Authorized use only: use these resources in labs, on systems you own, or where the owner has explicitly permitted the testing activity.

CVE workflow

Record → vendor advisory → affected versions → patch diff → PoC status → KEV/EPSS → harmless reproduction.

Web workflow

Browse normally → HTTP history → Repeater → change one input → compare response → document root cause.

Research notes

Capture the entry point, vulnerable function, missing check, impact, evidence, fixed version, and possible variants.

Start Here

Use these first. They provide the methodology, labs, and reference material that the rest of the site builds on.

Core learning

Resource	What it is useful for	Type
PortSwigger Web Security Academy	Free guided web-security lessons and vulnerable labs.	Primary
PortSwigger learning paths	Structured paths so you do not jump randomly between topics.	Primary
Burp Suite documentation	Official documentation for Proxy, Repeater, Intruder, Decoder, and related tools.	Tool docs
OWASP Web Security Testing Guide	A professional web-testing methodology and checklist.	Methodology
OWASP Cheat Sheet Series	Secure implementation guidance for common application features.	Reference
OWASP Top 10	A high-level map of common web-application security risks.	Reference
OWASP API Security Top 10	Common API authorization, authentication, and design failures.	Reference
HackTricks	Broad reference for web, cloud, network, and privilege-escalation concepts.	Reference
PayloadsAllTheThings	Payload examples and notes grouped by vulnerability class.	Reference
The Book of Secret Knowledge	Large collection of technical commands, references, and utilities.	Reference

First tools

Resource	What it is useful for	Type
Burp Suite Community Edition	Intercept, inspect, and manually alter web requests.	Install
Visual Studio Code	Code and notes editor with extensions for many languages.	Install
Git	Clone projects, inspect history, and compare patches.	Install
Python	Useful for small scripts, PoC review, parsing, and automation.	Install
CyberChef	Decode, encode, transform, and inspect data in the browser.	Utility
DevTools documentation	Learn browser Network, Sources, Storage, and Console panels.	Tool docs

Additional resources

Resource	What it is useful for	Type
MDN Web Security	Browser and web-platform security concepts from Mozilla.	Foundation
OWASP Developer Guide	Security guidance organized for people building applications.	Reference
Mozilla Web Security Guidelines	Practical secure-web configuration and implementation guidance.	Reference
Linux Journey	Free lessons covering Linux fundamentals used throughout security work.	Foundation
GitHub Skills	Hands-on Git and GitHub exercises for source review and collaboration.	Foundation
Microsoft Learn Security	Microsoft security, identity, cloud, and operations learning modules.	Learn

No resources in this tab match your search.

CVE Intelligence

Use several sources. NVD is a starting point, while the vendor advisory and patch are usually the most useful technical references.

Canonical records and advisories

Resource	What it is useful for	Type
NVD vulnerability search	CVSS, CWE, CPEs, descriptions, and tagged references.	Daily
CVE.org	Canonical CVE records and CNA information.	Daily
GitHub Advisory Database	Package advisories, affected ranges, patches, and GHSA records.	Daily
OSV	Open-source vulnerabilities mapped to package ecosystems and versions.	Daily
CIRCL Vulnerability-Lookup	Search and correlate vulnerability data from several sources.	Search
OpenCVE	Track vendors, products, and CVE updates.	Tracking
CVE Details	Historical browsing and product-oriented vulnerability views.	Search
Vulners	Cross-source vulnerability, advisory, and exploit search.	Search
ProjectDiscovery CVEMap	Filter and correlate CVEs, PoCs, templates, EPSS, and KEV data.	Search
AttackerKB	Community analysis focused on exploitability and practical impact.	Analysis

Risk and prioritization

Resource	What it is useful for	Type
CISA KEV Catalog	Vulnerabilities confirmed as exploited in the wild.	Priority
FIRST EPSS	Probability-oriented exploitation intelligence.	Priority
FIRST CVSS v4 calculator	Inspect or calculate CVSS v4 vectors.	Reference
MITRE CWE	Root-cause weakness taxonomy and examples.	Reference
CVE Trends	View CVEs receiving unusual public attention.	Trend
CISA Cybersecurity Advisories	Government advisories covering active campaigns and products.	Advisory
CERT/CC Vulnerability Notes	Coordinated vulnerability notes and mitigations.	Advisory
Snyk Vulnerability Database	Package vulnerability data with ecosystem context.	Package

Additional resources

Resource	What it is useful for	Type
NVD API documentation	Query structured vulnerability records and reference metadata.	API
CVE List V5 repository	Official CVE JSON records published through the CVE Program.	Dataset
CISA Vulnrichment	CISA-enriched CVE records, SSVC decisions, and related analysis.	Dataset
GitHub Global Advisories API	Search GitHub advisories by CVE, GHSA, package, ecosystem, and date.	API
Red Hat Security Data	Vendor analysis, affected Red Hat products, and remediation status.	Vendor
Ubuntu CVE Tracker	Ubuntu package status and distribution-specific remediation data.	Vendor

No resources in this tab match your search.

PoCs & Exploits

A PoC is evidence, not proof that code is safe or reliable. Review unknown repositories and test only in an isolated lab.

Search and repositories

Resource	What it is useful for	Type
GitHub code search	Search exact CVE IDs, GHSA IDs, functions, commits, and error strings.	Search
PoC-in-GitHub	Automated collection of repositories associated with CVE identifiers.	Unverified
Exploit Database	Public exploit and proof-of-concept archive.	Unverified
Packet Storm Security	Advisories, tools, and exploit material.	Unverified
Sploitus	Search engine for exploits and vulnerability references.	Search
Rapid7 Metasploit modules	Search published Metasploit modules.	Framework
Nuclei templates	Community templates for detection and validation.	Detection
Nuclei Template Documentation	Understand what a template tests before using it.	Tool docs
Metasploit documentation	Framework concepts, modules, payloads, and lab use.	Tool docs
OffSec Exploit Database GitLab	Repository version of the Exploit Database archive.	Archive

Research validation

Resource	What it is useful for	Type
VirusTotal	Check hashes, URLs, domains, and community detections.	Triage
URLhaus	Database of malware-distribution URLs.	Triage
MalwareBazaar	Malware sample intelligence and hashes.	Triage
Hybrid Analysis	Public sandbox reports for files and URLs.	Sandbox
ANY.RUN	Interactive malware-analysis sandbox; review privacy limits before uploading.	Sandbox
Joe Sandbox Cloud	Automated malware-analysis reports and indicators.	Sandbox

Additional resources

Resource	What it is useful for	Type
Trickest CVE repository	Large index connecting CVE identifiers with public references and repositories.	Index
InTheWild.io	Search public reports of vulnerabilities observed in real-world exploitation.	Exploitation
Project Zero 0days in the wild	Tracked zero-days and exploitation timelines studied by Project Zero.	Research
CISA Vulnrichment repository	SSVC and exploitation-context enrichment for CVE records.	Analysis
Nuclei template search	Search published templates and review their exact validation logic.	Detection
GitHub Advisory Database search	Find upstream advisories that may include reproduction steps and patch links.	Official

No resources in this tab match your search.

Web & API

Manual testing comes first: observe a normal request, move it to Repeater, alter one input, and compare the result.

Proxies and HTTP clients

Resource	What it is useful for	Type
Burp Suite	Primary intercepting proxy for the Academy and manual web testing.	Tool
OWASP ZAP	Open-source intercepting proxy and web scanner.	Tool
Caido	Modern web-security auditing toolkit and proxy.	Tool
mitmproxy	Scriptable command-line and web-based intercepting proxy.	Tool
Postman	Build, organize, and inspect API requests.	Tool
Insomnia	API client for REST, GraphQL, and related workflows.	Tool
HTTPie	Readable command-line HTTP client.	CLI
curl documentation	Essential HTTP and network request utility.	CLI
Webhook.site	Temporary endpoints for examining callbacks and webhooks.	Utility
jwt.io	Inspect JWT structure and claims; do not paste sensitive production tokens.	Utility

Discovery and validation

Resource	What it is useful for	Type
ffuf	Fast content, parameter, and virtual-host fuzzing.	Tool
feroxbuster	Recursive content discovery for authorized targets.	Tool
Gobuster	Directory, DNS, and virtual-host discovery.	Tool
ProjectDiscovery httpx	HTTP probing and response metadata collection.	Tool
ProjectDiscovery Katana	Web crawling for endpoint discovery.	Tool
Nuclei	Template-driven vulnerability validation.	Tool
sqlmap	SQL injection automation; learn manual verification first.	Advanced
SecLists	Wordlists and test data for security assessments.	Data
Can I take over XYZ?	Reference for identifying potential subdomain-takeover conditions.	Reference
Wappalyzer	Identify technologies used by websites.	Recon

Web references

Resource	What it is useful for	Type
PortSwigger Web Security Academy	Hands-on labs for web vulnerability classes.	Learn
OWASP WSTG	Testing methodology organized by security domain.	Reference
OWASP API Top 10	API-specific risk categories and guidance.	Reference
MDN HTTP overview	Learn requests, responses, headers, methods, and status codes.	Foundation
HTTP Semantics RFC	Authoritative HTTP semantics reference.	Standard
GraphQL security cheat sheet	Security considerations for GraphQL services.	Reference

Additional resources

Resource	What it is useful for	Type
Burp BApp Store	Extensions for authorization testing, logging, discovery, and analysis.	Extensions
Autorize	Burp extension that helps compare authorization behavior between sessions.	Extension
Logger++	Advanced request and response logging inside Burp Suite.	Extension
Param Miner	Discover hidden parameters, headers, and cache-related input behavior.	Extension
APIsec University	Free courses focused on API discovery, authorization, and testing.	Learn
Mozilla Observatory	Review public website security headers and configuration signals.	Utility

No resources in this tab match your search.

Network & Infrastructure

Focus on service discovery, packet interpretation, DNS, certificates, and validating exposure—not simply running scanners.

Discovery and packet analysis

Resource	What it is useful for	Type
Nmap	Host discovery, port scanning, service detection, and NSE.	Primary
Nmap Reference Guide	Official options and output reference.	Tool docs
Nmap NSE documentation	Search and understand Nmap scripts before using them.	Tool docs
Wireshark	Packet capture and protocol analysis.	Primary
Wireshark Display Filter Reference	Search protocol fields and display filters.	Reference
Masscan	High-speed port scanner for controlled environments.	Advanced
RustScan	Fast port discovery that can feed results into Nmap.	Tool
Netcat guide	Official Ncat guide for simple TCP/UDP connections and relays.	Utility
Test-NetConnection	Windows PowerShell connectivity testing.	Windows
Sysinternals TCPView	View local TCP and UDP endpoints and owning processes.	Windows

Internet and DNS intelligence

Resource	What it is useful for	Type
Shodan	Search indexed Internet-connected services.	Search
Censys Search	Search Internet hosts, services, and certificates.	Search
ZoomEye	Internet asset and service search.	Search
crt.sh	Search Certificate Transparency logs.	DNS/TLS
SecurityTrails	DNS, domain, and historical resolution data.	DNS
DNSDumpster	Visual DNS reconnaissance and host mapping.	DNS
MXToolbox	DNS, mail, blacklist, and connectivity diagnostics.	DNS/Mail
ViewDNS.info	Collection of DNS and domain lookup utilities.	DNS
GreyNoise Visualizer	Context for scanning and Internet background noise.	Intel
AbuseIPDB	Community IP reputation reports.	Intel

Windows and identity

Resource	What it is useful for	Type
Microsoft Sysinternals	Deep Windows inspection and troubleshooting tools.	Primary
LOLBAS	Windows binaries, scripts, and libraries relevant to living-off-the-land behavior.	Reference
BloodHound documentation	Understand Active Directory and Entra attack-path analysis.	Advanced
The Hacker Recipes	Reference for Windows, Active Directory, and authentication concepts.	Reference
ADSecurity.org	Active Directory security research and defensive guidance.	Research
Microsoft security documentation	Microsoft security architecture, products, and guidance.	Reference
Atomic Red Team	Small ATT&CK-mapped tests for authorized validation.	Lab
MITRE ATT&CK	Tactics, techniques, procedures, mitigations, and data sources.	Framework

Additional resources

Resource	What it is useful for	Type
Zeek	Network security monitoring and protocol-rich event generation.	Monitoring
Suricata	Open-source IDS, IPS, and network security monitoring engine.	Monitoring
Security Onion	Integrated defensive monitoring platform for network and endpoint telemetry.	Platform
DNSViz	Analyze DNSSEC and DNS delegation problems visually.	DNS
Qualys SSL Labs Server Test	Inspect public TLS configuration, certificates, ciphers, and protocol support.	TLS
RIPEstat	ASN, routing, address-space, and Internet registration context.	Internet

No resources in this tab match your search.

Code Review & Fuzzing

Trace attacker-controlled input to a sensitive operation, identify the missing check, reproduce the impact, then search for variants.

Static analysis and source review

Resource	What it is useful for	Type
GitHub Security Lab	Open-source audits, vulnerability research, and CodeQL resources.	Research
CodeQL documentation	Semantic source-code analysis and variant hunting.	Tool
CodeQL query help	Security queries grouped by language and weakness.	Reference
Semgrep	Pattern and data-flow-oriented static analysis.	Tool
Semgrep Registry	Browse rules and learn how security patterns are modeled.	Rules
SonarSource Security Research	Write-ups showing source-review and variant-analysis techniques.	Research
Snyk Learn	Interactive lessons on vulnerable code patterns.	Learn
GitHub code search syntax	Search repositories effectively during source review.	Reference
Compiler Explorer	Inspect compiler output and compare code generation.	Utility
DevSkim	Microsoft security linting rules and editor integrations.	Tool

Fuzzing

Resource	What it is useful for	Type
The Fuzzing Book	Free executable lessons covering fuzzing techniques.	Learn
AFL++	Coverage-guided fuzzing for native targets.	Advanced
libFuzzer documentation	In-process coverage-guided fuzzing with LLVM.	Advanced
OSS-Fuzz	Continuous fuzzing service and integration guidance for open source.	Platform
ClusterFuzzLite	Run fuzzing in CI for open-source projects.	Platform
Google FuzzTest	C++ property-based and fuzz testing framework.	Tool
Fuzzing101	Hands-on fuzzing exercises using real software.	Lab
OneFuzz	Microsoft open-source fuzzing platform.	Platform

Additional resources

Resource	What it is useful for	Type
Joern	Code property graph analysis for security-focused source review.	Tool
OWASP Benchmark	Measure and compare static-analysis tool performance using known test cases.	Benchmark
Bandit	Python source-code security linting.	Tool
Brakeman	Static analysis focused on Ruby on Rails applications.	Tool
gosec	Go source-code security analyzer.	Tool
Hypothesis	Property-based testing that can expose unexpected program states.	Testing

No resources in this tab match your search.

Reverse Engineering

Start with assembly fundamentals and small crackmes before attempting complex malware, kernels, browsers, or modern exploit chains.

Tools

Resource	What it is useful for	Type
Ghidra	Free software reverse-engineering suite.	Primary
Cutter	Graphical reverse-engineering platform powered by Rizin.	Tool
x64dbg	Windows user-mode debugger.	Windows
WinDbg documentation	Official Windows debugger documentation.	Windows
GDB documentation	GNU debugger documentation.	Linux
pwndbg	Exploit-development-oriented extension for GDB and LLDB.	Linux
radare2	Command-line reverse-engineering framework.	Tool
Rizin	Open-source reverse-engineering framework.	Tool
Detect It Easy	Identify file types, packers, compilers, and signatures.	Triage
PE-bear	Inspect Windows PE files and structures.	Windows

Learning and lab environments

Resource	What it is useful for	Type
OpenSecurityTraining2	Free courses on architecture, assembly, exploitation, and reverse engineering.	Primary
pwn.college	Hands-on Linux, systems, and binary-exploitation curriculum.	Primary
Nightmare	Beginner-friendly binary exploitation notes and exercises.	Learn
RPISEC Modern Binary Exploitation	Course material and labs for binary exploitation.	Learn
Malware Unicorn workshops	Reverse-engineering workshop material.	Learn
FLARE-VM	Windows reverse-engineering and malware-analysis environment.	Lab
REMnux	Linux toolkit for malware analysis and reverse engineering.	Lab
crackmes.one	Small reverse-engineering challenges; use isolated environments.	Practice
Reverse Engineering Stack Exchange	Technical Q&A covering tools, formats, and analysis.	Community
LiveOverflow	Educational material on exploitation and reverse engineering.	Learn

Additional resources

Resource	What it is useful for	Type
IDA Free	Free edition of the IDA disassembler for learning and smaller projects.	Tool
Binary Ninja Cloud	Browser-accessible reverse-engineering environment and free options.	Tool
capa	Identify executable capabilities using reusable analysis rules.	Triage
YARA	Write content and structure-based matching rules for files and memory.	Detection
FLOSS	Extract and decode obfuscated strings from malware samples.	Triage
PeStudio	Static inspection and triage of Windows executable files.	Windows

No resources in this tab match your search.

Labs & Practice

Use intentionally vulnerable targets and clearly scoped platforms. Keep a lab journal and repeat solved exercises without the walkthrough.

Web and API labs

Resource	What it is useful for	Type
PortSwigger Academy	Best starting point for guided web vulnerability labs.	Primary
OWASP Juice Shop	Modern intentionally vulnerable web application.	Local lab
OWASP WebGoat	Guided lessons in a deliberately insecure Java application.	Local lab
OWASP crAPI	API-focused intentionally vulnerable application.	Local lab
Damn Vulnerable Web Application	Classic PHP/MySQL web-security practice target.	Local lab
VAmPI	Vulnerable API built for learning OWASP API risks.	Local lab
PentesterLab	Exercises focused on web vulnerability understanding.	Platform
Web Security Dojo	Preconfigured web-security training environment.	Local lab

General and infrastructure labs

Resource	What it is useful for	Type
Hack The Box Academy	Structured modules covering many security domains.	Platform
TryHackMe	Guided beginner and intermediate learning paths.	Platform
VulnHub	Downloadable intentionally vulnerable virtual machines.	Local lab
Metasploitable 2	Intentionally vulnerable Linux VM for a private lab.	Local lab
OverTheWire	Progressive command-line and security wargames.	Platform
picoCTF	Beginner-friendly capture-the-flag challenges.	Platform
Root Me	Challenges across web, network, crypto, and exploitation.	Platform
pwn.college	Systems and exploitation curriculum.	Platform
CyberDefenders	Blue-team and digital-forensics labs.	Blue team
LetsDefend	SOC investigation and alert-handling labs.	Blue team
Malware-Traffic-Analysis.net	Packet captures and exercises for malicious network traffic.	Blue team
RangeForce Community Edition	Hands-on defensive-security exercises.	Blue team

Additional resources

Resource	What it is useful for	Type
CloudGoat	Deliberately vulnerable AWS scenarios for an isolated lab account.	Cloud lab
flaws.cloud	Guided AWS security mistakes and discovery exercises.	Cloud lab
Game of Active Directory	Deliberately vulnerable Active Directory lab environment.	AD lab
Damn Vulnerable Node Application	Intentionally vulnerable Node.js application for local practice.	Web lab
OWASP Security Shepherd	Configurable web and mobile application security training platform.	Web lab
Blue Team Labs Online	Defensive investigations, incident response, and forensic challenges.	Blue team

No resources in this tab match your search.

Threat Intel & Detection

Use threat intelligence to add context, then translate behavior into detections, logging requirements, and validation tests.

Threat intelligence

Resource	What it is useful for	Type
MITRE ATT&CK	Adversary behavior mapped to tactics and techniques.	Framework
AlienVault OTX	Community threat-intelligence pulses and indicators.	Intel
MISP Project	Threat-intelligence sharing platform and data model.	Platform
ThreatFox	Indicators associated with malware activity.	Intel
URLhaus	Malware-distribution URL intelligence.	Intel
MalwareBazaar	Malware hashes and sample metadata.	Intel
PhishTank	Community phishing URL reports.	Intel
Spamhaus	Abuse, botnet, domain, and IP reputation intelligence.	Intel
VirusTotal Intelligence	File, URL, domain, and IP reputation and relationships.	Intel
GreyNoise	Internet scanner and background-noise context.	Intel

Detection engineering

Resource	What it is useful for	Type
SigmaHQ	Generic SIEM detection-rule format and community rules.	Primary
Sigma rules repository	Community detection content and tooling.	Rules
Elastic detection rules	Open detection rules and research.	Rules
Splunk Security Content	Detections, analytic stories, and testing guidance.	Rules
Microsoft Sentinel detections	Analytics, hunting queries, playbooks, and content.	Rules
Atomic Red Team	Small tests for validating ATT&CK-aligned telemetry and detections.	Validation
DetectionLab	Lab environment for defensive-security testing.	Lab
LOLRMM	Catalog of remote-management tools that can be abused by adversaries.	Reference
LOLDrivers	Known vulnerable or malicious Windows drivers.	Reference
Unprotect Project	Reference for malware evasion concepts and defensive awareness.	Reference

Additional resources

Resource	What it is useful for	Type
OpenCTI	Open-source platform for structuring and relating threat intelligence.	Platform
MITRE ATT&CK Navigator	Create ATT&CK coverage layers and compare techniques visually.	Tool
Velociraptor	Endpoint visibility, collection, hunting, and digital forensics.	Endpoint
osquery	Query operating-system state using SQL-like tables.	Endpoint
YARA documentation	Rule syntax and modules for file and memory matching.	Detection
MISP Galaxy clusters	Reusable threat-actor, malware, tool, and technique knowledge structures.	Intel

No resources in this tab match your search.

Research Feeds

Read write-ups for the reasoning process: target selection, root cause, patch diff, exploitability, variants, and remediation.

Vulnerability research

Resource	What it is useful for	Type
Google Project Zero	Deep vulnerability and exploitation research.	Read
PortSwigger Research	Modern web-application research techniques.	Read
GitHub Security Lab	Open-source vulnerability findings and methodologies.	Read
Trail of Bits Blog	Software assurance, fuzzing, cryptography, and auditing.	Read
Assetnote Research	Enterprise and web vulnerability research.	Read
ProjectDiscovery Blog	Internet-scale discovery and vulnerability research.	Read
SonarSource Security Research	Source-code vulnerability research and patch analysis.	Read
Zero Day Initiative Blog	Vulnerability disclosures and exploit-focused analysis.	Read
Bishop Fox Blog	Offensive-security and vulnerability-research posts.	Read
Praetorian Blog	Security research, red-team, and engineering posts.	Read
SpecterOps Blog	Identity, Active Directory, and offensive-security research.	Read
Horizon3.ai Attack Team	Enterprise vulnerability and exploit research.	Read

Threat and incident research

Resource	What it is useful for	Type
Microsoft Security Blog	Threat research, incidents, and defensive guidance.	Read
Google Security Blog	Security engineering and ecosystem research.	Read
Mandiant Blog	Threat intelligence and incident-response research.	Read
Cisco Talos Blog	Threat intelligence and vulnerability research.	Read
Palo Alto Unit 42	Threat campaigns, malware, and incident analysis.	Read
SentinelLabs	Malware and threat-actor research.	Read
Rapid7 Blog	Vulnerability, incident, and product-security research.	Read
SANS Internet Storm Center	Daily observations and analysis from defenders.	Daily
Krebs on Security	Cybercrime and security reporting.	Read
The DFIR Report	Detailed intrusion timelines and defensive observations.	Read

Additional resources

Resource	What it is useful for	Type
watchTowr Labs	Enterprise-product vulnerability research and detailed exploit analysis.	Read
Orange Tsai research	Web exploitation, parser confusion, SSRF, and complex vulnerability chains.	Read
NCC Group Research	Vulnerability research, cryptography, hardware, and offensive techniques.	Read
JFrog Security Research	Open-source package and software-supply-chain vulnerability research.	Read
Tenable Research	Product vulnerability research, advisories, and technical analysis.	Read
Qualys Threat Research Unit	Operating-system and enterprise vulnerability research.	Read

No resources in this tab match your search.

Disclosure & Bounties

Read the program scope before testing. Scope, safe harbor, prohibited testing, and data-handling rules override general assumptions.

Programs

Resource	What it is useful for	Type
HackerOne program directory	Public bug-bounty and vulnerability-disclosure programs.	Scope
HackerOne Hacktivity	Public disclosed reports and researcher write-ups.	Learn
Bugcrowd engagements	Public programs and disclosure engagements.	Scope
Bugcrowd University	Researcher education and methodology.	Learn
Intigriti programs	Public bounty and disclosure programs.	Scope
Intigriti Hackademy	Bug-bounty education and challenge material.	Learn
YesWeHack programs	Public bug-bounty and disclosure programs.	Scope
Synack Red Team	Vetted security-research platform.	Platform

Disclosure guidance

Resource	What it is useful for	Type
Disclose.io	Safe-harbor and vulnerability-disclosure policy resources.	Reference
CERT/CC report form	Coordinated vulnerability reporting and guidance.	Reference
GitHub repository security advisories	Private reporting and coordinated disclosure for supported repositories.	Reference
Google VDP	Example of detailed scope and testing rules.	Example
Microsoft bounty programs	Microsoft program scopes and award structures.	Scope
CISA VDP Platform	Federal vulnerability-disclosure information.	Reference
FIRST PSIRT Services Framework	How product-security response teams organize disclosure work.	Reference
ISO/IEC 29147 overview	International vulnerability-disclosure standard overview.	Standard

Additional resources

Resource	What it is useful for	Type
security.txt standard	Publish or locate a standardized security contact and disclosure policy.	Standard
Google Bug Hunters	Google vulnerability-reward programs, rules, and public research.	Program
Mozilla Security Bug Bounty	Mozilla bounty scopes, eligibility, and reporting guidance.	Program
GitLab Bug Bounty	GitLab vulnerability disclosure and bounty information.	Program
OWASP Vulnerability Disclosure Cheat Sheet	Guidance for operating and participating in responsible disclosure.	Reference
Open Bug Bounty	Coordinated disclosure platform focused largely on web vulnerabilities.	Platform

No resources in this tab match your search.

Forums & Communities

Legitimate places to ask questions, follow research, troubleshoot tools, and meet practitioners. Read each community's rules before posting.

Community safety: never post client data, credentials, active incident details, private PoCs, or malware samples unless the forum explicitly permits it and you understand the handling rules.

Security Q&A and technical forums

Community	Best use	Type
Information Security Stack Exchange	Focused technical Q&A with voting, tags, and durable answers.	Q&A
BleepingComputer Forums	Windows support, malware removal, ransomware, and security discussions.	Forum
MalwareTips Forums	Malware removal, security products, news, and general security discussions.	Forum
Wilders Security Forums	Long-running privacy, security software, and operating-system community.	Forum
0x00sec	Technical offensive-security, development, and research discussions.	Forum
DEF CON Forums	Official DEF CON community, villages, groups, events, and technical topics.	Community
Hack The Box Forums	Platform support, Academy discussion, labs, and community knowledge.	Lab community
Kali Linux Forums	Kali installation, tools, hardware, and troubleshooting discussions.	Linux
PortSwigger Support Center	Burp Suite help, documentation routes, and support discussions.	Support
OWASP Community	Projects, chapters, events, working groups, and community participation.	Community

Focused communities

Community	Best use	Type
Malwarebytes Forums	Malware removal, endpoint security, and product-support discussions.	Malware
ESET Security Forum	Endpoint protection, malware, and security-product discussions.	Endpoint
Splunk Community	SIEM searches, detections, dashboards, ingestion, and troubleshooting.	Detection
Elastic Discuss Security	Elastic Security, endpoint, detection, and SIEM discussions.	Detection
Microsoft Security Community	Microsoft security, compliance, identity, Sentinel, and Defender discussions.	Microsoft
SANS Internet Storm Center	Daily defensive observations and practitioner commentary.	Blue team
Lobsters security tag	Technical security articles and discussion in a developer-focused community.	Discussion
HackerOne Community	Researcher resources, events, stories, and bug-bounty community material.	Bug bounty

Reddit communities

Community	Best use	Type
r/netsec	Technical security research and industry discussion.	Reddit
r/AskNetsec	Questions about security careers, concepts, tools, and learning.	Reddit
r/cybersecurity	Broad cybersecurity news, work, and community discussion.	Reddit
r/blueteamsec	Defensive engineering, detection, incident response, and threat research.	Reddit
r/ReverseEngineering	Reverse engineering, tooling, and technical write-ups.	Reddit
r/Malware	Malware analysis, reports, samples policy, and research discussion.	Reddit
r/sysadmin	Enterprise systems administration and operational security context.	Reddit
r/homelab	Home infrastructure and lab-building discussions.	Reddit

No communities in this tab match your search.

Verified Onion Services BETA

A small directory of legitimate onion services whose addresses are published by the operator on an official clearnet property or official announcement.

What “verified” means here: the address was copied from the linked operator-controlled source. It does not mean the service is audited, guaranteed online, or permanently safe. Re-check the source before relying on an address.

Not listed: marketplaces, piracy indexes, anonymous link directories, user-submitted mirrors, criminal forums, and services without an operator-controlled verification page.

Verification and safe access

Resource	What it is useful for	Type
Download Tor Browser	Use the official Tor Project download rather than third-party packages.	Official
Tor Project onion-service list	Operator-published list of Tor Project onion services and current v3 addresses.	Verification
Tor Browser onion-services manual	How onion services work and how Tor Browser handles them.	Reference
SecureDrop directory	Official directory for participating news organizations and their SecureDrop systems.	Directory

Operator-published services

Service	Onion address	Verification	Status
Tor Project Main Tor Project website.	`2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tor Project Support Tor documentation and user support.	`rzuwtpc4wb3xdzrj3yeajsvm3fkq4vbeubm2tdxaqruzzzgs5dwemlad.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tor Project Downloads Tor Browser and project downloads.	`vczcbkhpkhcywcyuyd7rfhu4bebsyscp2qoeyyvjva3km5py5rpisdid.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tor Project Forum Official Tor community forum.	`v236xhqtyullodhf26szyjepvkbv6iitrhjgrqj4avaoukebkk6n6syd.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tor Project Research Tor research portal.	`xhqthou6scpfnwjyzc3ekdgcbvj76ccgyjyxp6cgypxjlcuhnxiktnqd.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tor Project Blog Official Tor Project blog.	`pzhdfe7jraknpj2qgu5cz2u3i4deuyfwmonvzu5i3nyw4t4bmg7o5pad.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
Tails Tails operating-system website.	`tzoz3bensgxyzs7da7lpgsn3a74h7hlbm4wa6ytq2tg6ktd57w22vqqd.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Operator list
ProPublica Privacy-preserving mirror of ProPublica journalism.	`p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Official announcement
Reddit Official Reddit onion service.	`www.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion` Open in Tor Browser ·	Official verification source Checked 2026-06-29	Official announcement

Verification rule: copy the complete v3 address. Do not trust a matching prefix, search-engine snippet, screenshot, URL shortener, Tor2web proxy, or a mirror-directory listing by itself.

No onion services in this tab match your search.