Skip to content
View abdullahzarshaid's full-sized avatar
2 followers · 6 following

Block or report abdullahzarshaid

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
abdullahzarshaid/README.md

Abdullah Bin Zarshaid, Cybersecurity, Information Security, GRC and Corporate Training

Abdullah Bin Zarshaid

Cybersecurity Manager & Security Researcher

Information Security · GRC · Security Assessment · Corporate Training

I work as a cybersecurity manager, combining hands-on security assessment with information-security governance, risk and compliance. My work spans web and API security, network security, practical tooling, research and teaching. This portfolio brings together tools I build, coauthored research and learning resources.

My personal site is abdullahzarshaid.com. ABZSECURE is the consultancy and training brand I run. This GitHub account holds my own tools, research and teaching material.

Try PostureKit · Try EvidenceGate · Read the handbook · Pick a GRC tracker

Latest (17 October 2026): PostureKit 0.6 and EvidenceGate 1.0.0 are tagged releases with continuous tests on Linux, Windows and macOS, project pages and citation files; the handbook's October 2026 edition and the GRC trackers 1.0.1 are downloadable releases. Next: a Web and API penetration testing manual, lab targets only, written from the basics up.

Connect on LinkedIn Personal website View ORCID research profile Email Abdullah

Choose your starting point

Use a tool: PostureKit demo · EvidenceGate demo

Learn the workflow: From Scope to Security Evidence

Run security work in spreadsheets: six GRC trackers, pick one online

Research & contributions

CWE proposal, explicit session termination

I submitted Improper Enforcement of Explicit Session Termination to the CWE Program. The proposal is publicly tracked in the CWE Content Development Repository, issue #224, submission ES2609-7b54439f.

Status checked 25 September 2026: receipt acknowledged (Phase02-Ack-Receipt); evaluation pending. This is a proposal, not an assigned or accepted CWE entry. The linked issue is the source for subsequent status changes.

Session-lifecycle research

Lifecycle Conditions in CWE-613 Disclosures: A Reproducible, Evidence-Linked Characterisation (earlier working title Logout Is Not Expiration), with Shahbaz Akhtar Siddiqui. Manuscript under peer review; the data and code repository will be opened when the review concludes. Record on ORCID.

Tools & technology

Build & automate

Python   PowerShell   Bash   Git

Python · PowerShell · Bash · Git

Platforms & environments

Kali Linux   Linux   Docker   Microsoft Azure

Kali Linux · Linux · Docker · Microsoft Azure

Security assessment & analysis

Burp Suite   Nmap   Wireshark   Metasploit

Burp Suite · Nmap · Wireshark · Metasploit

Also in the assessment workflow: Greenbone / OpenVAS and Active Directory.

How I approach the work

  • Evidence before conclusions. Keep observations, interpretations and confirmed impact distinct.
  • Clear scope. Assess only authorized systems; keep private engagement material out of public examples.
  • Useful artifacts. Prefer inspectable Python and PowerShell, documented limits and reproducible examples.

Across the security lifecycle

  • Assess & investigate: Web and API security; network and wireless assessment; Windows, Active Directory and cloud configuration.
  • Govern & improve: Information-security governance; risk assessment; control mapping; evidence quality and remediation tracking.
  • Teach & research: Corporate training; practical labs; assessment methodology; reproducible security research.

Teaching materials retain contributor credit; research identifies its coauthors and publication status in the project repository. My earlier master's work on SDN-enabled IoT security is being revisited; it is not presented here as a new released tool or a published result.

Useful community resources

OWASP · NIST Cybersecurity Framework · MITRE ATT&CK · PortSwigger Web Security Academy

These are independent third-party resources, not my projects or endorsements of my work.

Connect

LinkedIn · Website · ABZSECURE · ORCID · Email

For a tool issue, please use its repository's issue tracker with a synthetic, sanitized example, never live credentials or client evidence.

Pinned Loading

  1. ethical-hacking-labs ethical-hacking-labs Public

    19 ethical-hacking topic guides: isolated practice, assessment evidence and defensive controls, with credited student examples.

    16

  2. evidencegate evidencegate Public

    Local evidence-quality checks for security assessments: SHA-256 integrity, CVSS 3.1, HTTP capture structure, scope and selected secret patterns.

    Python

  3. network-security-assessment-handbook network-security-assessment-handbook Public

    A 138-page practitioner's handbook: from networking fundamentals to network, wireless, web, API, cloud and directory assessment. Based on NIST SP 800-115, PTES, OWASP and MITRE ATT&CK.

    HTML

  4. posturekit posturekit Public

    Evidence-led Windows, Active Directory and wireless posture assessment with Python/PowerShell and scanner importers.

    Python

  5. abzsecure-grc-templates abzsecure-grc-templates Public

    Six original MIT-licensed GRC Excel trackers for risk, evidence, remediation, vendors, policies and assessment scope.

    HTML