Resource Library

The best beginner-friendly cybersecurity learning platform. Browser-based labs, guided rooms, and structured learning paths from absolute beginner to advanced. No local setup required.

The premier platform for intermediate and advanced penetration testing practice. Realistic machines to root, weekly challenges, and a competitive pro lab environment.

A beginner CTF platform built by Carnegie Mellon University. Categories include binary exploitation, reverse engineering, cryptography, web, and forensics. Excellent for first CTF experience.

The industry-standard web application security testing proxy. Intercept, modify, and replay HTTP requests. Essential for web pentesting, bug bounty, and learning how web attacks work.

The most widely used network scanner. Discovers hosts, open ports, running services, and OS versions. The first tool run in almost every penetration test.

The world's leading network protocol analyser. Capture and inspect live network packets at every layer. Essential for network forensics, protocol analysis, and learning how protocols work.

A browser-based data transformation tool. Encode, decode, encrypt, decrypt, compress, and analyse data without installing anything. Used constantly in CTFs and malware analysis.

The 10 most critical web application security risks according to real-world data. Mandatory knowledge for every web developer and security professional.

A comprehensive knowledge base of adversary tactics and techniques based on real-world observations. Used for threat intelligence, detection engineering, and red team planning.

A massive wiki of hacking techniques, tools, and methodologies covering Linux/Windows privilege escalation, web attacks, Active Directory, cloud, and mobile. Constantly updated.

PortSwigger's free Web Security Academy — hands-on labs for every web vulnerability type. The best free resource for learning web application security testing.

The most highly recommended practical pentesting course for beginners. Covers network scanning, web attacks, Active Directory, privilege escalation, and report writing.

Harvard's legendary intro to CS, free and self-paced. Covers computational thinking, abstraction, algorithms, and data structures using C, Python, SQL, and JavaScript — the exact foundation this roadmap builds on.

The definitive reference for HTML, CSS, JavaScript, and Web APIs, maintained by Mozilla and a large contributor community. The first place to check when you need to know exactly how a web platform feature behaves.

A free, project-based full-stack curriculum with thousands of interactive coding challenges, covering everything from HTML/CSS basics to APIs and databases.

The free, open-source software reverse engineering suite developed by the NSA — disassembly, decompilation, and scripting for malware analysis and exploit development. The official source and releases.

A knowledge graph of defensive cybersecurity countermeasures, mapped directly against MITRE ATT&CK's offensive techniques — the blue-team counterpart to ATT&CK.

Classic Linux and security wargames. Bandit teaches Linux CLI, Natas teaches web security, Leviathan and Narnia teach binary exploitation. SSH-based — no browser VM needed.

A dedicated cryptography learning platform. Solve challenges covering XOR, RSA, AES, elliptic curves, and hash functions while learning the underlying mathematics.

The central calendar and leaderboard for worldwide CTF competitions. Find upcoming events, read writeups from past competitions, and track team rankings.

The most widely used penetration testing framework. Contains hundreds of exploits, payloads, and auxiliary modules. Requires explicit authorisation to use against systems.

The premier penetration testing Linux distribution. Pre-installed with 600+ security tools including nmap, Burp Suite, Metasploit, Wireshark, aircrack-ng, and more.

A curated list of Unix binaries that can bypass local security restrictions. Used for privilege escalation via SUID, sudo, capabilities, and shell escapes.

The world's fastest GPU-accelerated password recovery tool. Supports hundreds of hash types and attack modes (dictionary, brute force, mask, combinator, rule-based).

The US government's framework for managing and reducing cybersecurity risk, organised around five functions: Identify, Protect, Detect, Respond, Recover.

The official Common Vulnerabilities and Exposures database. Look up any CVE to find detailed vulnerability descriptions, affected software versions, and severity scores.

A comprehensive nmap reference card covering host discovery, port scanning, service detection, OS fingerprinting, timing options, and output formats.

Quick reference for essential Linux commands: file operations, process management, networking, permissions, archiving, and text processing.

OWASP's guide to writing secure Python applications: input validation, cryptography, file handling, subprocess safety, and dependency management.

PortSwigger's comprehensive SQLi reference covering syntax for MySQL, MSSQL, Oracle, and PostgreSQL — comments, string concat, batched queries, and time-based blind injection.

The most comprehensive XSS payload reference available. Categorised by event handlers, HTML tags, and encoding bypass techniques. Updated regularly with new bypasses.

One-liner reverse shells for bash, Python, PHP, Ruby, Perl, nc, and PowerShell. Use only in authorised penetration tests or CTF challenges.

Quick reference table for all common CIDR prefixes showing subnet mask, number of hosts, and address range. Essential for fast subnetting during exams and pentests.

A complete, freely available book covering every aspect of the Linux command line: navigation, text processing, scripting, job control, and system administration.

The official nmap book by its creator, free to read online. Covers every scanning technique, NSE scripting, firewall evasion, and output analysis.

Free, comprehensive Security+ SY0-701 video course covering threats, architecture, cryptography, identity management, and incident response. Excellent exam prep.

University of Nottingham's computer science channel. Exceptional videos on cryptography, password hashing, TLS, buffer overflows, SQL injection, and more — all explained from first principles.

Energetic YouTube channel covering networking, ethical hacking, Linux, Python scripting, and cloud security with practical demos and beginner-friendly explanations.

Detailed HTB machine walkthroughs by a top-ranked player. Each video demonstrates real penetration testing methodology, tool usage, and lateral thinking. Intermediate to advanced.

A practical Python book covering automation, file manipulation, web scraping, and working with PDFs, Excel, and CSV files. Free to read online. Great foundation before security scripting.

A practical book teaching Python for offensive security: network sniffers, raw sockets, web scrapers, command-and-control tools, and forensic tools. For educational/authorised use.

A free, browser-based SQL learning platform with interactive exercises covering SELECT, JOIN, GROUP BY, and subqueries. Essential before studying SQL injection.

The most comprehensive web application penetration testing methodology. Covers all OWASP Top 10 vulnerabilities with testing procedures, tools, and remediation guidance.

A 40-episode series starting from the most basic underpinnings of digital computing (binary, logic gates, CPUs) and building up to modern systems. Great companion to the 'How Computers Work' and 'Binary & Number Systems' lessons.

Free, structured lessons on computer science theory: algorithms, cryptography, and information theory, with interactive exercises throughout.

A free, open-source full-stack web development curriculum that curates the best resources from across the web into a structured learning path, with portfolio-worthy projects along the way.

A thorough, example-driven JavaScript tutorial covering the language itself, browser/DOM interaction, and advanced topics — widely regarded as one of the best free references for modern JS.

Home of the Volatility Framework, the world's most widely used open-source memory forensics platform, plus documentation and training resources.

A free, hands-on university-level course (from ASU) teaching binary exploitation from first principles — buffer overflows, shellcoding, and ROP, with heavy emphasis on actual keyboard time over lecture.

Community-developed, vendor-specific secure configuration guides for over 100 technologies — the practical reference behind the hardening checklists covered in the Linux and AD Defense lessons.