Skip to content

curated list of free (or free tier available) infosec sites, & example content from there

Notifications You must be signed in to change notification settings

roelds/curated-infosec

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

15 Commits
 
 

Repository files navigation

curated-infosec

curated list of free (or free tier available) infosec sites, & example content from there

gettenantpartitionweb.azurewebsites.net

Search String	cisa.gov
Tenant ID	69c613d2-b051-4234-8ed1-fd530b70d5d3
Azure AD Instance	Azure AD Global: North America
Tenant Scope	GCC

downloads.iqual.co.uk/Microsoft

[To Parent Directory]
       <dir> Dell OEM
       <dir> dotNET
   616366080 NRMLFPP_EN1.ISO
       <dir> Office
       <dir> Server
       <dir> SQL
       <dir> Teams
       <dir> Windows

files.rg-adguard.net/category

Applications
Business Solutions
Designer Tools
Developer Tools
Insider Program
Insider Program (ESD)
MSDN Library
Operating Systems
Operating Systems - (ESD)
Servers
Themes
Tools and Resources

pan.huang1111.cn/s/45xRfg (DM me on KB for pword)

Screenshot 2023-08-23 152732

infosec.exchange/home

infosec.exchange is part of the decentralized social network powered by Mastodon. A Mastodon instance for info/cyber security-minded people.

osintframework.com

OSINT framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources. Some of the sites included might require registration or offer more data for $$$, but you should be able to get at least a portion of the available information for no cost.

cia.start.me

Independent Security Researcher

defuse.ca

Welcome to Defuse Security
Please feel free to check out, download, and share some of our free software, services, and research...
Services
PIE BIN
"Pre-Internet Encryption for Text" - A pastebin with client-side (JavaScript) encryption.
CrackStation.net Hash Cracker
A HUGE database of precomputed password hashes, rainbow tables, and more.
TRENT - Trusted Random Entropy
A trusted third party for doing online drawings, contests, or anything else that needs unbiased random numbers.
Online x86 / x64 Assembler
Convert any x86 or x64 intel assembly language code into the bytes the CPU executes. Useful for shellcode development and reverse engineering.
Big Number Calculator
A calculator for obtaining the decimal representation of very large numbers.
Software
Password Generator
Ultra-random Windows, Linux, and UNIX password generator.
"HelloWorld!" Secure CMS for PHP
A very lightweight, but very secure, Content Management System for PHP.
PHP Hash Cracker
A versatile hash cracking script written in PHP.
Backup Verification Script (Ruby)
A probabilistic recursive directory comparison tool.
Sockstress
A C implementation of the sockstress attack discovered in 2008.
Security Research
How to Hash Passwords (The Right Way)
A detailed explanation of why passwords need to be hashed, and how to do it right.
Password Policy Hall of Shame
A list of websites that probably aren't hashing their users' passwords.
NTFS File System Events Filename Disclosure
It is possible to view the names of files in protected NTFS folders while they are being created or modified.
PUP Confusion
Evading antivirus detection using PUPs - Potentially Unwanted Programs.
... we hope you find our pages useful. Thanks for visiting!

opensourcesecurityindex.io

Open Source Security Index
The Most Popular & Fastest Growing Open Source Security Projects on GitHub
The Open Source Security Index is designed to make finding open source security projects easier for everyone. We use the Github API to pull projects based on popular security topics (# tags) and manually add projects without labelled topics. This is a live project evolving with the help of the open source security community, please share feedback including anything we have left out at @OSecurityIndex

mvsp.dev

Minimum Viable Secure Product
A minimum security baseline for enterprise-ready products and services
Minimal. Baseline criteria for secure products.
Practical. Specifies checks applicable even to small companies.
Modern. Updated annually.

securemessagingapps.com

Secure Messaging Apps Comparison

fullhunt.io

FullHunt is the attack surface database of the entire Internet. FullHunt enables companies to discover all of their attack surfaces, monitor them for exposure, and continuously scan them for the latest security vulnerabilities. All, in a single platform, and more.

securitytxt.org

security.txt
A proposed standard which allows websites to define security policies.

sso.tax

The SSO Wall of Shame
A list of vendors that treat single sign-on as a luxury feature, not a core security requirement.

ed448.no

This domain is protected with DNSSEC algorithm 16 (Ed448). It is hosted at domainname.shop. They sign all their zones using DNSSEC by default.
Ed448 was standardized for use with DNSSEC in February 2017 (RFC8080) and has been a RECOMMENDED algorithm since June 2019 (RFC8624). It has been supported in the .no zone since February 2020. The latest stable versions of OpenSSL (3.x / 1.1.1) fully support Ed448. All older versions (including 1.1.0, 1.0.2 and 1.0.0) are now out of support and users of these older versions are encouraged to upgrade to 3.x or 1.1.1 as soon as possible.
Ed448 is an Edwards-curve Digital Signature Algorithm (EdDSA). Like other ellipctic curve algorithms, its main advantage over RSA is that it offers the same level of security with much shorter key lengths, leading to shorter DNSKEY and RRSIG records. This in turn means that most DNS responses will fit in a single UDP packet (<512 bytes), and the potential for DNS amplification DDoS attacks is greatly reduced. EdDSA also has a number of advantages over ECDSA algorithms such as DNSSEC algorithm 13 (ECDSA P-256) and 14 (ECDSA P-384): it is faster, it is not dependent on a unique random number when generating signatures, it is more resilient to side-channel attacks, and it is easier to implement correctly.

jitsi.org

More secure, more flexible, and completely free video conferencing

pgptool.org (or must use gpg to gen 25519 SC E A with comment)

PGP Tool
A simple and secure online client-side PGP Key Generator, Encryption and Decryption tool. Generate your PGP Key pairs, encrypt or decrypt messages easily with a few clicks.

crackstation.net

Free Password Hash Cracker
Enter up to 20 non-salted hashes, one per line:
32ca9fc1a0f5b6330e3f4c8c1bbecde9bedb9573
Supports: LM, NTLM, md2, md4, md5, md5(md5_hex), md5-half, sha1, sha224, sha256, sha384, sha512, ripeMD160, whirlpool, MySQL 4.1+ (sha1(sha1_bin)), QubesV3.1BackupDefaults
Hash	Type	Result
32ca9fc1a0f5b6330e3f4c8c1bbecde9bedb9573	sha1	Password1!
Color Codes: Green: Exact match, Yellow: Partial match, Red: Not found.

slsa.dev

Safeguarding artifact integrity across any software supply chain
Supply-chain Levels for Software Artifacts, or SLSA ("salsa").
It’s a security framework, a checklist of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure. It’s how you get from "safe enough" to being as resilient as possible, at any link in the chain.

findsecuritycontacts.com

What is a security contact?
A security contact is a way for websites or services to sign post where and how security researchers can get in contact. It also typically describes whether there is any vulnerability disclosure policy or bug bounty.
There are two methods to set security contacts, with a security.txt file served on a known path and with DNS TXT records.
findsecuritycontacts.com scans the top 500 sites daily for their security.txt file or DNS records.
You can also query any website to see if there is a security.txt file (RFC 9116) or DNS records and whether they appear to be formatted correctly.
You can find more about the security.txt file at securitytxt.org or by looking up RFC 9116; and about DNS security records and the status on dnssecuritytxt.org

dnssecuritytxt.org

DNS Security TXT
A standard allowing organizations to nominate security contact points and policies via DNS TXT records.
This proposal was first made public on March 25, 2021 and is is currently a draft. We welcome comments and feedback! To make suggestions please submit a PR via Github or submit a ticket. Thanks for your interest!
Find us on Twitter: https://twitter.com/dnssecuritytxt

breachdirectory.org

Maintenance Complete - visit deletemydata for removal
BY ROHAN PATRA
CHECK IF YOUR INFORMATION WAS EXPOSED IN A DATA BREACH
ELON@TESLA.COM
Protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Show 5 entries
Search:
CENSORED PASSWORD	SHA-1 HASH
g?3@***********	e3b5b2c8ec279492f2fc347c00dec294efd91f52
/RK2***********	aab763efd11eaa9dc986c48f09a002742b6a2b00
4R6F***********	57a01a05a9724f518ac42391a4a4779aedd81cc6
7555**	a65e955177bbc882c57ad93f4f3480b5487f34f5
5UXr***********	f87302519c6a91b56054328b9cfaa9ca73cd1cc9
Showing 1 to 5 of 6 entries

dnsviz.net

DNSViz is a tool for visualizing the status of a DNS zone. It was designed as a resource for understanding and troubleshooting deployment of the DNS Security Extensions (DNSSEC). It provides a visual analysis of the DNSSEC authentication chain for a domain name and its resolution path in the DNS namespace, and it lists configuration errors detected by the tool. Your feedback is appreciated.
ed448.no
2023-07-29
Select a date 
Updated: 2023-07-29 21:51:03 UTC (26 days ago) Update now
« Previous analysis | Next analysis »
Tweet
DNSSEC Responses Servers Analyze
DNSSEC options (show)
Notices
DNSSEC Authentication Chain
RRset statusRRset status
Secure (7)
DNSKEY/DS/NSEC statusDNSKEY/DS/NSEC status
Secure (8)
Delegation statusDelegation status
Secure (2)
NoticesNotices
Errors (1)
DNSKEY legend
Full legend
SEP bit set	SEP bit set
Revoke bit set	Revoke bit set
Trust anchor	Trust anchor
See also
DNSSEC Debugger by Verisign Labs.

zerotrustroadmap.org

A Roadmap to Zero Trust Architecture
Transform your network and modernize your security
Learn which products will help you get started
Questions about Zero Trust?
Email info@zerotrustroadmap.org

qr-code-generator.com (no signup, DL as jpg)

CREATE YOUR QR CODE FOR FREE

nordpass.com/secure-password

How secure is my password?
Take a moment to check if your passwords are easy pickings for bad actors.
••••••••••
Password strength:
WEAK
Time it takes to crack your password:2 seconds
Password composition
Make sure that your password is long enough and contains various types of characters.
At least 12 characters
Lowercase
Uppercase
Symbols (?#@…)
Numbers
Has this password been previously exposed in data breaches?
This password has been exposed 8,902 times.
powered by haveibeenpwned.com

uic.edu/apps/strong-password

Password strength test
This strength tester runs on your local machine and does not send your password over the network.
Password
••••••••••
Hide password
Complexity
Strong
Score

passwordsgenerator.net/plus

Password Generator PlusBeta
Password Length:33
Include Numbers:( e.g. 123456 )Include Lowercase Characters:( e.g. abcdefgh )Include Uppercase Characters:( e.g. ABCDEFGH )Begin With A Letter:( don't begin with a number or symbol )Include Symbols: 
!";#$%&'()*+,-./:;<=>?@[]^_`{|}~
No Similar Characters:( don't use characters like i, l, 1, L, o, 0, O, etc. )No Duplicate Characters:( don't use the same character more than once )No Sequential Characters:( don't use sequential characters, e.g. abc, 789 )Auto Generate On The First Call:( generate passwords automatically when you open this page )Quantity:1
Save My Preference:( save all the settings above in cookies )

securityeducationcompanion.org

SECURITY EDUCATION COMPANION
A free resource for digital security educators
SECURITY EDUCATION 101
LESSONS
TEACHING MATERIALS
Welcome to the Security Education Companion!
SEC is a resource for people teaching digital security to their friends and neighbors. If you’d like to help your community learn about digital security but aren’t sure where to start, these articles, lesson plans, and teaching materials are for you!

coveryourtracks.eff.org

See how trackers view your browser
Learn About
Test your browser to see how well you are protected from tracking and fingerprinting:
TEST YOUR BROWSER
Test with a real tracking company ?
How does tracking technology follow your trail around the web, even if you’ve taken protective measures? Cover Your Tracks shows you how trackers see your browser. It provides you with an overview of your browser’s most unique and identifying characteristics.
Only anonymous data will be collected through this site.
Want to learn more about tracking? Read how it works with our guide:
LEARN MORE ABOUT FINGERPRINTING

security.lfx.linuxfoundation.org

Security Leaderboard
13,384
Vulnerabilities Detected
5,166
Recommended Fixes
7,800
Unique Vulnerabilities Fixed out of 93,772
2,197
Repositories Successfully Scanned out of 3,666

cryptii.com/pipes/ascii85-encoding (base85 more efficient than base64)

Ascii85 / base85: Encode, decode and translate text online
Ascii85, also called Base85, is a form of binary-to-text encoding used to communicate arbitrary binary data over channels that were designed to carry only English language human-readable text.

freetsa.org

Time Stamp Authority
freeTSA.org provides a free Time Stamp Authority. Adding a trusted timestamp to code or to an electronic signature provides a digital seal of data integrity and a trusted date and time of when the transaction took place.

Hash CheckSums

lddgo.net/en/encrypt/crc

CRC Calculation Online
TAG back-end hardware
Input Content

toolkitbay.com/tkb/tool/BLAKE3

BLAKE3 Hash
Generate BLAKE3 (successor of BLAKE2) Hash / Checksum from your text or file.
Text Input
File Input
32 Chars Key (Optional)

Temp Services

Temp Email: temp-mail.org

Your Temporary Email Address
autogen@autogen.com
Forget about spam, advertising mailings, hacking and attacking robots. Keep your real mailbox clean and secure. Temp Mail provides temporary, secure, anonymous, free, disposable email address.

Temp Virtual Shared SMS Number: (most apps deny) smstome.com/country/usa

Receive SMS Online In USA
The phone numbers below are free for personal use and are sorted by date of when they were acquired. The value in parentheses indicates how many messages have been received since the number was posted on our website. Please choose an area code or region that best fits your use case to hand over to the service provider asking for phone verification. Keep in mind these numbers are temporary and will be removed after about a month of time.

GPG KeyServers

keys.openpgp.org

We found an entry for support@keys.openpgp.org
https://keys.openpgp.org/vks/v1/by-fingerprint/864C145731DD963466CC7571A2604867523C7ED8
Hint: It's more convenient to use keys.openpgp.org from your OpenPGP software.
The keys.openpgp.org server is a public service for the distribution and discovery of OpenPGP-compatible keys, commonly referred to as a "keyserver".
For instructions, see our usage guide.

pgp.surf.nl

Search results for '0x1A5D6C4C7DB87C81'
Type bits/keyID            cr. time   exp time   key expir
pub rsa4096/d2eb44626fddc30b513d5bb71a5d6c4c7db87c81 2009-09-15T23:54:29Z
uid UEC Image Automatic Signing Key <cdimage@ubuntu.com>
sig  sig  1a5d6c4c7db87c81 2009-09-15T23:58:29Z ____________________ ____________________ [selfsig]
sig  sig  5759f35001aa4a64 2009-09-16T00:11:19Z ____________________ ____________________ 5759f35001aa4a64
sig  sig  28deae7f29982e5a 2009-09-16T00:11:31Z ____________________ ____________________ 28deae7f29982e5a

About

curated list of free (or free tier available) infosec sites, & example content from there

Topics

Resources

Stars

Watchers

Forks