Open-source security reference
Understand cyber threats. Detect them. Stop them.
Every topic pairs a plain-language explanation with standards mappings and Python scripts you can read and run in a lab. This site is generated from the repository, so it always matches the code.
- 6
- Categories
- 26
- Topics
- 60
- Scripts
- 21,149
- Lines of code
Categories
- 01
Network Security
Network security involves protecting the usability, reliability, integrity, and safety of network infrastructure. This section covers various network-based threats, their detection methods, and prevention strategies.
4 topics, 14 scripts
- 02
Web Application Security
Web application security focuses on securing websites, web applications, and web services from various cyber threats. This section covers common web vulnerabilities, their detection methods, and prevention strategies.
6 topics, 14 scripts
- 03
Malware Analysis
Malware analysis is the study of malicious software to understand its behavior, identify its capabilities, and develop detection and prevention methods. This section covers various types of malware, analysis techniques, and defensive strategies.
4 topics, 13 scripts
- 04
Social Engineering
Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. Unlike technical hacking, social engineering targets the human element—often considered the weakest link in security.
4 topics, 7 scripts
- 05
Cryptography
Cryptography is the practice and study of techniques for secure communication in the presence of adversaries. This section covers encryption algorithms, hashing functions, digital signatures, and key management practices essential for protecting data.
5 topics, 6 scripts
- 06
Incident Response
Incident response is the systematic approach to managing and handling security breaches, attacks, or any event that compromises the confidentiality, integrity, or availability of information systems.
3 topics, 6 scripts
Recently reviewed
13 of 26 topics carry a review date
Asymmetric Encryption (RSA)
DraftAsymmetric cryptography uses a key pair: anyone can encrypt or verify with the public key, but only the private key holder can decrypt or sign. It solves the problem of sharing a secret with someone you have never met.
- CWE-327
1 scriptReviewed Oct 11, 2026Baiting
DraftBaiting leaves something tempting, usually a USB drive labelled "Payroll" or "Confidential", where a victim will find it. Plugging it in runs malware, or the device pretends to be a keyboard and types attack commands.
- T1091
- T1200
1 scriptReviewed Oct 11, 2026Cross-Site Request Forgery (CSRF)
DraftCSRF tricks a logged-in user's browser into sending a state-changing request (change email, transfer money) to a site that trusts the session cookie. The server sees a valid cookie and cannot tell the user did not intend the action.
- CWE-352
2 scriptsReviewed Oct 11, 2026Digital Signatures
DraftA digital signature proves that data came from the holder of a private key and has not been changed since. Anyone with the public key can check it. It provides integrity and authenticity, and non-repudiation when the key is controlled by one party.
- T1553.002
- CWE-347
1 scriptReviewed Oct 11, 2026DNS Spoofing and Cache Poisoning
DraftDNS spoofing makes a victim's resolver or device accept a forged DNS answer, so a real name such as your bank's domain leads to an attacker's server. The attacker can then show a look-alike site, read traffic, or block updates.
- T1557
2 scriptsReviewed Oct 11, 2026File Inclusion and Path Traversal
DraftFile inclusion bugs let a user control which file the server reads or executes. Local file inclusion (LFI) and path traversal expose files such as configuration and password files; remote file inclusion (RFI) can make the server run an attacker's code.
- T1190
- CWE-22
- CWE-98
2 scriptsReviewed Oct 11, 2026
Browse by standard
Look up a MITRE ATT&CK technique, CWE, CAPEC or OWASP category and see which topics and scripts cover it.