90 curated resources · browse by category

The cybersecurity command center for builders, breakers and defenders.

Am I Admin is a curated directory of the strongest labs, learning hubs, offensive tools, cheat sheets, frameworks and AI-security resources on the open web. Use the category list on the left to jump straight to what you need.

0Resources
0Categories
0Domains
0Live feeds
Start Here6
The world’s most popular penetration-testing distribution, with pre-built VM images ready to drop into any hypervisor.
Free
linux
distro
pentest
offensive
Direct Access
The leading beginner-to-intermediate platform, blending theory with browser-based labs in guided rooms and learning paths.
Freemium
beginner
guided
rooms
Direct Access
The strongest advanced-pentest environment, with live machines, a structured academy and deep Active Directory coverage.
Freemium
advanced
active-directory
academy
Direct Access
The de facto free university of web security, built by the Burp Suite team, with rigorous labs covering every OWASP Top 10 class.
Free
web
burp
owasp
free
Direct Access
The largest encyclopedia of offensive tricks: step-by-step techniques for every port, technology, bypass and cloud target.
Free
encyclopedia
offensive
reference
Direct Access
GCHQ’s "cyber Swiss-Army knife" — a drag-and-drop browser app with hundreds of operations for encoding, decoding, crypto and parsing.
Free
encoding
crypto
gchq
Direct Access
Lab Environments

OS Distributions

05

Security-focused operating systems pre-loaded with offensive and defensive tooling.

The world’s most popular penetration-testing distribution, with pre-built VM images ready to drop into any hypervisor.
Free
linux
distro
pentest
offensive
Direct Access
Lightweight, privacy-respecting security distro favored as an alternative to Kali for daily driving and pentesting.
Free
linux
distro
privacy
pentest
Direct Access
A complete Windows-based offensive distribution by Mandiant, purpose-built for red teaming and Active Directory engagements.
Free
windows
red-team
active-directory
mandiant
Direct Access
Windows distribution by Mandiant tailored for malware analysis and reverse engineering, with every standard RE tool pre-installed.
Free
windows
malware
reverse-engineering
mandiant
Direct Access
A free Linux toolkit for reverse-engineering and analyzing malicious software, bundling hundreds of curated tools for static, dynamic and document-based malware analysis.
Free
linux
malware
reverse-engineering
dfir
Direct Access

Vulnerable VMs

02

Intentionally broken machines you can attack legally to sharpen your skills.

A massive library of intentionally vulnerable virtual machines you can download and attack locally, no internet required.
Free
lab
vm
offline
practice
Direct Access
A deliberately insecure Linux VM packed with classic vulnerabilities — the canonical training ground for the Metasploit Framework.
Free
linux
metasploit
beginner
lab
Direct Access

Hypervisors

03

Run any of the lab images above on your own hardware.

Fast, professional-grade desktop hypervisor; the free edition handles most lab workloads with ease.
Freemium
hypervisor
desktop
Direct Access
Fully free and open-source hypervisor with broad support for virtual-disk formats and guest operating systems.
Free
hypervisor
open-source
Direct Access
Bare-metal hypervisor with a web UI — ideal for building a serious self-hosted home lab of VMs and containers.
Free
hypervisor
homelab
bare-metal
Direct Access
Learning Hubs

Hands-on Labs

04

Interactive, gamified platforms with guided learning paths.

The leading beginner-to-intermediate platform, blending theory with browser-based labs in guided rooms and learning paths.
Freemium
beginner
guided
rooms
Direct Access
The strongest advanced-pentest environment, with live machines, a structured academy and deep Active Directory coverage.
Freemium
advanced
active-directory
academy
Direct Access
Pay-what-you-can training from John Strand and friends — high-quality offensive and defensive courses for any budget.
Freemium
training
pay-what-you-can
Direct Access
A large community archive of “crackmes” — small programs built to be reverse-engineered — with difficulty and quality ratings for sharpening your RE and cracking skills.
Free
reverse-engineering
crackme
practice
Direct Access

Web & App Security

02

Deep dives into OWASP Top 10, cryptography and modern web exploitation.

The de facto free university of web security, built by the Burp Suite team, with rigorous labs covering every OWASP Top 10 class.
Free
web
burp
owasp
free
Direct Access
A playful interactive platform that teaches modern cryptography by walking you through breaking real-world schemes like RSA and AES.
Free
cryptography
ctf
Direct Access

Blue Team & DFIR

02

Defensive labs covering SOC, incident response and digital forensics.

Premier blue-team platform with realistic Blue Team CTFs, DFIR investigations, memory analysis and SOC monitoring scenarios.
Free
blue-team
dfir
soc
Direct Access
Interactive labs simulating real security incidents to sharpen incident response, malware triage and forensic tooling skills.
Free
blue-team
incident-response
malware
Direct Access

Academic & Certifications

03

Structured theoretical training aligned with industry certifications.

The best free resource for CompTIA Security+, Network+ and friends — complete video courses mapped exactly to exam objectives.
Free
comptia
security+
free
Direct Access
Large training library mixing free and paid paths for major certifications such as CISSP and CISA, plus full career tracks.
Freemium
cissp
cisa
certifications
Direct Access
Free SANS initiative covering the three pillars of cybersecurity: operating systems, networking and the basics of forensics.
Free
sans
foundations
free
Direct Access
The Arsenal

Tool Directories

03

Curated catalogs of pentest and defense tools, refreshed continuously.

Daily-updated news hub cataloging fresh open-source offensive and defensive tools, with setup notes and usage scenarios.
Free
news
tools
Direct Access
Historical directory of the top 125 security tools as voted by the community — maintained by the team behind Nmap.
Free
nmap
classic
top-tools
Direct Access
Tracker of new offensive and defensive tools, famous for running the Black Hat Arsenal showcase at the Black Hat conferences.
Free
blackhat
arsenal
Direct Access

Online Interactive Tools

09

In-browser utilities for encoding, payload generation and recon.

GCHQ’s "cyber Swiss-Army knife" — a drag-and-drop browser app with hundreds of operations for encoding, decoding, crypto and parsing.
Free
encoding
crypto
gchq
Direct Access
Interactive generator that produces ready-to-paste reverse-shell payloads across PowerShell, Python, Bash, Netcat, PHP and more.
Free
reverse-shell
payload
Direct Access
DNS recon tool that maps subdomains, hosts and external infrastructure for a target domain into a clean visual graph.
Free
dns
recon
subdomains
Direct Access
Free online password-hash cracker that uses massive pre-computed lookup tables to instantly reverse unsalted MD5, SHA1, SHA256 and other common hashes.
Free
hash-cracking
passwords
rainbow-tables
Direct Access
Sandbox that loads any URL in an instrumented browser and reports every request, redirect, certificate and screenshot it observed — invaluable for phishing triage and frontend recon.
Freemium
url
sandbox
phishing
recon
Direct Access
Interactive online malware sandbox that detonates suspicious files and URLs in a live VM, letting analysts watch process trees, network traffic and behavior in real time.
Free
malware
sandbox
dfir
analysis
Direct Access
A fast, full-featured hex editor that runs entirely in the browser — open, inspect and edit the raw bytes of any binary file with no install required.
Free
hex-editor
binary
reverse-engineering
Direct Access
On-demand GPU cloud marketplace offering cheap rented GPUs — popular for accelerating hashcat password cracking and running heavy ML workloads.
Paid
gpu
cloud
hash-cracking
compute
Direct Access
GPU cloud platform for renting on-demand and spot GPUs — used to scale up password cracking and to train or serve AI/ML models.
Paid
gpu
cloud
compute
ai
Direct Access

OSINT & Global Scanners

04

Discover assets, devices and metadata across the public internet.

The original search engine for internet-connected devices: indexes service banners across IoT, ICS and servers worldwide.
Freemium
osint
iot
banner-grabbing
Direct Access
A huge tree-shaped directory of OSINT tools and sources organized by the data type you’re trying to enrich or pivot from.
Free
osint
directory
Direct Access
Google-owned platform that scans files, URLs and IPs against 70+ engines and surfaces rich threat-intel context.
Freemium
malware
threat-intel
google
Direct Access
abuse.ch’s public repository for sharing and downloading malware samples by hash, tag or family — an essential feed for malware analysts and threat hunters.
Free
malware
samples
threat-intel
abuse.ch
Direct Access

Exploit & CVE Databases

02

Search known CVEs and their public proof-of-concept exploits.

Offensive Security’s archive of public exploits and shellcodes, searchable by CVE and ready to weaponize in your lab.
Free
exploits
cve
offsec
Direct Access
Searchable analytics for the global CVE corpus, with CVSS scoring, affected products and links to patches and PoCs.
Free
cve
cvss
vulnerabilities
Direct Access

Payloads & Wordlists

02

All-in-one payload, fuzzing and password list repositories.

Daniel Miessler’s definitive collection of wordlists for fuzzing, password attacks and injection templating.
Free
wordlists
fuzzing
passwords
Direct Access
Database of attack patterns and predictable resource locations purpose-built for application fuzzing.
Free
fuzzing
patterns
Direct Access
Advanced Tactics

Cheat Sheets · Privesc

04

Binary abuse, LOLBins and reverse shell one-liners.

Curated list of Unix binaries that can be abused to bypass restrictions, escalate privileges or escape hardened shells.
Free
linux
privesc
lolbins
Direct Access
Windows counterpart to GTFOBins: Microsoft-signed binaries that attackers can leverage to execute code or bypass defenses unnoticed.
Free
windows
lolbas
evasion
Direct Access
One of GitHub’s largest cheat-sheet repos, packed with payloads and techniques for every flavor of web exploitation and bypass.
Free
payloads
web
reference
Direct Access
The classic reference for spawning reverse shells in Python, Bash, Perl, PHP, Netcat and more during exploitation.
Free
reverse-shell
classic
Direct Access

Cheat Sheets · Active Directory

02

Enumeration, Kerberos abuse and domain dominance references.

Interactive command reference for Active Directory attacks, sortable by attack type, tool used and desired outcome.
Free
active-directory
commands
Direct Access
End-to-end AD pentest methodology covering enumeration, Kerberos abuse and the road to Domain Admin.
Free
active-directory
methodology
kerberos
Direct Access

Cheat Sheets · Defense & DFIR

03

Threat hunting indicators, incident response and forensic triage.

Official SANS index of cheat sheets spanning incident response, DFIR, Wireshark analysis and secure server administration.
Free
sans
dfir
incident-response
Direct Access
Concise field guide for threat hunters, listing key indicators and commands for chasing intrusion artifacts across hosts and networks.
Free
threat-hunting
blue-team
Direct Access
Gary Kessler’s exhaustive table of file signatures (magic numbers) — the go-to reference for identifying and carving file types by their header and trailer bytes during forensics.
Free
forensics
file-signatures
magic-numbers
dfir
Direct Access

Cheat Sheets · Web Security

01

Secure coding and web defense reference series.

OWASP’s strongest reference project: practical guidance for developers and testers on building secure apps and closing common flaws.
Free
owasp
secure-coding
web
Direct Access

Methodologies & Tips

03

Encyclopedic offensive methodologies and field tricks.

The largest encyclopedia of offensive tricks: step-by-step techniques for every port, technology, bypass and cloud target.
Free
encyclopedia
offensive
reference
Direct Access
A treasure trove of advanced red-team tradecraft: Windows internals, Active Directory abuse and creative AV/EDR evasion.
Free
red-team
windows
edr-evasion
Direct Access
Practical step-by-step guides by Raj Chandel, with strong focus on privilege escalation, protocol abuse and exploitation walkthroughs.
Free
walkthroughs
privesc
Direct Access

Bug Bounty Tips

02

Distilled tactics from real bounty reports and weekly digests.

Curated bug-bounty tips and weekly digests of the best writeups from across the community.
Free
bug-bounty
digest
Direct Access
Clint Gibler’s newsletter distilling the latest tools, talks and techniques from offensive and defensive conferences.
Free
newsletter
conferences
Direct Access

Curated Checklists

01

Community-maintained GitHub checklists for every phase of an engagement.

GitHub checklist covering every phase of a pentest engagement, from recon to final report delivery.
Free
checklist
methodology
Direct Access

Injection · Web

03

Specialized payload references for SQLi, XSS and SSTI.

Interactive XSS payload reference filterable by browser and tag, ideal for crafting WAF-bypass injections.
Free
xss
web
waf-bypass
Direct Access
Detailed SQLi reference for MySQL, MSSQL, Oracle and PostgreSQL with the exact syntax each engine demands.
Free
sqli
database
web
Direct Access
Dedicated section inside PayloadsAllTheThings covering server-side template injection — one of the most dangerous modern web bugs.
Free
ssti
web
payloads
Direct Access

Injection · System

02

Edge-case strings and protocol-level injection references.

A curated list of nasty strings that frequently break input validation, perfect for fuzzing fields and APIs.
Free
fuzzing
input-validation
Direct Access
OWASP guide focused on LDAP injection — invaluable when testing directory-driven authentication and lookup services.
Free
ldap
owasp
auth
Direct Access
Frameworks

Offensive & Testing Frameworks

04

Standards that shape how engagements are planned and executed.

The global standard for cataloging adversary behavior — a tactics-and-techniques matrix that drives detection and red-team planning.
Free
mitre
ttp
detection
Direct Access
The industry-standard awareness document of the ten most critical web application security risks — the baseline reference every developer and tester is expected to know.
Free
owasp
web
top-10
risks
Direct Access
The comprehensive methodology for testing web application security, structured around every class of vulnerability.
Free
owasp
web
methodology
Direct Access
Vendor-neutral standard defining the major phases of a professional pentest from pre-engagement through reporting.
Free
standard
process
Direct Access

Governance & Risk

03

Management standards for security programs and compliance.

Flexible risk-management framework built around five functions: Identify, Protect, Detect, Respond and Recover.
Free
nist
risk
governance
Direct Access
The flagship international standard for information security management systems (ISMS), spanning governance and operational controls.
Paid
iso
isms
compliance
Direct Access
Eighteen prioritized security controls considered the most effective at blocking the majority of real-world attacks.
Free
cis
controls
Direct Access

Threat Modeling

02

Adversary kill chains and structured threat-modeling languages.

Lockheed Martin’s seven-stage model of intrusion that helps defenders break attacks at every link of the chain.
Free
kill-chain
defense
Direct Access
Microsoft’s threat-modeling taxonomy covering Spoofing, Tampering, Repudiation, Information disclosure, DoS and Elevation of privilege.
Free
stride
threat-modeling
microsoft
Direct Access
Writeups & Channels

Writeups & Reports

04

Real-world walkthroughs from HTB, bug bounty and CTF events.

Gold-standard HTB writeups that explain not just how but why each tool and step is used — ideal for building methodology.
Free
htb
writeups
methodology
Direct Access
Largest searchable archive of real bug-bounty writeups, filterable by vulnerability class and target company.
Free
bug-bounty
archive
Direct Access
Community-submitted solutions for every public CTF challenge — a goldmine for creative problem-solving patterns.
Free
ctf
writeups
Direct Access
Live feed of disclosed reports from the HackerOne platform, showing exactly what bugs are paying out today.
Free
bug-bounty
hackerone
Direct Access

YouTube Channels

06

Practitioner channels that mix theory, demos and methodology.

The professor of pentesters — deep technical HTB walkthroughs focused on methodology and overcoming obstacles.
Free
htb
walkthroughs
Direct Access
Energetic channel covering CTFs, malware analysis and security programming with a knack for making advanced topics approachable.
Free
ctf
malware
Direct Access
Deep-dive channel that explores how vulnerabilities actually work at the binary and web layers — ideal for builders of mental models.
Free
deep-dive
binary
web
Direct Access
Founder of TCM Security; publishes practical ethical-hacking courses focused on the skills hiring managers actually look for.
Free
training
careers
Direct Access
The go-to channel for bug-bounty hunters, with guest interviews from top hackers sharing tools, workflows and mindset.
Free
bug-bounty
interviews
Direct Access
High-energy channel making networking, Linux and security fundamentals accessible to absolute beginners.
Free
beginner
networking
linux
Direct Access
AI & Security

AI-Powered Offensive Tools

03

LLM-augmented assistants for recon, exploitation and shell work.

LLM-driven assistant that guides pentesters live by interpreting tool output and suggesting next steps based on engagement context.
Free
llm
assistant
pentest
Direct Access
Burp Suite extension that ships HTTP traffic to ChatGPT to surface logical bugs traditional scanners tend to miss.
Free
burp
extension
llm
Direct Access
Brings AI directly into the terminal so you can generate complex shell commands and security scripts on demand.
Free
terminal
cli
llm
Direct Access

AI Security Frameworks

02

Standards covering attacks against and abuses of AI systems.

The reference list of the ten most dangerous risks facing LLM applications — from prompt injection to model theft.
Free
owasp
llm
prompt-injection
Direct Access
ATT&CK-style matrix for attacks targeting AI/ML systems, mapping how adversaries manipulate models in the wild.
Free
mitre
ml
adversarial
Direct Access

AI for Defense & Analysis

02

AI assistants embedded in SOC and malware-analysis workflows.

VirusTotal feature powered by Google Sec-PaLM that explains the behavior of submitted scripts and binaries in plain language.
Freemium
virustotal
llm
malware-analysis
Direct Access
AI assistant for SOC teams that accelerates threat triage, attack summarization and forensic reporting.
Paid
microsoft
soc
copilot
Direct Access

AI Research & Data

02

Communities and model hubs at the intersection of AI and security.

Discover pre-trained models on Hugging Face fine-tuned for vulnerability detection, malware classification and security NLP.
Free
huggingface
models
research
Direct Access
Community at the intersection of AI and security, running research talks and CTFs focused on attacking and defending ML systems.
Free
defcon
community
research
Direct Access

Built with Next.js · Tailwind · shadcn/ui · Lucide. Resource catalog curated for educational and authorized-testing use only.