Resources

A comprehensive collection of training platforms, books, certifications, tools, and communities to accelerate your cybersecurity education and professional development.

Training Platforms

Hands-on learning environments where you can practice penetration testing and security skills safely and legally.

HackTheBox

Advanced penetration testing labs with real-world scenarios and a global community.

TryHackMe

Beginner-friendly cybersecurity training with guided learning paths and virtual labs.

OverTheWire

Free wargames to learn security concepts through fun challenges and problem-solving.

PentesterLab

Learn web penetration testing from basic to advanced with practical exercises.

VulnHub

Free vulnerable virtual machines for practicing penetration testing skills offline.

PicoCTF

Free computer security education through beginner-friendly Capture The Flag competitions.

Root Me

Platform with hundreds of hacking challenges and virtual environments to test your skills.

Application Security

Specialised application security resources including research, training, and vulnerability intelligence for developers and security teams.

Davy Rogers

Davy Rogers personal site, with background on practical AppSec, secure engineering, threat modelling, and security work.

JustAppSec — Research

In-depth application security research covering threat models, attack vectors, and defensive controls for OWASP Top 10 and beyond.

JustAppSec — Training

Structured application security training pathways: secure coding, architecture, CI/CD security, monitoring, and offensive testing.

JustAppSec — CVE Database

Searchable CVE intelligence with CVSS scoring, severity filters, and links to related training and research.

JustAppSec — AppSec Scorecard

Free interactive self-assessment to evaluate your application security maturity across 10 key areas.

Bug Bounty Platforms

Earn money by finding and responsibly disclosing security vulnerabilities in real applications.

HackerOne

World's largest bug bounty platform connecting hackers with organizations seeking security research.

Bugcrowd

Crowdsourced cybersecurity platform for vulnerability disclosure and penetration testing.

Synack

Invite-only platform combining vetted security researchers with enterprise targets.

Intigriti

European bug bounty platform with focus on responsible disclosure and researcher community.

Certifications

Industry-recognized certifications to validate your cybersecurity skills and advance your career.

OSCP - Offensive Security Certified Professional

Highly respected hands-on penetration testing certification with 24-hour practical exam.

GPEN - GIAC Penetration Tester

Technical certification validating penetration testing skills from SANS Institute.

eJPT - Junior Penetration Tester

Beginner-friendly practical certification from eLearnSecurity, great for starting out.

CompTIA Security+

Entry-level security certification covering foundational cybersecurity concepts.

CISSP - Certified Information Systems Security Professional

Advanced certification for security professionals with management and leadership focus.

PNPT - Practical Network Penetration Tester

Real-world focused penetration testing certification from TCM Security.

CRTP - Certified Red Team Professional

Active Directory security certification focusing on enterprise attack techniques.

Essential Tools

Industry-standard security tools used by professionals for authorized testing and security research.

Kali Linux

Debian-based Linux distribution with 600+ preinstalled penetration testing tools.

Burp Suite

Leading web application security testing toolkit with intercepting proxy and scanner.

Wireshark

World's most popular network protocol analyzer for troubleshooting and security analysis.

Metasploit Framework

Comprehensive penetration testing framework for developing and executing exploits.

Nmap

Powerful network scanner for host discovery, port scanning, and service enumeration.

OWASP ZAP

Free, open-source web application security scanner maintained by OWASP.

Hashcat

World's fastest password recovery tool supporting multiple hash algorithms.

John the Ripper

Fast password cracker supporting hundreds of hash and cipher types.

Documentation & References

Essential documentation, databases, and reference materials for security research and testing.

OWASP Top 10:2025

Current awareness document listing the most critical web application security risks.

MITRE ATT&CK Framework

Globally-accessible knowledge base of adversary tactics and techniques.

CVE Database

Comprehensive database of publicly disclosed cybersecurity vulnerabilities.

Exploit Database

Archive of public exploits and corresponding vulnerable software.

GTFOBins

Curated list of Unix binaries that can be used to bypass security restrictions.

PayloadsAllTheThings

Comprehensive list of useful payloads and bypasses for web application security.

HackTricks

Collection of hacking tricks, techniques and methodologies for penetration testing.

CyberChef

Web app for encryption, encoding, compression and data analysis operations.

YouTube Channels

Educational content creators providing tutorials, walkthroughs, and cybersecurity insights.

IppSec

HackTheBox Walkthroughs

John Hammond

CTF & Security Tutorials

The Cyber Mentor

Ethical Hacking Training

LiveOverflow

Security Research & CTFs

NetworkChuck

IT & Cybersecurity

David Bombal

Networking & Security

Podcasts

Engaging cybersecurity podcasts covering news, stories, and technical deep dives.

Darknet Diaries

True stories from the dark side of the Internet - hacks, data breaches, and cybercrime.

Security Now

In-depth discussions on computer security, privacy, and technology since 2005. Hosted by Steve Gibson & Leo Laporte.

Smashing Security

Cybersecurity news and advice with a touch of humor.

Communities

Online communities where you can learn, share knowledge, and connect with other security professionals.

r/netsec

Technical information security content and discussion on Reddit.

r/AskNetsec

Ask questions and get advice from information security professionals.

Security Stack Exchange

Q&A site for information security professionals and enthusiasts.

Infosec social feeds

Follow security researchers across X, Bluesky, Mastodon, LinkedIn, and community newsletters for real-time updates.