I have been wanting to learn about kubernetes k8s since long, and create this blog series. Here we are finally started (thanks to null cloud security study group ), so without wasting too much time let’s get started. I am learning this having a security mindset, to find common misconfigurations and understand the development process to understand the mitigation. K8s is a container orchestrator. Before diving too much into the depth let’s see what orchestrators/orchestrations are....

WinjaCTF at c0c0n [2021]: I developed an easy challenge - called “Anonymous” - the challenge was based upon browser forensics. TL;DR Intended Way - Download the zip > Extract it > Navigate the Linux directory structure > To find a directory called .config > google-chrome > Default > Open the History File in SQL Browser > Search for URLs and upon up the URL to get a file with the name - formatted like flag....

If you have used Burp’s collaborator client for your Out-of-band testing, you know it’s awesome. Then why there is a need for a personal collaborator client? There are a few things that need to be addressed. Companies have started to blacklist burp collaborator’s domain, making it difficult for OOB vulnerabilities detection. ( Read here ) Collaborator client is not available for the community/free edition of BurpSuite. This brings the need for having a personal collaborator client, with no to minimal investments, that will help us in the detection of any out-of-band/blind vulnerabilities, and I have linked an amazing cheatsheet below that will guide in OOB Exploitation....

What’s a proxy? A proxy acts as a gateway between you and the internet. The internet traffic flow back and forth if a proxy is setup in the middle. So, what is the need of proxy? There are several reasons organizations and individuals use proxies: Control and monitor internet usage Proxy servers can give better speed and bandwidth by caching websites Proxy servers can also be setup along with VPNs to provide anonymity and better security There are different types of proxies, but a specific type of proxy that we are going to talk about in this blog is interception proxy....

You don’t need money to buy expensive things, sometimes hard work pays off. And yes nullcon trainings are still expensive for me xD and I am grateful that I got this chance to attend one. One year ago, I was going through the nullcon training schedule, and trying to understand the structure, and how much I can learn from it, because it was too expensive for me to get the actual training....

July 6th, 2020: It all started with this mail. I received a scholarship for CEH Practical (applied two times xD) and I had to pay $99 to take the exam. I guess it was worth it. Battling with college and other stuff, I used to think I am not ready yet and kept on postponing it until 6th of November, 2020. I finally took the exam and passed it easily, and now that I look back, I could have done it then as well, but yeah....

The CTF is live on Hacker101 as Grayhatcon CTF – Hacker101 CTF The CTF was built upon real vulnerabilities found during bug bounties. It had four flags – 250 points each. Objective - Hackerone’s Username and Password database has been leaked and put on an auction. Our task was to delete the auction listing before anyone buys it. We were given an IP, which resolved to a web application....

This is related to a talk given by me and pre & post-event activities, that were conducted at Developer Circles, Pune and Bengaluru. It all started with DEFCON 2020 Red Team Village CTF, my team and I reached the Top 50 and it was just amazing for all of us. It was an enriching experience, solving challenges from a wide range of categories and learning new stuff in the process. One section of the CTF dealt with Malware Analysis and I was fascinated by this domain of security and have been learning about it....