From 962aa79e56048c021e5e8adb74cd5608b887be51 Mon Sep 17 00:00:00 2001 From: Carter Perez Date: Tue, 9 Dec 2025 07:33:49 -0500 Subject: [PATCH] Created Tools and Resources (markdown) --- Tools-and-Resources.md | 208 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 208 insertions(+) create mode 100644 Tools-and-Resources.md diff --git a/Tools-and-Resources.md b/Tools-and-Resources.md new file mode 100644 index 0000000..554c643 --- /dev/null +++ b/Tools-and-Resources.md @@ -0,0 +1,208 @@ +# Tools and Resources + +Curated collection of cybersecurity tools, learning platforms, and resources. + +## Tools by Category + +### Reconnaissance & Scanning + +| Tool | Description | Link | +|------|-------------|------| +| Nmap | Network mapper and port scanner | [nmap.org](https://nmap.org/) | +| Nessus | Vulnerability scanner | [tenable.com](https://www.tenable.com/products/nessus) | +| Amass | Subdomain enumeration | [GitHub](https://github.com/owasp-amass/amass) | +| theHarvester | Information gathering | [GitHub](https://github.com/laramies/theHarvester) | +| Shodan | Internet search engine | [shodan.io](https://www.shodan.io/) | +| Recon-ng | Web reconnaissance framework | [GitHub](https://github.com/lanmaster53/recon-ng) | + +### Web Application Testing + +| Tool | Description | Link | +|------|-------------|------| +| Burp Suite | Web vulnerability scanner | [portswigger.net](https://portswigger.net/burp) | +| OWASP ZAP | Web app security scanner | [zaproxy.org](https://www.zaproxy.org/) | +| SQLmap | SQL injection testing | [sqlmap.org](https://sqlmap.org/) | +| Gobuster | Directory/DNS brute forcing | [GitHub](https://github.com/OJ/gobuster) | +| Nuclei | Template-based scanning | [GitHub](https://github.com/projectdiscovery/nuclei) | +| Nikto | Web server scanner | [GitHub](https://cirt.net/Nikto2) | + +### Network & Wireless + +| Tool | Description | Link | +|------|-------------|------| +| Wireshark | Network protocol analyzer | [wireshark.org](https://www.wireshark.org/) | +| Bettercap | Network attack framework | [GitHub](https://github.com/bettercap/bettercap) | +| Aircrack-ng | Wireless network auditing | [aircrack-ng.org](https://www.aircrack-ng.org/) | +| Responder | LLMNR/NBT-NS poisoner | [GitHub](https://github.com/SpiderLabs/Responder) | +| mitmproxy | HTTP/HTTPS proxy | [GitHub](https://github.com/mitmproxy/mitmproxy) | + +### Exploitation & Post-Exploitation + +| Tool | Description | Link | +|------|-------------|------| +| Metasploit | Penetration testing framework | [metasploit.com](https://www.metasploit.com/) | +| Hydra | Password cracking | [GitHub](https://github.com/vanhauser-thc/thc-hydra) | +| CrackMapExec | Post-exploitation framework | [GitHub](https://github.com/Porchetta-Industries/CrackMapExec) | +| Mimikatz | Credential extraction | [GitHub](https://github.com/gentilkiwi/mimikatz) | +| Empire | PowerShell post-exploitation | [GitHub](https://github.com/EmpireProject/Empire) | +| BloodHound | Active Directory analysis | [GitHub](https://github.com/BloodHoundAD/BloodHound) | + +### Cryptography & Analysis + +| Tool | Description | Link | +|------|-------------|------| +| John the Ripper | Password cracker | [openwall.com](https://www.openwall.com/john/) | +| Hashcat | GPU-accelerated hash cracking | [hashcat.net](https://hashcat.net/hashcat/) | +| Ghidra | Reverse engineering | [ghidra-sre.org](https://ghidra-sre.org/) | +| Radare2 | Binary analysis framework | [GitHub](https://github.com/radareorg/radare2) | + +### Forensics & Malware + +| Tool | Description | Link | +|------|-------------|------| +| Volatility | Memory forensics | [volatilityfoundation.org](https://www.volatilityfoundation.org/) | +| Cuckoo Sandbox | Malware analysis sandbox | [cuckoosandbox.org](https://cuckoosandbox.org/) | +| YARA | Pattern matching for malware | [GitHub](https://github.com/VirusTotal/yara) | + +### Defense & Monitoring + +| Tool | Description | Link | +|------|-------------|------| +| Suricata | Network IDS/IPS | [suricata.io](https://suricata.io/) | +| OSSEC | Host-based IDS | [ossec.net](https://www.ossec.net/) | +| Snyk | Dependency vulnerability scanner | [snyk.io](https://snyk.io/) | +| Semgrep | Static analysis | [semgrep.dev](https://semgrep.dev/) | + +--- + +## Learning Platforms + +### Hands-On Labs + +| Platform | Focus | Cost | +|----------|-------|------| +| [TryHackMe](https://tryhackme.com/) | Beginner-friendly challenges | Free + Premium | +| [Hack The Box](https://www.hackthebox.com/) | Penetration testing labs | Free + Premium | +| [HackTheBox Academy](https://academy.hackthebox.com/) | Structured learning paths | Paid | +| [PentesterLab](https://pentesterlab.com/) | Web security | Paid | +| [VulnHub](https://www.vulnhub.com/) | Vulnerable VMs | Free | + +### Video Courses + +| Platform | Focus | Cost | +|----------|-------|------| +| [Cybrary](https://www.cybrary.it) | General cybersecurity | Free + Premium | +| [INE](https://ine.com/learning/areas/security) | Security specialization | Paid | +| [Pluralsight](https://www.pluralsight.com/) | Tech skill development | Paid | +| [CBT Nuggets](https://www.cbtnuggets.com/) | Certification prep | Paid | +| [Udemy](https://www.udemy.com/) | Various instructors | Paid (sales) | + +### Free Resources + +| Resource | Description | +|----------|-------------| +| [Professor Messer](https://www.professormesser.com/) | CompTIA video courses | +| [SANS Cyber Aces](https://www.cyberaces.org/) | Free tutorials | +| [freeCodeCamp](https://www.youtube.com/freecodecamp) | Comprehensive courses | +| [Coursera](https://www.coursera.org/) | University courses (audit free) | + +--- + +## YouTube Channels + +### Top Recommendations + +| Channel | Focus | +|---------|-------| +| [Professor Messer](https://www.youtube.com/@professormesser) | CompTIA certification prep | +| [NetworkChuck](https://www.youtube.com/@NetworkChuck) | Networking & security | +| [John Hammond](https://www.youtube.com/@_JohnHammond) | Hacking & CTFs | +| [The Cyber Mentor](https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw) | Ethical hacking | +| [LiveOverflow](https://www.youtube.com/@LiveOverflow) | CTF & binary exploitation | +| [David Bombal](https://www.youtube.com/@davidbombal) | Cisco & networking | +| [HackerSploit](https://www.youtube.com/@HackerSploit) | Ethical hacking tutorials | +| [IppSec](https://www.youtube.com/@ippsec) | HTB walkthroughs | + +### Conferences + +| Channel | Content | +|---------|---------| +| [DEFCONConference](https://www.youtube.com/@DEFCONConference) | DEFCON talks | +| [BlackHat](https://www.youtube.com/@BlackHatOfficialYT) | BlackHat presentations | +| [SecurityWeekly](https://www.youtube.com/@SecurityWeekly) | Security news & updates | + +--- + +## Security Frameworks + +### NIST + +| Framework | Purpose | +|-----------|---------| +| [Cybersecurity Framework](https://www.nist.gov/cyberframework) | Risk management | +| [800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) | Security controls | +| [800-61](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) | Incident handling | +| [800-207](https://csrc.nist.gov/publications/detail/sp/800-207/final) | Zero Trust | + +### Industry Standards + +| Framework | Focus | +|-----------|-------| +| [MITRE ATT&CK](https://attack.mitre.org/) | Adversary tactics & techniques | +| [OWASP Top 10](https://owasp.org/www-project-top-ten/) | Web application risks | +| [CIS Controls](https://www.cisecurity.org/controls) | Critical security controls | +| [ISO 27001](https://www.iso.org/isoiec-27001-information-security.html) | Information security management | + +### Compliance + +| Standard | Industry | +|----------|----------| +| [PCI-DSS](https://www.pcisecuritystandards.org/) | Payment cards | +| [HIPAA](https://www.hhs.gov/hipaa/for-professionals/security/index.html) | Healthcare | +| [GDPR](https://gdpr.eu/) | EU data protection | +| [SOC 2](https://www.vanta.com/products/soc-2) | Service organizations | + +--- + +## Reddit Communities + +| Subreddit | Focus | +|-----------|-------| +| [r/cybersecurity](https://www.reddit.com/r/cybersecurity/) | General discussion | +| [r/netsec](https://www.reddit.com/r/netsec/) | Network security news | +| [r/AskNetsec](https://www.reddit.com/r/AskNetsec/) | Q&A | +| [r/CompTIA](https://www.reddit.com/r/CompTIA/) | Certification discussion | +| [r/oscp](https://www.reddit.com/r/oscp/) | OSCP preparation | +| [r/BlueTeamSec](https://www.reddit.com/r/BlueTeamSec/) | Defensive security | +| [r/RedTeam](https://www.reddit.com/r/RedTeam/) | Offensive security | +| [r/malware](https://www.reddit.com/r/malware/) | Malware analysis | + +--- + +## News & Blogs + +| Source | Type | +|--------|------| +| [Krebs on Security](https://krebsonsecurity.com/) | Investigative journalism | +| [Dark Reading](https://www.darkreading.com/) | Industry news | +| [The Hacker News](https://thehackernews.com/) | Breaking news | +| [Bleeping Computer](https://www.bleepingcomputer.com/) | News & tutorials | +| [Schneier on Security](https://www.schneier.com/) | Expert analysis | +| [SANS ISC](https://isc.sans.edu/) | Threat intelligence | + +--- + +## Databases & References + +| Resource | Content | +|----------|---------| +| [Exploit-DB](https://www.exploit-db.com/) | Exploits & vulnerabilities | +| [CVE](https://cve.mitre.org/) | Vulnerability identifiers | +| [NVD](https://nvd.nist.gov/) | Vulnerability database | +| [VirusTotal](https://www.virustotal.com/) | File/URL analysis | +| [AbuseIPDB](https://www.abuseipdb.com/) | IP reputation | +| [AlienVault OTX](https://otx.alienvault.com/) | Threat intelligence | + +--- + +See the main [README](https://github.com/CarterPerez-dev/Cybersecurity-Projects) for complete resource lists. \ No newline at end of file