Not underground like the Russian Business Network but not as well known as some people think. These sites and conferences will be well known to some but I am amazed that everyone does not know about them.
- 2600 – An oldie but a goodie. 2600 is not professional by any stretch but the technical content is generally top notch. They often go far off the beaten path with articles about hacking POS systems and HVAC systems.
- Sla.ckers.org Full Disclosure Forum – The Slackers Full Disclosure forum has quickly become the place for disclosing vulnerabilities in web sites.
- XSSed.com – Similar to the Slackers full disclosure list but focuses on XSS. One nice feature is you can sign up for alerts.
- Full Disclosure List – Pretty much the bleeding edge of vulnerability disclosure. Traffic is decreasing as more 0 days go private. Still a good list to watch.
- BlackHat Security Conference – This conference has been around for a long time but still maintains a high speaker quality.
- ShmooCon – A great mid-size conference with excellent talks and a strong community focus.
- SecLists.org – Fyodor’s collection of security mailing lists. Essential reading.
- Packet Storm Security – Exploits, advisories, and tools. Updated constantly.
- DEFCON – The granddaddy of hacker cons. If you have not been you are missing out.
- Phrack Magazine – The original hacker magazine. The technical depth is unmatched.