Curated · external · no affiliates

The resources we’d actually recommend.

Not a link dump. A short, opinionated shelf of 9 places to practise, reference and read real disclosures — the ones we send people to when they ask “where do I actually start?” Each entry says what it is and why it earns a spot. We take no affiliate money for any of them.

9 resources4 categoriesmostly free

Hands-on / lawful labs

Practise on real targets

PortSwigger Web Security AcademyFree

PortSwigger (makers of Burp Suite)

Hundreds of interactive labs covering every major web vulnerability, each with a guided write-up and a live target to exploit.

why it’s here

The single best free way to turn reading about XSS, SQLi and access-control bugs into muscle memory. Built by the people who make the industry-standard proxy.

TryHackMeFreemium

TryHackMe

Guided, beginner-friendly "rooms" that walk you from zero to running your first real attacks in the browser.

why it’s here

The gentlest on-ramp. If a raw terminal still feels intimidating, start here, then graduate to unguided challenges.

Hack The BoxFreemium

Hack The Box

Vulnerable machines and challenges with little hand-holding — you find the foothold and escalate yourself.

why it’s here

Where you go once guided rooms feel easy. Closest thing to the real "here is a box, break in" experience.

Reference & cheat-sheets

Know the canon

OWASP Top 10Free

OWASP Foundation

The reference list of the most critical web application security risks, refreshed from real-world data.

why it’s here

The shared vocabulary of the whole field. When a report says "A01: Broken Access Control", this is what it means.

OWASP Cheat Sheet SeriesFree

OWASP Foundation

Concise, practical defensive guidance — how to actually prevent each class of bug, per topic.

why it’s here

The other half of offense. Once you can find a bug, this tells you the correct fix to recommend in your report.

PayloadsAllTheThingsFree

swisskyrepo & contributors

A vast, community-maintained repository of payloads, bypasses and methodology notes for almost every vulnerability class.

why it’s here

The field notebook you keep open in a second tab. Stuck on a filter bypass? The technique is almost certainly in here.

MITRE ATT&CKFree

MITRE

A structured knowledge base of real adversary tactics and techniques, mapped across the whole intrusion lifecycle.

why it’s here

How defenders and threat hunters think. Learn to name what attackers do and you can reason about detecting it.

Bug bounty

Learn from real disclosures

HackerOne HacktivityFree

HackerOne

A public feed of disclosed vulnerability reports — real bugs, real programs, real payouts and the write-ups behind them.

why it’s here

Reading how a paid report is actually written and reproduced teaches more about impact and communication than any checklist.

Recon & attack surface

Map your own exposure

crt.sh — Certificate Transparency searchFree

Sectigo

Search public Certificate Transparency logs for every TLS certificate ever issued for a domain — instantly surfacing subdomains.

why it’s here

Pairs directly with our Certificate Transparency lesson. Run your own domain through it and see the forgotten hosts before an attacker does.

⚠ scope

Every practice platform here gives you lawful, intentionally-vulnerable targets. Use them. Only ever test systems you own or are explicitly authorized to assess — the techniques you learn are illegal against targets you don’t have permission for.

Ready to stop reading and start doing?

Our own paths are free, structured, and hands-on — no card, no setup.

Start a path Free tools ↗