Disassemblers & Decompilers
- Ghidra — free, open-source, scriptable
- IDA Free — industry standard (free tier)
- rizin / Cutter — radare2 successor
- Binary Ninja — commercial, great API
Debuggers
- x64dbg — free Windows debugger
- GDB — Linux standard
- Voltron — GDB UI upgrade
- ScyllaHide — anti-anti-debug
PE & Static Analysis
- pefile (Python) — PE parsing library
- Detect It Easy — packer/compiler ID
- CFF Explorer — PE editing suite
- FLOSS — obfuscated string extraction
Dynamic Analysis & Sandboxes
- REMnux — RE Linux toolkit distro
- Cuckoo Sandbox — automated analysis
- Sysinternals — ProcMon, etc.
- Wireshark — packet analysis
Learning Platforms
- TryHackMe — guided labs
- HackTheBox — CTF & challenges
- picoCTF — beginner-friendly CTF
- PortSwigger Academy — web security
Programming
- W3Schools — web fundamentals
- HackerRank — practice & challenges
- BinarySearch — algorithm problems
- HackerOne — bug bounty
Books
- Practical Malware Analysis — Sikorski & Honig
- Practical Reverse Engineering — Bruce Dang
- Black Hat Python — Justin Seitz
- Hacking: Art of Exploitation — Jon Erickson
Community & References
- CTFtime — CTF event tracker
- MalShare — malware sample repo
- VirusTotal — multi-AV scanning
- GTFOBins — Unix binary exploitation
- Exploit-DB — exploit database
Privilege Escalation
- Windows Privesc — fuzzysecurity
- Linux Privesc — g0tmi1k
- OSCP Jewels — notes & scripts
// note: Links are curated for educational use. Malware samples from repositories should only be handled in isolated lab environments.