azure automation powershell scripts

Role-based access control in Azure Automation -
https://docs.microsoft.com/en-us/azure/automation/automation-role-based-access-control

https://azure.microsoft.com/en-in/product-categories/identity/

https://www.synopsys.com/blogs/software-security/agile-cicd-devops-difference/ (Agile, CI/CD, DevOps difference)

bugbounty programmes

ttps://www.guru99.com/bug-bounty-programs.html (top 30 in the year 2020)
https://www.guru99.com/digital-forensics.html (digital forensics , What is Digital Forensics? History, Process, Types, Challenges )
https://www.guru99.com/no-log-vpn.html ( Best 16 No-Log VPN (2020 Update))
https://www.guru99.com/cybercrime-types-tools-examples.html ( What is Cybercrime? Types, Tools, Examples )
https://www.guru99.com/skills-required-become-ethical-hacker.html

POWER SHELL scripts
UNIT testing validation of powershell scripts https://dev.to/omiossec/unit-testing-in-powershell-introduction-to-pester-1de7
https://stackify.com/powershell-commands-every-developer-should-know/#Performance (tutorial)


https://www.comparitech.com/net-admin/powershell-cheat-sheet/
https://devblogs.microsoft.com/scripting/unit-testing-powershell-code-with-pester/


https://docs.microsoft.com/en-us/powershell/scripting/whats-new/breaking-changes-ps6?view=powershell-7

https://opensource.com/article/19/2/testing-bash-bats (Shell script for LINUX)


https://www.guru99.com/frontend-testing.html
https://www.guru99.com/top-20-web-testing-tools.html

Web applications pen testing

https://www.veracode.com/security/arp-spoofing ( web application flaws and vulnerabilities tutorials)
https://www.apriorit.com/dev-blog/622-qa-web-application-pen-testing-owasp-checklist
https://www.hacker101.com/ (free video lessons on ethical hacking and bug bounty )
https://hackademy.aetherlab.net/p/burp-suite ( for manual testing with Burp suite for free video lecture)
https://www.guru99.com/complete-web-application-testing-checklist.html
https://www.instart.com/blog/4-common-web-application-security-attacks-and-what-you-can-do-prevent-them
https://www.blackhat.com/trainings/ (Training of Black hat)
https://www.whitehatsec.com/glossary/ (various vulnerable attacks and analysis)
https://portswigger.net/blog/null-byte-attacks-are-alive-and-well
https://www.veracode.com/blog/secure-development/top-five-web-application-authentication-vulnerabilities-we-find
https://www.exploit-db.com/docs/english/44319-web-application-security-testing.pdf


Interview questions -Pen Testing
https://www.janbasktraining.com/blog/security-testing-interview-questions/ (15 questions and answers)
https://resources.infosecinstitute.com/category/certifications-training/pentesting-certifications/pentesting-interview-questions/ (10 Common Interview Questions For Penetration Testers )
https://resources.infosecinstitute.com/category/certifications-training/pentesting-certifications/pentesting-interview-questions/
https://www.wisdomjobs.com/e-university/malware-interview-questions.html     (250+ MALWARE INTERVIEW QUESTIONS & ANSWERS)
https://www.wisdomjobs.com/e-university/malware-interview-questions.html (50+ interview questions on Cyber security)
https://www.edureka.co/blog/interview-questions/cybersecurity-interview-questions/
APPROACHES, TOOLS AND TECHNIQUES FOR SECURITY TESTING
https://www.3pillarglobal.com/insights/approaches-tools-techniques-for-security-testing

Attacking Types, Methadology, Counter measures
https://www.greycampus.com/opencampus/ethical-hacking/web-server-and-its-types-of-attacks
(Web Server and its Types of Attacks)

Tips for securing Web-based applications
https://searchsecurity.techtarget.com/tip/Tips-for-securing-Web-based-applications?bucket=ETA
webpage programming from KHAN Academy

https://www.khanacademy.org/computing 

web applications pen Testing and samurai framework for web applications testing

https://www.tutorialspoint.com/penetration_testing/penetration_testing_quick_guide.htm (step by step procedure on manual testing and automated pen testing)
 Penetration testers knowledge and expertise: 
Black hat attack methodologies (e.g., remote access attacks, SQL injection)
Internal and external testing (i.e., perspective of someone within the network, perspective of hacker over Internet)
Web front-end technologies (e.g.,Javascript, HTML)
Web application programming languages (e.g., Python, PHP)
Web APIs (e.g., restful, SOAP)
Network technologies (e.g, firewalls, IDS)
Networking protocols (e.g., TCP/UDP, SSL)
Operating systems (e.g., Linux, Windows)
Scripting languages (e.g., python, pearl)
Testing tools (e.g., Nessus, Metasploit)
In short, penetration testers provide a deep look into the data security of an organization.
https://www.netsparker.com/blog/web-security/getting-started-web-application-security/
https://searchsecurity.techtarget.com/tip/5-step-checklist-for-web-application-security-testing
https://www.tutorialspoint.com/penetration_testing/penetration_testing_quick_guide.htm
https://www.guru99.com/web-application-testing.html
http://www.internet-computer-security.com/VPN-Guide/SSL-VPN.html
https://sectools.org/tool/samurai/
https://www.apriorit.com/dev-blog/622-qa-web-application-pen-testing-owasp-checklist

What are the Skill-Sets of Ethical Hackers?
Expert ethical hackers have the following skill-sets to hack the system ethically

• They must be trustworthy.
• Whatever the risks and vulnerabilities, they discover while testing the system, they have to keep them confidential.
• Clients provide confidential information about their system infrastructure such as IP address, password, etc. Ethical hackers need to keep this information confidential.
• Ethical hackers must have sound knowledge of computer programming, networking and hardware.
• They should have good analytical skills to analyze the situation and speculate the risk in advance.
• They should have the management skill along with patience, as pen testing can take one day, one week, or even more.

What do Ethical Hackers do?
Ethical hackers (while performing penetration testing) basically try to find the answers to the following questions −

• What are the weak points that a criminal hacker can hit?
• What can a criminal hacker see on the target systems?
• What can a criminal hacker do with that confidential information?

Moreover, an ethical hacker is required to address adequately the vulnerabilities and risks, which he found to exist in the target system(s). He needs to explain and suggest the avoidance procedures. Finally, prepare a final report of his all ethical activities that he did and observed while performing penetration testing.

SSL VPN (Secure Socket Layer VPN)

       Now vendors have started making use of the SSL application layer protocol in conjunction with VPN’s. SSL provides excellent security for remote access users as well as ease of use. SSL is already heavily used such as when you shop online, accessing your bank account online, you will notice an SSL protected page when you see the “https” in your browser URL bar as opposed to “http”. The difference in using SSL VPN is, with IPSec a remote user would require client software and would need to configure this. However with SSL VPN you do not need any client software as you log into a portal. You just need the URL address and use a web browser to access the portal.The portal is a GUI interface that is accessed via a web browser and contains tools and utilities in order to access applications on the network such as RDP and Outlook. SSL VPN can also imitate the way IPSec works via a lightweight software client that can be configured and installed without much effort, which simplifies the process in securely accessing the corporate network.

       For a first time VPN user using SSL they would access the VPN gateway via their web browser either using an IP address or a domain name. This would take them to a GUI asking them to log in. To imitate that of the way IPSec works (giving full access to the network from a client) client software can be installed via ActiveX or Java. When client software has been installed, remote user would be able to login which will create a VPN tunnel from remote user to VPN gateway. Now the end user will have access to their network resources.

         The client software installed through a web browser is a breeze and in fact you would not notice much at all. All the settings are configured for you, and it is as simple as clicking a button when installing client software for SSL VPN.

Nessus tool, Code development of web applications and networking

Nessus tool report analysis
https://virginia.service-now.com/its?id=itsweb_kb_article&sys_id=75e70054dbb553404f32fb671d9619d5
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H (CVSS report analysis)
https://www.greycampus.com/opencampus/ethical-hacking/sniffing-and-its-types (SNIFFING types)
web applications
https://developers.google.com/web/tools/lighthouse/audits/oversized-images
https://securityintelligence.com/a-step-by-step-guide-to-vulnerability-assessment/  (security news for updates)
https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html (OWASP cheat sheets)
https://www.hackingarticles.in/sessions-command-metasploit/ (Hacking Articles)

https://www.greycampus.com/blog/information-security/penetration-testing-step-by-step-guide-stages-methods-and-application (Pen Testing - step by step guide)

https://www.eurovps.com/blog/important-linux-log-files-you-must-be-monitoring/ (Linux commands - Log files)