awesome-cyber-security

0day.today - Biggest Exploits Database and 0day market - The Underground, is one of the world's most popular and comprehensive computer security web sites.

Self-hosted CTI-to-detection platform for ATT&CK/ATLAS mapping, IOC enrichment, TTP comparison, and analyst reporting.

ATT&CK is a knowledge base of cyber adversary behavior and taxonomy for adversarial actions across their lifecycle. ATT&CK has two parts: ATT&CK for Enterprise, which covers behavior against enterprise IT networks and cloud, and ATT&CK for Mobile, which focuses on behavior against mobile devices.

Chinese government-run vulnerability database analoguous to the United States’s CVE database hosted by Mitre Corporation.

cve-search is accessible via a web interface and an HTTP API. cve-search is an interface to search publicly known information from security vulnerabilities in software and hardware along with their corresponding exposures.

(WLB2) World Laboratory of Bugtraq is a huge collection of information on data communications safety. Its main objective is to inform about errors in various applications.

Security labs covering CTI, detection engineering, vulnerable cloud, AI agent security, Android, Active Directory, Windows, Linux, and malware analysis workflows.

A plethora of free cybersecurity courses and resources on all topics related to the field.

Offline-first, searchable arsenal of pentest & bug bounty resources: ~1500 payloads, command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells and 70 checklists.

Celerium (formerly Dark Cubed)’s intelligence hub with free cybersecurity resources for businesses and their customers.

For 20 years, the Computer Security Resource Center (CSRC) has provided access to NIST's cybersecurity- and information security-related projects, publications, news and events. CSRC supports stakeholders in government, industry and academia—both in the U.S. and internationally.

This page is devoted to helping cyber security experts find the resources they need to grow and thrive.

The listing of related sites provide additional sources to pursue the topic of Cybersecurity. The sites include Government organizations, including federal agencies, Department of Defense and military service agencies, commercial organizations, and academic institutions.

A collection of awesome software, libraries, documents, books, resources and cool stuff about security.

A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams.

A curated list of amazingly awesome tools and resources related to the use of machine learning for cyber security.

A curated list of awesome malware analysis tools and resources.

A curated list of machine learning resources for automated CVE analysis

Maintained by @vaib25vicky with contributions from the security and developer communities.

A curated list of resources for Industrial Control System and OT security including tools, frameworks, threat intelligence and functional safety integration resources.

A structured 5-phase cybersecurity audit methodology for ICS/OT environments aligned with IEC 62443, NIST SP 800-82 and IEC 62061 for safety-critical systems.

International standard for functional safety of safety-related control systems for machinery. Essential for OT environments where PLCs and safety interlocks perform SIL-classified safety functions.

The UK National Cyber Security Centre framework for operators of essential services and critical national infrastructure covering governance, protection, detection and response.

NIST Guide to Operational Technology Security covering OT-specific network architecture, incident response and the challenges of securing systems that cannot use standard IT patching processes.

Official OWASP Foundation project mapping the top 10 security risks in operational technology environments, with compliance mappings to IEC 62443, NIST SP 800-82 and IEC 62061.

A curated list of storage open source tools. Backups, redundancy, sharing, distribution, encryption, etc.

Online tool for testing website CORS configurations.

Blocks installation of malicious and vulnerable PyPI and npm packages on developer workstations.

Pre-install gate for pip that produces a verdict before the artifact reaches the machine, so neither build-time nor first-import code runs locally; SARIF output and CI exit codes.

Analyzes Content Security Policy configurations for security weaknesses.

Identifies malicious PyPI and npm packages using Semgrep rules and package metadata heuristics.

Assesses domain, DNS, TLS, certificate, and email security configurations.