infosec-resources

KO | EN

gitlite — search

#python #hacktoberfest #golang #android #machine-learning #rust #linux #macos #kubernetes #vue #pytorch #security #ios #open-source

infosec-resources

(★ 1,390)

A list of helpful cybersecurity / infosec resources

File Explorer

Download Latest Version (.zip)

README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# List of InfoSec resources

I get this question a lot so I compiled a big list that I can just link people to directly.

Submissions are welcome. Please make a PR and I will try to get around to it when I have time.

# Where to start?

- [LiveOverflow's YouTube channel](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w)
- [Advice for young hackers. How to teach yourself](https://www.youtube.com/watch?v=0Ejj2aBG5c8)
- [How to start hacking? The ultimate two path guide to information security. - /r/hacking](https://www.reddit.com/r/hacking/comments/a3oicn/how_to_start_hacking_the_ultimate_two_path_guide/)

# CTFs

If you are new, you should start with high school level and eventually level up to college level.

- https://ctftime.org - Find CTFs and write-ups
- https://picoctf.com/ (high school level)
- NSA Codebreaker challenge
- CSAW RED (high school level) - Formerly known as CSAW HSF
- CSAW CTF (college level)
- HackTheBox - I never did this, but it's popular
- [Flare-On](https://flare-on.com/): Annual reversing CTF
- PlaidCTF (warning: hard)
- AngstromCTF, TJCTF, UMDCTF, TUCTF, UIUCTF. Look for CTFs organized by college students or people somewhat above your skill level but not too far
- Other great CTFs in no particular order, some may be missing (may be hard): DiceCTF, Sekai CTF, Midnight Sun CTF, Google CTF, Blue Water CTF

# Blockchain / Web3

- [The Auditooor Grindset](https://www.zellic.io/blog/the-auditooor-grindset/)
- [Zellic blog](https://www.zellic.io/blog/) - Blockchain security and cryptography research
- [Paradigm CTF](https://ctf.paradigm.xyz/) - [chals](https://github.com/paradigmxyz/paradigm-ctf-2023)
- ETHSecurity Telegram channel

# Binary Exploitation

- [pwn.college](https://pwn.college/) - Guide written by Zardus and adam doupe, former organisers of DEF CON CTF
- [Gatech Sslab CS 6265: InfoSec Lab](https://tc.gts3.org/cs6265/2021/) - GREAT resource on intro to binex.
- [how2heap](https://github.com/shellphish/how2heap) - intro to glibc heap exploitation
- [Dhaval Kapil's heap explotation guide](https://heap-exploitation.dhavalkapil.com/) - intro to glibc heap exploitation. slightly outdated but still good
- http://pwnable.tw/ - more pwnables
- https://microcorruption.com/login
- [Extreme Vulnerable Driver](https://github.com/hacksysteam/HackSysExtremeVulnerableDriver) - a vulnerable driver you can learn to pwn drivers with
- [exploit.education](http://exploit.education) - Learn exploit dev, binary analysis (Suggested by @gautammenghani, not vetted by me)

# Game hacking and reversing

- [Pointers for REAL dummies](http://alumni.cs.ucr.edu/~pdiloren/C++_Pointers/) - This is how I finally understood pointers when I was 12 years old. GREAT guide and it will teach you about C and what is memory.
- [Fl33p's CS:S bunnyhop hack tutorial (YT)](https://www.youtube.com/watch?v=RiS-j_ecG0A) - A bit outdated but this is what helped me finally understand how to use a debugger and Cheat Engine and Visual Studio. The explanations are not 100% accurate but most importantly it is really beginner friendly for noobs
- [godbolt.org Compiler Explorer](godbolt.org/) - Good to learn what code looks like when it gets compiled
- [Reverse Engineering Stack Exchange](https://reverseengineering.stackexchange.com/) - Good place to figure out how to do something in IDA Pro.
- [osdev wiki](https://wiki.osdev.org/Expanded_Main_Page) - Has some outdated or inaccurate info, but usually a good starting point.

# Discord servers

Remember to be nice, don't be rude or annoying, etc. Act like an adult.

⚠️⚠️⚠️ **DISCLAIMER: I DO NOT ENDORSE any of these servers personally, their administrators, or any of the discussion that may occur in them. I deny any particular knowledge or awareness of the day-to-day occurrences and contents of conversations on these servers. In other words, this is simply a list of some well-known, popular infosec related servers. The views, opinions, and speech of the participants or administrators on the servers below bear NO REFLECTION whatsoever on my own personal opinions, values, or beliefs. This list is provided as a USEFUL RESOURCE only.** ⚠️⚠️⚠️

- [Reverse Engineering discord](https://discord.com/invite/weKN5wb) - **do NOT discuss game hacking in this Discord or you will be banned.**
- [Capture the Flag discord](https://discord.gg/ArjWjvctft) - CTF community
- [Secret club public discord](https://discord.com/invite/BT764JJDhe) - Administered by Carl Schou and Derek Rynd.
- [gynvael's server](https://discord.gg/QAwfE5R) - administered by gynvael.
- [Day0 podcast server](https://discord.gg/dvZN4csDFx) - administered by zi and Specter.
- [Awesome Fuzzing](https://discord.gg/XaX2m2msQh) - fuzzing enthusiasts.
- [Back.engineering server](https://discord.gg/VHDrMC8NSM) - administered by xeroxz.
- [osdev server](https://discord.gg/RnCtsqD) - I don't know this server, but it's popular.

# Blogs (in no particular order)

⚠️⚠️⚠️ **DISCLAIMER: I DO NOT ENDORSE the personal character of any of the listed authors. The blogs listed below are chosen SOLELY based on the merits and quality of the publications and research ONLY. In other words, this is simply a list of well-known infosec authors. The views, opinions, and writing of the blogs below or their authors bear NO REFLECTION whatsoever on my own personal opinions, values, or beliefs. This list is provided as a USEFUL RESOURCE only.** ⚠️⚠️⚠️

- [Zellic blog](https://www.zellic.io/blog/) - Blockchain security and cryptography research
- [chompie1337's blog](https://chomp.ie/Home) - [twitter](https://twitter.com/chompie1337)
- [Qualys Advisories](https://www.qualys.com/research/security-advisories/) - 1337 security research
- [Back Engineering](https://back.engineering/blog) - misc reversing stuff
- [Raymond Chen's Blog](https://devblogs.microsoft.com/oldnewthing/) - windows internals
- [Quarkslab Blog](https://blog.quarkslab.com/) - Awesome security engineering, systems and systems research
- [Gbps's blog](https://ctf.re/) - Good reverse engineering and low-level systems articles.
- [Google Project Zero blog](https://googleprojectzero.blogspot.com) - Cutting-edge vulnerability research.
- [Secret Club](https://secret.club) - Syndicated publication on various innovative research on reverse engineering, esp. game hacking.
- [Can Bölük's blog](https://can.ac) - Hypervisors, Windows internals, anticheats. He is a legendary reverse engineer
- [Derek Rynd and Aidan Khoury's blog (revers.engineering)](https://revers.engineering) - Hypervisors, Windows internals, Anticheats. They are both way smarter than me
- [Sinaei's blog](https://rayanfam.com/) - Hypervisor from scratch
- [Orange Tsai's blog](https://blog.orange.tw/) - Lot of cutting-edge research on a broad range of topics. He is totally an infosec legend
- [Alex Ionescu and Yarden Shafir's blog](https://windows-internals.com/pages/internals-blog/) - Windows internals, systems, kernel.
- [Rolf Rolles' blog](https://www.msreverseengineering.com/blog/) - Reverse engineering, program analysis, (de)obfuscation, IDA Pro
- [back.engineering](https://back.engineering/) - Mainly xeroxz's blog but also features some syndicated articles.
- [lcamtuf's blog](https://lcamtuf.blogspot.com/) - Fuzzing and systems.
- [Halvarflake's blog](https://addxorrol.blogspot.com/) - Various topics in systems and security.
- [Trail of Bits blog](https://blog.trailofbits.com/) - State-of-the-art research on cryptography, program analysis, bug hunting
- [Bruce Dawson's blog](https://randomascii.wordpress.com) - Systems, compilers, and performance.
- [Travis Downs' blog](https://travisdowns.github.io/) - Systems, compilers, and performance.
- [Krebs on Security](https://krebsonsecurity.com) - Mainstream InfoSec news.
- [Bruce Schneier's blog](https://www.schneier.com) - Cryptography and privacy news.
- [Hex-Rays blog](https://hex-rays.com/blog/) - Tips and tricks for IDA Pro

# Other InfoSec newsletters, zines, and publications

- [phrack magazine](https://phrack.org/) - famous hacker zine
- [LWN](https://lwn.net/) - Linux internals
- [/r/securityCreators/](https://www.reddit.com/r/securityCreators/)
- [zSecurity Twitter](https://twitter.com/_zsecurity_)

# Favorite Tools

I am a Windows user so I mainly use Windows tools. Sorry Linux users.

## Must-have, essential tools
- [Python 3](https://python.org) - hacker's best friend
- [x64dbg](https://github.com/x64dbg/x64dbg) - Windows userland debugger
- [Process Hacker](https://processhacker.sourceforge.io/)
- IDA Pro (or Ghidra) - disassembler
- [HxD](https://mh-nexus.de/en/hxd/) - hex editor
- [Cheat Engine](https://www.cheatengine.org/) - memory hacking tool
- [CFF explorer](https://ntcore.com/?page_id=388) - PE editor
- Windows Calculator, MSpaint, and notepad
- [diffchecker.com](https://www.diffchecker.com/)
- [cyberchef](https://gchq.github.io/CyberChef/) - data processing multitool
- [Sublime Text](https://www.sublimetext.com/)
- [Sysinternals suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite)
- [mitmproxy](https://mitmproxy.org/)

## Other handy tools
- [Wireshark](wireshark.org)
- [WinDbg](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools) - for Windows kernel debugging
- [Pestudio](https://www.winitor.com/) - pe dissector and triage tool
- [ReClassEx](https://github.com/ajkhoury/ReClassEx) - in-memory struct dissector
- [010 hex editor](https://www.sweetscape.com/010editor/) - fancier, but paid, hex editor. I don't use this often but it's popular
- [JDA Java disassembler](https://github.com/LLVM-but-worse/java-disassembler) - for Java applications
- [dnSpy](https://github.com/dnSpy/dnSpy) - for .NET applications
- [apktool](https://ibotpeaches.github.io/Apktool/) - for Android shit
- [java-deobfuscator](https://github.com/java-deobfuscator/deobfuscator) - written by samczsun who is smart as hell
- [de4dot](https://github.com/de4dot/de4dot) - .NET deobfuscator
- [Detect It Easy (DIE)](https://github.com/horsicq/Detect-It-Easy) - detect compiler and packers. I don't often use this since I can usually recognize by experience
- [Sage](https://www.sagemath.org/) - for cryptography
- [Proxifier](https://www.proxifier.com/) - basically proxychains for Windows
- [Krakatau](https://github.com/Storyyeller/Krakatau) - Good java disassembler
- [Mitmproxy](https://mitmproxy.org/) - Burp suite for broke people

## Hex-Rays plugins
- [HexRaysPyTools](https://github.com/igogo-x86/HexRaysPyTools) - must-have
- [ClassInformer](https://sourceforge.net/projects/classinformer/) - RTTI parser (for Win32)
- [ret-sync](https://github.com/bootleg/ret-sync)
- [Labelless](https://github.com/a1ext/labeless)
- [abyss](https://github.com/patois/abyss)

## x64dbg plugins
- [ScyllaHide](https://github.com/x64dbg/ScyllaHide) - Anti-anti-debug
- [xHotspots](https://github.com/ThunderCls/xHotSpots) - Sometimes useful for reversing GUI shit
- [OllyDumpEx](https://low-priority.appspot.com/ollydumpex/)
- In general, refer to this comprehensive [list](https://github.com/x64dbg/x64dbg/wiki/Plugins)

# Lectures and slides

- [Gatech CS 8803: Compilers Theory and Practice](https://omscs.gatech.edu/cs-8803-o08-compilers-theory-and-practice-course-videos)
- [Gatech Sslab CS 3210: Operating Systems](https://tc.gts3.org/cs3210/)

# Reference materials

- [Intel Manual volume 3](https://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-system-programming-manual-325384.html) - they say that every question you have is answered somewhere in this book. the question is where to find it. and also how to understand it. since this shit is not easy nor fun to read. sometimes if you ask some stupid question people will tell you to go read the intel manual. it's an advanced way to tell people to fuck off.
- Hacker's Delight - bit hacking tricks, you see them used by compilers often. Division constants
- [Dragon Book](https://en.wikipedia.org/wiki/Compilers:_Principles,_Techniques,_and_Tools) - popular compilers textbook
- [SSA book](https://github.com/pfalcon/ssabook) - resource for advanced topics on single static assignment form in compilers
- [MSDN](https://learn.microsoft.com/en-us/windows/win32/api/) - win32 and windows internals

infosec-resources

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

infosec-resources

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README