Blogs There are a LOT of pentesting blogs, these are the ones I monitor constantly and value in the actual day to day testing work

.Blogs
There are a LOT of pentesting blogs, these are the ones I monitor constantly and value in the actual day to day testing work
* [Carnal 0wnage](http://carnal0wnage.attackresearch.com/) - [atom](http://carnal0wnage.attackresearch.com/feeds/posts/default)
* [McGrew Security](http://www.mcgrewsecurity.com/)
* [GNUCITIZEN](http://www.gnucitizen.org)
* [Darknet - The Darkside](http://www.darknet.org.uk/) - [rss](http://feeds.feedburner.com/darknethackers)
* [spylogic](http://spylogic.net/) - [rss](http://feeds2.feedburner.com/spylogic)
* [TaoSecurity](http://taosecurity.blogspot.com/) - [atom](http://taosecurity.blogspot.com/feeds/posts/default)
* [Room362](http://www.room362.com/)
* [SIPVicious](http://blog.sipvicious.org/) - [rss](http://feeds.feedburner.com/Sipvicious)
* [portswigger](http://blog.portswigger.net/)
* [pentestmonkeyblog](http://pentestmonkey.net/blog/)
* [jeremiahgrossman](http://jeremiahgrossman.blogspot.com/)
* [i8jesus](http://i8jesus.com/)
* [c22](http://blog.c22.cc/)
* [Skull Security](https://blog.skullsecurity.org/) - [rss](https://blog.skullsecurity.org/feed)
* [metasploit](http://blog.metasploit.com/)
* [darkoperator](http://www.darkoperator.com/)
* [skeptikal](http://blog.skeptikal.org/)
* [preachsecurity](http://preachsecurity.blogspot.com/)
* [tssci-security](http://www.tssci-security.com/)
* [gdssecurityl](http://www.gdssecurity.com/l/b/)
* [websec](http://websec.wordpress.com/)
* [bernardodamele](http://bernardodamele.blogspot.com/)
* [laramies](http://laramies.blogspot.com/)
* [andlabs](http://blog.andlabs.org/)
* [xs-sniperblog](http://xs-sniper.com/blog/)
* [commonexploits](http://www.commonexploits.com/)
* [sensepostblog](http://www.sensepost.com/blog/)
* [wepma](http://wepma.blogspot.com/)
* [Exploit KB](http://exploit.co.il/) - [rss](http://exploit.co.il/feed/)
* [securityreliks](http://securityreliks.wordpress.com/)
* [Mad Irish](http://www.madirish.net/) - [rss](http://www.madirish.net/rss.php)
* [sirdarckcat](http://sirdarckcat.blogspot.com/)
* [reusablesec](http://reusablesec.blogspot.com/)
* [myne-us](http://myne-us.blogspot.com/)
* [notsosecure](http://www.notsosecure.com/)
* [spiderlabs](http://blog.spiderlabs.com/)
* [corelan](http://www.corelan.be/)
* [DigiNinja](https://digi.ninja/) - [rss](https://digi.ninja/rss.xml)
* [pauldotcom](http://www.pauldotcom.com/)
* [attackvector](http://www.attackvector.org/)
* [deviating](http://deviating.net/)
* [alphaonelabs](http://www.alphaonelabs.com/)
* [smashingpasswords](http://www.smashingpasswords.com/)
* [wirewatcher](http://wirewatcher.wordpress.com/)
* [gynvael](http://gynvael.coldwind.pl/)
* [nullthreat](http://www.nullthreat.net/)
* [question-defense](http://www.question-defense.com/)
* [archangelamael](http://archangelamael.blogspot.com/)
* [memset](http://memset.wordpress.com/)
* [sickness](http://sickness.tor.hu/)
* [punter-infosec](http://punter-infosec.com/)
* [securityninja](http://www.securityninja.co.uk/)
* [securityandrisk](http://securityandrisk.blogspot.com/)
* [pentestit](http://www.pentestit.com/)

### Forums:

Created for forums that will help in both tool usage, syntax, attack techniques, and collection of scripts and tools.

* [EH-Net Forums](https://www.ethicalhacker.net/forums/index.php)
* [Hak5 Forums](https://forums.hak5.org/)
* [Kali Linux Forums](https://forums.kali.org/)
* [Hack Forums](http://www.hackforums.net/)
* [Hackthissite Forums](http://www.hackthissite.org/forums/index.php)
* [Security Override Forums](http://securityoverride.com/forum/index.php)
* [Government Security](http://www.governmentsecurity.org/forum/)

## Wikis
* [Pwn Wiki](http://pwnwiki.io/)
* [Skull Security](https://wiki.skullsecurity.org/)
* [BlindSeeker Wiki](https://www.blindseeker.com)
* [SQL Injection Wiki](http://www.sqlinjectionwiki.com/)
* [Forgotten Security's CTF Wiki](http://ctf.forgottensec.com/wiki/index.php)

### Magazines:

* [(In)Secure Magazine](http://www.net-security.org/insecuremag.php)
* [Hackin9](http://hakin9.org/)

### Video:

* [SecurityTube](http://www.securitytube.net/)

----
## Methodologies:

* [Penetration Testing Framework](http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html)
* [The Penetration Testing Execution Standard](http://www.pentest-standard.org/index.php/Main_Page)
* [The WASC Threat Classification](http://projects.webappsec.org/w/page/13246978/Threat-Classification)
* [OWASP Top Ten Project](http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project)
* [The Social Engineering Framework](http://www.social-engineer.org/framework/general-discussion/)

----
## OSINT

### People and Organizational:

* http://www.spokeo.com/
* http://www.123people.com/
* http://www.xing.com/
* http://www.zoominfo.com/search
* http://pipl.com/
* http://www.zabasearch.com/
* http://www.searchbug.com/default.aspx
* http://theultimates.com/
* http://skipease.com/
* http://addictomatic.com/
* http://socialmention.com/
* http://entitycube.research.microsoft.com/
* http://www.yasni.com/
* http://tweepz.com/
* http://tweepsearch.com/
* http://www.glassdoor.com/index.htm
* http://www.jigsaw.com/
* http://searchwww.sec.gov/EDGARFSClient/jsp/EDGAR_MainAccess.jsp
* http://www.tineye.com/
* http://www.peekyou.com/
* http://picfog.com/
* http://twapperkeeper.com/index.php

### Infrastructure:

* http://uptime.netcraft.com/
* http://www.serversniff.net/
* http://www.domaintools.com/
* http://centralops.net/co/
* http://hackerfantastic.com/
* http://whois.webhosting.info/
* https://www.ssllabs.com/ssldb/analyze.html
* http://www.clez.net/
* http://www.my-ip-neighbors.com/
* https://www.shodan.io/
* http://www.exploit-db.com/google-dorks/
* http://www.hackersforcharity.org/ghdb/

----
## Exploits and Advisories:

* http://www.exploit-db.com/
* http://www.cvedetails.com/
* https://cxsecurity.com/
* http://www.packetstormsecurity.org/
* http://www.securityforest.com/wiki/index.php/Main_Page
* http://www.securityfocus.com/bid
* http://nvd.nist.gov/
* http://osvdb.org/
* http://www.nullbyte.org.il/Index.html
* http://secdocs.lonerunners.net/
* http://www.phenoelit-us.org/whatSAP/index.html
* http://secunia.com/
* http://cve.mitre.org/

----
## Cheatsheets and Syntax:

* http://cirt.net/ports_dl.php?export=services
* http://www.cheat-sheets.org/
* http://blog.securitymonks.com/2009/08/15/whats-in-your-folder-security-cheat-sheets/

### Agile Hacking:

* http://www.gnucitizen.org/blog/agile-hacking-a-homegrown-telnet-based-portscanner/
* http://blog.commandlinekungfu.com/
* http://www.securityaegis.com/simple-yet-effective-directory-bruteforcing/
* http://isc.sans.edu/diary.html?storyid=2376
* http://isc.sans.edu/diary.html?storyid=1229
* http://ss64.com/nt/
* http://pauldotcom.com/2010/02/running-a-command-on-every-mac.html
* http://synjunkie.blogspot.com/2008/03/command-line-ninjitsu.html
* http://www.zonbi.org/2010/06/09/wmic-the-other-other-white-meat/
* http://rstcenter.com/forum/22324-hacking-without-tools-windows.rst
* http://www.coresecurity.com/files/attachments/Core_Define_and_Win_Cmd_Line.pdf
* http://www.scribd.com/Penetration-Testing-Ninjitsu2-Infrastructure-and-Netcat-without-Netcat/d/3064507
* http://www.pentesterscripting.com/
* http://www.sans.org/reading_room/whitepapers/hackers/windows-script-host-hack-windows_33583
* http://www.blackhat.com/presentations/bh-dc-10/Bannedit/BlackHat-DC-2010-Bannedit-Advanced-Command-Injection-Exploitation-1-wp.pdf

### OS and Scripts:

* http://en.wikipedia.org/wiki/IPv4_subnetting_reference
* http://www.nixtutor.com/linux/all-the-best-linux-cheat-sheets/
* http://shelldorado.com/shelltips/beginner.html
* http://www.linuxsurvival.com/
* http://mywiki.wooledge.org/BashPitfalls
* http://rubular.com/
* http://www.iana.org/assignments/port-numbers
* http://www.robvanderwoude.com/ntadmincommands.php
* http://www.nixtutor.com/linux/all-the-best-linux-cheat-sheets/

### Tools:

* http://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf
* http://www.secguru.com/files/cheatsheet/nessusNMAPcheatSheet.pdf
* http://sbdtools.googlecode.com/files/hping3_cheatsheet_v1.0-ENG.pdf
* http://sbdtools.googlecode.com/files/Nmap5%20cheatsheet%20eng%20v1.pdf
* http://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf
* http://rmccurdy.com/scripts/Metasploit%20meterpreter%20cheat%20sheet%20reference.html
* http://h.ackack.net/cheat-sheets/netcat

----
## Distributions:

* [Kali Linux](http://www.kali.org/)
* [NodeZero Linux](http://www.nodezero-linux.org/)
* [BackBox Linux](http://www.backbox.org/)
* [Samurai Web Testing Framework](http://samurai.inguardians.com/)
* [Knoppix STD](http://s-t-d.org/)
* [Pentoo](http://www.pentoo.ch/)
* [WEAKERTH4N](http://www.weaknetlabs.com/)
* [Matriux](http://www.matriux.com/index.php?language=en)
* [DEFT](http://www.deftlinux.net/)
* [CAINE](http://www.caine-live.net/)
* [Parrot Security OS](http://www.parrotsec.org/)
* [BlackArch Linux](http://www.blackarch.org/)
* [ArchAssualt](https://archassault.org/)

----
## Labs:
### ISOs and VMs:

* http://sourceforge.net/projects/websecuritydojo/
* http://code.google.com/p/owaspbwa/wiki/ProjectSummary
* http://heorot.net/livecds/
* http://informatica.uv.es/~carlos/docencia/netinvm/
* http://www.bonsai-sec.com/en/research/moth.php
* http://blog.metasploit.com/2010/05/introducing-metasploitable.html
* http://pynstrom.net/holynix.php
* http://gnacktrack.co.uk/download.php
* http://sourceforge.net/projects/lampsecurity/files/
* https://www.hacking-lab.com/news/newspage/livecd-v4.3-available.html
* http://sourceforge.net/projects/virtualhacking/files/
* http://www.badstore.net/
* http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
* http://www.dvwa.co.uk/
* http://sourceforge.net/projects/thebutterflytmp/

### Vulnerable Software:

* http://www.oldapps.com/
* http://www.oldversion.com/
* http://www.exploit-db.com/webapps/
* http://code.google.com/p/wavsep/downloads/list
* http://www.owasp.org/index.php/Owasp_SiteGenerator
* http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx
* http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx
* http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx
* http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx

### Test Sites:

* http://www.webscantest.com/
* http://crackme.cenzic.com/Kelev/view/home.php
* http://zero.webappsecurity.com/banklogin.asp?serviceName=FreebankCaastAccess&templateName=prod_sel.forte&source=Freebank&AD_REFERRING_URL=http://www.Freebank.com
* http://testaspnet.vulnweb.com/
* http://testasp.vulnweb.com/
* http://testphp.vulnweb.com/
* http://demo.testfire.net/
* http://hackme.ntobjectives.com/

----
## Exploitation:

* http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html
* http://www.mgraziano.info/docs/stsi2010.pdf
* http://www.abysssec.com/blog/2010/05/past-present-future-of-windows-exploitation/
* http://www.ethicalhacker.net/content/view/122/2/
* http://code.google.com/p/it-sec-catalog/wiki/Exploitation
* http://x9090.blogspot.com/2010/03/tutorial-exploit-writting-tutorial-from.html
* http://ref.x86asm.net/index.html

----
## Reverse Engineering & Malware:

* http://www.woodmann.com/TiGa/idaseries.html
* http://www.binary-auditing.com/
* http://visi.kenshoto.com/
* http://www.radare.org/y/
* http://www.offensivecomputing.net/

----
## Passwords and Hashes:

* http://www.irongeek.com/i.php?page=videos/password-exploitation-class
* http://cirt.net/passwords
* http://sinbadsecurity.blogspot.com/2008/10/ms-sql-server-password-recovery.html
* http://www.foofus.net/~jmk/medusa/medusa-smbnt.html
* http://www.foofus.net/?page_id=63
* http://hashcrack.blogspot.com/
* http://www.nirsoft.net/articles/saved_password_location.html
* http://www.onlinehashcrack.com/
* http://www.md5this.com/list.php?
* http://www.virus.org/default-password
* http://www.phenoelit-us.org/dpl/dpl.html
* http://news.electricalchemy.net/2009/10/cracking-passwords-in-cloud.html

### Wordlists:
* [Korelogic](http://contest.korelogic.com/wordlists.html)
* [PacketStorm](http://packetstormsecurity.org/Crackers/wordlists/)
* [Skullsecurity](http://www.skullsecurity.org/wiki/index.php/Passwords)
* [Wordbook](http://wordbook.xyz/download/)

### Pass the Hash:
* http://www.sans.org/reading_room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation_33283
* http://www.sans.org/reading_room/whitepapers/testing/crack-pass-hash_33219
* http://carnal0wnage.blogspot.com/2008/03/using-pash-hash-toolkit.html

----
## MiTM:

* http://www.giac.org/certified_professionals/practicals/gsec/0810.php
* http://www.linuxsecurity.com/docs/PDF/dsniff-n-mirror.pdf
* http://www.cs.uiuc.edu/class/sp08/cs498sh/slides/dsniff.pdf
* http://www.techvibes.com/blog/a-hackers-story-let-me-tell-you-just-how-easily-i-can-steal-your-personal-data
* http://www.mindcenter.net/uploads/ECCE101.pdf
* http://toorcon.org/pres12/3.pdf
* http://media.techtarget.com/searchUnifiedCommunications/downloads/Seven_Deadliest_UC_Attacks_Ch3.pdf
* http://packetstormsecurity.org/papers/wireless/cracking-air.pdf
* http://www.blackhat.com/presentations/bh-europe-03/bh-europe-03-valleri.pdf
* http://www.oact.inaf.it/ws-ssri/Costa.pdf
* http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-sam_bowne-hijacking_web_2.0.pdf
* http://mcafeeseminar.com/focus/downloads/Live_Hacking.pdf
* http://www.seanobriain.com/docs/PasstheParcel-MITMGuide.pdf
* http://www.more.net/sites/default/files/2010JohnStrandKeynote.pdf
* http://www.leetupload.com/database/Misc/Papers/Asta%20la%20Vista/18.Ettercap_Spoof.pdf
* http://bandwidthco.com/whitepapers/netforensics/arp/EtterCap%20ARP%20Spoofing%20&%20Beyond.pdf
* http://bandwidthco.com/whitepapers/netforensics/arp/Fun%20With%20EtterCap%20Filters.pdf
* http://www.iac.iastate.edu/iasg/libarchive/0910/The_Magic_of_Ettercap/The_Magic_of_Ettercap.pdf
* http://articles.manugarg.com/arp_spoofing.pdf
* http://academy.delmar.edu/Courses/ITSY2430/eBooks/Ettercap(ManInTheMiddleAttack-tool).pdf
* http://www.ucci.it/docs/ICTSecurity-2004-26.pdf
* http://web.mac.com/opticrealm/iWeb/asurobot/My%20Cyber%20Attack%20Papers/My%20Cyber%20Attack%20Papers_files/ettercap_Nov_6_2005-1.pdf
* http://blog.spiderlabs.com/2010/12/thicknet.html
* http://www.hackyeah.com/2010/10/ettercap-filters-with-metasploit-browser_autopwn/
* http://www.go4expert.com/forums/showthread.php?t=11842
* http://www.irongeek.com/i.php?page=security/ettercapfilter
* http://openmaniak.com/ettercap_filter.php
* http://www.irongeek.com/i.php?page=videos/dns-spoofing-with-ettercap-pharming
* http://www.irongeek.com/i.php?page=videos/ettercap-plugins-find-ip-gw-discover-isolate
* http://www.irongeek.com/i.php?page=videos/ettercapfiltervid1
* http://spareclockcycles.org/2010/06/10/sergio-proxy-released/

----
## Tools:
### OSINT:
* http://www.edge-security.com/theHarvester.php
* http://www.mavetju.org/unix/dnstracer-man.php
* http://www.paterva.com/web5/

## Metadata:
* http://www.sans.org/reading_room/whitepapers/privacy/document-metadata-silent-killer_32974
* http://lcamtuf.coredump.cx/strikeout/
* http://www.sno.phy.queensu.ca/~phil/exiftool/
* http://www.edge-security.com/metagoofil.php
* http://www.darkoperator.com/blog/2009/4/24/metadata-enumeration-with-foca.html

### Google Hacking:
* http://www.stachliu.com/index.php/resources/tools/google-hacking-diggity-project/
* http://midnightresearch.com/projects/search-engine-assessment-tool/#downloads
* http://sqid.rubyforge.org/#next
* http://voidnetwork.org/5ynL0rd/darkc0de/python_script/dorkScan.html

### Web:
* http://www.bindshell.net/tools/beef
* http://blindelephant.sourceforge.net/
* http://xsser.sourceforge.net/
* http://sourceforge.net/projects/rips-scanner/
* http://www.divineinvasion.net/authforce/
* http://andlabs.org/tools.html#sotf
* http://www.taddong.com/docs/Browser_Exploitation_for_Fun&Profit_Taddong-RaulSiles_Nov2010_v1.1.pdf
* http://carnal0wnage.blogspot.com/2007/07/using-sqid-sql-injection-digger-to-look.html
* http://code.google.com/p/pinata-csrf-tool/
* http://xsser.sourceforge.net/#intro
* http://www.contextis.co.uk/resources/tools/clickjacking-tool/
* http://packetstormsecurity.org/files/view/69896/unicode-fun.txt
* http://sourceforge.net/projects/ws-attacker/files/
* https://github.com/koto/squid-imposter

### Attack Strings:
* http://code.google.com/p/fuzzdb/
* http://www.owasp.org/index.php/Category:OWASP_Fuzzing_Code_Database#tab=Statements

### Shells:
* http://sourceforge.net/projects/yokoso/
* http://sourceforge.net/projects/ajaxshell/

### Scanners:
* http://w3af.sourceforge.net/
* http://code.google.com/p/skipfish/
* http://sqlmap.sourceforge.net/
* http://sqid.rubyforge.org/#next
* http://packetstormsecurity.org/UNIX/scanners/XSSscan.py.txt
* http://code.google.com/p/fimap/wiki/WindowsAttack
* http://code.google.com/p/fm-fsf/

### Proxies:
## Burp:
* http://www.sans.org/reading_room/whitepapers/testing/fuzzing-approach-credentials-discovery-burp-intruder_33214
* http://www.gdssecurity.com/l/b/2010/08/10/constricting-the-web-the-gds-burp-api/
* http://sourceforge.net/projects/belch/files/
* http://www.securityninja.co.uk/application-security/burp-suite-tutorial-repeater-and-comparer-tools
* http://blog.ombrepixel.com/
* http://andlabs.org/tools.html#dser
* http://feoh.tistory.com/22
* http://www.sensepost.com/labs/tools/pentest/reduh
* http://www.owasp.org/index.php/OWASP_WebScarab_NG_Project
* http://intrepidusgroup.com/insight/mallory/
* http://www.fiddler2.com/fiddler2/
* http://websecuritytool.codeplex.com/documentation?referringTitle=Home
* http://translate.google.com/translate?hl=en&sl=es&u=http://xss.codeplex.com/releases/view/43170&prev=/search%3Fq%3Dhttp://www.hackingeek.com/2010/08/x5s-encuentra-fallos-xss-lfi-rfi-en-tus.html%26hl%3Den&rurl=translate.google.com&twu=1

### Social Engineering:
* http://www.secmaniac.com/

### Password:
* http://nmap.org/ncrack/
* http://www.foofus.net/~jmk/medusa/medusa.html
* http://www.openwall.com/john/
* http://ophcrack.sourceforge.net/
* http://blog.0x3f.net/tool/keimpx-in-action/
* http://code.google.com/p/keimpx/
* http://sourceforge.net/projects/hashkill/

### Metasploit:

* http://www.indepthdefense.com/2009/02/reverse-pivots-with-metasploit-how-not.html
* http://code.google.com/p/msf-hack/wiki/WmapNikto
* http://www.indepthdefense.com/2009/01/metasploit-visual-basic-payloads-in.html
* http://seclists.org/metasploit/
* http://pauldotcom.com/2010/03/nessus-scanning-through-a-meta.html
* http://meterpreter.illegalguy.hostzi.com/
* http://blog.metasploit.com/2010/03/automating-metasploit-console.html
* http://www.workrobot.com/sansfire2009/561.html
* http://www.securitytube.net/video/711
* http://en.wikibooks.org/wiki/Metasploit/MeterpreterClient#download
* http://vimeo.com/16852783
* http://milo2012.wordpress.com/2009/09/27/xlsinjector/
* http://www.fastandeasyhacking.com/
* http://trac.happypacket.net/
* http://www.blackhat.com/presentations/bh-dc-10/Ames_Colin/BlackHat-DC-2010-colin-david-neurosurgery-with-meterpreter-wp.pdf
* http://www.blackhat.com/presentations/bh-dc-10/Egypt/BlackHat-DC-2010-Egypt-UAV-slides.pdf

### Net Scanners and Scripts:

* http://nmap.org/
* http://asturio.gmxhome.de/software/sambascan2/i.html
* http://www.softperfect.com/products/networkscanner/
* http://www.openvas.org/
* http://tenable.com/products/nessus
* http://www.rapid7.com/vulnerability-scanner.jsp
* http://www.eeye.com/products/retina/community

### Post Exploitation:

* http://www.awarenetwork.org/home/rattle/source/python/exe2bat.py
* http://www.phx2600.org/archive/2008/08/29/metacab/
* http://www.room362.com/blog/2011/9/6/post-exploitation-command-lists.html

### Source Inspection:

* http://www.justanotherhacker.com/projects/graudit.html
* http://code.google.com/p/javasnoop/

### Firefox Addons:

* https://addons.mozilla.org/id/firefox/collections/byrned/pentesting/?page=8
* https://addons.mozilla.org/en-US/firefox/addon/osvdb/
* https://addons.mozilla.org/en-US/firefox/addon/packet-storm-search-plugin/
*