TLS

SSL/TLS and PKI History A comprehensive history of the most important events that shaped the SSL/TLS and PKI ecosystem (i.e., certificates and certification authorities). Describes the major vulnerabilities discovered in this area.
SSL Server Test Free online service performs a deep analysis of the configuration of any TLS SSL web server on the public Internet (is the TLS configuration ofn esse3.units.it ok?)
Security Headers A similar service that focusses instead on the security-relevant HTTPS headers.

TLS internals

31 TLS from Computer Security at Berkeley (CS161). Everything in this book is more than ok.
The Illustrated TLS 1.2 Connection Every byte explained and reproduced (TLS 1.2, TLS 1.3, QUIC)
The First Few Milliseconds of an TLS 1.2 Connection
Why use TLS 1.3? by Cloudflare, clear and concise.

13. Certificates from Computer Security at Berkeley (CS161). Everything in this book is more than ok.
What’s going on with certificate revocation? A fantastic description of why certificate revocation is so hard. Complex because the topic is complex.
Delegating trust is really, really, really hard (infosec edition) A fantastic description of why defining and managing trust in certification authorities is so hard. Complex because the topic is complex.
Russia’s certificate authority for sanctioned organizations
The Difference Between Root Certificate Authorities, Intermediates, and Resellers
Checking if a Certificate is Revoked: How Hard Can It Be? Another discussion of why certificate revocation is hard.

Understanding certificate pinning
Certificate pinning: A Comparative Analysis of Certificate Pinning in Android & iOS. A scientific paper with a large scale analysis. Interesting for understanding how to determine whether a smartphone app indeed implements Certificate pinning. "We find that 0.9% to 8% of Android apps and 2.5% to 11% of iOS apps use certificate pinning".
Intercepting Android App Traffic with BurpSuite Video on setting up an Android VM, Installing the Burp Certificate in the System Store, and proxying application traffic through BurpSuite. It also go over using Frida to defeat certificate pinning.
Easy Way to Bypass SSL Pinning with Objection & Frida (Beginner Friendly)

Encrypted Traffic Analysis (ENISA) Key use cases: application identification, network analytics, user information identification, detection of encrypted malware, file/device/website/location fingerprinting and DNS tunnelling detection.

mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols
Burp Suite Community Edition Start your web security testing journey for free.
Fiddler Web debugging proxy for MacOS, Windows, and Linux

Evilginx 3.0 Man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection.
- This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide man-in-the-middle functionality to act as a proxy between a browser and phished website.
- Most existing tutorials are for version 2. Version 3 phishlets (i.e., YAML configuration files for targeting a specific site) are not fully compatible with version 2, hence some tutorial might not work with the new version.
Bypassing 2FA Authentication with Evilginx2
How to set up Evilginx to phish Office 365 credentials