can be abused to bypass local security restrictions (privesc, shell escape, file read/write) once you already have limited execution.
Troy Hunt's free breach-notification service — checks whether an email or password has appeared in a known data breach, with a domain-level API for organisations.
Curated database of known DLL hijacking opportunities in legitimate Windows and third-party software, indexed by binary, missing DLL and export requirements.
The cryptography community's own preprint repository — new attacks, protocols and proofs are posted here well before appearing at CRYPTO, EUROCRYPT or a journal.
Searchable database of entities named in the ICIJ's cross-border investigations (Panama Papers, Paradise Papers, Pandora Papers and others).
Offline viewer for analysing recorded IQ capture files by eye — zoom, measure and manually mark out symbols in a signal before writing a decoder for it.
inspectrum capture.cfile
Search engine and data archive covering leaks, breaches, darknet content, WHOIS history and document dumps, searchable by selector (email, domain, IP, hash, Bitcoin address).
A threat-intel aggregation platform that fans a single observable (hash, IP, domain, URL) out to dozens of analyzers — VirusTotal, AbuseIPDB, YARA, sandboxes — and returns one combined report instead of querying each by hand.
Full-text search across the Internet Archive's millions of archived books, documents and software — distinct from the Wayback Machine's URL-based page snapshots.
Symbolic execution engine that runs LLVM bitcode and generates test cases covering every path it can reach — used for both bug-hunting and CTF challenges compiled to bitcode.
klee ./program.bc
Crowd-sourced database mapping relationships between powerful people, companies and organisations — board seats, donations, family ties.
Reference database of Windows binaries, scripts and libraries that can be repurposed for living-off-the-land attack techniques — the site itself, not any single one-liner in it.
macOS equivalent of GTFOBins/LOLBAS — documents native macOS binaries that can be abused for living-off-the-land offensive techniques.
abuse.ch project sharing malware samples and hashes submitted by the community, with free API access for hash lookups and bulk sample downloads for research.
Trail of Bits' symbolic execution tool for exploring a binary's (or EVM contract's) execution paths and generating concrete inputs that reach a chosen state.
manticore ./chall
Python reverse-engineering framework covering disassembly, lifting to an intermediate representation, emulation and symbolic execution across several architectures.
The ATT&CK knowledge base itself — tactics, techniques and real intrusion examples per adversary group — distinct from the interactive Navigator tool built on top of it.
Interactive matrix tool for exploring, annotating and layering the ATT&CK framework — used to map detections/coverage or plan a red-team engagement against real adversary techniques.
MITRE's knowledge graph of defensive countermeasures, mapped against ATT&CK offensive techniques — the "other side" of ATT&CK for planning detections and mitigations.
Pre-recorded, ATT&CK-mapped security event datasets (from Roberto Rodriguez's OTR project) for practising detection engineering and hunting without needing your own attack lab.
Decodes classic digital paging/data-over-radio protocols (POCSAG, FLEX, AFSK, DTMF and more) from an audio stream, usually piped straight from rtl_fm.
rtl_fm -f 152.0M | multimon-ng -a POCSAG512 -t raw -
Freely available proceedings of the Network and Distributed System Security Symposium, another top-tier venue alongside USENIX Security, IEEE S&P and CCS.
A domain's hosting history in one report — IP history, hosting provider changes, detected technology and a risk rating, often used to attribute infrastructure moves.
Protocol reverse-engineering tool — infers the message format and state machine of an unknown or undocumented protocol from captured traffic samples.
NIST's official vulnerability database — the canonical source for CVE records, CVSS scores and CPE data, with a full public API.
Cross-border investigative search engine over leaked documents, corporate registries and sanctions data, built by the Organized Crime and Corruption Reporting Project.
The largest open database of company registration records worldwide, aggregating official company-registry data from dozens of jurisdictions.
An open-source threat intelligence platform structured around the STIX2 data model — links indicators, malware, threat actors and campaigns as a knowledge graph rather than a flat feed of IOCs.
Free CVE tracking and alerting platform — subscribe to specific vendors/products and get notified of new or updated CVEs affecting them.
Consolidated, searchable database of global sanctions lists, politically exposed persons and watchlists, free for non-commercial use.
Open-source GSM baseband firmware and host tools for a handful of old Motorola phones, letting researchers run and inspect the actual GSM protocol stack instead of only sniffing the air interface.
Open-source vulnerability database aggregating advisories across language package ecosystems (npm, PyPI, Go, crates.io, etc) with a queryable API.
Classic set of SSH-accessible wargames (Bandit, Narnia, Krypton and more) teaching Linux, binary exploitation and cryptography fundamentals level by level.
ssh [email protected] -p 2220
Long-running archive of exploits, advisories, tools and papers, mirroring much of Exploit-DB's content alongside its own original submissions.
Frida-based web UI for poking at an iOS app's file system, keychain, class list and network traffic on a jailbroken device — a lighter, browser-based alternative to Needle for quick looks.
Every issue of the long-running Phrack e-zine, still publishing original exploitation-technique writeups decades after it started.
Carnegie Mellon's beginner-friendly CTF, whose archive of past-competition challenges stays open year-round as a practice platform across binary, crypto, web and forensics categories.
Facial-recognition reverse image search that finds other photos of the same face across the indexed web — widely used and widely criticised; know your legal/ethical footing before using it on a person.
Commercial people-search API aggregating public records, social profiles and contact data for identity-resolution and investigative use cases.
Searchable archive of pastebin.com dumps going back years, letting you search historical paste content by keyword after the original paste has been deleted.
Free threat-intelligence search engine that correlates indicators pulled from a wide range of open-source feeds into a single scored lookup.
Long-running wargame focused on system/binary exploitation ("pwnable") challenges of increasing difficulty, one of the most cited practice grounds for CTF pwn.
Taiwan-based binary exploitation wargame in the same spirit as pwnable.kr, with a broad and well-regarded set of pwn challenges.
Bridges radare2's static analysis and Frida's dynamic instrumentation into one session, so a mobile (or desktop) binary can be disassembled and hooked from the same prompt.
r2 frida://usb//com.example.app
Reverse-engineering focused wargame site with a long-standing set of crackme-style challenges.
Free tier of Microsoft's threat-intel platform (formerly RiskIQ PassiveTotal) offering passive DNS, WHOIS history and certificate data for infrastructure investigations.
A structured series of binary exploitation challenges purpose-built to teach ROP techniques, with the same challenge repeated across x86, x86-64, ARM and MIPS builds.
Decodes and prints the traffic of hundreds of ISM-band devices (weather stations, tyre-pressure sensors, wireless doorbells, key fobs) from an RTL-SDR-class dongle.
rtl_433 -f 433.92M
Full computer algebra system with deep number-theory and elliptic-curve support — the usual scripting environment for hand-rolled RSA/ECC/lattice attacks that go beyond canned tools.
sage -c "print(factor(n))"
Searches the full text of every filing submitted to the US SEC (10-K, 8-K, proxy statements, etc), useful for corporate due-diligence and executive research.
Curated collection of publicly available security-relevant datasets (network captures, logs, malware metadata) for research and detection-engineering practice.
Historical and current DNS/WHOIS intelligence platform — passive DNS history, IP neighbor lists and subdomain data, popular for infrastructure attribution.
AI-assisted academic search engine with citation graphs and influence scoring, an alternative lens on the same literature Google Scholar indexes.
Nonprofit that scans the internet at scale and sends free daily exposure/compromise reports to the network owners who register for them.
Subscription database-breach search engine used in credential and account-exposure investigations, searchable by email, username, IP or password hash.
Searchable database of known vulnerabilities in open-source library dependencies across major language ecosystems, with remediation/fixed-version guidance.
Code search and navigation engine across many repositories at once, self-hostable or hosted — useful for tracing where a leaked secret or vulnerable pattern is actually used.
Search engine that aggregates exploits and security tools from multiple public sources (Exploit-DB, GitHub, Metasploit modules) into one searchable index.
Sun position/shadow-length calculator for any place and date, used in manual image geolocation to narrow down time-of-day and time-of-year from shadows in a photo.
Free web-mention monitoring service similar to Google Alerts, useful as a second source since the two crawl and rank differently.
Curated repository of live malware samples for research and defence testing — clearly labelled and deliberately hard to run by accident.
abuse.ch platform for sharing indicators of compromise (IOCs) — malicious IPs, domains and URLs tied to specific malware families, free to query via API.
Dynamic binary analysis library combining symbolic execution and taint analysis, usable as a scriptable engine for deobfuscation and constraint solving in RE work.
GUI workbench for reverse-engineering unknown radio protocols — demodulate, decode and re-encode signals, then fuzz them, without writing GNU Radio flowgraphs by hand.
abuse.ch project tracking URLs actively distributing malware, with a searchable database and downloadable blocklists for defensive use.
Free sandboxed URL scanner that renders a page, records every request it makes, and archives screenshots and the DOM — used to safely inspect a suspicious link before clicking it.
Checks a website's reputation against multiple blacklist and reputation engines at once, a quick sanity check before visiting an unfamiliar link.
Freely available full proceedings of USENIX Security, one of the top academic venues for systems-security research, with papers going back decades.
delv (shipped with BIND) walks the DNSSEC chain from the root down and reports exactly where validation succeeds or breaks, which dig alone won't show.
delv +rtrace example.com
Multi-engine file/URL/domain/IP reputation lookup aggregating dozens of AV engines and sandboxes — the standard first stop for triaging a suspicious sample or link.
Community-driven vulnerability database with its own numeric risk scoring alongside CVSS, and exploit/patch availability tracking per entry.
Vulnerability intelligence search engine tracking newly disclosed CVEs, linked exploits and vendor patches, with free email alerts by product.
Vulnerability intelligence platform tracking real-world exploitation and public PoC availability for CVEs, going beyond static CVSS scoring.
Independent full-disclosure vulnerability research archive with detailed technical write-ups, often published ahead of or alongside vendor patches.
Aggregated vulnerability intelligence database and API pulling together CVEs, vendor advisories, exploit-DB entries and patch data in one searchable feed, with Nmap/Burp integrations.
Large public archive of malware samples, source code leaks and research papers — the go-to reference library for malware researchers looking up a family or campaign.
Internet Archive's historical web snapshot service — recovers deleted pages, old site structure, past staff/contact pages and prior versions of JS/robots.txt for recon.
Reverse image search engine with notably better face and landmark matching than Google/Bing for OSINT work, especially outside the US/EU.
"Your Everyday Threat Intelligence" — a platform for aggregating and de-duplicating observables, TTPs and threat data from multiple feeds into one queryable, taggable repository for an analyst team to build on.
Public advisories from Trend Micro's ZDI bug-bounty program, published once a vendor patches or a disclosure deadline passes, with technical root-cause detail.
An internet-wide, single-packet network scanner built for research-scale sweeps of the whole IPv4 address space on a single port, rather than deep per-host scanning of a target list.
zmap -p 443 -o results.csv
A DNS and DNSSEC health-check tool developed by .SE and AFNIC — runs dozens of correctness and best-practice tests against a domain's DNS delegation and reports misconfigurations before they cause an outage or a security gap.