Useful security sites
The archive is a place for notes and explanations. When you need an authoritative, current reference, these public resources are the ones most worth bookmarking. All are maintained by established organisations, and none is affiliated with this site.
Reference list
- OWASP: a nonprofit community producing free guides, cheat sheets and testing methodology for application security. Useful for secure coding advice and for the widely cited lists of common web risks.
- CVE Program: the system that assigns standard identifiers to publicly known vulnerabilities. Useful when you need an unambiguous name for a flaw and a pointer to where it is described.
- NIST National Vulnerability Database: a searchable database that enriches CVE entries with severity scores, affected product data and references. Useful for triage and for judging whether a flaw applies to your systems.
- CERT/CC Vulnerability Notes: advisories from the CERT Coordination Center, often covering flaws that span several vendors. Useful for coordinated disclosure background and mitigation guidance.
- CTFtime: a calendar and results archive for capture-the-flag competitions worldwide. Useful for finding events to enter and for locating team write-ups after they end.
Using them together
A typical workflow starts with a CVE identifier, checks the NVD entry for severity and affected versions, then reads vendor or CERT/CC advice for fixes. OWASP material helps explain the class of flaw and how to prevent it, and CTFtime is a good route to hands-on practice.
For notes in this archive that explain how particular flaws and techniques work, start with the web security and kernel and exploits sections, or return to the reading guide.