Resources
Free platforms, tools, YouTube channels, and blogs for cybersecurity students. Everything listed here is free or has a free tier.
Practice Platforms
TryHackMe
Browser-based labs and guided learning paths. Best starting point for beginners. Has structured paths for SOC Analyst, Pentester, and more.
Hack The Box Academy
Structured modules on offensive and defensive topics. Free tier available. More technical than TryHackMe.
PortSwigger Web Security Academy
The best free resource for web application security. Covers every OWASP topic with hands-on labs. Made by the creators of Burp Suite.
OverTheWire
Command-line and Linux wargames. Bandit is the best starting point for beginners learning Linux through challenges.
PicoCTF
CTF platform built for beginners and students. Great for learning web, forensics, crypto, and reverse engineering basics.
Blue Team Labs Online
Free labs focused on defensive security — log analysis, threat hunting, SIEM, malware analysis, and incident response.
CyberDefenders
Blue team CTF challenges. Good for SOC analyst skills — PCAP analysis, memory forensics, threat hunting.
LetsDefend
Simulates a real SOC environment. Practice triaging alerts, investigating incidents, and writing reports. Free tier available.
Hack The Box
Retired machines and active challenges for more advanced offensive skills. Use after TryHackMe.
VulnHub
Free downloadable vulnerable VMs to practice on your own machine. Good for home lab practice.
Tools
Nmap
Network scanner for port discovery, service detection, OS fingerprinting. Essential recon tool.
Burp Suite Community
Web proxy for intercepting and modifying HTTP traffic. Used for manual web application testing.
Wireshark
Packet capture and analysis tool. Used in network forensics, troubleshooting, and CTF challenges.
Metasploit Framework
Open-source exploitation framework. Used in pentesting for exploitation, post-exploitation, and payload generation.
Gobuster
Directory and DNS brute-forcing tool. Used to find hidden files, directories, and subdomains.
ffuf
Fast web fuzzer written in Go. Used for directory brute forcing, parameter discovery, and virtual host fuzzing.
Hydra
Online password brute-forcing tool. Supports SSH, FTP, HTTP forms, SMB, RDP, and more.
John the Ripper
Offline password hash cracking tool. Works with many hash types including MD5, SHA, NTLM, and bcrypt.
Hashcat
GPU-based hash cracking tool. Faster than John for large wordlists and complex hash types.
CyberChef
Browser-based tool for encoding, decoding, encrypting, and analysing data. Runs in your browser, no install needed.
Volatility
Memory forensics framework. Used to analyse RAM dumps for running processes, network connections, and artifacts.
BloodHound
Active Directory attack path visualisation tool. Used to find privilege escalation and lateral movement paths in AD environments.
Splunk Free
SIEM platform with a free tier. Used for log ingestion, searching, dashboards, and alert creation.
Wordlists
SecLists
The most comprehensive collection of wordlists for security testing — directories, passwords, usernames, payloads, and more.
RockYou.txt
The most used password wordlist, containing 14 million real leaked passwords. Used with Hashcat and John.
YouTube Channels
NetworkChuck
Beginner-friendly networking and cybersecurity content. Good for Networking and Linux basics.
TCM Security
Practical pentesting tutorials. One of the best channels for learning hands-on offensive security.
John Hammond
CTF walkthroughs, malware analysis, and security research. Great for learning how real vulnerabilities work.
IppSec
HackTheBox machine walkthroughs. Watch these after you attempt a machine yourself to learn methodology.
David Bombal
Networking, Python scripting, and cybersecurity tools. Good for networking fundamentals.
LiveOverflow
Binary exploitation, CTF challenges, and deep technical security research. More advanced but excellent quality.
The Cyber Mentor
Ethical hacking courses, OSCP prep, and pentesting methodology. Very practical and beginner-friendly.
Reading and Blogs
OWASP Top 10
The industry standard list of the most critical web application security risks. Required reading for web security.
HackTricks
Massive open-source hacking reference. Covers almost every attack technique with commands and examples.
GTFOBins
Reference for Unix binaries that can be abused for privilege escalation and bypassing restrictions.
LOLBAS
Same as GTFOBins but for Windows. Living Off the Land Binaries and Scripts for Windows attackers.
PortSwigger Research
High-quality web security research articles from the team behind Burp Suite. Advanced but very detailed.
Krebs on Security
Real-world cybersecurity news and investigations. Good for understanding how attacks happen in the wild.
Certifications to Aim For
| Certification | Level | Focus |
|---|---|---|
| CompTIA Security+ | Beginner | General security foundations |
| eJPT (eLearnSecurity) | Beginner | Practical pentesting basics |
| CompTIA CySA+ | Intermediate | Blue team and SOC analysis |
| CEH | Intermediate | Ethical hacking methodology |
| PNPT (TCM Security) | Intermediate | Practical network pentesting |
| OSCP (Offensive Security) | Advanced | Real-world pentesting |
Want something added?
Open a Discussion or suggest it in the repo and we will add it.