cybersecurity-framework - Interactive map of everything in cybersecurity: 27

项目说明

> ⚠️ EDUCATIONAL USE ONLY — AUTHORIZED TESTING ONLY.
> This project exists for education, research, and **defense of systems you own
> or hold explicit written authorization to assess**. Unauthorized use is
> prohibited and may be illegal. Read ETHICS.md and
> SCOPE.md before use. Use at your own risk; AS IS, no warranty.

🧭 CyberOps Framework — The Interactive Map of E in Cybersecurity

> An open-source, living atlas of the entire cybersecurity landscape — every domain,
> every category, and the best tool for each job (★), mapped the way OSINT Framework
> maps recon — but for the *whole* of cyber: offense, defense, cloud, mobile, IoT,
> forensics, malware, hardening and more.

🌐 Live site: <

📚 Read the first: .md — how this becomes a full end-to-end
cybersecurity education platform.

<p>
<img alt="License" src=" />
<img alt="CI" src=" />
<img alt="Co" src=" />
<img alt="Stack" src=" />
</p>

Contents: What this is · Co ·
Roadmap · Quickstart ·
Repo structure · Ethics & scope ·
Contributing · Changelog

---

What this is

| | |
|---|---|
| A curated tool tree | domains → categories → best-in-class tools with honest when-to-use, effort, rating, install line, and real alternatives. No hype. |
| A learning map | every tool links to the concepts behind it — you learn *why* it's the right instrument, not just its name. |
| An education platform | offensive + defensi into two pillars and 27 domains co the full attack/defense lifecycle. |
| A community project | MIT-licensed. Anyone can add categories, tools, or fixes. Contributions re against SCHEMA.md and ETHICS.md. |

One question it answers in seconds: *“I need to do X. Which tool?”*

---

Built to answer that question

⚔️ Offensi pillar — Reconnaissance & OSINT → Scanning → Web & Mobile Apps →

Identity & AD → Passwords & Crypto → Exploitation → C2 & Red Team → Phishing →
Wireless/IoT/Embedded

🛡️ Defensi pillar — Detection & Monitoring → Application Assurance →

Forensics & IR → Malware Analysis → Hardening & Compliance → Cloud & Container →
Deception & Ad Emulation

★ Best-in-class picks — 517 of the best tools flagged, so beginners aren't thrown into

decision paralysis.

🎚️ Honest effort ratings — 524 easy · 416 medium · 127 ad, so you can pick a sane

entry path and grow.

🔗 Install line + URL for every tool — copy-paste real install commands directly from

the site.

🔎 Instant search across 1067 tools.

🧩 Recursi — categories nest arbitrarily deep (subcategories → sub-subcategories → tools).

---

Current co

| Metric | Value |
|---|---|
| Domains | 27 |
| Categories (nested incl.) | 776 |
| Tools | 1067 |
| Best-in-class picks (★) | 517 |
| Tools by first-party authors (◆) | 30 |
| Effort split | easy 524 · medium 416 · ad 127 |
| License | MIT |

The 27 domains: Acti Security, Application Security, Binary Exploitation,
Blue Team, C2 Frameworks, Cloud Security, Container & K8s, Cryptography, Exploitation,
Digital Forensics & IR, Hardening & Compliance, Honeypots, IoT & Embedded, Malware
Analysis, Mobile Security, Network Attacks, OSINT, Password Attacks, Phishing & Social
Engineering, Pri Escalation, Purple Team, Reconnaissance, Red Team, Threat
Intelligence, Scanning, Web App Security, Wireless & Bluetooth.

---

🚀 The — from tool tree to full education platform

This is V1. The endgame is documented in .md — a complete,
community-built, end-to-end cybersecurity education website where every concept, tool,
attack technique, and defense control in the field is mapped, explained, and connected.

Near-term roadmap:

[ ] AI & LLM Security domain (prompt injection, model extraction, OWASP LLM Top 10)

[ ] GRC / Go, Risk & Compliance domain (ISO 27001, NIST CSF, SOC 2)

[ ] Supply-chain & De domain (SBOM, sigstore, CI/CD abuse)

[ ] OT/ICS/SCADA domain

[ ] Bug-bounty & Responsible Disclosure resources

[ ] Web3 / Blockchain security domain

[ ] Concept notes on every category — a short "learn this first" paragraph per node

[ ] Learning paths — preset journeys: *Web App Pentester*, *SOC Analyst*, *Malware

Analyst*, *Cloud Security Engineer*, *Red Team Operator*, *DFIR*

[ ] Alignment with MITRE ATT&CK, NIST CSF, OWASP so the map is also a study map

[ ] Community features — issues template-dri, badge for contributors

See the full plan, scope boundaries, and non-goals in .md.

---

Quickstart

No build step, no npm, no framework — the site is a single docs/index.html
pushed to GitHub Pages.

Repository structure

---

🛡️ Ethics, legal & scope — read before using

This map exists to help owners and defenders test their own systems. Every tool here
must be used only on systems you own or for which you hold **explicit written
authorization. Unauthorized access may the CFAA (18 U.S.C. §1030)**,
the Wiretap Act, EU Directive 2013/40/EU, and local law.

Read ETHICS.md — the four non-negotiable rules.

Run the SCOPE.md four-question checklist before any li.

This is an atlas, not a weapon. Categories are written from the defender/tester

perspective: *never a how-to break into a third party; always a how-to check your own.*

---

Contributing

We want the community to help complete the map. Open an issue or PR to add a tool, fix a
dead URL, or refine a when-to-use.

Read CONTRIBUTING.md first.

Every addition must follow SCHEMA.md — real, curated, safety-gated, no hype.

License

MIT — free to use, remix, and redistribute with attribution. See LICENSE.

Tool names, logos, and brands referenced or linked from this map are the property of their
respecti; this project is not affiliated with or endorsed by any of them.

---

· an atlas of cyber education — always in scope, always educational. ·

项目信息

开发语言：Python

Star 数：6

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Interactive map of everything in cybersecurity: 27 domains, 776 categories, 1067 curated offensive & defensive tools with effort ratings and when-to-use guidance.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。