added stuff

Exploits/Databases/NodeJS-SQL-Injection.md

@@ -0,0 +1,10 @@
+# NodeJS SQL Injections
+
+* [Stackhawk's article]( https://www.stackhawk.com/blog/node-js-sql-injection-guide-examples-and-prevention/) shows how to do SQL injection in nodejs
+
+```sh
+username=admin&password[password]=1
+```
+
+#TBD
+

Miscellaneous/Atomic Read Team.md

@@ -0,0 +1,56 @@
+# Atomic Red Team
+
+https://github.com/redcanaryco/atomic-red-team
+
+## Structure
+
+YAML files are used to describe a specific attack, which then can be replayed. Automatically most of the time.
+These scenarios are used for testing purposes.
+
+## Atomic Red Team for Powershell
+
+* [Invoke-AtomicRedTeam](https://github.com/redcanaryco/invoke-atomicredteam/wiki)
+
+Cmdlets are `Invoke-AtomicRedTeam` and `Invoke-AtomicTest`.
+
+
+Import the module
+```powershell
+powershell -ExecutionPolicy bypass
+Import-Module Invoke-AtomicRedTeam.psd1 -Force
+$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Users\Administrator\Desktop\atomics"}
+```
+
+### Invoke-AtomicTest
+
+Use `Invoke-AtomicTest` 
+```sh
+Invoke-AtomicTest <MITRE TacticNo.> -ShowDetailsBrief
+Invoke-AtomicTest <MITRE TacticNo.> -ShowDetails
+```
+
+Check if prerequisites are available
+```sh
+Invoke-AtomicTest <MITRE TechniqueNo.> -GetPreReqs
+```
+
+
+Multiple techniques can be executed through the following line
+```sh
+'T<number>', 'T<number>', 'T<number>' | ForEach-Object {echo "Enumerating Tactic $_"; Invoke-AtomicTest $_ -showDetails}
+```
+
+Use `-cleanup` to revert the changes. Use `-promptForInputArgs` to set variables interactively.
+
+### Argument Customization
+
+Customize arguments of a test execution via
+```sh
+$customArgs=@{"user" = "username"; "password" = "securepassword"}
+Invoke-AtomicTest T<number>-<Testnumber> -InputArgs $customArgs
+```
+
+### AtomicGUI
+
+There is a web application that can be started via `Start-AtomicGUI` to create new atomic rules.
+

README.md

@@ -67,14 +67,5 @@ Authorized audit of security systems of computers and networks.
 * [OSSTMM3](https://www.isecom.org/OSSTMM.3.pdf)
 * [NIST](https://www.nist.gov/cyberframework)
 * [CAF](https://www.ncsc.gov.uk/collection/caf/caf-principles-and-guidance)
+* [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) as a practical approach
 
-## Testing Webapps
-
-* Two methods
-1. Every Page and its functions one by one
-2. Test by stages 
-    * Authorization
-    * Authentication
-    * Injection
-    * Client Side Controls
-    * Application Logic