There are thousands of lists promising free IT and cybersecurity tools. A list is only useful if you know what problem each tool solves.

You do not need fifty bookmarks. You need a small set of resources that help you learn a concept, observe a system, investigate evidence, or verify a technical claim.

The resources below cover different jobs:

  • Learn a technology from structured material
  • Build or simulate a network
  • Inspect packets and hosts
  • Decode technical data
  • Check exposure without guessing
  • Add context to suspicious files and vulnerabilities
  • Read threat behavior and exploitation evidence
  • Find the standards behind the terminology

Most are useful far beyond a certification exam. That is the point. The best study resource often becomes a work resource later.

2. How to Use This List

Do not work through these resources in order as though they are a course.

Pick one because you have a question.

If you are learning how Domain Name System (DNS) resolution looks on the wire, open Wireshark. If you are trying to understand what a threat actor does after gaining access, open MITRE ATT&CK. If an exam objective mentions an unfamiliar security control, check the National Institute of Standards and Technology (NIST) source instead of relying on a one-sentence definition copied through ten websites.

A useful workflow is:

  1. Learn the concept.
  2. Observe or practice it.
  3. Check a primary source when the details matter.
  4. Write down what you learned in your own words.

Free resources become much more valuable when they have a specific job.

If you want to... Start with... Why
Learn Microsoft technology Microsoft Learn Structured modules, learning paths, documentation, and hands-on material.
Practice networking without hardware Cisco Networking Academy and Packet Tracer Courses plus a network simulator for building and testing topologies.
Understand packets Wireshark See protocols and conversations instead of only memorizing what they should do.
Discover hosts and services Nmap Learn network inventory and service discovery on systems you are authorized to scan.
Decode unfamiliar data CyberChef Transform encodings, hashes, timestamps, certificates, addresses, and many other formats.
Understand real attacker behavior MITRE ATT&CK Connect tactics, techniques, sub-techniques, and observed procedures.
Check whether exploitation is known CISA KEV See vulnerabilities the Cybersecurity and Infrastructure Security Agency says have been exploited in the wild.
Read the source material NIST CSRC and the RFC Editor Go back to standards, guidance, protocol definitions, and technical references.

3. Learn the Technology

Microsoft Learn

Microsoft Learn is useful when you want structured, product-specific training without starting with a paid course.

Microsoft says its training is free and available without creating a profile. Signing in adds progress tracking, bookmarks, collections, achievements, and access to some labs and other features, but the learning content itself can be read without an account.

Use it for technologies such as:

  • Azure
  • Windows
  • Microsoft Entra
  • Microsoft Defender
  • PowerShell
  • Microsoft 365
  • Cloud and identity concepts

The main advantage is not that every Microsoft Learn module is exciting. It is that the material is maintained by the organization responsible for the technology.

If a third-party explanation and the current Microsoft documentation disagree, the current Microsoft documentation gets the last word.

Cisco Networking Academy and Packet Tracer

Cisco Networking Academy provides free online courses across networking, cybersecurity, programming, information technology, artificial intelligence, and related subjects.

For networking students, Cisco Packet Tracer is especially useful. Despite the name, Packet Tracer is a network simulator. It lets you build simulated network topologies and practice configuration without buying a pile of switches and routers.

Packet Tracer is not a replacement for every behavior of real equipment. It is very good for learning the relationships between:

  • Devices
  • Interfaces
  • Internet Protocol (IP) addressing
  • Virtual local area networks (VLANs)
  • Trunks
  • Routing
  • Access control lists
  • Network services
  • Configuration and verification commands

A simulator is most useful when you verify what you built. Do not stop when the diagram looks correct.

OpenStax Computer Science

OpenStax Computer Science is useful when you need a textbook rather than another short article.

OpenStax, part of Rice University, provides free online computer science textbooks covering areas such as introductory computer science, information systems, Python programming, data science, and workplace technology.

The introductory computer science text includes algorithms, data structures, computer systems, software development, cybersecurity, cloud computing, and hands-on activities.

That makes OpenStax a good resource when a certification topic exposes a larger foundation gap. Sometimes the problem is not that you need a better exam trick. You need to learn the underlying subject.

4. See What the Network Is Doing

Wireshark

Wireshark is a network protocol analyzer. It can capture live traffic or open saved packet captures so you can inspect what systems actually exchanged.

That is useful for learning:

  • Address Resolution Protocol (ARP)
  • DNS
  • Dynamic Host Configuration Protocol (DHCP)
  • Transmission Control Protocol (TCP) handshakes
  • Transport Layer Security (TLS)
  • Internet Control Message Protocol (ICMP)
  • Retransmissions
  • Ports and protocols
  • Client-server conversations

A packet capture turns a sentence such as "DNS resolves a name to an address" into actual packets you can follow.

You do not even need to capture your own traffic at first. The Wireshark SampleCaptures collection provides captures you can inspect while learning filters and protocol behavior.

Packet analysis is one of the easiest ways to make networking concepts stop feeling like vocabulary.

Nmap

Nmap is a free, open-source tool for network discovery and security auditing. Administrators also use it for inventory, service discovery, and checking which hosts or services are reachable.

In a home lab or another environment you are authorized to test, Nmap can help answer questions such as:

  • Which hosts are up?
  • Which ports are open?
  • What service appears to be listening?
  • Did a firewall rule change what is reachable?
  • Did the service you configured actually start?

The safety rule is simple:

Scan systems you own, administer, or have clear permission to test.

Nmap's own legal guidance recommends obtaining written authorization before scanning networks you do not control. A useful learning tool does not become more educational because someone else receives the intrusion-detection alert.

5. Decode and Transform Data

CyberChef

GCHQ CyberChef is one of those tools that becomes more useful as you learn more.

It can help with:

  • Base64 and hexadecimal encoding
  • URL encoding
  • Hashing
  • Timestamps
  • IP addresses
  • Compression
  • X.509 certificates
  • Regular-expression operations
  • Byte and text transformations
  • File and data inspection

For a student, the important benefit is visibility. You can build a recipe one operation at a time and watch the data change.

The official CyberChef site says normal input data and recipes are processed entirely in the browser and are not sent to a server. It also identifies a few operations that intentionally contact external services, including HTTP requests, DNS over HTTPS, and map lookups.

That distinction matters. "Runs in the browser" is useful privacy information, not permission to stop thinking about the data.

CyberChef can also be downloaded and run locally, which is useful for isolated labs.

6. Check Exposure and Suspicious Files Carefully

Have I Been Pwned

Have I Been Pwned helps people check whether an email address has appeared in known data breaches.

It is useful for understanding what breach exposure means in a way that a textbook definition often does not.

The site's FAQ says ordinary account searches are not explicitly logged by the website, and its Pwned Passwords service anonymizes password lookups before sending them to the service.

For a student, this can help connect several concepts:

  • Breach notification
  • Credential reuse
  • Password exposure
  • Identity risk
  • Monitoring after an incident

A breach result does not mean someone currently has access to the account. It means the address appeared in breach data associated with that service. The response is to understand what was exposed, change affected or reused credentials, enable stronger authentication where available, and watch for follow-on abuse.

Use it to understand your own exposure. Do not turn breach searching into a hobby involving classmates, coworkers, or strangers.

VirusTotal

VirusTotal can analyze files, URLs, domains, and other indicators using many security engines and contextual sources.

It is very useful for learning how defenders combine signals rather than asking one scanner for a magical yes-or-no answer.

You can use it to inspect:

  • File hashes
  • Detection results
  • URLs and domains
  • Related infrastructure
  • Community and vendor context
  • Relationships between indicators

But there is an important rule:

Do not upload confidential, proprietary, personal, or client data to the standard VirusTotal service.

VirusTotal's official documentation says standard submissions and results are shared with examining partners. VirusTotal offers a separate Private Scanning service for organizations that need submissions kept within their organization, and that service requires special privileges.

For a student, the safest habit is to start with known public hashes, public URLs, and training samples. If you are unsure whether you are allowed to upload a file, do not upload it.

7. Understand Threats and Vulnerabilities

MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary behavior based on real-world observations.

It gives you a structured way to separate:

  • Tactics: why the adversary is doing something
  • Techniques: how the adversary achieves the goal
  • Sub-techniques: a more specific form of the behavior
  • Procedures: how the behavior has been observed in real activity

This is much more useful than memorizing a giant matrix.

Pick a technique from a report or scenario and follow it. Look at the platforms, detection ideas, mitigations, groups, and software associated with it. Then ask what evidence a defender might see.

ATT&CK is especially helpful once security questions start describing behavior instead of naming the technique directly.

CISA Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) Catalog answers a different question:

Is there evidence that attackers have actually exploited this vulnerability in the wild?

CISA describes KEV as the authoritative source for vulnerabilities known to have been exploited in the wild and recommends using it as an input to vulnerability-prioritization decisions.

That makes KEV a useful companion when reading Common Vulnerabilities and Exposures (CVE) records.

A high severity score tells you about technical characteristics. KEV tells you something about observed exploitation. Your own affected version, exposure, configuration, and business context still matter.

This is why vulnerability management cannot be reduced to sorting one column from highest number to lowest.

8. Read the Standards Behind the Acronyms

NIST Computer Security Resource Center

The NIST Computer Security Resource Center (CSRC) publishes cybersecurity and privacy standards, guidelines, recommendations, research, and reference material.

Students often encounter NIST document numbers before they know why anyone cares about them.

You do not need to read every Special Publication cover to cover. Use CSRC when you need the source behind a concept such as:

  • Risk management
  • Identity and authentication
  • Security controls
  • Incident response
  • Zero trust
  • Cryptography
  • System security
  • Cybersecurity frameworks and guidance

Learn to distinguish a final publication from a draft and check whether an older document has been superseded or withdrawn.

Reading even a few pages of the actual source can clarify a concept that has become strangely distorted after years of summaries.

RFC Editor

The RFC Editor is the official home of Requests for Comments (RFCs), which document Internet standards as well as informational, experimental, and historical material.

If you are studying networking, RFCs eventually appear everywhere:

  • Private IPv4 addressing
  • IPv6
  • DNS
  • DHCP
  • TCP
  • HTTP
  • TLS-related standards
  • Multicast and local-link behavior
  • Routing and addressing conventions

Do not assume every RFC is a current Internet Standard. The RFC series contains several document categories, and newer RFCs can update or obsolete older ones.

The useful habit is knowing where to look when a protocol detail matters.

You rarely need to memorize an RFC number merely because it exists. Being able to find the authoritative definition is more durable.

9. Free Tools and References on Cert Happens

Cert Happens is also part of the free toolkit.

The goal is not to replace the official documentation above. Use Cert Happens as the practice and quick-reference layer when you want to check your understanding, work through a calculation, or review a concept without turning every study session into another search.

Useful starting points include:

  • IPv4 subnet calculator: Check network addresses, broadcast addresses, usable ranges, wildcard masks, and subnet math while you practice. Try the problem yourself first, then use the calculator to verify it.
  • IPv6 address calculator and IPv6 addressing reference: Expand and compress IPv6 addresses, inspect prefixes, and review address types and notation.
  • Ports and protocols: Check common ports, transport protocols, purposes, and related details when a packet capture, firewall rule, or exam scenario gives you a number without much context.
  • Hash generator and checksum verifier: Calculate a SHA-256, SHA-384, SHA-512, or legacy SHA-1 digest for text or a local file and compare a published checksum. The input stays in your browser.
  • Base64 and hex encoder/decoder: Convert UTF-8 text to Base64 or hexadecimal, decode either format back to text, or convert Base64 and hexadecimal directly. The input stays in your browser.
  • Acronyms and terms: Each certification has its own acronym reference. Open the Security+, Network+, CCNA, CISSP, or ISC2 CC guide for your current path, or use site search to see where a term appears elsewhere on Cert Happens.
  • Study guides and quick reviews: The Security+, Network+, CCNA, CISSP, and ISC2 CC hubs collect focused guides, references, quick reviews, and practice material for each certification.
  • Randomized practice tests: The same certification hubs link to free practice tests designed to help you diagnose what you understand and what still needs work.

A good combination is often primary source + hands-on tool + Cert Happens reference or practice.

For example, simulate a small network in Packet Tracer, inspect traffic in Wireshark, use the Ports and Protocols reference for a quick check, and use the subnet calculator to verify your addressing work.

10. A Small Starter Set

You do not need to learn every resource at once.

If you are new to IT, start with:

  • Microsoft Learn for structured technical learning
  • OpenStax when you need deeper foundations
  • Wireshark to see network behavior
  • Cisco Packet Tracer if networking is part of your path

If you are moving toward cybersecurity, add:

  • CyberChef for data transformations
  • Have I Been Pwned for breach exposure context
  • VirusTotal for public indicator and file-analysis context
  • MITRE ATT&CK for adversary behavior
  • CISA KEV for real-world exploitation context

Keep NIST CSRC and the RFC Editor nearby as source material rather than daily destinations.

Nmap belongs in both IT and cybersecurity. Learn it in your own lab first.

A bookmark folder is not a skill. Pick one resource and use it to answer a real question.

11. Use Online Tools Without Leaking Data

Free tools can create an easy trap: the tool is available, so everything on your screen starts to look uploadable.

Before putting data into an online service, ask:

  • Does this contain a password, token, API key, cookie, private key, or session data?
  • Does it contain a customer's or employer's information?
  • Is the file proprietary?
  • Does the service retain or share submissions?
  • Can I use a hash, synthetic example, or public training file instead?
  • Can the same task be done locally?

For security tools, add two more questions:

  • Do I own or administer the target?
  • Do I have explicit authorization for this test?

This is not paperwork getting in the way of learning. Handling data and authorization correctly is part of the skill.

The safest student lab is one where you control the systems, understand what leaves the environment, and can break things without creating a problem for someone else.

12. Official References

Wireshark for Beginners: What to Look for in Your First Packet Capture Capture traffic you intentionally create and learn to follow requests, responses, connections, and protocol fields. Nmap in a Home Lab: Learn Network Discovery Without Scanning the Internet Discover lab hosts, inspect selected ports and services, and compare results without scanning random Internet systems. How to Study for IT Certifications on a Budget Build a low-cost study plan and spend only when a paid resource solves a real learning problem. How to Build IT Experience With a Home Lab Without Buying a Rack of Hardware Turn free and inexpensive software into a practical environment for learning systems and networking.
Ports and protocols Review common ports, protocols, purposes, and transport details. IPv4 subnet calculator Check network, broadcast, usable ranges, wildcard masks, and subnet math while you practice. IPv6 addressing reference Review IPv6 notation, scopes, address types, prefixes, and common exam concepts. IPv6 address calculator Expand, compress, and inspect IPv6 addresses and prefixes. Hash generator and checksum verifier Hash text or a local file in your browser and compare a published checksum. Base64 and hex encoder/decoder Convert UTF-8 text, Base64, and hexadecimal locally in your browser.