Skip to content
Get packs

Guide · Open source

How to use awesome-hacking: a guide to its resource list

Updated · written with AI from the project's own documentation and checked against our catalogue data

awesome-hacking is a curated GitHub list of links to hacking tutorials, tools, practice environments and reference sites, grouped by topic such as system exploitation, reverse engineering, web security, networking, forensics, cryptography and CTF competitions. This guide shows you how to navigate the list, choose resources that fit your level, and move from a link to a working setup. The list does not install or run software itself, so the steps below focus on finding and evaluating what it points to.

awesome-hackingcarpedm20/awesome-hacking · ★ 17.4k · MIT

Quick start

  1. 1Open the README. Go to the awesome-hacking repository on GitHub and read the table of contents.
  2. 2Pick a topic. Choose the section that matches your goal, such as Reverse Engineering or Wargame.
  3. 3Start with tutorials. Open the Tutorials subsection to build background before using tools.
  4. 4Open a linked project. Click through to the tool or environment and read its own documentation.
  5. 5Set up a practice environment. If you want a practice target, use a docker pull command from the Docker section and check the image page first.
  6. 6Verify before relying on it. Check the licence, maintenance status and install instructions on the project's page.

What awesome-hacking is and what it is not

awesome-hacking is an index. Each entry is a link, usually with a short description, and the README is organised by topic. It was inspired by awesome-machine-learning and is released under the MIT licence.

It does not install anything, and it does not provide a single tool with setup instructions. When you pick a tool or environment from the list, you follow that project's own documentation.

  • Good for: a map of security topics and a shortlist of tools and tutorials.
  • Not good for: a single tool with step-by-step setup, or a current recommendation list. The README shows no recent update history beyond its last push date.

Get a local copy of the list (optional)

You can read the list on GitHub without downloading anything. If you prefer to keep a local copy for offline browsing, clone the repository with the command from the README.

git clone https://github.com/carpedm20/awesome-hacking

Choose a topic that matches your goal

The table of contents lists the main sections: System, Reverse Engineering, Web, Network, Forensic, Cryptography, Wargame, CTF, OS, Post exploitation and ETC. Many sections are split into Tutorials, Tools and General.

If you are new, start with Tutorials. The System section opens with Roppers Computing Fundamentals, which is described as a free, self-paced curriculum for someone with no prior technical knowledge. Wargame and CTF sections suit learners who want practice targets and competitions.

  • Students wanting a starting map: read the Tutorials subsections first.
  • Developers evaluating tools: go to Reverse Engineering or Web and compare the Tools entries.
  • CTF preparation: use the Wargame and CTF sections.

Use the Docker entries for practice environments

The System section includes a Docker Images for Penetration Testing & Security subsection. Each entry gives a docker pull command followed by a link to the project. Examples include OWASP Juice Shop, OWASP WebGoat, Damn Vulnerable Web Application (DVWA) and OWASP Mutillidae II, which are intentionally vulnerable applications for practice.

Run only the commands shown in the list, and read each image page on Docker Hub or the project's GitHub page first to confirm what it is and how to start it.

docker pull bkimminich/juice-shop

Evaluate a tool before you commit to it

Entries often include a one-line description, such as Metasploit providing information about security vulnerabilities and aiding penetration testing, or radare2 being a portable reversing framework. Use these as a first filter, then open the project page.

Some entries carry notes from the author. For example, Luyten is described as one of the best Java decompilers but a bit slow and not very well maintained, and JAD is marked closed-source and unmaintained. Check the project's own activity before relying on it.

  • Confirm the licence on the project page.
  • Check whether the project is still maintained.
  • Read the official install instructions, not guesses from the list.

Contribute or find more resources

The README invites pull requests to add resources. For a list of free hacking books, the README links to a separate repository, Hack-with-Github/Free-Security-eBooks.

What people use it for

  • Building a reading list for a security course by working through the listed tutorials.
  • Shortlisting reverse engineering tools such as Ghidra, radare2 or x64dbg to test on your own machine.
  • Finding intentionally vulnerable web apps like DVWA or Juice Shop to practise on.
  • Looking up CTF and wargame resources before a competition.

Frequently asked questions

Is awesome-hacking free?

The repository is released under the MIT licence, as stated on its page. The list itself is free to read, but the tools and resources it links to each have their own licences and terms, which you should check on their pages.

Do I need to install awesome-hacking?

No. It is a list of links, not software. The only command in the README is an optional git clone to keep a local copy of the list.

What are the prerequisites for using awesome-hacking?

The README does not list prerequisites. The list is written for readers with some technical knowledge, so beginners with no computing background may want to start with the Roppers Computing Fundamentals course it links to.

Is awesome-hacking up to date?

The README shows no recent update history beyond its last push date, so some links may be out of date. Check each linked project for current status before relying on it.

What are good alternatives to awesome-hacking?

The README lists comparable projects: Hack-with-Github/Free-Security-eBooks for free books, sbilly/awesome-security, and enaqx/awesome-pentest. These are similar curated lists you can compare against.

Why does a Docker pull command fail or the container not work?

The list does not give troubleshooting steps. Read the linked Docker Hub page or project README for that image, since each one has its own setup and requirements.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use awesome-hacking if you want a broad, hand-picked map of security topics and a shortlist of tutorials, tools and practice environments in one place. Pick a different resource if you need a single tool with step-by-step setup, a beginner course that starts from zero, or recommendations you can assume are current.

Install options & downloads