Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-cyber-security

A bunch of resources containing learning resources, certifications, security frameworks, bug bounties, podcasts and tools used for cyber security.
https://github.com/tzurilabs/awesome-cyber-security

Last synced: 6 days ago
JSON representation

  • Bug Bounties

    • Blue Team Certifications

      • Redstorm.io - A bug bounty platform that allows hackers to report vulnerabilities in exchange for rewards, focusing on improving cybersecurity for businesses.
      • Patchstack - A bug bounty platform focused on securing WordPress plugins and themes through vulnerability disclosure and patching.
      • Redstorm.io - A bug bounty platform that allows hackers to report vulnerabilities in exchange for rewards, focusing on improving cybersecurity for businesses.
      • app.cyberarmy.id - An Indonesian bug bounty platform connecting security researchers with companies to help them identify and resolve vulnerabilities.
      • Patchstack - A bug bounty platform focused on securing WordPress plugins and themes through vulnerability disclosure and patching.
      • Redstorm.io - A bug bounty platform that allows hackers to report vulnerabilities in exchange for rewards, focusing on improving cybersecurity for businesses.
      • app.cyberarmy.id - An Indonesian bug bounty platform connecting security researchers with companies to help them identify and resolve vulnerabilities.

  • Tools

    • Network Pentesting

      • Hydra - A fast network logon cracker that supports numerous protocols for password guessing.
      • Meterpreter - A payload within Metasploit that allows for post-exploitation, providing a command shell and extensive features for maintaining access.
      • Empire - A post-exploitation framework that uses PowerShell agents for persistence and control.
      • Cobalt Strike - A commercial penetration testing tool that provides advanced features for post-exploitation and persistence.
      • RATs (Remote Access Trojans) - Tools like DarkComet or NjRAT allow attackers to maintain remote control over compromised systems.
      • Timestomp - A tool that allows users to modify file timestamps to obscure evidence of access or modification.
      • Maltego - A tool for open-source intelligence (OSINT) and forensics that can visualize relationships between data.
      • Harvester - A tool used for gathering e-mail accounts and subdomain names from different public sources (search engines, pgp key servers).
      • DNSRecon - A DNS reconnaissance tool that performs various DNS enumeration techniques.
      • Nmap - A powerful network scanner used for discovering hosts and services on a computer network.
      • Nessus - A widely used vulnerability scanner that identifies vulnerabilities in systems and applications.
      • Wireshark - A network protocol analyzer that captures and analyzes network traffic, useful for troubleshooting and identifying vulnerabilities.
      • Maltego - A tool for open-source intelligence (OSINT) and forensics that can visualize relationships between data.
      • Harvester - A tool used for gathering e-mail accounts and subdomain names from different public sources (search engines, pgp key servers).
      • DNSRecon - A DNS reconnaissance tool that performs various DNS enumeration techniques.
      • Nmap - A powerful network scanner used for discovering hosts and services on a computer network.
      • Nessus - A widely used vulnerability scanner that identifies vulnerabilities in systems and applications.
      • Wireshark - A network protocol analyzer that captures and analyzes network traffic, useful for troubleshooting and identifying vulnerabilities.
      • Hydra - A fast network logon cracker that supports numerous protocols for password guessing.
      • Aircrack-ng - A suite of tools for assessing Wi-Fi network security, including capturing packets and cracking WEP/WPA/WPA2 keys.
      • Netcat - A networking utility that can create TCP/UDP connections and is often used for creating backdoors.
      • Meterpreter - A payload within Metasploit that allows for post-exploitation, providing a command shell and extensive features for maintaining access.
      • Empire - A post-exploitation framework that uses PowerShell agents for persistence and control.
      • Cobalt Strike - A commercial penetration testing tool that provides advanced features for post-exploitation and persistence.
      • RATs (Remote Access Trojans) - Tools like DarkComet or NjRAT allow attackers to maintain remote control over compromised systems.
      • Aircrack-ng - A suite of tools for assessing Wi-Fi network security, including capturing packets and cracking WEP/WPA/WPA2 keys.
      • Netcat - A networking utility that can create TCP/UDP connections and is often used for creating backdoors.
      • Metasploit (Clearing Logs / Post Exploitation Modules) - Metasploit's post-exploitation modules can assist in clearing logs and covering tracks.
      • Timestomp - A tool that allows users to modify file timestamps to obscure evidence of access or modification.
      • Sysinternals Suite - A collection of utilities (like PsExec) that can help manage and hide processes, as well as clear logs.
      • Rootkits - Though illegal and unethical for legitimate pentesting, rootkits can hide files and processes from detection.
      • Sysinternals Suite - A collection of utilities (like PsExec) that can help manage and hide processes, as well as clear logs.
      • Rootkits - Though illegal and unethical for legitimate pentesting, rootkits can hide files and processes from detection.
      • Metasploit - A widely used penetration testing framework that includes a range of exploits and payloads to gain access to systems.

    • Network Security

      • Wordpress honeypots - Honeypot setups specifically designed to capture attacks targeting vulnerabilities in WordPress installations.
      • Detect It Easy (DIE) - A tool for identifying and analyzing file formats and executable packers to help with reverse engineering.
      • Ghidra - An open-source software reverse engineering tool developed by the NSA, providing powerful decompilation and analysis capabilities.
      • Detect It Easy (DIE) - A tool for identifying and analyzing file formats and executable packers to help with reverse engineering.
      • Ghidra - An open-source software reverse engineering tool developed by the NSA, providing powerful decompilation and analysis capabilities.
      • Radare 2 - A free and open-source reverse engineering framework offering disassembly, debugging, and binary analysis features.
      • JADX - A decompiler for Android applications, converting APK files back into readable Java source code.
      • Any Run - An interactive online malware analysis service that allows users to run and analyze malicious files in real time.
      • Triage - A cloud-based automated malware analysis platform designed for quick and efficient analysis of suspicious files.
      • Cuckoo Sandbox - An open-source automated malware analysis system that runs suspicious files in an isolated environment to observe behavior.
      • Snort - An open-source intrusion detection and prevention system (IDS/IPS) capable of real-time traffic analysis and packet logging.
      • Suricata - A high-performance, open-source IDS, IPS, and network security monitoring engine that can handle multi-threaded traffic analysis.
      • Radare 2 - A free and open-source reverse engineering framework offering disassembly, debugging, and binary analysis features.
      • JADX - A decompiler for Android applications, converting APK files back into readable Java source code.
      • Any Run - An interactive online malware analysis service that allows users to run and analyze malicious files in real time.
      • Triage - A cloud-based automated malware analysis platform designed for quick and efficient analysis of suspicious files.
      • Cuckoo Sandbox - An open-source automated malware analysis system that runs suspicious files in an isolated environment to observe behavior.
      • Snort - An open-source intrusion detection and prevention system (IDS/IPS) capable of real-time traffic analysis and packet logging.
      • Suricata - A high-performance, open-source IDS, IPS, and network security monitoring engine that can handle multi-threaded traffic analysis.
      • OSSEC - An open-source host-based intrusion detection system (HIDS) that monitors logs, detects anomalies, and provides real-time alerting.
      • Zeek - A network security monitoring tool that analyzes traffic and provides deep inspection and logging of network activity.
      • Dionaea - A low-interaction honeypot designed to capture malware and network attacks by emulating vulnerable services.
      • Glastopf - A web application honeypot that emulates vulnerable websites to gather information on web-based attacks.
      • Cowrie - A medium-interaction SSH and Telnet honeypot designed to log brute-force attacks and shell commands.
      • Kippo - A medium-interaction SSH honeypot focused on logging brute-force login attempts and simulating an interactive shell.
      • Laravel application honeypot - A honeypot package for Laravel applications to protect against automated form submissions and spam.
      • Wordpress honeypots - Honeypot setups specifically designed to capture attacks targeting vulnerabilities in WordPress installations.
      • OSSEC - An open-source host-based intrusion detection system (HIDS) that monitors logs, detects anomalies, and provides real-time alerting.
      • Zeek - A network security monitoring tool that analyzes traffic and provides deep inspection and logging of network activity.
      • Dionaea - A low-interaction honeypot designed to capture malware and network attacks by emulating vulnerable services.
      • Glastopf - A web application honeypot that emulates vulnerable websites to gather information on web-based attacks.
      • Cowrie - A medium-interaction SSH and Telnet honeypot designed to log brute-force attacks and shell commands.
      • Kippo - A medium-interaction SSH honeypot focused on logging brute-force login attempts and simulating an interactive shell.
      • Laravel application honeypot - A honeypot package for Laravel applications to protect against automated form submissions and spam.

    • Web Application Pentesting

      • Recon-ng - A web reconnaissance framework that provides a powerful environment for open-source web-based reconnaissance.
      • Google Dorking - A technique that uses advanced Google search operators to find sensitive information exposed on the web.
      • OWASP ZAP - An open-source web application security scanner that helps find security vulnerabilities in web applications.
      • Recon-ng - A web reconnaissance framework that provides a powerful environment for open-source web-based reconnaissance.
      • Google Dorking - A technique that uses advanced Google search operators to find sensitive information exposed on the web.
      • OWASP ZAP - An open-source web application security scanner that helps find security vulnerabilities in web applications.
      • Nikto - A web server scanner that performs comprehensive tests against web servers for multiple items, including outdated server software, and vulnerabilities.
      • Acunetics - An automated web application security scanner that checks for vulnerabilities like SQL injection, XSS, and more.
      • SQLMap - An open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities.
      • XSSer - a tool to exploit XSS vulnerabilities.
      • Burpsuite (Intruder) - Besides scanning, Burp's Intruder tool can be used for brute-forcing and payload injection.
      • BeEF - a powerful tool that can perform various tasks aimed at exploiting vulnerabilities in web browsers.
      • Nikto - A web server scanner that performs comprehensive tests against web servers for multiple items, including outdated server software, and vulnerabilities.
      • Acunetics - An automated web application security scanner that checks for vulnerabilities like SQL injection, XSS, and more.
      • SQLMap - An open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities.
      • XSSer - a tool to exploit XSS vulnerabilities.
      • BeEF - a powerful tool that can perform various tasks aimed at exploiting vulnerabilities in web browsers.
      • Burpsuite - A popular web application security testing tool that includes features for scanning, crawling, and analyzing web applications.

    • Software Security

      • Microsoft Threat Modelling Tool - A tool that helps identify and address security threats early in the software development process by creating threat models.
      • Semgrep - A fast and customizable static analysis tool for finding security vulnerabilities and enforcing code standards.
      • ZAP-Cli - A command-line interface for OWASP ZAP that automates web application security scanning and testing.
      • Microsoft Threat Modelling Tool - A tool that helps identify and address security threats early in the software development process by creating threat models.
      • Semgrep - A fast and customizable static analysis tool for finding security vulnerabilities and enforcing code standards.
      • ZAP-Cli - A command-line interface for OWASP ZAP that automates web application security scanning and testing.

  • Learning Resources

  • Podcasts

    • Blue Team Certifications

      • Darknet Diaries - A storytelling podcast focused on true stories from the dark side of the internet, including hacking and cybercrime.
      • The IT Career Podcast - A podcast offering insights into IT careers, cybersecurity, and practical advice for getting started or advancing in the field.
      • David Bombal Podcast - A podcast hosted by David Bombal, covering cybersecurity topics, networking, and tech interviews with industry experts.
      • Hack The Box Podcast - The official Hack The Box podcast that discusses ethical hacking, cybersecurity challenges, and interviews with security professionals.
      • Langley Files - A podcast by the CIA offering a behind-the-scenes look at intelligence, cybersecurity, and national security issues.
      • David Bombal Podcast - A podcast hosted by David Bombal, covering cybersecurity topics, networking, and tech interviews with industry experts.
      • Darknet Diaries - A storytelling podcast focused on true stories from the dark side of the internet, including hacking and cybercrime.
      • The IT Career Podcast - A podcast offering insights into IT careers, cybersecurity, and practical advice for getting started or advancing in the field.
      • Critical Thinking Bug Bounties Podcast - A podcast focusing on bug bounties, ethical hacking, and vulnerability disclosure, featuring discussions with security experts.
      • Hacker Valley Media - A podcast exploring various cybersecurity topics, from hacking stories to mental health in the cybersecurity industry.
      • Critical Thinking Bug Bounties Podcast - A podcast focusing on bug bounties, ethical hacking, and vulnerability disclosure, featuring discussions with security experts.
      • Hacker Valley Media - A podcast exploring various cybersecurity topics, from hacking stories to mental health in the cybersecurity industry.
      • Hack The Box Podcast - The official Hack The Box podcast that discusses ethical hacking, cybersecurity challenges, and interviews with security professionals.
      • Langley Files - A podcast by the CIA offering a behind-the-scenes look at intelligence, cybersecurity, and national security issues.

  • Certifications

  • Security Frameworks

    • Blue Team Certifications

      • Fortinet Security Fabric - A comprehensive cybersecurity framework designed by Fortinet, integrating various security solutions to protect network infrastructure from threats.
      • MITRE ATT&CK - A knowledge base that provides a framework for understanding and defending against cyber adversaries, including tactics and techniques that can affect network security.
      • OWASP Top Ten - A widely recognized list of the ten most critical web application security risks, providing guidance on vulnerabilities and best practices for developers and security professionals.
      • OWASP ASVS (Application Security Verification Standard) - A framework for designing, developing, and testing secure web applications, providing a basis for assessing security controls.
      • CWE (Common Weakness Enumeration) - A community-developed list of common software and hardware weaknesses that can lead to security vulnerabilities, serving as a guide for secure coding practices.
      • SANS Top 25 Software Errors - A list identifying the 25 most dangerous software errors that can lead to vulnerabilities in web applications, offering guidance for prevention.
      • ISO/IEC 27032 - An international standard providing guidelines for cybersecurity, focusing on the protection of information in cyberspace and addressing network security considerations.
      • NIST Cybersecurity Framework - A flexible framework that provides guidelines for managing and mitigating cybersecurity risks, including those related to network security.
      • OWASP Top Ten - A widely recognized list of the ten most critical web application security risks, providing guidance on vulnerabilities and best practices for developers and security professionals.
      • OWASP ASVS (Application Security Verification Standard) - A framework for designing, developing, and testing secure web applications, providing a basis for assessing security controls.
      • CWE (Common Weakness Enumeration) - A community-developed list of common software and hardware weaknesses that can lead to security vulnerabilities, serving as a guide for secure coding practices.
      • SANS Top 25 Software Errors - A list identifying the 25 most dangerous software errors that can lead to vulnerabilities in web applications, offering guidance for prevention.
      • ISO/IEC 27032 - An international standard providing guidelines for cybersecurity, focusing on the protection of information in cyberspace and addressing network security considerations.
      • NIST Cybersecurity Framework - A flexible framework that provides guidelines for managing and mitigating cybersecurity risks, including those related to network security.
      • Fortinet Security Fabric - A comprehensive cybersecurity framework designed by Fortinet, integrating various security solutions to protect network infrastructure from threats.
      • MITRE ATT&CK - A knowledge base that provides a framework for understanding and defending against cyber adversaries, including tactics and techniques that can affect network security.
Programming Languages
Python 18 C 4 Java 2 Perl 2
Categories
Tools 92 Learning Resources 46 Certifications 27 Security Frameworks 16 Podcasts 14 Bug Bounties 7
Sub Categories
Blue Team Certifications 48 Network Security 34 Network Pentesting 34 Web Application Pentesting 18 Red Team Certifications 16 Youtube Channels 14 Books 12 Cyber Security Learning Platforms 11 Basic Concepts 9 Software Security 6
Keywords
pentesting 6 security 6 python 4 honeypot 4 penetration-testing 4 thc 2 docker 2 linux 2 operating-system 2 exploiting 2 toolkit 2 xss 2 xsser 2 blueteam 2 discovery 2 emails 2 information-gathering 2 pentest-tool 2 pentest 2 password-cracking 2 password-cracker 2 network-security 2 hydra 2 bruteforcing 2 bruteforcer 2 bruteforce-attacks 2 bruteforce 2 brute-force-passwords 2 brute-force-attacks 2 brute-force 2 threatintel 2 threat-sharing 2 threat-analysis 2 telnet-honeypot 2 telnet 2 ssh 2 sftp 2 scp 2 kippo 2 decoy 2 deception 2 cowrie-ssh 2 cowrie 2 attacker 2 dionaea 2 java 2 dex 2 decompiler 2 android 2 zap 2