The tradecraft shelf
Field Manuals
Everything here is public, legal, and learnable — the same open sources the professionals quietly use. Work through them in order and you'll know more about investigating the internet than most people who claim to do it for a living.
Manual 01
Textfile / Zine Archives
The ancestors. Before the web had a front page, it had textfiles — and the zines never really stopped.
- textfiles.com — Jason Scott's sprawling museum of BBS-era textfiles, zines, and warez docs. The direct ancestor of this whole enterprise.
- Phrack Magazine — the legendary underground hacker e-zine; every issue back to 1985, with new releases still landing.
- 2600: The Hacker Quarterly — the print hacker quarterly's home: articles, the Off The Hook radio show, and HOPE conference.
- Bitsavers — volunteer-scanned vintage computer manuals, schematics, and datasheets. Hardware archaeology at its finest.
Manual 02
Hacker Culture & News
The current scene: people breaking things, fixing things, and writing it all down.
- Hackaday — daily hardware hacks, reverse engineering, and glorious over-engineering from the workbench crowd.
- Krebs on Security — Brian Krebs' cybercrime and breach investigations; the gold standard for this beat.
- Schneier on Security — Bruce Schneier on security, crypto, and surveillance politics — the thinking person's security blog.
- Electronic Frontier Foundation — digital-rights law and activism; they fight the court battles so you can keep your tools.
- Chaos Computer Club — Europe's oldest hacker association: congresses, camps, and hacker politics done right.
Manual 03
OSINT / Investigation
Open-source intelligence: finding things that are public but not obvious. Start with the framework, then drill the tools.
- OSINT Framework — the classic tree of OSINT tools organized by target type. Your map of the territory.
- bellingcat — open-source investigations with the verification tradecraft taught in public. Study their methodology posts.
- IntelTechniques — Michael Bazzell's OSINT and privacy toolset, workflows, and search utilities.
- Have I Been Pwned — breach lookup for your emails and passwords. Check yourself before you wreck yourself.
- urlscan.io — submit a suspicious URL, get back a screenshot, DOM, and network trace. Never click blind again.
- crt.sh — Certificate Transparency search: map a domain's infrastructure from its TLS certificates.
- Wayback Machine — time-travel deleted pages and defunct sites. The investigator's DeLorean.
- VirusTotal — drop in a file hash, URL, or IP and see what 70+ antivirus engines and threat feeds think of it. The first stop for anything suspicious.
- Shodan — the search engine for everything connected to the internet: webcams, routers, industrial gear. Google for devices, minus the innocence.
- MITRE ATT&CK — the encyclopedia of how attackers actually operate, tactic by tactic. Learn to think like the other side, legally.
- Maltego — link-analysis charting: turn entities and relationships into visual graphs. Big-investigation tradecraft, on your desktop.
- theHarvester — open-source recon for emails, subdomains, and employee names. The first five minutes of any engagement.
- WhatsMyName — paste a username, find where it lives across hundreds of sites. People reuse handles; this proves it.
- AbuseIPDB — crowdsourced IP reputation: check whether an address is a known troublemaker before you trust it.
- GreyNoise — separates internet background noise from real threats. Not everything rattling your logs is aimed at you.
- Any.run — interactive malware sandbox: detonate a file in a live VM and watch what it does, safely, in your browser.
- Hybrid Analysis — free automated malware analysis with crowdsourced verdicts. Upload the sketchy, read the report.
- ExifTool — the gold standard for reading and writing photo metadata. If a photo has secrets, this finds them.
- SpiderFoot — automated OSINT reconnaissance: point it at a domain, IP, or email and let 200+ modules do the digging. Self-host it; don't hand strangers the keys.
- Kaspersky Cyberthreat Map — live global attack telemetry from Kaspersky's sensor network. The famous laser map, still running.
- Check Point ThreatCloud Map — real-time threat visualization from Check Point's ThreatCloud sensors around the world.
- FBI Crime Data Explorer — the Bureau's official crime statistics: offenses, arrests, and trends by place and time. The primary source, not someone's chart of it.
- Global Terrorism Database — the University of Maryland's open database of 200,000+ terrorist events since 1970. The scholarly record.
Manual 04
Privacy & Anonymity
Defense in depth for your own digital life. Threat-model first, then pick your gear.
- Tor Project — Tor Browser, relay guides, and censorship-circumvention docs. The anonymity network itself.
- Tails — the amnesic live OS that routes everything through Tor and forgets you were ever there.
- Qubes OS — security by compartmentalization: your digital life split into isolated virtual machines.
- Privacy Guides — community-maintained, no-affiliate privacy recommendations and threat models. Start here, not with a VPN ad.
Manual 05
Retro / Phreak Corners
The old magic: phone phreaks, wardrivers, and the mischief that started it all.
- Phone Losers of America — phone-phreak and prank culture since the 90s; zines and telecom-mischief archives.
- WiGLE — the crowdsourced wardriving database mapping wireless networks across the globe.
Manual 06
Security Learning / CTF
Reading about tradecraft only goes so far. These will make you earn it — hands on keyboard.
- OverTheWire — classic SSH wargames. Start with Bandit and work your way up the food chain.
- picoCTF — free year-round capture-the-flag puzzles; the friendliest on-ramp in the game.
- pwn.college — a free program that teaches offense from the ground up. Bring coffee.
- CryptoPals — the famous crypto challenge sets: break real ciphers yourself, byte by byte.