Curated, not random links
Academy library
PortSwigger Web Security Academy, TryHackMe paths, OWASP / MITRE / NIST, and CTF platforms — organised after you finish CYNARKS in-browser Labs. External sites are optional deep practice, not required to complete Labs. For in-app OSINT lanes and ethics, see OSINT command center.
Web Application Security
PortSwigger Web Security Academy
FreeCross-site scripting (XSS)
Gold-standard free labs for reflected/stored/DOM XSS.
Beginner → Advanced
PortSwigger Web Security Academy
FreeSQL injection
Hands-on SQLi with increasing difficulty — pairs with our in-browser SQLi sim.
Beginner → Advanced
PortSwigger Web Security Academy
FreeAccess control vulnerabilities
IDOR and broken access control practice.
Intermediate
PortSwigger Web Security Academy
FreeServer-side request forgery (SSRF)
Cloud metadata and internal SSRF patterns.
Intermediate
PortSwigger Web Security Academy
FreeAuthentication vulnerabilities
Password reset, 2FA bypass, and session flaws.
Intermediate
PortSwigger Web Security Academy
FreeFull Web Security Academy catalog
Complete free topic index — use after CYNARKS web path.
All
PortSwigger Web Security Academy
FreeCross-site request forgery (CSRF)
Pairs with our in-browser CSRF defense lab.
Intermediate
PortSwigger Web Security Academy
FreeXML external entity (XXE) injection
XML parser abuse — after CYNARKS injection topics.
Intermediate
PortSwigger Web Security Academy
FreeJWT attacks
Deepen after our JWT segment lab.
Intermediate → Advanced
PortSwigger Web Security Academy
FreeFile upload vulnerabilities
Matches our vulns knowledge base entry.
Intermediate
PortSwigger Web Security Academy
FreeDirectory traversal
After the in-browser traversal pattern lab.
Beginner → Intermediate
TryHackMe
FreeWeb Fundamentals
HTTP/cookies/JS baseline before PortSwigger deep dives.
Beginner
TryHackMe
FreeOWASP Top 10
Room-style walkthrough of Top 10 categories.
Beginner
PortSwigger Web Security Academy
FreeCORS
After our CORS misconfiguration vuln entry.
Intermediate
PortSwigger Web Security Academy
FreeServer-side template injection
Pairs with SSTI in vulns knowledge base.
Advanced
PortSwigger Web Security Academy
FreeRace conditions
Logic flaw depth after access-control labs.
Advanced
PortSwigger Web Security Academy
FreeJWT attacks
Pairs with JWT misuse in our vulns catalog.
Advanced
Fundamentals
TryHackMe
FreemiumPre Security path
Networking + Linux foundations before offensive rooms.
Beginner
TryHackMe
FreemiumCyber Security 101
Broad intro path alongside our roadmap levels.
Beginner
TryHackMe
FreeLinux Fundamentals
After our commands + OS fundamentals roadmap.
Beginner
TryHackMe
FreeNetwork Fundamentals / Security
Pairs with networking roadmap + packet labs.
Beginner
Offensive
Blue Team
Standards
OWASP
FreeOWASP Top 10
Canonical web risk categories for reporting language.
All
OWASP
FreeOWASP Cheat Sheet Series
Remediation-ready guidance for developers.
All
MITRE
FreeMITRE ATT&CK
Map detections and adversary behaviours.
Intermediate
NIST
FreeNIST Cybersecurity Framework
Governance language for risk conversations.
All
MITRE
FreeATT&CK Navigator
Visual coverage mapping for blue-team study.
Intermediate
NIST
FreeNIST SP 800-61 Incident Handling
IR lifecycle depth after our SOC/IR labs.
Intermediate
CTF Platforms
Tool Documentation
Identity
OSINT & Recon
OSINT Framework
FreeOSINT Framework
Category tree of OSINT resources — pair with Learn /osint lanes.
All
Bellingcat
FreeBellingcat investigation resources
Image/geo verification and responsible publishing.
Intermediate
OSINT Dojo
FreeOSINT Dojo
Structured exercises for passive recon skills.
Beginner → Intermediate
Community
FreeAwesome OSINT (GitHub)
Curated mega-list — use with ethics section on /osint.
All