Security lists age badly. Links die, tools stop being maintained, and nothing tells you which entries are still worth your time. Hacking is a curated map of security courses, labs, tools, references and lists that checks itself every week: each GitHub project shows its stars, its last update and whether it is still maintained.
Important
Everything here is for learning, defending systems and authorized testing. Only test systems you own or have written permission to test. See Ethics and legal use.
| Typical "awesome" lists | Hacking | |
|---|---|---|
| Freshness | Entries added once, rarely revisited | Weekly health check of every GitHub project, with archived and moved repos flagged automatically |
| Signal | Only a name and a one-liner | Type, skill level, stars, last update and maintenance status for each entry |
| Where to start | A wall of links | Learning paths that order resources from first steps to advanced |
| Practice | Tools only | Free courses, wargames and vulnerable labs to practice legally |
| Reuse | Markdown only | Structured data, a searchable website and a JSON feed |
Not sure where to begin? Pick a path. Each one is an ordered route through the resources below, from first steps to advanced practice.
| Path | For you if you want to… | Level |
|---|---|---|
| 🧭 Start here | build the foundations: Linux, networking, the web and your first CTFs | Beginner |
| 🌐 Web application security | find and fix vulnerabilities in web apps and APIs | Beginner → Advanced |
| 🛡️ Blue team and incident response | detect, investigate and respond to attacks | Beginner → Advanced |
| 🏰 Networks and Active Directory | understand enterprise networks and how to harden them | Intermediate → Advanced |
| 🔬 Reverse engineering and binaries | read compiled code, analyze malware and understand memory bugs | Intermediate → Advanced |
| ☁️ Cloud and DevSecOps | secure code, pipelines, containers and cloud accounts | Beginner → Intermediate |
125 resources in 14 categories · 114 GitHub projects health-checked weekly (last check: 2026-11-09)
97 active · 12 maintained · 5 slow · 0 stale · 0 archived
Jump to: Learn and practice · Vulnerable labs · Web and API security · Recon and OSINT · Network and Active Directory · Exploitation and privilege escalation · Reverse engineering and malware analysis · Detection, forensics and incident response · Cloud and DevSecOps · Mobile security · Cryptography and passwords · Hardware, IoT and specialized systems · AI security · References and meta-lists
Health: 🟢 Active (updated in the last 6 months) · 🔵 Maintained (updated in the last 18 months) · 🟡 Slow (no update for 18 months to 3 years) · 🔴 Stale (no update for over 3 years) · ⚫ Archived (archived by its owner). Stars and dates come from the GitHub API.
Free courses, wargames and hands-on platforms. Start here.
| Resource | What it is | Health |
|---|---|---|
| Awesome Cyber Security University List · Beginner |
A self-study curriculum of free resources, ordered from introduction to purple teaming. | 🟢 ★ 3.8k Oct 2026 |
| Awesome Cyber Skills List · Beginner |
Legal places to practice hacking skills: challenge sites, vulnerable apps and wargames. | 🟢 ★ 4.8k Sep 2026 |
| CryptoHack Course · Intermediate |
Free platform for learning modern cryptography by breaking flawed implementations of RSA, AES, elliptic curves and more. | Free |
| CTF Wiki Reference · Beginner |
Community knowledge base covering CTF categories: web, crypto, reverse engineering, pwn and misc. | 🟢 ★ 9.8k Aug 2026 |
| CTFtime Platform · All levels |
Calendar of upcoming capture-the-flag events, team rankings and an archive of challenge writeups. | — |
| Exploit Education Lab · Intermediate |
Downloadable VMs for learning exploitation: Nebula (Linux privilege escalation), Phoenix (memory corruption) and Fusion (advanced). | — |
| Hack The Box Platform · Intermediate |
Hacking labs and machines. The free plan includes Starting Point tiers 0-2 and retired machines in Guided Mode. Free plan with limits; paid plans unlock more. |
— |
| Hacker101 Course · Beginner |
HackerOne's free web security class with videos and CTF-style exercises for aspiring bug bounty hunters. | 🟡 ★ 15k Feb 2025 |
| OverTheWire Platform · Beginner |
Classic wargames played over SSH. Start with Bandit for Linux basics, then move on to web (Natas) and binary games. | — |
| picoCTF (CyLab Security Academy) Course · Beginner |
Carnegie Mellon University's free learning platform, home of the picoCTF beginner competition. | Free |
| pwn.college Course · Beginner |
Arizona State University's free, hands-on 'dojo' that teaches core security skills from the terminal up to binary exploitation. | Free |
| TryHackMe Platform · Beginner |
Guided rooms and learning paths in the browser. The free plan includes free rooms and a 1-hour daily AttackBox. Free plan with limits; paid plans unlock all paths. |
— |
| Web Security Academy Course · Beginner |
Free interactive web security training from PortSwigger with hands-on labs for SQL injection, XSS, SSRF, access control and more. | Free |
Deliberately vulnerable apps and environments to practice on legally, on your own machine.
| Resource | What it is | Health |
|---|---|---|
| DVWA Lab · Beginner |
Damn Vulnerable Web Application: a classic PHP/MySQL app with adjustable difficulty for practicing common web flaws. | 🟢 ★ 14k Oct 2026 |
| GOAD (Game of Active Directory) Lab · Advanced |
Builds a vulnerable multi-domain Active Directory lab to practice AD attack and defense techniques. | 🟢 ★ 8.6k Oct 2026 |
| OWASP Juice Shop Lab · Beginner |
A modern, intentionally insecure web shop with 100+ challenges covering the OWASP Top 10 and beyond. | 🟢 ★ 14k Nov 2026 |
| OWASP WebGoat Lab · Beginner |
Lessons plus a deliberately insecure Java application that explains each vulnerability as you exploit it. | 🟢 ★ 9.5k Nov 2026 |
| Vulhub Lab · Intermediate |
Ready-made Docker Compose environments that reproduce real-world vulnerabilities for study. | 🟢 ★ 21k Oct 2026 |
Testing guides, checklists, scanners and payload references for web apps and APIs.
| Resource | What it is | Health |
|---|---|---|
| API Security Checklist Reference · Beginner |
Short checklist of countermeasures for designing, testing and releasing APIs. | 🟢 ★ 23k Jul 2026 |
| Awesome AppSec List · Beginner |
Resources for developers learning to build secure applications. | 🟡 ★ 7.1k Feb 2025 |
| Awesome Node.js Security List · Intermediate |
Node.js security tools, educational material, companies and talks. | 🟢 ★ 3.1k Oct 2026 |
| Awesome Web Hacking List · Beginner |
Books, documentation, tools and labs for web application penetration testing. | 🟢 ★ 7.3k Oct 2026 |
| Awesome Web Security List · Intermediate |
Curated web security materials: XSS, SQLi, SSRF, deserialization, browser exploitation and more. | 🟢 ★ 14k Nov 2026 |
| ffuf Tool · Intermediate |
Fast web fuzzer for content discovery, virtual hosts and parameter fuzzing. | 🟢 ★ 17k Sep 2026 |
| Gobuster Tool · Beginner |
Brute-forces directories, DNS subdomains, virtual hosts and cloud buckets. | 🔵 ★ 14k Jan 2026 |
| Nuclei Tool · Intermediate |
Template-based vulnerability scanner with a large community library of checks. | 🟢 ★ 33k Nov 2026 |
| OWASP ASVS Reference · Intermediate |
Application Security Verification Standard: testable security requirements for designing and verifying apps. | 🟢 ★ 3.8k Nov 2026 |
| OWASP Top 10 Reference · Beginner |
The standard awareness document for the most critical web application security risks (2025 edition). | Free |
| OWASP Web Security Testing Guide Reference · Intermediate |
Comprehensive methodology for testing web applications, organized by test category. | 🟢 ★ 10k Nov 2026 |
| PayloadsAllTheThings Reference · Intermediate |
Payloads, bypasses and methodology notes for web application testing and CTFs. | 🟢 ★ 83k Oct 2026 |
| SecLists Reference · Beginner |
The standard collection of wordlists for discovery, fuzzing, usernames and passwords. | 🟢 ★ 75k Nov 2026 |
| sqlmap Tool · Intermediate |
Automates detecting and exploiting SQL injection flaws in applications you are authorized to test. | 🟢 ★ 39k Nov 2026 |
| ZAP Tool · Beginner |
Open source web app scanner and intercepting proxy for finding vulnerabilities during development and testing. | 🟢 ★ 16k Nov 2026 |
Asset discovery, port scanning and open-source intelligence.
| Resource | What it is | Health |
|---|---|---|
| Awesome Asset Discovery List · Intermediate |
Resources for the asset discovery phase of a security assessment. | 🟡 ★ 2.9k Jan 2025 |
| Awesome OSINT List · Beginner |
Large collection of open-source intelligence tools and resources, organized by data source. | 🟢 ★ 31k Nov 2026 |
| httpx Tool · Beginner |
Fast HTTP probing toolkit to find live hosts and collect titles, status codes and technologies. | 🟢 ★ 11k Nov 2026 |
| masscan Tool · Intermediate |
Very fast asynchronous port scanner for large address ranges. | 🟢 ★ 26k Oct 2026 |
| Nmap Tool · Beginner |
The network mapper: host discovery, port scanning, service and OS detection, plus the NSE scripting engine. | 🟢 ★ 14k Nov 2026 |
| OWASP Amass Tool · Intermediate |
In-depth attack surface mapping and external asset discovery. | 🟢 ★ 15k Oct 2026 |
| RustScan Tool · Beginner |
Fast port scanner that finds open ports quickly and can hand results to Nmap. | 🟢 ★ 21k Nov 2026 |
| subfinder Tool · Beginner |
Passive subdomain discovery using many online sources. | 🟢 ★ 15k Nov 2026 |
Packet analysis, network monitoring and Windows/AD assessment.
| Resource | What it is | Health |
|---|---|---|
| Awesome PCAP Tools List · Intermediate |
Tools for processing and analyzing network traffic captures. | 🔵 ★ 3.4k Sep 2025 |
| Awesome Suricata List · Intermediate |
Rules, tools, dashboards and documentation for Suricata. | 🟢 ★ 248 Aug 2026 |
| BloodHound Tool · Intermediate |
Maps relationships in Active Directory and Entra ID to reveal attack paths so defenders can remove them. | 🟢 ★ 3.5k Nov 2026 |
| Impacket Tool · Advanced |
Python classes and example scripts for working with network protocols such as SMB, Kerberos and MSRPC. | 🟢 ★ 16k Nov 2026 |
| Suricata Tool · Intermediate |
High-performance IDS/IPS and network security monitoring engine. | 🟢 ★ 6.9k Nov 2026 |
| Wireshark Tool · Beginner |
The standard network protocol analyzer for capturing and inspecting traffic. | 🟢 ★ 10k Nov 2026 |
| Zeek Tool · Intermediate |
Network security monitoring platform that turns traffic into rich, structured logs. | 🟢 ★ 8.2k Nov 2026 |
Frameworks and references used in authorized penetration tests and CTFs.
| Resource | What it is | Health |
|---|---|---|
| Awesome Bug Bounty List · Beginner |
Bug bounty programs, write-ups and getting-started resources. | 🔵 ★ 6k Mar 2026 |
| Awesome Penetration Testing List · Intermediate |
Broad collection of penetration testing resources, tools and references. | 🟢 ★ 28k Jul 2026 |
| GTFOBins Reference · Intermediate |
Curated list of Unix binaries that can be abused to bypass local security restrictions. | 🟢 ★ 14k May 2026 |
| Linux Kernel Exploitation List · Advanced |
Links on Linux kernel fuzzing, exploitation techniques and mitigations. | 🟢 ★ 6.7k Nov 2026 |
| LOLBAS Reference · Intermediate |
Windows binaries, scripts and libraries that can be misused, documented for attackers and defenders alike. | 🟢 ★ 8.9k Sep 2026 |
| Metasploit Framework Tool · Intermediate |
Widely used framework for developing, testing and running exploits in authorized engagements. | 🟢 ★ 39k Nov 2026 |
| PEASS-ng Tool · Intermediate |
linPEAS and winPEAS: scripts that highlight local privilege escalation paths on Linux and Windows. | 🟢 ★ 21k Nov 2026 |
| pwndbg Tool · Intermediate |
GDB and LLDB plugin that makes debugging and exploit development much easier. | 🟢 ★ 11k Nov 2026 |
| pwntools Tool · Intermediate |
Python library for CTF and exploit development: process I/O, ROP chains, shellcraft and more. | 🟢 ★ 14k Nov 2026 |
Disassemblers, debuggers, instrumentation and analysis references.
| Resource | What it is | Health |
|---|---|---|
| Awesome Executable Packing List · Advanced |
Research, tools and datasets on executable packing and unpacking. | 🟢 ★ 1.6k Oct 2026 |
| Awesome Malware Persistence List · Advanced |
Techniques malware uses to persist, with detection resources. | 🟢 ★ 319 Aug 2026 |
| Awesome Reversing List · Intermediate |
Reverse engineering courses, books, tools and practice targets. | 🟡 ★ 1.6k Mar 2025 |
| Awesome YARA List · Intermediate |
YARA rules, tools and people to follow. | 🟢 ★ 4.3k Jun 2026 |
| capa Tool · Intermediate |
Identifies capabilities in executables, such as 'communicates over HTTP' or 'encrypts data'. | 🟢 ★ 6.3k Nov 2026 |
| Cutter Tool · Intermediate |
Free reverse engineering GUI powered by the Rizin framework. | 🟢 ★ 20k Nov 2026 |
| Frida Tool · Intermediate |
Dynamic instrumentation toolkit for hooking functions in running processes on desktop and mobile. | 🟢 ★ 23k Nov 2026 |
| Ghidra Tool · Intermediate |
Software reverse engineering suite from the NSA with a disassembler, decompiler and scripting. | 🟢 ★ 99k Nov 2026 |
| radare2 Tool · Advanced |
Scriptable command-line framework for reverse engineering and binary analysis. | 🟢 ★ 25k Nov 2026 |
| x64dbg Tool · Intermediate |
Open source x64/x32 debugger for Windows. | 🟢 ★ 50k Nov 2026 |
| YARA Tool · Intermediate |
Pattern-matching tool for identifying and classifying malware samples. | 🟢 ★ 10k Oct 2026 |
DFIR tooling, detection rules, threat hunting and adversary emulation.
| Resource | What it is | Health |
|---|---|---|
| Atomic Red Team Tool · Intermediate |
Small, portable tests mapped to ATT&CK for validating your detections. | 🟢 ★ 13k Nov 2026 |
| Autopsy Tool · Intermediate |
Digital forensics platform and GUI for The Sleuth Kit. | 🔵 ★ 3.4k May 2026 |
| Awesome Detection Engineering List · Intermediate |
Resources for building and maintaining detections. | 🟢 ★ 1.4k Oct 2026 |
| Awesome Forensics List · Intermediate |
Forensic analysis tools and learning resources. | 🟢 ★ 5.2k Sep 2026 |
| Awesome Honeypots List · Intermediate |
Honeypots, deception tools and related components. | 🟢 ★ 11k Jun 2026 |
| Awesome Incident Response List · Intermediate |
Tools and resources for incident response teams. | 🟢 ★ 9.5k Oct 2026 |
| Awesome IOCs List · Intermediate |
Sources of indicators of compromise. | 🟢 ★ 1k Oct 2026 |
| Awesome Threat Intelligence List · Intermediate |
Threat intelligence sources, formats, frameworks and tools. | 🟢 ★ 11k Oct 2026 |
| Caldera Tool · Advanced |
Automated adversary emulation platform for testing defenses, originally from MITRE. | 🟢 ★ 7.5k Aug 2026 |
| MITRE ATT&CK Reference · Beginner |
Free knowledge base of adversary tactics and techniques based on real-world observations. | Free |
| osquery Tool · Intermediate |
Query your operating system like a database with SQL for monitoring and investigations. | 🟢 ★ 24k Nov 2026 |
| Plaso Tool · Advanced |
Builds super-timelines from many forensic artifact types. | 🟢 ★ 2.2k Nov 2026 |
| Sigma Reference · Intermediate |
Generic, shareable detection rule format with thousands of community rules for SIEMs. | 🟢 ★ 11k Nov 2026 |
| ThreatHunter-Playbook Reference · Intermediate |
Community threat hunting playbooks with detection logic and datasets. | 🔵 ★ 4.7k Dec 2025 |
| Velociraptor Tool · Intermediate |
Endpoint visibility and DFIR tool for collecting and hunting across many machines. | 🟢 ★ 4.4k Nov 2026 |
| Volatility 3 Tool · Advanced |
Memory forensics framework for extracting artifacts from RAM captures. | 🟢 ★ 4.6k Oct 2026 |
Cloud posture, container and code scanning, secrets detection, CI/CD security.
| Resource | What it is | Health |
|---|---|---|
| Awesome CI/CD Attacks List · Advanced |
Research on attacking and hardening CI/CD systems and deployment pipelines. | 🟢 ★ 641 Jun 2026 |
| Gitleaks Tool · Beginner |
Detects hardcoded secrets in Git repositories and files. | 🟢 ★ 31k Oct 2026 |
| OSV-Scanner Tool · Beginner |
Finds known vulnerabilities in your dependencies using the OSV database. | 🟢 ★ 11k Nov 2026 |
| Prowler Tool · Intermediate |
Security posture checks for AWS, Azure, GCP and Kubernetes against common benchmarks. | 🟢 ★ 15k Nov 2026 |
| Semgrep Tool · Beginner |
Fast static analysis with readable rules for finding bugs and enforcing secure code. | 🟢 ★ 18k Nov 2026 |
| Static Analysis Tools List · Beginner |
Large directory of static analysis tools and linters for every language. | 🟢 ★ 15k Nov 2026 |
| Trivy Tool · Beginner |
Scans containers, filesystems, Git repos and IaC for vulnerabilities, misconfigurations and secrets. | 🟢 ★ 39k Nov 2026 |
| TruffleHog Tool · Beginner |
Finds and verifies leaked credentials across Git, cloud storage and chat tools. | 🟢 ★ 29k Nov 2026 |
Android and iOS testing guides and tools.
| Resource | What it is | Health |
|---|---|---|
| Android Security Awesome List · Intermediate |
Android security tools, academic research and learning material. | 🟢 ★ 9.8k Nov 2026 |
| macOS and iOS Security Awesome List · Intermediate |
macOS and iOS security tools and resources. | 🟢 ★ 1.8k Oct 2026 |
| MobSF Tool · Beginner |
Automated static and dynamic analysis for Android and iOS apps. | 🟢 ★ 22k Nov 2026 |
| OWASP MASTG Reference · Intermediate |
Mobile Application Security Testing Guide: the standard manual for testing Android and iOS apps. | 🟢 ★ 13k Nov 2026 |
Learning cryptography and auditing password strength.
| Resource | What it is | Health |
|---|---|---|
| Awesome Cryptography List · Intermediate |
Cryptography libraries, books, courses and tools. | 🟢 ★ 7.2k Jul 2026 |
| Awesome Password Cracking List · Intermediate |
Tools, research, wordlists and papers on password cracking. | 🟢 ★ 1.1k Sep 2026 |
| hashcat Tool · Intermediate |
GPU-accelerated password recovery for auditing hash strength. | 🟢 ★ 27k Nov 2026 |
| John the Ripper Tool · Beginner |
Long-standing password security auditing and recovery tool. | 🟢 ★ 14k Nov 2026 |
Cellular, vehicles, industrial control systems, drones, RTC and physical security.
| Resource | What it is | Health |
|---|---|---|
| Awesome Cellular Hacking List · Advanced |
Research on 2G to 5G cellular network security. | 🟢 ★ 4.1k Nov 2026 |
| Awesome Drone Hacking List · Advanced |
Drone and UAV security research and tools. | 🟢 ★ 211 Sep 2026 |
| Awesome ICS Security List · Advanced |
Industrial control system (SCADA/ICS) security resources. | 🔵 ★ 2k Oct 2025 |
| Awesome IoT and Hardware Security List · Intermediate |
IoT and hardware security tools, learning resources and research. | 🟢 ★ 73 Nov 2026 |
| Awesome Mainframe Hacking List · Advanced |
Resources on mainframe (z/OS) security testing. | 🟡 ★ 499 Jan 2025 |
| Awesome RTC Hacking List · Advanced |
Security of VoIP, WebRTC and real-time communications. | 🟢 ★ 561 Jun 2026 |
| Awesome Vehicle Security List · Advanced |
Automotive security resources: CAN bus, tools, talks and research. | 🟢 ★ 4.8k May 2026 |
| Red Team Physical Tools List · Advanced |
Tools for physical security assessments: locks, RFID and covert entry. | 🔵 ★ 625 Feb 2026 |
Security of machine learning systems and LLM applications.
| Resource | What it is | Health |
|---|---|---|
| Awesome AI Security List · Intermediate |
Research, tools and resources on the security of AI systems. | 🔵 ★ 1.7k Mar 2026 |
| Awesome Prompt Injection List · Beginner |
Learning resources and tools on prompt injection in LLM applications. | 🟢 ★ 716 Sep 2026 |
| Awesome RL for Cybersecurity List · Advanced |
Research on reinforcement learning applied to cyber attack and defense. | 🟢 ★ 1.1k Jul 2026 |
| garak Tool · Intermediate |
LLM vulnerability scanner that probes models for jailbreaks, prompt injection, leakage and more. | 🟢 ★ 10k Nov 2026 |
Broad knowledge bases, cheat sheets and other curated collections.
| Resource | What it is | Health |
|---|---|---|
| Awesome Annual Security Reports List · Beginner |
Annual industry security reports in one place. | 🟢 ★ 1.2k Nov 2026 |
| Awesome Hacking List · Beginner |
The long-running index of awesome lists for hackers and pentesters, started in 2016. | 🟢 ★ 125k Oct 2026 |
| Awesome Infosec List · Beginner |
Courses, labs, CTFs and books for learning information security. | 🟢 ★ 5.8k Aug 2026 |
| Awesome Security List · Beginner |
Software, libraries, documents and books about security. | 🔵 ★ 15k Jan 2026 |
| Awesome Security Talks List · Beginner |
Recorded security conference talks. | 🔵 ★ 4.2k Feb 2026 |
| Awesome Tor List · Beginner |
Resources about the Tor network and anonymous communication. | 🟢 ★ 139 Oct 2026 |
| Awesome Web3 Security List · Intermediate |
Smart contract and blockchain security resources. | 🔵 ★ 1.6k Mar 2026 |
| CyberChef Tool · Beginner |
The 'Cyber Swiss Army Knife': encode, decode, decrypt and analyze data in your browser. | 🟢 ★ 36k Nov 2026 |
| CyberSources List · Beginner |
Collection of cybersecurity resources, tools and references. | 🟢 ★ 2.5k Oct 2026 |
| h4cker Reference · Beginner |
Thousands of resources on ethical hacking, bug bounties, DFIR, AI security and more, maintained by Omar Santos. | 🟢 ★ 30k Nov 2026 |
| HackTricks Reference · Intermediate |
Large wiki of pentesting techniques and checklists across platforms and services. | 🟢 ★ 13k Nov 2026 |
| Infosec Reference Reference · Intermediate |
Extensive, categorized information security reference. | 🔵 ★ 6k Oct 2025 |
| OWASP Cheat Sheet Series Reference · Beginner |
Concise, practical guidance on specific application security topics for developers. | 🟢 ★ 34k Nov 2026 |
Every Monday a GitHub Action queries the GitHub API for each tracked project and records its stars, the date of the last commit on its default branch, whether it is archived and whether it has moved. The README and website are rebuilt from that data, and anything archived, deleted or renamed is reported in an issue so it can be replaced or removed. A second weekly job checks that every link still resolves.
Status is based on the last commit: 🟢 under 6 months, 🔵 under 18 months, 🟡 under 3 years, 🔴 older, ⚫ archived.
- Only test systems you own, or systems you have explicit written permission to test. Unauthorized access is a crime in most countries.
- Use the vulnerable labs and practice platforms to build skills safely.
- Follow the scope and rules of bug bounty programs exactly, and disclose vulnerabilities responsibly.
- Many tools listed here can cause damage when misused. Understand what a tool does before you run it.
Suggestions and fixes are welcome: new resources, better descriptions, broken links or moved projects. Please read CONTRIBUTING.md. In short:
- Add your entry to the right file in
data/(the format is inschema.json). - Run
npm run format && npm run check. - Open a pull request. The health data for new GitHub projects is filled in automatically.
Found something outdated or unsafe? Open an issue.
The curated data in data/, the learning paths and the generated lists are dedicated to the public domain under CC0 1.0. Scripts and the website are under the MIT License. Every listed project belongs to its authors and has its own license.
If this map helps you, a ⭐ helps others find it.