Resources

NVD (opens in a new tab) → nvd.nist.gov

The US government's database of published CVEs, with CVSS scores and affected products. Search a product name to see its known flaws.

CVE.org (opens in a new tab) → cve.org

The official CVE list. Look up an ID like CVE-2021-44228 to read the original record and its references.

CISA KEV catalog (opens in a new tab) → cisa.gov

Vulnerabilities that attackers are confirmed to be exploiting. Use it to decide what to patch first.

Exploit-DB (opens in a new tab) → exploit-db.com

Public archive of proof-of-concept exploits linked to CVEs. Read one to see how a flaw is abused, then study how the patch blocks it. Run nothing outside your own lab.

GitHub Advisory Database (opens in a new tab) → github.com

Security advisories for open-source packages (npm, PyPI, Maven and more). Check whether a library in your project has a known issue.

OSV.dev (opens in a new tab) → osv.dev

Open vulnerability database for open-source ecosystems, searchable by package name and version.

MITRE CWE (opens in a new tab) → cwe.mitre.org

The catalogue of weakness types behind CVEs, e.g. CWE-79 (XSS) and CWE-89 (SQL injection). Handy for clean exam definitions.

FIRST EPSS (opens in a new tab) → first.org

A daily score for how likely a CVE is to be exploited in the next 30 days. Pair it with CVSS to prioritise patching.

FIRST CVSS calculator (opens in a new tab) v3.1 (opens in a new tab) → first.org

The official CVSS calculator. Pick each metric and watch how a severity score is built (v4.0; v3.1 also available).

MITRE ATT&CK (opens in a new tab) → attack.mitre.org

A matrix of real attacker tactics and techniques. Map any incident you read about to its technique IDs.

MITRE CAPEC (opens in a new tab) → capec.mitre.org

A catalogue of attack patterns (how an attack works step by step), linked to the CWE weaknesses they abuse.

OWASP Top 10 (opens in a new tab) → owasp.org

The ten most critical web application risks. Learn each one with its example, impact, and prevention.

OWASP Cheat Sheet Series (opens in a new tab) → cheatsheetseries.owasp.org

Short, practical guides on doing things securely: passwords, sessions, input validation and more.

NIST Cybersecurity Framework (opens in a new tab) → nist.gov

A widely used structure for managing security risk: Govern, Identify, Protect, Detect, Respond, Recover.

TryHackMe (opens in a new tab) → tryhackme.com

Guided rooms in the browser, from networking basics to web attacks. The best first step for beginners.

Hack The Box Academy (opens in a new tab) → academy.hackthebox.com

Structured modules with hands-on labs. Deeper and more technical once you know the basics.

PortSwigger Web Security Academy (opens in a new tab) → portswigger.net

Free web-security lessons with a live lab for each topic: SQL injection, XSS, access control and more.

OverTheWire (opens in a new tab) → overthewire.org

Wargames played over SSH. Start with Bandit to get comfortable with the Linux command line.

picoCTF (opens in a new tab) → picoctf.org

Beginner-friendly capture-the-flag challenges from Carnegie Mellon, with a practice gym open all year.

OWASP Juice Shop (opens in a new tab) → owasp.org

A deliberately insecure web shop you run on your own machine, with challenges covering the OWASP Top 10.

DVWA (opens in a new tab) → github.com

Damn Vulnerable Web Application: a classic PHP lab with low, medium and high difficulty levels. Run it locally only.

CyberDefenders (opens in a new tab) → cyberdefenders.org

Blue-team labs: investigate packet captures, logs and disk images like a SOC analyst.

CyberChef (opens in a new tab) → gchq.github.io

The "cyber Swiss army knife": Base64, hex, hashing, XOR and hundreds more operations, all in your browser.

VirusTotal (opens in a new tab) → virustotal.com

Check a file hash, URL or domain against dozens of antivirus engines. Uploads are shared with researchers, so never upload private files.

Shodan (opens in a new tab) → shodan.io

A search engine for internet-connected devices. See which services and ports are exposed to the world, and why that matters.

crt.sh (opens in a new tab) → crt.sh

Search Certificate Transparency logs to see every TLS certificate issued for a domain.

MXToolbox (opens in a new tab) → mxtoolbox.com

DNS, MX, SPF and DMARC lookups plus blacklist checks. Useful when studying email security and phishing.

Have I Been Pwned (opens in a new tab) → haveibeenpwned.com

Check whether an email address appears in a known data breach. A real lesson in why password reuse is dangerous.

explainshell (opens in a new tab) → explainshell.com

Paste a shell command and see what every part and flag does before you run it.

GTFOBins (opens in a new tab) → gtfobins.org

How ordinary Linux binaries can be misused to escalate privileges. Read it from the defender's side: what to lock down.

LOLBAS (opens in a new tab) → lolbas-project.github.io

The Windows counterpart to GTFOBins: built-in tools attackers abuse, and what defenders should monitor.

Cisco Packet Tracer (opens in a new tab) → netacad.com

Cisco's network simulator from the Networking Academy. Build topologies, configure routers and switches, and test them. Free with a NetAcad account.

Wireshark docs (opens in a new tab) → wireshark.org

The official user guide and references. Learn capture filters, display filters, and how to follow a TCP stream.

Wireshark sample captures (opens in a new tab) → wiki.wireshark.org

Ready-made .pcap files for DHCP, DNS, HTTP, ARP and more. Open them and practise without capturing anyone's traffic.

Professor Messer Network+ (opens in a new tab) → professormesser.com

A complete free video course for CompTIA Network+ (N10-009). Short videos that line up well with CM2014 chapters.

subnetting.org (opens in a new tab) → subnetting.org

Randomly generated subnetting questions with answers. Do ten a day until it's automatic.

subnettingpractice.com (opens in a new tab) → subnettingpractice.com

Subnetting practice questions for IPv4 and IPv6, plus a cheat sheet.

IANA port registry (opens in a new tab) → iana.org

The official list of which service uses which port number. The source of truth for exam port questions.

Nmap Reference Guide (opens in a new tab) → nmap.org

The full Nmap manual: scan types, port states and options. Only scan your own lab or networks you have written permission to test.

CompTIA A+ (opens in a new tab) → comptia.org

The official A+ certification page. Use the exam objectives as a checklist of hardware topics. The exam itself is paid.

Professor Messer A+ (opens in a new tab) → professormesser.com

Free video course for A+ Core 1 (220-1201): hardware, peripherals, printers, mobile devices and troubleshooting.

iFixit: PC desktop (opens in a new tab) → ifixit.com

Step-by-step repair guides with photos: replacing RAM, PSUs, drives, fans and more.

PCPartPicker (opens in a new tab) → pcpartpicker.com

Plan a PC build and see compatibility warnings: socket, RAM type, power draw and case size.