Cybersecurity-Perfect-Roadmap

KO | EN

gitlite — search

#python #java #php #hacktoberfest #ruby #javascript #dotfiles #docker #android #framework #template-engine #django

Cybersecurity-Perfect-Roadmap

★ 26 Open GitHub ↗

A comprehensive, step-by-step guide to mastering cybersecurity from beginner to expert level with curated resources, tools, and career guidance

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# N3tHawk Cybersecurity Perfect Roadmap 🔐

> 🚀 **Your ultimate guide to becoming a cybersecurity expert — from zero to hero. Packed with curated resources, hands-on tools, labs, CTFs, certifications, and career tips. Designed for absolute beginners, students, and aspiring professionals!**

---

## 📚 Table of Contents

- [🔥 Introduction](#-introduction)
- [🧭 How to Use This Roadmap](#-how-to-use-this-roadmap)
- [🗺️ Roadmap Overview](#-roadmap-overview)
- [⚙️ Foundation Phase](#️-foundation-phase)
- [💻 Technical Skills Phase](#-technical-skills-phase)
- [🛠️ Specialization Phase](#-specialization-phase)
- [🎯 Advanced Phase](#-advanced-phase)
- [💼 Professional Development](#-professional-development)
- [📘 Learning Resources](#-learning-resources)
- [🧰 Cybersecurity Tools](#-cybersecurity-tools)
- [🎓 Certifications Guide](#-certifications-guide)
- [🛣️ Career Paths](#️-career-paths)
- [👨‍👩‍👧‍👦 Cybersecurity Communities](#-cybersecurity-communities)
- [🏁 Capture The Flag (CTF) Competitions](#-capture-the-flag-ctf-competitions)
- [🧪 Cybersecurity Labs and Practice Environments](#-cybersecurity-labs-and-practice-environments)
- [🔍 Security Research Resources](#-security-research-resources)
- [🤝 Contributing](#-contributing)

---

## 🔥 Introduction

Welcome to the **N3tHawk Cybersecurity Perfect Roadmap** — a powerful, organized, and evolving roadmap tailored for anyone looking to break into the exciting field of **cybersecurity**. Whether you're a total newbie or looking to sharpen your skills, this roadmap is your ultimate guide! 🧑‍💻💥

---

## 🧭 How to Use This Roadmap

1. 🔎 Explore each phase in order, based on your current knowledge level.
2. 🎯 Set realistic goals with timeframes.
3. 🧠 Use the curated resources, tools, and labs provided.
4. 📈 Track your progress and grow from beginner → intermediate → expert!

---

## 🗺️ Roadmap Overview

We break cybersecurity into **4 major phases**, each containing multiple skills and resource links:

1. 🏗️ Foundation Phase – Networking, Linux, Computer Basics, etc.
2. 🔧 Technical Skills Phase – Ethical Hacking, Web, OSINT, etc.
3. 🎓 Specialization Phase – Red Team, Blue Team, Threat Intel, etc.
4. 🚀 Advanced Phase – Malware Analysis, Reverse Engineering, Exploit Dev.

---

## ⚙️ Foundation Phase

### 1. Computer Fundamentals

- **Operating Systems**
  - [CS50: Introduction to Computer Science](https://www.edx.org/course/introduction-computer-science-harvardx-cs50x)
  - [Operating Systems: Three Easy Pieces](http://pages.cs.wisc.edu/~remzi/OSTEP/)
  - [MIT 6.S081: Operating System Engineering](https://pdos.csail.mit.edu/6.S081/2020/)
  - [Introduction to Operating Systems – Georgia Tech (Udacity)](https://www.udacity.com/course/introduction-to-operating-systems--ud923)
  - **Books**:
    - "Modern Operating Systems" by Andrew S. Tanenbaum
    - "Computer Systems: A Programmer's Perspective" by Randal E. Bryant
    - "Operating System Concepts" – Abraham Silberschatz, et al.
  - **Practical Exercises**:
    - Install and explore Windows, Ubuntu, Arch, macOS
    - Learn memory management, scheduling, file systems
    - Play [OverTheWire: Bandit](https://overthewire.org/wargames/bandit/)
    - Use [QEMU](https://www.qemu.org/) or [VirtualBox](https://www.virtualbox.org/)
  
  - **Networking Basics**
    - [Computer Networking: A Top-Down Approach](https://gaia.cs.umass.edu/kurose_ross/index.php)
    - [Stanford CS144: Computer Networking](https://cs144.github.io/)
    - [Practical Networking](https://www.practicalnetworking.net/)
    - [Wireshark Tutorial (YouTube)](https://www.youtube.com/playlist?list=PLW8bTPfXNGdC5Co0VnBK1yVzAwSSphzpJ)
    - [Cisco Networking – Packet Tracer](https://www.netacad.com/courses/packet-tracer)

- **Books**:
    - "TCP/IP Illustrated, Volume 1" by W. Richard Stevens
    - "Network Warrior" by Gary A. Donahue
    - Computer Networking: Principles, Protocols and Practice – Olivier Bonaventure
  - **Tools**:
    - [Wireshark](https://www.wireshark.org/) - Network protocol analyzer
    - [tcpdump](https://www.tcpdump.org/) - Command-line packet analyzer
    - [Cisco Packet Tracer](https://www.netacad.com/courses/packet-tracer) - Network simulation tool
    - [GNS3](https://www.gns3.com/)
  - **Practical Exercises**:
    - Simulate networks with GNS3 or Packet Tracer
    - Analyze packets with Wireshark
    - Practice subnetting, DNS, firewall rules

- **Programming Fundamentals**
  - [Python for Everybody](https://www.py4e.com/)
  - [Automate the Boring Stuff with Python](https://automatetheboringstuff.com/)
  - [Codecademy Python Course](https://www.codecademy.com/learn/learn-python-3)
  - [freeCodeCamp JavaScript Algorithms and Data Structures](https://www.freecodecamp.org/learn/javascript-algorithms-and-data-structures/)
  - [Harvard CS50's Web Programming with Python and JavaScript](https://cs50.harvard.edu/web/)
  - **Books**:
    - "Python Crash Course" by Eric Matthes
    - "Eloquent JavaScript" by Marijn Haverbeke
    - "Head First Python" by Paul Barry
  - **Tools**:
    - [Visual Studio Code](https://code.visualstudio.com/) - Code editor
    - [PyCharm](https://www.jetbrains.com/pycharm/) - Python IDE
    - [Jupyter Notebooks](https://jupyter.org/) - Interactive computing
    - [Replit](https://replit.com/)
  - **Practical Exercises**:
    - Build simple security tools (port scanner, password generator)
    - Automate repetitive security tasks
    - Solve coding challenges on [HackerRank](https://www.hackerrank.com/) or [LeetCode](https://leetcode.com/)

- **Linux Fundamentals**
  - [Linux Journey](https://linuxjourney.com/)
  - [Linux Command Line Basics](https://ubuntu.com/tutorials/command-line-for-beginners#1-overview)
  - [OverTheWire: Bandit](https://overthewire.org/wargames/bandit/)
  - [Linux Survival](https://linuxsurvival.com/)
  - [Linux From Scratch](https://www.linuxfromscratch.org/)
  - **Books**:
    - "The Linux Command Line" by William Shotts
    - "How Linux Works" by Brian Ward
    - "Linux Bible" by Christopher Negus
  - **Tools**:
    - [VirtualBox](https://www.virtualbox.org/) - Virtualization software
    - [Vagrant](https://www.vagrantup.com/) - Development environment management
    - [Kali Linux](https://www.kali.org/) - Security-focused Linux distribution
  - **Practical Exercises**:
    - Install and configure a Linux distribution
    - Master bash scripting for automation
    - Set up a LAMP/LEMP stack
    - Configure user permissions and security settings

### 2. Information Security Principles

- **CIA Triad & Security Fundamentals**
  - [Cybrary Introduction to IT & Cybersecurity](https://www.cybrary.it/course/introduction-to-it-and-cybersecurity/)
  - [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
  - [edX Introduction to Cybersecurity](https://www.edx.org/course/introduction-to-cybersecurity)
  - [Coursera Information Security](https://www.coursera.org/specializations/information-security)
  - **Books**:
    - "Computer Security: Principles and Practice" by William Stallings
    - "Security Engineering" by Ross Anderson
    - "The Art of Deception" by Kevin Mitnick
  - **Practical Exercises**:
    - Analyze case studies of security breaches
    - Create a security policy for a fictional organization
    - Conduct a basic risk assessment

- **Cryptography Basics**
  - [Cryptography I by Stanford University](https://www.coursera.org/learn/crypto)
  - [Practical Cryptography for Developers](https://cryptobook.nakov.com/)
  - [Khan Academy Cryptography](https://www.khanacademy.org/computing/computer-science/cryptography)
  - [Crypto101](https://www.crypto101.io/)
  - **Books**:
    - "Serious Cryptography" by Jean-Philippe Aumasson
    - "Applied Cryptography" by Bruce Schneier
    - "Cryptography Engineering" by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno
  - **Tools**:
    - [CyberChef](https://gchq.github.io/CyberChef/) - Encryption/decryption tool
    - [OpenSSL](https://www.openssl.org/) - Cryptography toolkit
    - [Hashcat](https://hashcat.net/hashcat/) - Password recovery tool
  - **Practical Exercises**:
    - Implement basic encryption/decryption algorithms
    - Analyze cryptographic protocols
    - Solve cryptography challenges on [Cryptopals](https://cryptopals.com/)

- **Security Policies & Compliance**
  - [SANS Security Policy Templates](https://www.sans.org/security-resources/policies/)
  - [ISO 27001 Overview](https://www.iso.org/isoiec-27001-information-security.html)
  - [NIST Special Publications](https://csrc.nist.gov/publications/sp)
  - [GDPR Compliance](https://gdpr.eu/)
  - **Books**:
    - "Information Security Policies, Procedures, and Standards" by Thomas R. Peltier
    - "The Compliance Guide to the NIST Cybersecurity Framework" by Lars Benson
    - "CISSP Study Guide" by Eric Conrad
  - **Practical Exercises**:
    - Create a security policy for a fictional organization
    - Conduct a gap analysis against a security framework
    - Develop an incident response plan

### 3. Basic Security Tools

- **Security Tool Fundamentals**
  - [SANS SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling](https://www.sans.org/cyber-security-courses/hacker-techniques-exploits-incident-handling/)
  - [Black Hills Information Security Webcast](https://www.blackhillsinfosec.com/blog/webcasts/)
  - [Cybrary Open Source Intelligence](https://www.cybrary.it/practice-lab/perform-open-source-intelligence)
  - **Books**:
    - "Hacking: The Art of Exploitation" by Jon Erickson
    - "The Hacker Playbook 3" by Peter Kim
  - **Tools**:
    - [Kali Linux](https://www.kali.org/) - Security-focused Linux distribution
    - [Metasploit](https://www.metasploit.com/) - Penetration testing framework
    - [Nmap](https://nmap.org/) - Network discovery and security auditing
  - **Practical Exercises**:
    - Set up a security lab environment
    - Perform basic reconnaissance on a target (with permission)
    - Use OSINT tools to gather information

- **Vulnerability Scanning**
  - [OpenVAS Tutorial](https://www.openvas.org/)
  - [Nessus Essentials Tutorial](https://www.tenable.com/products/nessus/nessus-essentials)
  - [OWASP ZAP Getting Started](https://www.zaproxy.org/getting-started/)
  - **Books**:
    - "Mastering Kali Linux for Advanced Penetration Testing" by Vijay Kumar Velu
    - "The Basics of Hacking and Penetration Testing" by Patrick Engebretson
  - **Tools**:
    - [OpenVAS](https://www.openvas.org/) - Open-source vulnerability scanner
    - [Nessus](https://www.tenable.com/products/nessus) - Vulnerability scanner
    - [Nikto](https://cirt.net/Nikto2) - Web server scanner
  - **Practical Exercises**:
    - Set up a vulnerable machine (e.g., [Metasploitable](https://sourceforge.net/projects/metasploitable/))
    - Perform vulnerability scans and analyze results
    - Create vulnerability reports

## 💻 Technical Skills Phase

### 4. Network Security

- **Network Protocols & Security**
  - [Professor Messer Network+ Course](https://www.professormesser.com/network-plus/n10-008/n10-008-training-course/)
  - [SANS SEC560: Network Penetration Testing and Ethical Hacking](https://www.sans.org/cyber-security-courses/network-penetration-testing-ethical-hacking/)
  - [Cybrary Network Security](https://www.cybrary.it/course/cyber-network-security)
  - **Books**:
    - "Network Security Essentials" by William Stallings
    - "Practical Packet Analysis" by Chris Sanders
    - "Black Hat Python" by Justin Seitz
  - **Tools**:
    - [Wireshark](https://www.wireshark.org/) - Network protocol analyzer
    - [Nmap](https://nmap.org/) - Network discovery and security auditing
    - [Bettercap](https://www.bettercap.org/) - Network attack and monitoring tool
    - [Zeek](https://zeek.org/) - Network security monitor
  - **Practical Exercises**:
    - Perform network reconnaissance with Nmap
    - Analyze network traffic for security issues
    - Detect and prevent ARP spoofing attacks
    - Configure network security monitoring

- **Firewalls & IDS/IPS**
  - [pfSense Fundamentals](https://www.netgate.com/training/pfsense-fundamentals-and-advanced-application)
  - [Snort IDS Fundamentals](https://iritt.medium.com/ids-fundamentals-cyber-security-101-security-solutions-tryhackme-walkthrough-23edba97cfa3)
  - [Suricata IDS/IPS](https://suricata.io/)
  - [Cisco Firewall Configuration](https://www.cisco.com/c/en/us/solutions/small-business/resource-center/security/how-to-setup-a-firewall.html)
  - **Books**:
    - "Practical Intrusion Analysis" by Ryan Trost
    - "The Practice of Network Security Monitoring" by Richard Bejtlich
    - "Firewalls and Internet Security" by William R. Cheswick
  - **Tools**:
    - [pfSense](https://www.pfsense.org/) - Open-source firewall
    - [Snort](https://www.snort.org/) - Network intrusion detection system
    - [Suricata](https://suricata.io/) - Network IDS/IPS
    - [Security Onion](https://securityonionsolutions.com/) - Security monitoring platform
  - **Practical Exercises**:
    - Set up a firewall with pfSense
    - Configure and tune IDS/IPS rules
    - Analyze and respond to security alerts
    - Create custom detection rules

- **VPN & Secure Communications**
  - [OpenVPN Setup Guide](https://openvpn.net/community-resources/how-to/)
  - [WireGuard VPN Tutorial](https://www.wireguard.com/quickstart/)
  - [IPsec VPN Configuration](https://www.cisco.com/c/en/us/support/docs/routers/1700-series-modular-access-routers/71462-rtr-l2l-ipsec-split.html)
  - [SSL/TLS Deep Dive](https://www.feistyduck.com/library/openssl-cookbook/)
  - **Books**:
    - "VPNs Illustrated: Tunnels, VPNs, and IPsec" by Jon C. Snader
    - "Implementing SSL/TLS Using Cryptography and PKI" by Joshua Davies
  - **Tools**:
    - [OpenVPN](https://openvpn.net/) - Open-source VPN solution
    - [WireGuard](https://www.wireguard.com/) - Modern VPN protocol
    - [Strongswan](https://www.strongswan.org/) - IPsec implementation
    - [OpenSSL](https://www.openssl.org/) - SSL/TLS toolkit
  - **Practical Exercises**:
    - Set up a site-to-site VPN
    - Configure a remote access VPN
    - Implement certificate-based authentication
    - Analyze VPN traffic for security issues

### 5. System Security

- **Operating System Security**
  - [Windows Security Fundamentals](https://learn.microsoft.com/en-us/credentials/certifications/security-compliance-and-identity-fundamentals/?practice-assessment-type=certification)
  - [Linux Security Fundamentals](https://www.udemy.com/course/linux-security-fundamentals/?srsltid=AfmBOopLV9Q8LTu-wp-oVIfdZGQsfKXtfOMFtL3M9BsnM1lUoptqTaPT&couponCode=KEEPLEARNING)
  - [macOS Security and Privacy Guide](https://github.com/drduh/macOS-Security-and-Privacy-Guide)
  - [SANS SEC505: Securing Windows](https://www.cybersecuritycourses.com/course/sec505-securing-windows-and-powershell-automation/)
  - **Books**:
    - "Windows Internals" by Mark Russinovich
    - "Linux Security Cookbook" by Daniel J. Barrett
    - "macOS and iOS Internals" by Jonathan Levin
  - **Tools**:
    - [Microsoft Baseline Security Analyzer](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance)
    - [Lynis](https://cisofy.com/lynis/) - Security auditing tool for Linux
    - [OpenSCAP](https://www.open-scap.org/) - Security compliance solution
    - [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/)
  - **Practical Exercises**:
    - Harden a Windows/Linux server
    - Implement security baselines
    - Perform security audits
    - Configure secure authentication mechanisms

- **Endpoint Protection**
  - [SANS SEC505: Securing Windows](https://www.cybersecuritycourses.com/course/sec505-securing-windows-and-powershell-automation/)
  - [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)
  - [Microsoft Defender for Endpoint](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/)
  - [Endpoint Detection and Response (EDR)](https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/)
  - **Books**:
    - "Endpoint Security and Compliance Management" by Daniel Blander
    - "Malware Analyst's Cookbook" by Michael Hale Ligh
  - **Tools**:
    - [Windows Defender](https://www.microsoft.com/en-us/windows/comprehensive-security)
    - [ClamAV](https://www.clamav.net/) - Open-source antivirus
    - [OSSEC](https://www.ossec.net/) - Host-based intrusion detection
    - [Wazuh](https://wazuh.com/) - Security monitoring solution
  - **Practical Exercises**:
    - Configure endpoint protection solutions
    - Implement application whitelisting
    - Detect and respond to malware infections
    - Create security policies for endpoints

- **Vulnerability Management**
  - [Nessus Essentials Tutorial](https://www.tenable.com/products/nessus/nessus-essentials)
  - [OpenVAS Tutorial](https://www.openvas.org/)
  - [Qualys Vulnerability Management](https://www.qualys.com/apps/vulnerability-management/)
  - [NIST Vulnerability Management](https://nvd.nist.gov/vuln/search)
  - **Books**:
    - "The Vulnerability Management Lifecycle" by Sagar Rahalkar
    - "Vulnerability Management" by Park Foreman
  - **Tools**:
    - [Nessus](https://www.tenable.com/products/nessus) - Vulnerability scanner
    - [OpenVAS](https://www.openvas.org/) - Open-source vulnerability scanner
    - [Qualys](https://www.qualys.com/) - Cloud-based security and compliance
    - [Nexpose](https://www.rapid7.com/products/nexpose/) - Vulnerability management
  - **Practical Exercises**:
    - Perform vulnerability assessments
    - Prioritize vulnerabilities based on risk
    - Develop remediation plans
    - Implement vulnerability management processes

### 6. Web Application Security

- **OWASP Top 10**
  - [OWASP Top Ten](https://owasp.org/www-project-top-ten/)
  - [Web Security Academy](https://portswigger.net/web-security)
  - [SANS SEC542: Web App Penetration Testing and Ethical Hacking](https://www.sans.org/cyber-security-courses/web-app-penetration-testing-ethical-hacking/)
  - [Kontra OWASP Top 10](https://application.security/free/owasp-top-10)
  - **Books**:
    - "The Web Application Hacker's Handbook" by Dafydd Stuttard and Marcus Pinto
    - "Web Security for Developers" by Malcolm McDonald
    - "Real-World Bug Hunting" by Peter Yaworski
  - **Tools**:
    - [OWASP ZAP](https://www.zaproxy.org/) - Web application security scanner
    - [Burp Suite](https://portswigger.net/burp) - Web vulnerability scanner
    - [Nikto](https://cirt.net/Nikto2) - Web server scanner
    - [SQLmap](https://sqlmap.org/) - SQL injection tool
  - **Practical Exercises**:
    - Set up a vulnerable web application (e.g., [DVWA](https://github.com/digininja/DVWA))
    - Identify and exploit common web vulnerabilities
    - Implement security controls to prevent attacks
    - Perform a web application security assessment

- **Web Application Penetration Testing**
  - [Burp Suite Academy](https://portswigger.net/web-security)
  - [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/)
  - [HackTheBox Web Challenges](https://www.hackthebox.eu/)
  - [PentesterLab](https://pentesterlab.com/)
  - **Books**:
    - "Mastering Modern Web Penetration Testing" by Prakhar Prasad
    - "Bug Bounty Hunting Essentials" by Shahmeer Amir
    - "Web Hacking 101" by Peter Yaworski
  - **Tools**:
    - [Burp Suite](https://portswigger.net/burp) - Web vulnerability scanner
    - [OWASP ZAP](https://www.zaproxy.org/) - Web application security scanner
    - [Dirsearch](https://github.com/maurosoria/dirsearch) - Web path scanner
    - [Wfuzz](https://github.com/xmendez/wfuzz) - Web application fuzzer
  - **Practical Exercises**:
    - Perform a full web application penetration test
    - Write a detailed security report
    - Exploit and chain multiple vulnerabilities
    - Participate in bug bounty programs

- **Secure Coding Practices**
  - [Secure Coding in Python](https://github.com/Ericsson/secure_coding_one_stop_shop_for_python)
  - [OWASP Secure Coding Practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/)
  - [Secure Coding in Java](https://www.oracle.com/java/technologies/javase/seccodeguide.html)
  - [Microsoft Secure Coding Guidelines](https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2010/ms182020(v=vs.100))
  - **Books**:
    - "Secure Coding in C and C++" by Robert C. Seacord
    - "Iron-Clad Java: Building Secure Web Applications" by Jim Manico
    - "Secure Programming Cookbook for C and C++" by John Viega
  - **Tools**:
    - [SonarQube](https://www.sonarqube.org/) - Code quality and security
    - [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) - Software composition analysis
    - [Snyk](https://snyk.io/) - Open source security platform
    - [Checkmarx](https://www.checkmarx.com/) - Static application security testing
    - [Vulert](https://www.vulert.com)- Vulert secures software by detecting vulnerabilities in open-source dependencies—without accessing your code. It supports Js, PHP, Java, Python, and more.

- **Practical Exercises**:
    - Review code for security vulnerabilities
    - Implement secure authentication and authorization
    - Secure data storage and transmission
    - Integrate security into the development lifecycle

## 🛠️ Specialization Phase

### 7. Offensive Security

- **Penetration Testing Methodology**
  - [TryHackMe: Complete Beginner Path](https://tryhackme.com/path/outline/beginner)
  - [HackTheBox Academy](https://academy.hackthebox.com/)
  - [SANS Penetration Testing Roadmap](https://www.sans.org/cyber-security-skills-roadmap/)
  - [Offensive Security Certified Professional (OSCP)](https://www.offensive-security.com/pwk-oscp/)
  - [Penetration Testing Execution Standard (PTES)](http://www.pentest-standard.org/)
  - **Books**:
    - "The Hacker Playbook 3" by Peter Kim
    - "Advanced Penetration Testing" by Wil Allsopp
    - "Penetration Testing: A Hands-On Introduction to Hacking" by Georgia Weidman
  - **Tools**:
    - [Metasploit Framework](https://www.metasploit.com/) - Penetration testing framework
    - [Cobalt Strike](https://www.cobaltstrike.com/) - Adversary simulation software
    - [Empire](https://github.com/BC-SECURITY/Empire) - Post-exploitation framework
    - [Covenant](https://github.com/cobbr/Covenant) - .NET command and control framework
  - **Practical Exercises**:
    - Complete CTF challenges on platforms like HackTheBox and TryHackMe
    - Perform a full penetration test in a lab environment
    - Document findings in a professional penetration testing report
    - Practice OSCP-like challenges

- **Exploitation Techniques**
  - [Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/)
  - [OSCP Preparation Guide](https://johnjhacking.com/blog/the-oscp-preperation-guide-2020/)
  - [Exploit Development](https://github.com/wtsxDev/Exploit-Development)
  - [Buffer Overflow Tutorial](https://www.youtube.com/watch?v=1S0aBV-Waeo)
  - **Books**:
    - "The Shellcoder's Handbook" by Chris Anley
    - "A Guide to Kernel Exploitation" by Enrico Perla
    - "Gray Hat Python" by Justin Seitz
  - **Tools**:
    - [Metasploit Framework](https://www.metasploit.com/) - Penetration testing framework
    - [GDB](https://www.gnu.org/software/gdb/) - GNU debugger
    - [IDA Pro](https://hex-rays.com/ida-pro/) - Disassembler and debugger
    - [Ghidra](https://ghidra-sre.org/) - Software reverse engineering framework
  - **Practical Exercises**:
    - Develop custom exploits for known vulnerabilities
    - Analyze and modify public exploits
    - Practice buffer overflow exploitation
    - Perform post-exploitation activities

- **Social Engineering**
  - [Social Engineering: The Science of Human Hacking](https://www.social-engineer.org/)
  - [The Social-Engineer Toolkit (SET)](https://github.com/trustedsec/social-engineer-toolkit)
  - [SANS SEC567: Social Engineering for Penetration Testers](https://www.sans.org/cyber-security-courses/social-engineering-security/)
  - **Books**:
    - "Social Engineering: The Art of Human Hacking" by Christopher Hadnagy
    - "Phishing Dark Waters" by Christopher Hadnagy and Michele Fincher
    - "The Art of Deception" by Kevin Mitnick
  - **Tools**:
    - [Social-Engineer Toolkit (SET)](https://github.com/trustedsec/social-engineer-toolkit)
    - [Gophish](https://getgophish.com/) - Open-source phishing framework
    - [King Phisher](https://github.com/securestate/king-phisher) - Phishing campaign toolkit
    - [SpiderFoot](https://www.spiderfoot.net/) - OSINT automation tool
  - **Practical Exercises**:
    - Create and execute a phishing campaign (in a controlled environment)
    - Develop social engineering scenarios
    - Practice pretexting and impersonation techniques
    - Analyze successful social engineering attacks

### 8. Defensive Security

- **Security Operations Center (SOC)**
  - [SOC Analyst Learning Path](https://app.letsdefend.io/path/soc-analyst-learning-path)
  - [Blue Team Labs Online](https://blueteamlabs.online/)
  - [SANS SEC450: Blue Team Fundamentals](https://www.sans.org/cyber-security-courses/blue-team-fundamentals-security-operations-analysis/)
  - [Cybrary SOC Analyst](https://www.cybrary.it/career-path/soc-analyst)
  - **Books**:
    - "Blue Team Handbook: SOC, SIEM, and Threat Hunting" by Don Murdoch
    - "Security Operations Center: Building, Operating, and Maintaining your SOC" by Joseph Muniz
    - "The Practice of Network Security Monitoring" by Richard Bejtlich
  - **Tools**:
    - [Splunk](https://www.splunk.com/) - Security information and event management
    - [ELK Stack](https://www.elastic.co/elastic-stack) - Log analysis platform
    - [Wazuh](https://wazuh.com/) - Security monitoring solution
    - [TheHive](https://thehive-project.org/) - Security incident response platform
  - **Practical Exercises**:
    - Set up a SIEM solution
    - Create detection rules for common attacks
    - Perform log analysis and correlation
    - Develop incident response playbooks

- **Incident Response**
  - [SANS Incident Handler's Handbook](https://www.sans.org/white-papers/33901/)
  - [NIST Incident Response Framework](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)
  - [SANS FOR508: Advanced Digital Forensics, Incident Response, and Threat Hunting](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/)
  - [Incident Response Consortium](https://www.incidentresponse.com/)
  - **Books**:
    - "Incident Response & Computer Forensics" by Jason T. Luttgens
    - "The Art of Memory Forensics" by Michael Hale Ligh
    - "Digital Forensics and Incident Response" by Gerard Johansen
  - **Tools**:
    - [TheHive](https://thehive-project.org/) - Security incident response platform
    - [Velociraptor](https://www.velocidex.com/) - Digital forensics and incident response
    - [MISP](https://www.misp-project.org/) - Threat intelligence platform
    - [GRR Rapid Response](https://github.com/google/grr) - Remote live forensics
  - **Practical Exercises**:
    - Develop an incident response plan
    - Simulate and respond to security incidents
    - Perform forensic analysis of compromised systems
    - Create incident response reports

- **Digital Forensics**
  - [SANS FOR500: Windows Forensic Analysis](https://www.sans.org/cyber-security-courses/windows-forensic-analysis/)
  - [Digital Forensics Framework](https://github.com/arxsys/dff)
  - [Computer Forensics Tutorial](https://www.udemy.com/course/computer-forensics-and-digital-forensics-for-everyone/?srsltid=AfmBOoq91fIkp7eYQunGBGJV6SW4KWgg8aj-rmXTlcuUVp05GZT3s4aM)
  - [NIST Computer Forensics Tools and Techniques Catalog](https://toolcatalog.nist.gov/)
  - **Books**:
    - "File System Forensic Analysis" by Brian Carrier
    - "Digital Forensics with Open Source Tools" by Cory Altheide and Harlan Carvey
    - "Windows Forensic Analysis Toolkit" by Harlan Carvey
  - **Tools**:
    - [Autopsy](https://www.autopsy.com/) - Digital forensics platform
    - [FTK Imager](https://www.exterro.com/digital-forensics-software/ftk-imager) - Forensic imaging tool
    - [Volatility](https://www.volatilityfoundation.org/) - Memory forensics framework
    - [Sleuth Kit](https://www.sleuthkit.org/) - Disk analysis tools
  - **Practical Exercises**:
    - Perform disk forensics on compromised systems
    - Analyze memory dumps for evidence
    - Recover deleted files and data
    - Create forensic investigation reports

### 9. Cloud Security

- **Cloud Security Fundamentals**
  - [AWS Security Fundamentals](https://aws.amazon.com/training/course-descriptions/security-fundamentals/)
  - [Azure Security Technologies](https://learn.microsoft.com/en-us/training/courses/az-500t00)
  - [Google Cloud Security](https://cloud.google.com/security/)
  - [Cloud Security Alliance Courses](https://cloudsecurityalliance.org/education/)
  - [IBM Cloud Security](https://www.ibm.com/cloud/learn/cloud-security)
  - **Books**:
    - "Cloud Security: A Comprehensive Guide" by Chris Dotson
    - "Practical Cloud Security" by Chris Dotson
    - "AWS Security" by Dylan Shields
  - **Tools**:
    - [AWS Security Hub](https://aws.amazon.com/security-hub/)
    - [Azure Security Center](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/microsoft.azuresecuritycenter?tab=overview)
    - [Google Cloud Security Command Center](https://cloud.google.com/security-command-center)
    - [CloudSploit](https://github.com/aquasecurity/cloudsploit) - Cloud security scanner
  - **Practical Exercises**:
    - Set up secure cloud infrastructure
    - Implement identity and access management
    - Configure cloud security monitoring
    - Perform cloud security assessments

- **Cloud Security Architecture**
  - [Cloud Security Alliance Guidance](https://cloudsecurityalliance.org/research/guidance/)
  - [Well-Architected Framework (AWS)](https://aws.amazon.com/architecture/well-architected/)
  - [Azure Well-Architected Framework](https://docs.microsoft.com/en-us/azure/architecture/framework/)
  - [Google Cloud Architecture Framework](https://cloud.google.com/architecture/framework)
  - **Books**:
    - "Cloud Security Architecture" by Lee Newcombe
    - "Architecting for Security in the Cloud" by David Linthicum
  - **Tools**:
    - [Terraform](https://www.terraform.io/) - Infrastructure as code
    - [CloudFormation](https://aws.amazon.com/cloudformation/) - AWS infrastructure as code
    - [Azure Resource Manager](https://azure.microsoft.com/en-us/features/resource-manager/) - Azure infrastructure as code
  - **Practical Exercises**:
    - Design a secure cloud architecture
    - Implement defense in depth in cloud environments
    - Create infrastructure as code templates with security controls
    - Perform threat modeling for cloud architectures

- **Container Security**
  - [Docker Security](https://docs.docker.com/engine/security/)
  - [Kubernetes Security](https://kubernetes.io/docs/concepts/security/)
  - [OWASP Docker Security](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)
  - [Kubernetes Security Best Practices](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)
  - **Books**:
    - "Container Security" by Liz Rice
    - "Kubernetes Security" by Liz Rice and Michael Hausenblas
  - **Tools**:
    - [Clair](https://github.com/quay/clair) - Container vulnerability scanner
    - [Trivy](https://github.com/aquasecurity/trivy) - Container vulnerability scanner
    - [Falco](https://falco.org/) - Container runtime security
    - [Aqua Security](https://www.aquasec.com/) - Container security platform
  - **Practical Exercises**:
    - Secure Docker containers and images
    - Implement Kubernetes security controls
    - Set up container vulnerability scanning
    - Monitor container runtime security

## Advanced Phase

### 10. Advanced Topics

- **Malware Analysis**
  - [Practical Malware Analysis](https://nostarch.com/malware)
  - [SANS FOR610: Reverse-Engineering Malware](https://www.sans.org/cyber-security-courses/reverse-engineering-malware-malware-analysis-tools-techniques/)
  - [Malware Analysis Tutorials](https://fumalwareanalysis.blogspot.com/)
  - [OALabs YouTube Channel](https://www.youtube.com/c/OALabs)
  - **Books**:
    - "Practical Malware Analysis" by Michael Sikorski and Andrew Honig
    - "Malware Analyst's Cookbook" by Michael Ligh et al.
    - "Learning Malware Analysis" by Monnappa K A
  - **Tools**:
    - [Ghidra](https://ghidra-sre.org/) - Software reverse engineering framework
    - [IDA Pro](https://hex-rays.com/ida-pro/) - Disassembler and debugger
    - [Cuckoo Sandbox](https://cuckoosandbox.org/) - Malware analysis sandbox
    - [REMnux](https://remnux.org/) - Linux toolkit for malware analysis
  - **Practical Exercises**:
    - Analyze malware samples in a safe environment
    - Reverse engineer malicious code
    - Create malware analysis reports
    - Build automated malware analysis pipelines

- **Threat Intelligence**
  - [MITRE ATT&CK Framework](https://attack.mitre.org/)
  - [SANS FOR578: Cyber Threat Intelligence](https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/)
  - [Open Source Intelligence Techniques](https://inteltechniques.com/)
  - [Threat Intelligence Platforms](https://www.gartner.com/reviews/market/security-threat-intelligence-services)
  - **Books**:
    - "Intelligence-Driven Incident Response" by Scott J. Roberts and Rebekah Brown
    - "The Threat Intelligence Handbook" by Recorded Future
    - "Applied Intelligence" by Kris Lovejoy
  - **Tools**:
    - [MISP](https://www.misp-project.org/) - Threat intelligence platform
    - [OpenCTI](https://www.opencti.io/) - Open cyber threat intelligence platform
    - [ThreatConnect](https://threatconnect.com/) - Threat intelligence platform
    - [Recorded Future](https://www.recordedfuture.com/) - Threat intelligence
  - **Practical Exercises**:
    - Collect and analyze threat intelligence
    - Map threats to the MITRE ATT&CK framework
    - Create threat intelligence reports
    - Integrate threat intelligence into security operations

- **Advanced Persistent Threats**
  - [APT Groups and Operations](https://apt.threattracking.com/)
  - [Mandiant APT Reports](https://www.mandiant.com/resources/insights/reports)
  - [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)
  - [ThaiCERT APT Encyclopedia](https://apt.etda.or.th/cgi-bin/aptgroups.cgi)
  - **Books**:
    - "Advanced Persistent Threat Hacking" by Tyler Wrightson
    - "APT41: A Dual Espionage and Cyber Crime Operation" by FireEye
  - **Tools**:
    - [Yara](https://virustotal.github.io/yara/) - Pattern matching for malware detection
    - [Sigma](https://github.com/SigmaHQ/sigma) - Generic signature format for SIEM systems
    - [CyberChef](https://gchq.github.io/CyberChef/) - Data analysis tool
  - **Practical Exercises**:
    - Analyze APT campaigns and techniques
    - Create detection rules for APT tactics
    - Simulate APT attacks in a controlled environment
    - Develop APT hunting strategies

### 11. Specialized Security Domains

- **IoT Security**
  - [OWASP IoT Security](https://owasp.org/www-project-internet-of-things/)
  - [IoT Security Foundation](https://www.iotsecurityfoundation.org/)
  - [NIST IoT Security](https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program)
  - [IoT Security Guidelines](https://www.gsma.com/iot/iot-security/iot-security-guidelines/)
  - **Books**:
    - "Practical IoT Hacking" by Fotios Chantzis et al.
    - "IoT Penetration Testing Cookbook" by Aaron Guzman and Aditya Gupta
    - "Abusing the Internet of Things" by Nitesh Dhanjani
  - **Tools**:
    - [Shodan](https://www.shodan.io/) - IoT search engine
    - [Firmware Analysis Toolkit](https://github.com/attify/firmware-analysis-toolkit) - Firmware security analysis
    - [IoTSeeker](https://github.com/rapid7/IoTSeeker) - IoT device scanner
  - **Practical Exercises**:
    - Analyze IoT device security
    - Perform firmware analysis
    - Test IoT communication protocols
    - Implement IoT security controls

- **Mobile Security**
  - [OWASP Mobile Security Testing Guide](https://owasp.org/www-project-mobile-security-testing-guide/)
  - [Mobile Application Security Verification Standard](https://github.com/OWASP/owasp-masvs)
  - [Android Security](https://source.android.com/security)
  - [iOS Security](https://support.apple.com/guide/security/welcome/web)
  - **Books**:
    - "Android Security Internals" by Nikolay Elenkov
    - "iOS Application Security" by David Thiel
    - "Mobile Application Penetration Testing" by Vijay Kumar Velu
  - **Tools**:
    - [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Mobile security testing framework
    - [Frida](https://frida.re/) - Dynamic instrumentation toolkit
    - [Objection](https://github.com/sensepost/objection) - Mobile runtime exploration
    - [Drozer](https://github.com/FSecureLABS/drozer) - Android security assessment
  - **Practical Exercises**:
    - Perform mobile app penetration testing
    - Analyze mobile app permissions and security
    - Test mobile authentication mechanisms
    - Implement secure mobile development practices

- **Industrial Control Systems Security**
  - [ICS-CERT Training](https://us-cert.cisa.gov/ics/Training-Available-Through-ICS-CERT)
  - [SANS ICS410: ICS/SCADA Security Essentials](https://www.sans.org/cyber-security-courses/ics-scada-cyber-security-essentials/)
  - [NIST SP 800-82: Guide to ICS Security](https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final)
  - [ISA/IEC 62443 Standards](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards)
  - **Books**:
    - "Industrial Network Security" by Eric D. Knapp and Joel Thomas Langill
    - "Hacking Exposed Industrial Control Systems" by Clint Bodungen et al.
    - "Cybersecurity for SCADA Systems" by William Shaw
  - **Tools**:
    - [Shodan](https://www.shodan.io/) - ICS device search
    - [Wireshark](https://www.wireshark.org/) - Protocol analyzer with ICS protocol support
    - [Conpot](https://github.com/mushorg/conpot) - ICS honeypot
    - [PLCscan](https://github.com/meeas/plcscan) - PLC scanner
  - **Practical Exercises**:
    - Set up an ICS lab environment
    - Analyze ICS protocols and vulnerabilities
    - Implement ICS security controls
    - Perform ICS security assessments

## Professional Development

### 12. Career Development

- **Certifications Planning**
  - [CompTIA Certification Roadmap](https://www.comptia.org/certifications/which-certification)
  - [SANS Certification Roadmap](https://www.sans.org/cyber-security-skills-roadmap/)
  - [ISC2 Certifications](https://www.isc2.org/Certifications)
  - [ISACA Certifications](https://www.isaca.org/credentialing)
  - [EC-Council Certifications](https://www.eccouncil.org/programs/)
  - **Books**:
    - "CISSP All-in-One Exam Guide" by Shon Harris and Fernando Maymi
    - "CompTIA Security+ Get Certified Get Ahead" by Darril Gibson
    - "OSCP Preparation Guide" by TJ_Null
  - **Resources**:
    - [Certification Comparison](https://pauljerimy.com/security-certification-roadmap/)
    - [Cybersecurity Certification Guide](https://www.cybersecurityeducation.org/certifications/)
    - [Reddit r/cybersecurity Certification Guides](https://www.reddit.com/r/cybersecurity/wiki/index/#wiki_certification_questions)
  - **Practical Exercises**:
    - Create a personalized certification roadmap
    - Build a study plan for your target certification
    - Join study groups and practice exams
    - Create practical labs to reinforce certification material

- **Building a Professional Network**
  - [Cybersecurity Communities](https://github.com/sbilly/awesome-security#other-awesome-lists-and-repositories)
  - [Security Conferences](https://infosec-conferences.com/)
  - [OWASP Chapters](https://owasp.org/chapters/)
  - [Cybersecurity Meetups](https://www.meetup.com/topics/cybersecurity/)
  - [Women in Cybersecurity (WiCyS)](https://www.wicys.org/)
  - **Resources**:
    - [Building Your Cybersecurity Network](https://cybersecurityguide.org/resources/career-networking-guide/)
  - **Practical Exercises**:
    - Join cybersecurity communities and forums
    - Attend local meetups and conferences
    - Contribute to open-source security projects
    - Participate in online discussions and forums
    - Create and share cybersecurity content

- **Continuous Learning**
  - [Cybersecurity Podcasts](https://nordlayer.com/blog/cybersecurity-podcasts-to-check-out/)
  - [Security Research Blogs](https://www.akamai.com/blog/security-research)
  - [Academic Journals](https://www.scimagojr.com/journalrank.php?category=1712)
  - [Security Newsletters](https://www.sans.org/newsletters/)
  - [GitHub Security Repositories](https://github.com/topics/security)
  - **Resources**:
    - [Awesome Hacking Resources](https://github.com/vitalysim/Awesome-Hacking-Resources)
    - [Cybersecurity Canon](https://icdt.osu.edu/cybercanon/bookreviews)
    - [Cybersecurity Learning Paths](https://tryhackme.com/paths)
  - **Practical Exercises**:
    - Subscribe to security newsletters and podcasts
    - Follow security researchers on social media
    - Set up a personal blog to document your learning
    - Participate in bug bounty programs
    - Contribute to security tools and research

## Learning Resources

### Books

- **Beginner**
  - "Cybersecurity for Beginners" by Raef Meeuwisse
  - "The Art of Invisibility" by Kevin Mitnick
  - "Social Engineering: The Science of Human Hacking" by Christopher Hadnagy
  - "Practical Malware Analysis" by Michael Sikorski and Andrew Honig
  - "Cryptography for Dummies" by Chey Cobb
  - "Computer Security: Principles and Practice" by William Stallings and Lawrie Brown
  - "Network Security Essentials" by William Stallings

- **Intermediate**
  - "The Web Application Hacker's Handbook" by Dafydd Stuttard and Marcus Pinto
  - "Blue Team Handbook" by Don Murdoch
  - "Penetration Testing: A Hands-On Introduction to Hacking" by Georgia Weidman
  - "The Tangled Web: A Guide to Securing Modern Web Applications" by Michal Zalewski
  - "Threat Modeling: Designing for Security" by Adam Shostack
  - "Reversing: Secrets of Reverse Engineering" by Eldad Eilam
  - "The Hacker Playbook 3" by Peter Kim

- **Advanced**
  - "The Art of Memory Forensics" by Michael Hale Ligh et al.
  - "Gray Hat Hacking: The Ethical Hacker's Handbook" by Allen Harper et al.
  - "The Shellcoder's Handbook" by Chris Anley et al.
  - "Practical Reverse Engineering" by Bruce Dang et al.
  - "Advanced Penetration Testing" by Wil Allsopp
  - "Black Hat Python" by Justin Seitz
  - "Windows Internals" by Mark Russinovich et al.

- **Specialized**
  - "Cloud Security: A Comprehensive Guide" by Chris Dotson
  - "Industrial Network Security" by Eric D. Knapp and Joel Thomas Langill
  - "iOS Application Security" by David Thiel
  - "Android Security Internals" by Nikolay Elenkov
  - "Container Security" by Liz Rice
  - "Applied Cryptography" by Bruce Schneier
  - "Intelligence-Driven Incident Response" by Scott J. Roberts and Rebekah Brown

### Online Platforms

- **Learning Platforms**
  - [TryHackMe](https://tryhackme.com/) - Interactive cybersecurity training
  - [HackTheBox](https://www.hackthebox.eu/) - Penetration testing labs
  - [VulnHub](https://www.vulnhub.com/) - Vulnerable virtual machines
  - [PortSwigger Web Security Academy](https://portswigger.net/web-security) - Web security training
  - [Cybrary](https://www.cybrary.it/) - Free cybersecurity courses
  - [edX Cybersecurity Courses](https://www.edx.org/learn/cybersecurity) - University-level courses
  - [Coursera Cybersecurity Specializations](https://www.coursera.org/browse/information-technology/security) - University-level courses
  - [SANS Cyber Aces](https://www.cyberaces.org/) - Free online courses
  - [Offensive Security](https://www.offensive-security.com/) - Professional penetration testing training
  - [INE Security](https://security.ine.com/) - Cybersecurity training
  - [PentesterLab](https://pentesterlab.com/) - Web penetration testing exercises
  - [RangeForce](https://www.rangeforce.com/) - Hands-on cybersecurity training
  - [Pluralsight](https://www.pluralsight.com/browse/information-cyber-security) - IT and security courses
  - [Udemy](https://www.udemy.com/courses/it-and-software/network-and-security/) - Various security courses

- **Practice Environments**
  - [Damn Vulnerable Web Application (DVWA)](https://github.com/digininja/DVWA) - Vulnerable web application
  - [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) - Vulnerable web application
  - [WebGoat](https://owasp.org/www-project-webgoat/) - Deliberately insecure web application
  - [Metasploitable](https://sourceforge.net/projects/metasploitable/) - Vulnerable Linux virtual machine
  - [Vulnhub](https://www.vulnhub.com/) - Vulnerable virtual machines
  - [Hack The Box](https://www.hackthebox.eu/) - Online penetration testing platform
  - [PentesterLab](https://pentesterlab.com/) - Web penetration testing exercises
  - [Root Me](https://www.root-me.org/) - Hacking challenges
  - [Hacker101 CTF](https://ctf.hacker101.com/) - CTF challenges by HackerOne
  - [CryptoHack](https://cryptohack.org/) - Cryptography challenges
  - [OverTheWire](https://overthewire.org/wargames/) - Security wargames

### YouTube Channels

- [John Hammond](https://www.youtube.com/user/RootOfTheNull) - CTF walkthroughs and security tutorials
- [IppSec](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA) - HackTheBox walkthroughs
- [The Cyber Mentor](https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw) - Penetration testing tutorials
- [David Bombal](https://www.youtube.com/user/ConfigTerm) - Networking and security tutorials
- [NetworkChuck](https://www.youtube.com/user/NetworkChuck) - Networking and security tutorials
- [Nahamsec](https://www.youtube.com/channel/UCCZDt7MuC3Hzs6IH4xODLBw) - Bug bounty and web security
- [LiveOverflow](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A) - Exploit development and CTF
- [STÖK](https://www.youtube.com/channel/UCQN2DsjnYH0pQcECM0d6oLQ) - Bug bounty hunting
- [HackerSploit](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A) - Penetration testing tutorials
- [PwnFunction](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A) - Web security animations
- [InsiderPhD](https://www.youtube.com/user/RapidBug) - Bug bounty and web security
- [Security Weekly](https://www.youtube.com/user/SecurityWeeklyTV) - Security news and interviews
- [Black Hat](https://www.youtube.com/user/BlackHatOfficialYT) - Conference presentations
- [DEFCONConference](https://www.youtube.com/user/DEFCONConference) - Conference presentations
- [SANS Offensive Operations](https://www.youtube.com/c/SANSOffensiveOperations) - Offensive security techniques

## Cybersecurity Tools

### Reconnaissance & Information Gathering

- [Nmap](https://nmap.org/) - Network discovery and security auditing
- [Shodan](https://www.shodan.io/) - Search engine for Internet-connected devices
- [Recon-ng](https://github.com/lanmaster53/recon-ng) - Web reconnaissance framework
- [theHarvester](https://github.com/laramies/theHarvester) - Email, subdomain and name harvester
- [Maltego](https://www.maltego.com/) - Open source intelligence and forensics
- [SpiderFoot](https://github.com/smicallef/spiderfoot) - OSINT automation tool
- [Amass](https://github.com/OWASP/Amass) - In-depth attack surface mapping and asset discovery
- [Sublist3r](https://github.com/aboul3la/Sublist3r) - Subdomain enumeration tool
- [OWASP Maryam](https://github.com/saeeddhqan/Maryam) - Open-source intelligence framework

### Vulnerability Assessment

- [OpenVAS](https://www.openvas.org/) - Open-source vulnerability scanner
- [Nessus](https://www.tenable.com/products/nessus) - Vulnerability scanner
- [Nikto](https://cirt.net/Nikto2) - Web server scanner
- [Qualys](https://www.qualys.com/) - Cloud-based security and compliance
- [Nexpose](https://www.rapid7.com/products/nexpose/) - Vulnerability management
- [Acunetix](https://www.acunetix.com/) - Web vulnerability scanner
- [Netsparker](https://www.netsparker.com/) - Web application security scanner
- [Nuclei](https://github.com/projectdiscovery/nuclei) - Vulnerability scanner based on templates
- [Vulners Scanner](https://github.com/vulnersCom/nmap-vulners) - NSE script using Vulners.com API

### Web Application Security

- [Burp Suite](https://portswigger.net/burp) - Web vulnerability scanner and proxy
- [OWASP ZAP](https://www.zaproxy.org/) - Web application security scanner
- [Sqlmap](https://sqlmap.org/) - Automatic SQL injection tool
- [Wfuzz](https://github.com/xmendez/wfuzz) - Web application fuzzer
- [Dirsearch](https://github.com/maurosoria/dirsearch) - Web path scanner
- [Nikto](https://cirt.net/Nikto2) - Web server scanner
- [Skipfish](https://github.com/spinkham/skipfish) - Active web application security reconnaissance tool
- [w3af](https://github.com/andresriancho/w3af) - Web Application Attack and Audit Framework
- [Arachni](https://www.arachni-scanner.com/) - Web application security scanner framework

### Exploitation

- [Metasploit](https://www.metasploit.com/) - Penetration testing framework
- [BeEF](https://beefproject.com/) - Browser Exploitation Framework
- [Empire](https://github.com/BC-SECURITY/Empire) - Post-exploitation framework
- [Cobalt Strike](https://www.cobaltstrike.com/) - Adversary simulation software
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) - PowerShell post-exploitation framework
- [Pupy](https://github.com/n1nj4sec/pupy) - Cross-platform remote administration and post-exploitation tool
- [Covenant](https://github.com/cobbr/Covenant) - .NET command and control framework
- [Sliver](https://github.com/BishopFox/sliver) - Cross-platform adversary emulation framework

### Password Attacks

- [Hashcat](https://hashcat.net/hashcat/) - Advanced password recovery
- [John the Ripper](https://www.openwall.com/john/) - Password cracking tool
- [Hydra](https://github.com/vanhauser-thc/thc-hydra) - Login cracker
- [Aircrack-ng](https://www.aircrack-ng.org/) - WiFi security auditing tools suite
- [Medusa](https://github.com/jmk-foofus/medusa) - Parallel network login auditor
- [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - Post-exploitation tool
- [mimikatz](https://github.com/gentilkiwi/mimikatz) - Windows credential dumping
- [RainbowCrack](http://project-rainbowcrack.com/) - Rainbow table implementation

### Forensics & Incident Response

- [Autopsy](https://www.autopsy.com/) - Digital forensics platform
- [Volatility](https://www.volatilityfoundation.org/) - Memory forensics framework
- [FTK Imager](https://accessdata.com/product-download/ftk-imager-version-4-5) - Forensic imaging tool
- [The Sleuth Kit](https://www.sleuthkit.org/) - Disk analysis tools
- [SANS SIFT](https://digital-forensics.sans.org/community/downloads) - Forensic toolkit
- [Rekall](https://github.com/google/rekall) - Memory analysis framework
- [CAINE](https://www.caine-live.net/) - Computer Aided INvestigative Environment
- [GRR Rapid Response](https://github.com/google/grr) - Remote live forensics
- [TheHive](https://thehive-project.org/) - Security incident response platform

### Defensive Tools

- [Wireshark](https://www.wireshark.org/) - Network protocol analyzer
- [Snort](https://www.snort.org/) - Intrusion detection system
- [OSSEC](https://www.ossec.net/) - Host-based intrusion detection
- [Wazuh](https://wazuh.com/) - Security monitoring solution
- [Security Onion](https://securityonionsolutions.com/) - Security monitoring platform
- [Suricata](https://suricata.io/) - Network IDS/IPS
- [Zeek](https://zeek.org/) - Network security monitor
- [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) - Windows system monitoring
- [YARA](https://virustotal.github.io/yara/) - Pattern matching for malware detection

### Cloud Security

- [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Multi-cloud security auditing tool
- [Prowler](https://github.com/toniblyx/prowler) - AWS security best practices assessment
- [CloudSploit](https://cloudsploit.com/) - Cloud security scanner
- [Pacu](https://github.com/RhinoSecurityLabs/pacu) - AWS exploitation framework
- [CloudGoat](https://github.com/RhinoSecurityLabs/cloudgoat) - Vulnerable AWS environment
- [AzureHound](https://github.com/BloodHoundAD/AzureHound) - Azure security assessment
- [GCP Audit](https://github.com/google/gcp_scanner) - GCP security scanner
- [Falco](https://falco.org/) - Container runtime security
- [Kube-bench](https://github.com/aquasecurity/kube-bench) - Kubernetes security benchmarking

### Mobile Security

- [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Mobile security testing framework
- [Frida](https://frida.re/) - Dynamic instrumentation toolkit
- [Objection](https://github.com/sensepost/objection) - Mobile runtime exploration
- [Drozer](https://github.com/FSecureLABS/drozer) - Android security assessment
- [QARK](https://github.com/linkedin/qark) - Android app vulnerability scanner
- [idb](https://github.com/dmayer/idb) - iOS app security assessment tool
- [Needle](https://github.com/FSecureLABS/needle) - iOS security testing framework
- [Apktool](https://apktool.org/) - Android APK reverse engineering
- [Jadx](https://github.com/skylot/jadx) - Dex to Java decompiler

### OSINT Tools

- [Maltego](https://www.maltego.com/) - Open source intelligence and forensics
- [Shodan](https://www.shodan.io/) - Search engine for Internet-connected devices
- [theHarvester](https://github.com/laramies/theHarvester) - Email, subdomain and name harvester
- [Metagoofil](https://github.com/laramies/metagoofil) - Metadata extraction tool
- [Recon-ng](https://github.com/lanmaster53/recon-ng) - Web reconnaissance framework
- [SpiderFoot](https://www.spiderfoot.net/) - OSINT automation tool
- [OSINT Framework](https://osintframework.com/) - Collection of OSINT tools
- [Sherlock](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username
- [IntelTechniques](https://inteltechniques.com/tools/) - OSINT tools collection

## Certifications Guide

### Entry-Level Certifications

- [CompTIA Security+](https://www.comptia.org/certifications/security) - Foundational cybersecurity certification
  - **Focus Areas**: Network security, threats and vulnerabilities, identity management, cryptography
  - **Prerequisites**: None, but Network+ and 2 years of experience recommended
  - **Exam Format**: 90 questions, 90 minutes, performance-based and multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Security specialist, security administrator, security consultant

- [CompTIA Network+](https://www.comptia.org/certifications/network) - Networking fundamentals
  - **Focus Areas**: Network concepts, infrastructure, operations, security, troubleshooting
  - **Prerequisites**: None, but A+ and 9-12 months of experience recommended
  - **Exam Format**: 90 questions, 90 minutes, performance-based and multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Network administrator, network technician, help desk technician

- [CompTIA A+](https://www.comptia.org/certifications/a) - IT fundamentals
  - **Focus Areas**: Hardware, operating systems, software troubleshooting, networking, security
  - **Prerequisites**: None, but 9-12 months of experience recommended
  - **Exam Format**: Two exams: Core 1 and Core 2, 90 minutes each
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Help desk technician, desktop support analyst, field service technician

- [Certified Information Systems Security Professional (CISSP) Associate](https://www.isc2.org/Certifications/CISSP) - Entry-level version of CISSP
  - **Focus Areas**: Same as CISSP but for those without the required experience
  - **Prerequisites**: Pass the CISSP exam but have less than 5 years of experience
  - **Exam Format**: Same as CISSP
  - **Validity**: Indefinite until requirements for full CISSP are met
  - **Career Paths**: Stepping stone to security analyst, security consultant roles

### Intermediate Certifications

- [CompTIA CySA+](https://www.comptia.org/certifications/cybersecurity-analyst) - Cybersecurity analyst
  - **Focus Areas**: Threat detection, security monitoring, incident response, vulnerability management
  - **Prerequisites**: Network+ and Security+ recommended, 4+ years of experience
  - **Exam Format**: 85 questions, 165 minutes, performance-based and multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Security analyst, threat intelligence analyst, security operations center (SOC) analyst

- [CompTIA PenTest+](https://www.comptia.org/certifications/pentest) - Penetration testing
  - **Focus Areas**: Planning and scoping, information gathering, vulnerability identification, attacks and exploits, reporting
  - **Prerequisites**: Network+ and Security+ recommended, 3+ years of experience
  - **Exam Format**: 85 questions, 165 minutes, performance-based and multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Penetration tester, vulnerability assessment analyst, security consultant

- [Certified Ethical Hacker (CEH)](https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/) - Ethical hacking and countermeasures
  - **Focus Areas**: Ethical hacking methodology, tools, techniques, countermeasures
  - **Prerequisites**: 2 years of experience or official training
  - **Exam Format**: 125 questions, 4 hours, multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Ethical hacker, security analyst, penetration tester

- [GIAC Security Essentials (GSEC)](https://www.giac.org/certification/security-essentials-gsec) - Security essentials
  - **Focus Areas**: Security administration, risk management, cryptography, access controls
  - **Prerequisites**: None
  - **Exam Format**: 180 questions, 5 hours, multiple choice and performance-based
  - **Validity**: 4 years, renewable with continuing education
  - **Career Paths**: Security administrator, security analyst, security engineer

### Advanced Certifications

- [Offensive Security Certified Professional (OSCP)](https://www.offensive-security.com/pwk-oscp/) - Penetration testing with Kali Linux
  - **Focus Areas**: Hands-on penetration testing, exploitation, privilege escalation
  - **Prerequisites**: Strong understanding of networking, Linux, and scripting
  - **Exam Format**: 24-hour practical exam with report submission
  - **Validity**: Lifetime
  - **Career Paths**: Penetration tester, red team operator, security consultant

- [Certified Information Systems Security Professional (CISSP)](https://www.isc2.org/Certifications/CISSP) - Security management
  - **Focus Areas**: Security and risk management, asset security, security architecture, network security, identity management, security assessment, security operations, software development security
  - **Prerequisites**: 5 years of experience in at least 2 domains
  - **Exam Format**: 100-150 questions, 3 hours, adaptive testing
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Security manager, security architect, CISO, security consultant

- [Certified Information Security Manager (CISM)](https://www.isaca.org/credentialing/cism) - Information security management
  - **Focus Areas**: Information security governance, risk management, program development, incident management
  - **Prerequisites**: 5 years of experience in information security management
  - **Exam Format**: 150 questions, 4 hours, multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Security manager, security director, CISO

- [GIAC Certified Incident Handler (GCIH)](https://www.giac.org/certification/certified-incident-handler-gcih) - Incident handling
  - **Focus Areas**: Incident handling process, computer crime investigation, hacker techniques
  - **Prerequisites**: None
  - **Exam Format**: 115 questions, 3 hours, multiple choice
  - **Validity**: 4 years, renewable with continuing education
  - **Career Paths**: Incident responder, SOC analyst, security analyst

### Specialized Certifications

- [Certified Cloud Security Professional (CCSP)](https://www.isc2.org/Certifications/CCSP) - Cloud security
  - **Focus Areas**: Cloud concepts, architecture, design, security, operations, legal compliance
  - **Prerequisites**: 5 years of IT experience, 3 years in security, 1 year in cloud security
  - **Exam Format**: 125 questions, 3 hours, multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: Cloud security architect, cloud security engineer, cloud security manager

- [GIAC Certified Forensic Analyst (GCFA)](https://www.giac.org/certification/certified-forensic-analyst-gcfa) - Digital forensics
  - **Focus Areas**: Digital forensics techniques, incident response, malware analysis
  - **Prerequisites**: None
  - **Exam Format**: 115 questions, 3 hours, multiple choice
  - **Validity**: 4 years, renewable with continuing education
  - **Career Paths**: Digital forensic analyst, incident responder, malware analyst

- [Offensive Security Certified Expert (OSCE)](https://www.offensive-security.com/ctp-osce/) - Advanced penetration testing
  - **Focus Areas**: Advanced exploitation techniques, custom exploit development
  - **Prerequisites**: OSCP recommended
  - **Exam Format**: 48-hour practical exam with report submission
  - **Validity**: Lifetime
  - **Career Paths**: Advanced penetration tester, exploit developer, security researcher

- [Certified Information Systems Auditor (CISA)](https://www.isaca.org/credentialing/cisa) - Information systems auditing
  - **Focus Areas**: IS audit process, governance, systems acquisition, operations, protection of assets
  - **Prerequisites**: 5 years of experience in IS audit, control, or security
  - **Exam Format**: 150 questions, 4 hours, multiple choice
  - **Validity**: 3 years, renewable with continuing education
  - **Career Paths**: IS auditor, IT audit manager, compliance officer

## Career Paths

### Defensive Roles

- **Security Analyst**
  - **Responsibilities**: Monitor and analyze security alerts, implement security measures, conduct vulnerability assessments
  - **Skills Required**: Network security, security tools, vulnerability assessment, incident response
  - **Certifications**: CompTIA Security+, CySA+, GIAC GSEC
  - **Career Progression**: Senior Security Analyst → Security Engineer → Security Architect

- **Security Engineer**
  - **Responsibilities**: Design and implement security solutions, manage security infrastructure, conduct security assessments
  - **Skills Required**: Network security, security architecture, security tools, scripting
  - **Certifications**: CISSP, GIAC GSEC, CEH
  - **Career Progression**: Senior Security Engineer → Security Architect → CISO

- **SOC Analyst**
  - **Responsibilities**: Monitor security events, analyze alerts, respond to incidents, maintain security tools
  - **Skills Required**: SIEM tools, incident response, network security, log analysis
  - **Certifications**: CompTIA Security+, CySA+, GCIH
  - **Career Progression**: SOC Analyst Level 2 → SOC Analyst Level 3 → SOC Manager

- **Incident Responder**
  - **Responsibilities**: Investigate and remediate security incidents, develop incident response plans, conduct forensic analysis
  - **Skills Required**: Digital forensics, malware analysis, incident response, threat hunting
  - **Certifications**: GCIH, GCFA, GREM
  - **Career Progression**: Senior Incident Responder → Incident Response Manager → Security Director

- **Security Architect**
  - **Responsibilities**: Design secure systems and networks, develop security standards, evaluate security solutions
  - **Skills Required**: Security architecture, risk assessment, compliance, technical leadership
  - **Certifications**: CISSP, CISM, SABSA
  - **Career Progression**: Senior Security Architect → Security Director → CISO

### Offensive Roles

- **Penetration Tester**
  - **Responsibilities**: Test systems for vulnerabilities through simulated attacks, document findings, recommend remediation
  - **Skills Required**: Ethical hacking, exploitation, scripting, report writing
  - **Certifications**: OSCP, CEH, PenTest+
  - **Career Progression**: Senior Penetration Tester → Red Team Lead → Security Consultant

- **Red Team Operator**
  - **Responsibilities**: Simulate advanced adversaries to test defenses, develop custom tools, conduct long-term engagements
  - **Skills Required**: Advanced exploitation, social engineering, evasion techniques, custom tool development
  - **Certifications**: OSCP, OSCE, GXPN
  - **Career Progression**: Senior Red Team Operator → Red Team Lead → Director of Offensive Security

- **Vulnerability Researcher**
  - **Responsibilities**: Discover and analyze new vulnerabilities, develop proof-of-concept exploits, research security weaknesses
  - **Skills Required**: Reverse engineering, exploit development, programming, vulnerability analysis
  - **Certifications**: OSCE, GXPN, OSEE
  - **Career Progression**: Senior Vulnerability Researcher → Security Research Lead → Security Director

- **Exploit Developer**
  - **Responsibilities**: Develop exploits for vulnerabilities, create custom attack tools, research exploitation techniques
  - **Skills Required**: Advanced programming, reverse engineering, exploit development, assembly language
  - **Certifications**: OSCE, OSEE, GXPN
  - **Career Progression**: Senior Exploit Developer → Research Lead → Security Director

### Management Roles

- **Chief Information Security Officer (CISO)**
  - **Responsibilities**: Executive responsible for an organization's security strategy, policies, and programs
  - **Skills Required**: Leadership, risk management, security governance, business acumen, communication
  - **Certifications**: CISSP, CISM, CGEIT
  - **Career Progression**: Terminal position, may move to larger organizations or consulting

- **Security Manager**
  - **Responsibilities**: Manage security teams and operations, implement security policies, oversee security projects
  - **Skills Required**: Team management, security operations, project management, risk assessment
  - **Certifications**: CISSP, CISM, PMP
  - **Career Progression**: Security Director → CISO

- **Security Consultant**
  - **Responsibilities**: Advise organizations on security matters, conduct assessments, develop security strategies
  - **Skills Required**: Security assessment, consulting, communication, technical expertise
  - **Certifications**: CISSP, CISA, CISM
  - **Career Progression**: Senior Consultant → Principal Consultant → Practice Lead

- **GRC (Governance, Risk, Compliance) Specialist**
  - **Responsibilities**: Ensure compliance with regulations and standards, conduct risk assessments, develop security policies
  - **Skills Required**: Compliance frameworks, risk assessment, policy development, auditing
  - **Certifications**: CISA, CRISC, CISM
  - **Career Progression**: GRC Manager → Director of Compliance → CISO

### Specialized Roles

- **Digital Forensic Analyst**
  - **Responsibilities**: Investigate digital evidence, recover and analyze data, document findings for legal proceedings
  - **Skills Required**: Digital forensics tools, evidence handling, chain of custody, legal knowledge
  - **Certifications**: GCFA, EnCE, CCFE
  - **Career Progression**: Senior Forensic Analyst → Forensic Manager → Director of Forensics

- **Malware Analyst**
  - **Responsibilities**: Analyze malicious software, reverse engineer malware, develop detection methods
  - **Skills Required**: Reverse engineering, programming, malware analysis tools, sandboxing
  - **Certifications**: GREM, GXPN, GCIH
  - **Career Progression**: Senior Malware Analyst → Threat Research Lead → Security Director

- **Cloud Security Specialist**
  - **Responsibilities**: Secure cloud environments, implement cloud security controls, assess cloud security
  - **Skills Required**: Cloud platforms (AWS, Azure, GCP), cloud security tools, DevSecOps
  - **Certifications**: CCSP, AWS Certified Security, Azure Security Engineer
  - **Career Progression**: Senior Cloud Security Specialist → Cloud Security Architect → CISO

- **Application Security Engineer**
  - **Responsibilities**: Secure software applications, conduct code reviews, implement secure coding practices
  - **Skills Required**: Secure coding, application security testing, programming, SDLC
  - **Certifications**: CSSLP, GWAPT, OSWE
  - **Career Progression**: Senior AppSec Engineer → AppSec Architect → Director of Application Security

## Cybersecurity Communities

### Online Communities

- [Reddit r/cybersecurity](https://www.reddit.com/r/cybersecurity/) - General cybersecurity discussions
- [Reddit r/netsec](https://www.reddit.com/r/netsec/) - Network security news and discussions
- [Reddit r/AskNetsec](https://www.reddit.com/r/AskNetsec/) - Questions about network security
- [Stack Exchange Information Security](https://security.stackexchange.com/) - Q&A for information security professionals
- [OWASP Community](https://owasp.org/www-community/) - Web application security community
- [Hack The Box Forum](https://forum.hackthebox.eu/) - Penetration testing and CTF discussions
- [TryHackMe Discord](https://discord.gg/tryhackme) - Community for TryHackMe platform users
- [NetSec Focus](https://www.netsecfocus.com/) - Information security community
- [Bleeping Computer Forums](https://www.bleepingcomputer.com/forums/) - Computer security forums

### Professional Organizations

- [ISACA](https://www.isaca.org/) - Information Systems Audit and Control Association
- [(ISC)²](https://www.isc2.org/) - International Information System Security Certification Consortium
- [ISSA](https://www.issa.org/) - Information Systems Security Association
- [SANS](https://www.sans.org/) - SysAdmin, Audit, Network, and Security Institute
- [EC-Council](https://www.eccouncil.org/) - International Council of E-Commerce Consultants
- [CompTIA](https://www.comptia.org/) - Computing Technology Industry Association
- [CSA](https://cloudsecurityalliance.org/) - Cloud Security Alliance
- [FIRST](https://www.first.org/) - Forum of Incident Response and Security Teams
- [Women in Cybersecurity (WiCyS)](https://www.wicys.org/) - Organization for women in cybersecurity

### Conferences

- [DEF CON](https://www.defcon.org/) - One of the world's largest hacker conventions
- [Black Hat](https://www.blackhat.com/) - Information security conference
- [RSA Conference](https://www.rsaconference.com/) - Cybersecurity conference
- [BSides](http://www.securitybsides.com/) - Community-driven framework for information security events
- [SANS Summits](https://www.sans.org/cyber-security-summit/) - Cybersecurity summits
- [Infosecurity Europe](https://www.infosecurityeurope.com/) - Europe's information security event
- [CyberSecurity Summit](https://cybersecuritysummit.com/) - Cybersecurity leadership summit
- [Women in Cybersecurity Conference](https://www.wicys.org/events/wicys-conference/) - Conference for women in cybersecurity
- [CISO Forum](https://cisoforum.com/) - Chief Information Security Officer forum

## Capture The Flag (CTF) Competitions

### Beginner-Friendly CTFs

- [PicoCTF](https://picoctf.org/) - Free, educational CTF for beginners
- [CTFlearn](https://ctflearn.com/) - Online platform with various CTF challenges
- [Hacker101 CTF](https://ctf.hacker101.com/) - CTF by HackerOne for learning web security
- [CyberDefenders](https://cyberdefenders.org/) - Blue team CTF challenges
- [SANS Holiday Hack Challenge](https://holidayhackchallenge.com/) - Annual holiday-themed CTF
- [Google CTF Beginners Quest](https://capturetheflag.withgoogle.com/) - Beginner-friendly CTF by Google
- [TryHackMe](https://tryhackme.com/) - Learn cybersecurity through CTF-like challenges
- [OverTheWire](https://overthewire.org/wargames/) - Wargames for learning security concepts

### Advanced CTFs

- [DEF CON CTF](https://www.defcon.org/html/links/dc-ctf.html) - One of the oldest and most prestigious CTFs
- [CSAW CTF](https://www.csaw.io/ctf) - CTF competition by NYU Tandon School of Engineering
- [PlaidCTF](https://plaidctf.com/) - Annual CTF by Plaid Parliament of Pwning
- [HITCON CTF](https://ctf.hitcon.org/) - Hacks In Taiwan Conference CTF
- [Dragon CTF](https://dragonsector.pl/) - CTF by Dragon Sector team
- [RuCTF](https://ructf.org/) - Russian CTF
- [0CTF/TCTF](https://ctf.0ops.sjtu.cn/) - International CTF competition
- [Hack.lu CTF](https://hack.lu/) - CTF during the Hack.lu conference

### CTF Resources

- [CTFtime](https://ctftime.org/) - CTF events calendar and team rankings
- [CTF Field Guide](https://trailofbits.github.io/ctf/) - Guide to CTF competitions
- [LiveOverflow YouTube Channel](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w) - CTF walkthroughs and explanations
- [John Hammond YouTube Channel](https://www.youtube.com/user/RootOfTheNull) - CTF walkthroughs
- [IppSec YouTube Channel](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA) - HackTheBox walkthroughs
- [CTF Resources](https://github.com/ctfs/resources) - Collection of CTF resources
- [Awesome CTF](https://github.com/apsdehal/awesome-ctf) - List of CTF frameworks, libraries, resources
- [CTF Tools](https://github.com/zardus/ctf-tools) - Collection of tools for CTF competitions

## Cybersecurity Labs and Practice Environments

### Online Practice Environments

- [Hack The Box](https://www.hackthebox.eu/) - Online platform for penetration testing practice
- [TryHackMe](https://tryhackme.com/) - Learn cybersecurity through hands-on exercises
- [VulnHub](https://www.vulnhub.com/) - Vulnerable virtual machines for practice
- [PortSwigger Web Security Academy](https://portswigger.net/web-security) - Web security training
- [PentesterLab](https://pentesterlab.com/) - Web penetration testing exercises
- [Root Me](https://www.root-me.org/) - Hacking challenges platform
- [HackThis](https://www.hackthis.co.uk/) - Hacking challenges and tutorials
- [Damn Vulnerable Web Application (DVWA)](https://github.com/digininja/DVWA) - Vulnerable web application
- [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) - Vulnerable web application

### Building Your Own Lab

- **Virtualization Platforms**
  - [VirtualBox](https://www.virtualbox.org/) - Free virtualization software
  - [VMware Workstation/Player](https://www.vmware.com/) - Virtualization software
  - [Proxmox VE](https://www.proxmox.com/en/) - Open-source virtualization platform
  - [Hyper-V](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/) - Windows virtualization

- **Vulnerable Systems**
  - [Metasploitable](https://sourceforge.net/projects/metasploitable/) - Vulnerable Linux virtual machine
  - [DVWA](https://github.com/digininja/DVWA) - Damn Vulnerable Web Application
  - [WebGoat](https://owasp.org/www-project-webgoat/) - Deliberately insecure web application
  - [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) - Vulnerable web application
  - [Vulnhub Images](https://www.vulnhub.com/) - Collection of vulnerable virtual machines

- **Attack Platforms**
  - [Kali Linux](https://www.kali.org/) - Penetration testing distribution
  - [Parrot Security OS](https://parrotsec.org/) - Security-focused Linux distribution
  - [BlackArch Linux](https://blackarch.org/) - Penetration testing distribution
  - [Commando VM](https://github.com/mandiant/commando-vm) - Windows-based penetration testing VM

- **Network Simulation**
  - [GNS3](https://www.gns3.com/) - Network simulation software
  - [Cisco Packet Tracer](https://www.netacad.com/courses/packet-tracer) - Network simulation tool
  - [EVE-NG](https://www.eve-ng.net/) - Network emulation platform
  - [Netkit](http://wiki.netkit.org/) - Network emulation tool

### Lab Guides and Resources

- [Building a Home Lab for Offensive Security](https://www.offensive-security.com/offsec/tjnulls-home-lab-guide/)
- [Building a Cybersecurity Lab](https://www.cybersecuritydegrees.com/faq/how-to-set-up-a-cyber-security-lab/)
- [Home Lab Setup Guide](https://www.hackingloops.com/kali-linux-virtualbox-pentest-lab-setup/)
- [Network Security Lab Setup](https://www.hackingarticles.in/home-lab-setup/)
- [Building an Active Directory Lab](https://www.labeveryday.com/post/how-to-setup-active-directory-lab-in-windows-server)
- [Cybersecurity Home Lab on a Budget](https://systemoverlord.com/2017/10/24/building-a-home-lab-for-offensive-security-basics.html)

## Security Research Resources

### Vulnerability Databases

- [National Vulnerability Database (NVD)](https://nvd.nist.gov/) - U.S. government repository of vulnerability data
- [CVE Details](https://www.cvedetails.com/) - Security vulnerability database
- [Exploit Database](https://www.exploit-db.com/) - Archive of exploits and vulnerable software
- [Vulnerability Lab](https://www.vulnerability-lab.com/) - Vulnerability research and security database
- [Packet Storm](https://packetstormsecurity.com/) - Information security services, news, files, and tools
- [Vulners](https://vulners.com/) - Vulnerability database with API
- [VulDB](https://vuldb.com/) - Vulnerability database
- [Rapid7 Vulnerability & Exploit Database](https://www.rapid7.com/db/) - Vulnerability and exploit database

### Security Blogs and News

- [Krebs on Security](https://krebsonsecurity.com/) - Security news and investigation
- [Schneier on Security](https://www.schneier.com/) - Security blog by Bruce Schneier
- [The Hacker News](https://thehackernews.com/) - Cybersecurity news and analysis
- [Threatpost](https://threatpost.com/) - Information security news
- [Dark Reading](https://www.darkreading.com/) - Cybersecurity news and analysis
- [Naked Security](https://nakedsecurity.sophos.com/) - Security news from Sophos
- [BleepingComputer](https://www.bleepingcomputer.com/) - Information security and technology news
- [Security Affairs](https://securityaffairs.co/wordpress/) - Information security news
- [Graham Cluley](https://grahamcluley.com/) - Computer security news and opinions

### Research Papers and Publications

- [arXiv Cryptography and Security](https://arxiv.org/list/cs.CR/recent) - Preprint research papers
- [IEEE Security & Privacy](https://www.computer.org/csdl/magazine/sp) - Security research journal
- [USENIX Security Symposium](https://www.usenix.org/conferences/byname/108) - Security conference papers
- [ACM CCS](https://www.sigsac.org/ccs.html) - Computer and Communications Security conference
- [NDSS Symposium](https://www.ndss-symposium.org/) - Network and Distributed System Security Symposium
- [Black Hat Briefings](https://www.blackhat.com/html/archives.html) - Security conference presentations
- [DEF CON Media](https://media.defcon.org/) - DEF CON conference presentations
- [Virus Bulletin](https://www.virusbulletin.com/) - Security research and analysis

### Security Research Tools

- [Shodan](https://www.shodan.io/) - Search engine for Internet-connected devices
- [Censys](https://censys.io/) - Search engine for Internet-connected devices
- [VirusTotal](https://www.virustotal.com/) - Analyze suspicious files and URLs
- [Any.Run](https://any.run/) - Interactive malware analysis
- [Hybrid Analysis](https://www.hybrid-analysis.com/) - Free malware analysis service
- [Cuckoo Sandbox](https://cuckoosandbox.org/) - Automated malware analysis
- [MITRE ATT&CK](https://attack.mitre.org/) - Knowledge base of adversary tactics and techniques
- [OWASP](https://owasp.org/) - Open Web Application Security Project resources

Cybersecurity-Perfect-Roadmap

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README