🛡️ Security Bookmarks

A pile of good security links, organized enough that you'll actually use it.

One HTML file, every Chromium browser, no extension required.

---

📖 What this is

Security-Bookmarks packages years of accumulated tooling: OSINT search engines, forensic utilities, CTF labs, hardware-hacking references, and more into a single, cleanly organized bookmark file.

Import it once and every teammate, VM, or fresh browser profile gets the same curated toolkit, nested in logical folders instead of a flat, unsearchable list.

📸 assets/screenshot-bookmarks-bar.png

---

📑 Table of Contents

• Import Instructions
• Library Structure
• Full Index
• Screenshots
• Contributing
• Disclaimer
• License

---

📥 Import Instructions

Google Chrome / Brave / Vivaldi

1. Download bookmarks.html (or just clone the repo).
2. Go to chrome://bookmarks.
3. Click the ⋮ menu in the top right, then Import bookmarks.
4. Pick bookmarks.html.

Microsoft Edge

1. Download bookmarks.html.
2. Go to edge://favorites.
3. Click ⋯, then Import favorites → Favorites or bookmarks HTML file.
4. Pick bookmarks.html.

Arc

1. Download bookmarks.html.
2. Arc Menu → Import Data → Bookmarks HTML File.
3. Pick bookmarks.html.

Everything lands inside one Security Toolkit folder, so it won't dump 90 new bookmarks all over your existing bar. You can thank me later.

---

🗂 Library Structure

Security Toolkit/
├── 🔎 OSINT & Recon/
│   ├── 🔭 Search Engines                  → urlscan.io, Wayback Machine, Shodan, Censys, ZoomEye
│   ├── 🪪 People, Identity & Breach Data  → OSINT Industries, FaceCheck, HIBP, DeHashed, Breachsense, LeakIX
│   └── 🚨 Threat Intel & Reputation       → AbuseIPDB, Cisco Talos, VirusTotal
├── 🌐 Networking & IP Tools                → ifconfig.co, ipinfo.io, Speedtest, WiGLE, DNSdumpster, MXToolbox
├── 🧰 Analysis & Utilities/
│   ├── Forensics                          → CyberChef, Forensically, unfurl, CrackStation, Pic2Map
│   ├── Reporting                          → CVSS Calculator, Hemingway Editor
│   └── (loose)                            → revshells.com, webhook.site, Bitwarden, explainshell.com, SSL Labs
├── 🔌 Hardware & Physical Security/
│   ├── 💲 Gadget Retailers                → PwnShop, Hak5, OpenSourceSDRLab, Flipper Zero, JustCallMeKoko, Rabbit-Labs, Lab401, HackerGadgets
│   ├── 📦 Resources                       → ALFA driver, Flipper Zero demo, BadUSB/Digispark videos
│   └── (loose)                            → FZEE Flasher
├── 🤖 AI & Chatbots/
│   ├── Visuals                            → Higgsfield AI, Nano-Banana (Gemini), ChatGPT Images 2.0
│   └── (loose)                            → Grok, Perplexity, ChatGPT, Claude, Gemini, Copilot, Meta AI, DeepSeek, Cytd
├── 🕵️ Privacy & Anonymity/
│   ├── Browsers                           → Tor Project, DuckDuckGo, Brave
│   └── (loose)                            → Windscribe, Bitwarden, Proton Mail, Tails, Cryptgeon
├── 📚 Learning & Community/
│   ├── 🎓 Creators & Educators/
│   │   └── ▶️ YouTube                     → Null Byte, NetworkChuck, Darknet Diaries
│   ├── 🏁 CTF & Practice Labs/
│   │   ├── 🧪 Labs                        → TryHackMe, Web Security Academy, CyLab/picoCTF, WeChall, Hack The Box, OverTheWire, UnderTheWire, PentesterLab, Merlin
│   │   ├── 🎯 Vulnerable Sites            → OWASP Juice Shop, pwnable.kr, Altoro Mutual
│   │   ├── Online CTFs                    → Google CTF
│   │   └── (loose)                        → CTF101, Capture-The-Flag 101 video
│   └── (loose)                            → DEF CON, 2600
└── 📄 Reference Manuals                    → Google Dorks List, Geoleaks Codebook, Hacking Books (tanc7), Kali command reference, XSS Cheat Sheet

Eight top-level folders now. CTF & Practice Labs moved under Learning & Community at some point (worth a double check that this was on purpose and not a drag-and-drop accident in Brave's bookmark manager), which makes it the deepest branch: four folders down before you hit an actual link. Everything else stays within two or three.

---

📋 Full Index

🔎 OSINT & Recon

Search Engines

Tool	What it's for
urlscan.io	Scans and sandboxes a URL before you touch it yourself
Wayback Machine	Pulls up old versions of a page, dead links and all
Shodan	Search engine for internet-connected devices
Censys Search	Internet-wide host and certificate search
ZoomEye	Another cyberspace search engine, different dataset

People, Identity & Breach Data

Tool	What it's for
OSINT Industries	Phone and email identity lookups
FaceCheck	Reverse image and facial recognition search
Have I Been Pwned	Checks if an email's shown up in a breach
DeHashed	Breach data search engine
Breachsense	Monitors for your data turning up in a breach or on the dark web
LeakIX	Search engine for exposed services and leaked data

Threat Intel & Reputation

Tool	What it's for
AbuseIPDB	Crowdsourced IP abuse reports
Cisco Talos Intelligence	Threat intel from Cisco's research group
VirusTotal	Multi-engine file and URL scanning

🌐 Networking & IP Tools

Tool	What it's for
ifconfig.co	Tells you your own External IP
ipinfo.io	IP data and geolocation, more detail than the above
Speedtest	The classic, how fast is this connection really
WiGLE	Wireless network mapping
DNSdumpster	DNS recon, good first step on a new target
MXToolbox	Grab bag of network diagnostic tools

🧰 Analysis & Utilities

Forensics

Tool	What it's for
CyberChef	GCHQ's "Cyber Swiss Army Knife," data transforms and decoding
Forensically	Free photo forensics, error level analysis and the like
unfurl	Pulls apart URLs, timestamps, and tokens for DFIR work
CrackStation	Online hash lookup against huge precomputed tables
Pic2Map	Pulls the GPS data out of a photo and drops a pin on the map

Reporting

Tool	What it's for
CVSS Calculator	FIRST's official CVSS 3.1 severity scoring calculator
Hemingway Editor	Flags dense, hard-to-read sentences, handy for report writing

Loose

Tool	What it's for
revshells.com	Generates reverse shell one-liners for whatever's on the box
webhook.site	Spin up a URL, watch what hits it, useful for SSRF and blind callbacks
Bitwarden Password Strength Tester	Checks how long a password would survive
explainshell.com	Paste a shell command, get every flag explained
SSL Labs	Qualys' SSL/TLS configuration grader

🔌 Hardware & Physical Security

Gadget Retailers

Tool	What it's for
PwnShop	Security tools for students, by students
Hak5	Pentest hardware and media, the OG
OpenSourceSDRLab	HackRF One and uConsole resale on AliExpress
Flipper Zero	The official site and store
JustCallMeKoko LLC	ESP32 Marauder, wardriving gear, Flipper adapters
Rabbit-Labs	RF, Wi-Fi, and accessories
Lab401	Trusted RFID and pentesting gear, Flipper Zero to Proxmark
HackerGadgets	uConsole and Pi accessories

Resources

Tool	What it's for
ALFA AWUS036ACS Driver	Driver install guide for the adapter everyone in Wi-Fi auditing owns
Flipper Zero "Rolling Flaws"	RF replay attack demo
BadUSB / Digispark Wi-Fi Password Theft	ATtiny85 payload walkthrough
$3 Digispark BadUSB Script	Proof that BadUSB doesn't need a big budget

Loose

Tool	What it's for
FZEE Flasher	Flashes ESP32 firmware straight from the browser

🤖 AI & Chatbots

Visuals

Tool	What it's for
Higgsfield AI	AI video and creative generation suite
Nano-Banana (Gemini)	Google's image generation model, inside Gemini
ChatGPT Images 2.0	OpenAI's image generator

Loose

Tool	What it's for
Grok	xAI's assistant
Perplexity	AI search that cites its sources
ChatGPT	OpenAI's assistant
Claude	Anthropic's assistant, the one that keeps getting asked to edit this README
Google Gemini	Google's assistant
Microsoft Copilot	Microsoft's assistant
Meta AI	Meta's assistant
DeepSeek	DeepSeek's assistant
Cytd	Tracks how visible a brand is across AI answers

🕵️ Privacy & Anonymity

Browsers

Tool	What it's for
Tor Project	Anonymity network and browser
DuckDuckGo	Search that isn't building a profile on you
Brave	Privacy-focused browser

Loose

Tool	What it's for
Windscribe	Free-tier VPN
Bitwarden	Free password manager
Proton Mail	Encrypted email
Tails	Amnesic live OS, boots from USB and forgets everything after
Cryptgeon	Self-destructing notes for sharing a secret exactly once

📚 Learning & Community

Creators & Educators → YouTube

Tool	What it's for
Null Byte	Long-running hacking tutorial channel
NetworkChuck	Networking and cybersecurity tutorials
Darknet Diaries	True cybercrime stories, hosted by Jack Rhysider

CTF & Practice Labs → Labs

Tool	What it's for
TryHackMe	Guided labs, good on-ramp if you're newer to this
Web Security Academy	Free, deep web security training from the Burp Suite folks
CyLab Security Academy (picoCTF)	Quick browser-based labs, no VM required
WeChall	A list of active challenge sites so you don't have to hunt for them
Hack The Box	The other big one, less hand-holding
OverTheWire	Wargames, old-school and still sharp
UnderTheWire	Same idea, but PowerShell instead of bash
PentesterLab	Paid and free web hacking exercises, code review included
Merlin	A game where you prompt-inject a password out of an LLM

CTF & Practice Labs → Vulnerable Sites

Tool	What it's for
OWASP Juice Shop	The intentionally broken app everyone learns on eventually
pwnable.kr	Binary exploitation wargame
Altoro Mutual	IBM's ancient but still-useful SQLi demo bank

CTF & Practice Labs → Online CTFs

Tool	What it's for
Google CTF	Google's annual capture-the-flag competition

CTF & Practice Labs → Loose

Tool	What it's for
CTF101	Fundamentals, start here if CTFs are new to you
Capture-The-Flag 101	A video walkthrough of the whole idea

Loose

Tool	What it's for
DEF CON	The conference's home page
2600 Magazine Store	The Hacker Quarterly, still going after all these years

📄 Reference Manuals

Tool	What it's for
Google Dorks List	Curated dork reference for search-engine recon
Geoleaks Codebook (PDF)	Geolocation OSINT codebook
Hacking Books (tanc7)	A small repo of hacking book PDFs, not just the Kali command list below
All Kali Linux Commands (PDF)	Command reference, good for when you blank on syntax
XSS Cheat Sheet	The reference for every XSS vector worth trying

---

🖼 Screenshots

Bookmarks Bar	Folder Expanded	Import Dialog
📸 assets/screenshot-bar.png	📸 assets/screenshot-folder.png	📸 assets/screenshot-import.png

Screenshots are still pending, I keep meaning to record these. Drop images into assets/ and swap the placeholders above whenever someone gets around to it.

---

🤝 Contributing

Found a tool that deserves a spot? PRs are welcome. To add one:

1. Fork the repo and edit bookmarks.html directly, keeping it in the existing folder structure.
2. Update the tables in this README to match.
3. Open a PR and say in one line why it belongs here.

I'm picky about three things:

1. It has to be mostly free (or at least free-tier). Some exceptions can be made if it utilizes an externally payed service (e.g. API Tokens, Third-Party tool for a popular payed services, etc.)

2. Usable straight from a browser. Some exceptions are: Downloadable documents/ressources (e.g. Cheatsheets), and some Installers to REALLY useful tools.

3. MUST BE LEGAL (most importantly). Any illegal, inappropriate, or malicious entries will be denied and reported.

---

Disclaimer

These links exist for education and authorized security research. Full stop. A good chunk of this list is dual-use by nature (vulnerable demo apps, hash crackers, BadUSB payloads, OSINT lookups), so point them at systems and data you own or are cleared to test, and nowhere else. What you do with them, and whether it's legal where you're doing it, is on you.

---

📄 License

MIT. See LICENSE.