h4cker for curated cybersecurity learning and reference material

h4cker is a massive curated repository of cybersecurity references, scripts, labs, and training resources maintained by Omar Santos, primarily intended for structured learning and authorized practice.

Tool	The-Art-of-Hacking/h4cker — curated collection of cybersecurity references, scripts, tools, code, labs, and training resources maintained by Omar Santos
Category	Curated learning repository / reference collection
Primary Use	Supplemental material for books, video courses, and live training, plus self-directed study across cybersecurity-domains, ai, certifications, and build-your-own-lab
Safe Use	Designed for authorized training, certification study, home lab practice, and professional development; explicitly positioned as ethical-hacking education material
Telemetry Note	As a static reference repository, h4cker itself generates no telemetry; individual tools it links to may leave artifacts, so defenders should evaluate linked tooling separately in lab environments

Every so often a repository stops being a tool and becomes an institution. The-Art-of-Hacking/h4cker, maintained by Omar Santos (@santosomar), is one of those cases: a Jupyter Notebook-anchored collection sitting at roughly 29.4k stars, licensed under MIT, and functioning less like a single utility and more like a living index of the security profession. The README is candid about its purpose — it is supplemental material for books, video courses, and live training created by Santos, and that pedagogical origin shapes everything about how the repository is organized.

The top-level structure tells you the maintainers thought hard about information architecture. Rather than one giant awesome-list dump, h4cker splits into a handful of deliberately scoped directories: cybersecurity-domains, ai, certifications, build-your-own-lab, and training-reference. This is a meaningful design decision. Most curated lists in this space fail because they accrete links without taxonomy; here, the domain taxonomy lives in cybersecurity-domains, which covers fundamentals, offensive security, defensive security, application security, cloud and container security, infrastructure and network security, cryptography and PKI, hardware and embedded security, governance/risk/compliance, and labs/practice.

What stands out in the current iteration is the dedicated ai directory. The repository's own topic tags — ai, ai-security, artificial-intelligence — signal that machine learning security has been promoted from an afterthought to a first-class citizen. Per the README, this section holds AI security material, LLM engineering resources, AI-assisted incident response and automation content, and AI ethics, privacy, and governance references. That last item matters more than it might appear: most offensive-security collections skip governance entirely, and its inclusion here reflects the reality that AI security work is increasingly inseparable from policy questions.

The certifications directory is another structurally interesting choice. The README notes that certification roadmaps — covering Cisco SCOR, cloud certifications, Kubernetes/CNCF tracks, CompTIA, ISC2, and offensive security certifications — are deliberately grouped separately so exam preparation material does not mix into the broader domain taxonomy. Anyone who has tried to study for, say, an OSCP-adjacent exam while wading through general-purpose links will appreciate this. The separation preserves the integrity of both use cases: the domain tree stays useful for practitioners, while the certification tree stays useful for candidates on a deadline.

For hands-on learners, build-your-own-lab is arguably the most operationally valuable section. It is described as a root-level directory of lab-building and cyber range resources — the scaffolding for exactly the kind of authorized, isolated environment where offensive techniques can be practiced legally. Pairing it with the labs/practice branch of cybersecurity-domains gives a reader a complete path: learn a concept, read the reference material, then stand up a range and exercise the skill against systems they own. That is the correct pedagogical loop, and it is rare to find a repository that closes it.

The training-reference directory rounds things out with cheat sheets, O'Reilly resources, curated lists of people and projects to follow, and organized tool indexes. The inclusion of a human layer — who to follow, whose projects matter — is a small but telling detail. Security is a fast-moving field where tool indexes go stale quickly, and pointing readers at maintainers and researchers whose output is consistently current is a hedge against link rot that pure tool lists cannot offer. The tool indexes themselves remain useful as a discovery layer, but the curated-people aspect is what keeps the section alive between commits.

Technically, there is not much to operate, which is the point. You consume h4cker through git clone https://github.com/The-Art-of-Hacking/h4cker or by browsing the rendered tree on the web, and the README's usage guidance is straightforward: start with the domain landing page matching your goal, then follow links down to tools, labs, scripts, and references. There is no build step, no dependencies, no configuration surface — the repo's value is entirely in curation and organization, not in runtime behavior. Contributors are directed to CONTRIBUTING.md, and the project is explicitly MIT licensed, which makes reuse in corporate training programs frictionless.

From a defensive perspective, h4cker is best understood as a map of what the training ecosystem is teaching. Blue team leads and security managers can scan cybersecurity-domains to audit their own team's coverage against a broadly accepted curriculum; the defensive security and incident-response subsections double as a skills checklist. Because the content is anchored to published books and formal coursework, it skews toward foundational and intermediate material rather than bleeding-edge zero-day research — a feature, not a bug, for anyone building a structured onboarding program.

The topic tags also reveal the repository's identity tension. Alongside ethical-hacking and penetration-testing sit vulnerability-management, vulnerability-assessment, and vulnerability-identification — tags that belong as much to a SOC or GRC workflow as to a red team one. This mirrors Santos's professional footprint across both offensive and defensive education. Practitioners should therefore not approach h4cker expecting an exploit dump; expect a curriculum, with offensive material framed inside an educational and authorized-testing context throughout.

There are limitations worth naming honestly. Because the README is a directory-level guide, depth varies across the tree — some domains are richly populated, others lean on external links whose freshness depends on the pace of community contribution. At nearly thirty thousand stars and backed by an active, well-known maintainer with an editorial process (CONTRIBUTING.md, explicit curation), the risk of abandonment is low, but the risk of uneven coverage is real, and readers should verify linked resources independently before relying on them in a production assessment.

Who should actually use this? The clearest audiences are students working toward the certifications indexed in certifications, engineers building a home lab from build-your-own-lab, and instructors assembling course material who want a permissively licensed, well-organized backbone. Working operators will find it most useful as a discovery and refresher layer rather than a daily-driver toolkit. Within an authorized engagement or a training program, h4cker functions as the connective tissue between theory and the specific tools you eventually run — and it does that job with an organization discipline that most of its imitators never manage to copy.

Official project repository for The-Art-of-Hacking/h4cker.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.