Skip to content
alien@bugs:~tty01
Abdallah Mekky

RECOVERED TRANSMISSIONS

Archive

Standards, advisories, machine references and carefully bounded places to practice. Each link leads to the people who maintain it.

An independent index; not affiliated with or endorsed by the sources listed here.

First contact

Standards and methodology from the organizations that maintain them.

OWASP Web Security Testing Guide

An open-source guide to web application security testing methodology.

OWASP Application Security Verification Standard

A community-maintained standard for verifying web application security requirements.

OWASP Top 10

An awareness document describing prominent web application security risks.

OWASP Cheat Sheet Series

Practical security guidance maintained by the OWASP community.

NIST SP 800-115

NIST’s technical guide to information security testing and assessment.

NIST Cybersecurity Framework

NIST’s framework for managing and communicating cybersecurity risk.

Threat atlas

Shared vocabularies for describing behavior, weaknesses and defensive techniques.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques, maintained by MITRE.

MITRE D3FEND

A knowledge graph of defensive cybersecurity techniques and their relationships.

Common Weakness Enumeration (CWE)

A community-developed list of software and hardware weakness types.

Common Attack Pattern Enumeration (CAPEC)

A catalog of common patterns used to describe how attacks exploit weaknesses.

Signal feed

Primary advisories, vulnerability records and scoring references; use them to understand risk, not to find targets.

CISA Known Exploited Vulnerabilities Catalog

CISA’s authoritative catalog of vulnerabilities known to be exploited in the wild.

CISA Cybersecurity Advisories

Technical alerts and advisories published by the US Cybersecurity and Infrastructure Security Agency.

CVE Program

The public dictionary of disclosed cybersecurity vulnerabilities and exposures.

NIST National Vulnerability Database

NIST’s searchable vulnerability data, including references, severity metrics and affected products.

CERT/CC Vulnerability Notes

Coordination notes and technical information from Carnegie Mellon’s CERT Coordination Center.

FIRST CVSS

The Forum of Incident Response and Security Teams’ standard for communicating vulnerability severity.

FIRST EPSS

A data-driven estimate of the probability that a published vulnerability will be exploited.

Machine language

Primary documentation for inspecting programs, protocols and the operating system beneath them.

Ghidra

The NSA’s open-source software reverse-engineering framework and official source repository.

GNU Debugger (GDB)

The official manual for inspecting and debugging programs.

The radare2 book

Project documentation for the radare2 reverse-engineering framework.

CyberChef

GCHQ’s open-source toolkit for exploring and transforming data.

HTTP Semantics · RFC 9110

The IETF specification for HTTP methods, status codes, fields and semantics.

TLS 1.3 · RFC 8446

The IETF specification for Transport Layer Security version 1.3.

Linux man-pages

Reference documentation for the Linux kernel and C library interfaces.

MDN HTTP

A maintained reference to HTTP concepts, requests, responses and headers.

Safe ground

Intentionally vulnerable or purpose-built environments for authorized, bounded practice. A public website is never a practice target.

PortSwigger Web Security Academy

Free interactive material and browser-based labs for web security.

OWASP Juice Shop

An intentionally insecure application designed for security testing practice.

OWASP WebGoat

An intentionally insecure application maintained by OWASP as a teaching environment.

OWASP Security Shepherd

A security training platform with deliberately vulnerable exercises.

Damn Vulnerable Web Application

A deliberately vulnerable PHP/MySQL application for security training in a controlled environment.

OverTheWire: Bandit

A beginner-friendly wargame for learning Linux and command-line fundamentals.

Hacker101 CTF

Free web security lessons and capture-the-flag challenges from HackerOne.

Questions

Are these sources affiliated with Abdallah Mekky?

No. They are independent sources maintained by their respective organizations.

Where is a safe place to begin?

Start with foundational guidance, then use an intentionally vulnerable training environment.