~ Early Web Links ~

CGISecurity.com bills itself as the oldest application security site online, predating OWASP, and covers topics ranging from XSS and CSRF to cryptography, web application firewalls, and vulnerability research. Run by Robert Auger, the site offers advisories, research papers, security tool roundups, and a deep archive of industry news and commentary stretching back to 2001.

Created by Freerk, this comprehensive tutorial covers dozens of techniques for bypassing internet censorship, including proxies, shell accounts, JAP, and circumventing blocked ports in schools, workplaces, and countries with restrictive filtering. It documents specific censorware products like NetNanny, WebSense, and DansGuardian, making it a rare and detailed reference for anyone facing restricted internet access.

A comprehensive reference covering SQL injection techniques across MySQL, MSSQL, Oracle, and other database platforms, with detailed cheat sheets for testing, exploitation, obfuscation, and prevention. The Knowledge Base is organized as a dense technical reference for security researchers and penetration testers, covering everything from basic injection testing to advanced topics like out-of-band channeling and password cracking.

The No Trace Project is a multilingual security resource for anarchists and activists, providing tools to understand surveillance capabilities, counter infiltration, and practice operational security. It features a threat library, a database of known infiltrators, documented cases of hidden surveillance devices, and zines covering counter-repression strategies across more than a dozen languages.

Mike's digital garden at Shellsharks covers infosec research, technology, and personal life across a richly interconnected set of blogs, notebooks, and logs. A self-described 'Internet homesteader,' Mike has built an expansive personal web presence complete with a podcast, linklog, devlog, and Fediverse integration that makes it a compelling destination for security-minded web explorers.

Sqlninja is an open-source penetration testing tool designed to exploit SQL Injection vulnerabilities in web applications backed by Microsoft SQL Server, automating the process of gaining remote access to vulnerable database servers. Created by 'icesurfer', it includes attack modules, a Metasploit wrapper, DNS tunneling for data extraction, and even a hidden Easter Egg that streams music.

The Joy of Cryptography is a free online undergraduate textbook by Mike Rosulek, published by MIT Press, covering provable security from one-time pads and pseudorandomness through RSA, zero-knowledge proofs, and post-quantum cryptography. The first three chapters are available under a Creative Commons license, with the remaining chapters releasing in July 2026, making it an invaluable open resource for students and educators alike.

Anurag Agarwal's threat modeling blog dives into real-world web security vulnerabilities, including this post presenting a working proof-of-concept Ajax sniffer that overrides XMLHttpRequest to intercept and exfiltrate data. The site covers topics like XSS, Ajax worms, SQL injection, clipboard theft, and secure SDLC integration, making it a valuable technical resource for security researchers and developers.

TechnicalInfo.net by Gunter Ollmann offers a comprehensive toolkit for passive information gathering, including domain WHOIS lookups, DNS records, IP address lookups, traceroutes, and bandwidth speed tests. The collection is aimed at security researchers and network administrators, with tools organized around reconnaissance techniques and network analysis.

Published by the Free Software Foundation, Email Self-Defense is a step-by-step guide teaching readers how to encrypt their email using GnuPG to resist bulk surveillance and protect their privacy. Available in over 15 languages, the guide walks users through setting up encryption on Mac, Windows, and Linux with clear illustrated steps and an accompanying infographic.