Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
Awesome-Vulnerability-Research
🦄 A curated list of the awesome resources about the Vulnerability Research
https://github.com/sergey-pronin/Awesome-Vulnerability-Research
- Sergey Pronin
- stargazer
-  and Eero Kurimo, 2017
- From Fuzzing Apache httpd Server to CVE-2017-7668 and a $1500 Bounty - by Javier Jiménez, 2017
- Root cause analysis of integer flow - by [Corelan Team](#websites), 2013
- The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities - by Mark Dowd, John McDonald, Justin Schuh - published 2006, ISBN-13: 978-0321444424 / ISBN-10: 9780321444424
- The Shellcoder's Handbook: Discovering and Exploiting Security Holes - by Chris Anley, John Heasman, Felix Lindner, Gerardo Richarte - published 2007, 2nd Edition, ISBN-13: 978-0470080238 / ISBN-10: 047008023X
- Advanced Windows Exploitation (AWE) - by Offensive Security with complementary OSEE (Offensive Security Exploitation Expert) Certification
- Cracking The Perimeter (CTP) - by Offensive Security, with complementary OSCE (Offensive Security Certified Expert) Certification
- Modern Binary Exploitation (CSCI 4968) - by RPISEC at Rensselaer Polytechnic Institute in Spring 2015. This was a university course developed and run solely by students to teach skills in vulnerability research, reverse engineering, and binary exploitation.
- Software Security Course on Coursera - by University of Maryland.
- Offensive Computer Security - by W. Owen Redwood and Prof. Xiuwen Liu.
- DEF CON - Las Vegas, NV, USA
- Black Hat - Las Vegas, NV, USA
- Black Hat Europe - London, UK //🔥Join [me](https://github.com/sergey-pronin) this year on [Dec, 7-10, 2020](https://www.blackhat.com/eu-20/)!
- Black Hat Asia - Singapore
- BSides - Worldwide
- BruCON - Brussels, Belgium
- Chaos Communication Congress (CCC) - Hamburg, Germany
- Code Blue - Tokyo, Japan
- Nullcon - Goa, India
- 44CON - London, UK
- AppSecUSA - Washington DC
- OWASP AppSec EU - Europewide
- Positive Hack Days - Moscow, Russia
- ZeroNights - Moscow, Russia
- WarCon - Warsaw, Poland
- Vulnerabilities 101: How to Launch or Improve Your Vulnerability Research Game - by [Joshua Drake](#twitter) and [Steve Christey Coley](#twitter) at [DEFCON](#confernces) 24, 2016
- Writing Vulnerability Reports that Maximize Your Bounty Payouts - by [Kymberlee Price](#twitter), originally presented at [Nullcon](#conferences), 2016
- Browser Bug Hunting: Memoirs of a Last Man Standing
- HackSys Extreme Vulnerable Windows Driver
- Vulnerabilities 101: How to Launch or Improve Your Vulnerability Research Game [PDF - by [Joshua Drake](#twitter) and [Steve Christey Coley](#twitter) at [DEFCON](#confernces) 24, 2016
- Effective File Format Fuzzing [PDF - by [Mateusz “j00ru” Jurczyk](#twitter) presented at [BlackHat EU](#confernces), 2016
- Bootstrapping A Security Research Project [PDF - boston-2016-bootstrapping-a-security-research-project) - by [Andrew M. Hay](#twitter) at SOURCE Boston, 2016
- Bug Hunting with Static Code Analysis [PDF - by Nick Jones, MWR Labs, 2016
- CVE - Common Vulnerabilities and Exposures, maintained by the [MITRE Corporation](https://www.mitre.org/)
- CWE - Common Weakness Enumeration, maintained by the [MITRE Corporation](https://www.mitre.org/)
- CVSS - Common Vulnerability Scoring System, maintained by [FIRST (Forum of Incident Response and Security Teams)](https://www.first.org/)
- ISO/IEC 29147:2014 - Vulnerability Disclosure Standard
- RFPolicy 2.0 - Full Disclosure Policy (RFPolicy) v2.0 by [Packet Storm](https://packetstormsecurity.com/)
- TSIG Authentication Bypass Through Signature Forgery in ISC BIND [PDF - Clément BERTHAUX, Synacktiv, [CVE-2017-3143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143)
- PDF - [Morten Schenk](#github), originally presented at [Black Hat](#conferences) 2017
- Windbg - The preferred debugger by exploit writers.
- ltrace - Intercepts library calls
- ansvif - An advanced cross platform fuzzing framework designed to find vulnerabilities in C/C++ code.
- Metasploit Framework - A framework which contains some fuzzing capabilities via Auxiliary modules.
- Spike - A fuzzer development framework like sulley, a predecessor of sulley.
- Google Sanitizers - A repo with extended documentation, bugs and some helper code for the AddressSanitizer, MemorySanitizer, ThreadSanitizer, LeakSanitizer. The actual code resides in the [LLVM](#l) repository.
- FLARE VM - FLARE (FireEye Labs Advanced Reverse Engineering) a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc.
- hackers-grep - The hackers-grep is a tool that enables you to search for strings in PE files. The tool is capable of searching strings, imports, exports, and public symbols (like woah) using regular expressions.
- Grinder - Grinder is a system to automate the fuzzing of web browsers and the management of a large number of crashes.
- Choronzon - An evolutionary knowledge-based fuzzer
- boofuzz - A fork and successor of Sulley framework
- Google Chrome issue tracker - The Chromium Project. *Google Account Required*
- Corelan Team
- FuzzySecurity - to-follow)
- Fuzzing Blogs - by fuzzing.info
- j00ru//vx tech blog - Coding, reverse engineering, OS internals covered one more time
- (join now)
- jksecurity
- MortenSchenk
- (@thegrugq)
- (@jduck)
- (@sushidude)
- (@andrewsmhay)
- (@thegrugq)
- (@FuzzySec)
- (@timstrazz)
- (@wpawlikowski)
- (@attekett)
- (@h0wlu)
- (@antisnatchor)
- (@Kym_Possible)
- (@MichalKoczwara)
- (@j00ru)
- (@ProjectZeroBugs) - Cheks for new bug reports every 10 minutes. Not affiliated with Google.
- (@HackwithGithub) - Open source hacking tools for hackers and pentesters.
- SecuriTeam Secure Disclosure (SSD) - SSD provides the support you need to turn your experience uncovering security vulnerabilities into a highly paid career. SSD was designed by researchers, for researchers and will give you the fast response and great support you need to make top dollar for your discoveries.
- The Zero Day Initiative (ZDI) - ZDI is originally founded by TippingPoint, is a program for rewarding security researchers for responsibly disclosing vulnerabilities. Currently managed by Trend Micro.
- Awesome AppSec - A curated list of resources for learning about application security. Contains books, websites, blog posts, and self-assessment quizzes.
- Awesome Web Security - A curated list of Web Security materials and resources.
- Awesome Fuzzing - A curated list of fuzzing resources for learning Fuzzing and initial phases of Exploit Development like root cause analysis.
- Hack with Github - Open source hacking tools for hackers and pentesters.
- Movies for Hackers - A list of movies every cyberpunk must watch.
- SecLists - SecLists is the security tester's companion.
- (@jduck)
- you, who has sent the pull requests - Vulnerability-Research/issues) a link to add here!
- 
Keywords
fuzzing
5
awesome
4
security
4
awesome-list
3
exploitation
2
reverse-engineering
2
hacking
2
list
2
penetration-testing
2
uaf
1
vulnerabilities
1
windows
1
exploit
1
fuzz-testing
1
fuzzer
1
pentesting
1
quality-control
1
vulnerability
1
type-confusion
1
memory-corruption
1
linux
1
kernel
1
info-leak
1
hevd
1
exploit-development
1
driver
1
buffer-overflow
1
wargame
1
ctf
1
python
1
sexy-lists
1
movies
1
curated-list
1
collection
1
pentesting-windows
1
bug-bounty
1
android
1
secfigo
1
fuzzing-framework
1
websecurity
1
web
1
security-experts
1
reading-list
1
owasp
1
curated
1
application-security
1
ruby
1
grinder
1
browsers
1
malware-analysis
1