Curated by Scott Altiparmak, Senior Information Security Engineer
⭐ If this saved you a bookmark folder, star it and pass it on. ⭐
📚 The Collection
| Guide | What's inside |
|---|---|
| 🔎 OSINT.md | Find almost anyone. 40+ recon and people-search tools. |
| 🕶️ PRIVACY.md | Disappear from the internet. 45+ removal and hardening tools. |
| 🎣 ATTACK.md | How hackers actually get in, and how to stop them. 30+ tools. |
| 📰 NEWS.md | Get dangerously informed. My Feedly setup and RSS feed list. |
| 📱 MOBILE.md | The security apps on my phone. Turn Android into a pentest kit. |
| 🎓 LEARN.md | Study real attacks. 5 free resources that teach the actual job. |
| 🕹️ PRACTICE.md | Practice hacking legally. 7 free hands-on labs and platforms. |
| 🛠️ PROJECTS.md | Cybersecurity projects to build and put on your resume, beginner to advanced. |
| 🪟 WINDOWS.md | Free Windows tools every IT and security pro should have. |
| 📄 RESUME.md | Free cybersecurity resume templates, entry-level and experienced. |
Jump to: 🕵️ OSINT · 💥 Pentest · 🪜 Priv-Esc · 🦠 Malware · 🎓 Learn · 📰 News · 👤 About
🕵️ Recon & OSINT
Mapping attack surface, harvesting intel, and finding what's exposed before anyone else does.
| Resource | What it does |
|---|---|
| Shodan | Search engine for internet-connected devices and exposed services. |
| Censys | Attack-surface search across hosts, certs, and services. |
| crt.sh | Certificate transparency search to uncover subdomains. |
| DNSdumpster | Free DNS recon and subdomain mapping. |
| ViewDNS.info | Bundle of DNS, WHOIS, and reverse-IP lookup tools. |
| theHarvester | Emails, subdomains, and names from public sources. |
| OSINT Framework | Categorized directory of OSINT tools for any lead. |
| Hunter | Find and verify professional email addresses. |
| Wappalyzer | Fingerprint the tech stack behind any website. |
| Wayback Machine | Historical snapshots of pages and deleted content. |
| Google Hacking DB | Dorks that surface exposed files and portals. |
| awesome-shodan-queries | Curated Shodan searches worth bookmarking. |
💥 Exploitation & Pentest
Payloads, wordlists, and the cheat sheets I reach for mid-engagement.
| Resource | What it does |
|---|---|
| HackTricks | The offensive-security bible, methodology for everything. |
| PayloadsAllTheThings | Payloads and bypasses for every vuln class. |
| SecLists | The security tester's collection of wordlists. |
| GTFOBins | Unix binaries abused to bypass local restrictions. |
| LOLBAS | Living-off-the-land binaries and scripts for Windows. |
| Exploit-DB | Archive of public exploits and vulnerable software. |
| Rapid7 Vuln & Exploit DB | Searchable vulnerability and exploit database. |
| AMSI.fail | Generates AMSI bypasses for testing detections. |
🪜 Windows Privilege Escalation
Enumerate, suggest, and climb on Windows targets.
| Resource | What it does |
|---|---|
| winPEAS (PEASS-ng) | Automated Windows privesc enumeration. |
| PrivescCheck | Lightweight PowerShell privesc checks. |
| Priv2Admin | Abuse paths for Windows privileges. |
| wesng | Windows Exploit Suggester, Next Generation. |
🦠 Malware & Analysis
Detonate, inspect, and verify the unknown.
| Resource | What it does |
|---|---|
| VirusTotal | Multi-engine file and URL reputation. |
| ANY.RUN | Interactive online malware sandbox. |
| Hybrid Analysis | Automated analysis powered by Falcon Sandbox. |
| Talos File Reputation | Cisco Talos hash and file lookup. |
| CrackStation | Fast lookup for unsalted password hashes. |
| Compiler Explorer | Inspect what compilers emit, great for RE. |
🎓 Learn & Practice
Hands-on labs and hardware to keep the skills current.
| Resource | What it does |
|---|---|
| TryHackMe | Guided learning paths from beginner to advanced. |
| Hack The Box | Realistic machines and challenges to break. |
| Hak5 | Offensive hardware and field gear. |
📰 News & Community
Where I keep up with what broke today.
| Resource | What it does |
|---|---|
| BleepingComputer | Breach news, malware coverage, and support. |
| The Hacker News | Fast, widely-read security news. |
| Krebs on Security | Deep investigative security journalism. |
| infosec.exchange | The infosec Mastodon community. |
| NIST | Standards, frameworks, and reference material. |
👤 About the Author
Hi, I'm Scott Altiparmak, a Senior Information Security Engineer with 8+ years of experience focused on identity, cloud security, and automation. This repo is my actual working set of bookmarks, curated and shared so the next person doesn't have to rebuild it from scratch.
Connect or follow along:
🤝 Contributing
Found something that belongs here? Contributions welcome.
- Fork the repo
- Add your resource to the right category table, alphabetical within reason
- Keep the one-line description short and honest
- Open a pull request
Missing a category you'd want (cloud, mobile, threat intel, blue team)? Open an issue and suggest it.
📜 License
Released under the MIT License. Copyright © 2026 Scott Altiparmak. Use it, fork it, share it.
⚠️ Disclaimer
These resources are shared for education, research, and authorized security testing only. Only test systems you own or have explicit written permission to assess. You are responsible for how you use them.