Chandrapal Badshah | Security Engineer on Chandrapal Badshah

Never Trust Your AI Agent's Own Sandbox

For the last few weeks I’ve been trying to sandbox agents on my machine. Coding agents and other autonomous ones that fire on a trigger and run a workflow while I’m not watching.

The Hunt for an Open Source AI Workflow Tool

I wanted to build a SOC agent. Nothing exotic. Something that picks up an alert, investigates it across the tools we already run, and tells me what it found. And for the workflows where it wants to change something - update a WAF rule, delete a resource - it stops and asks a human first. I thought the hard part would be the agent. It was finding something to orchestrate it.

AI Is the Best Thing to Happen to Security

LLMs have been around for a while now. When Anthropic released a statement that nation state attackers are using Claude for attacks, I read it with a lot of skepticism.

Let Attendees Say No to Conference Swag

TL;DR: Allow attendees to politely decline the conference freebies. I’ve attended quite a few tech conferences in India over the years, both as a speaker/trainer and attendee. Conferences can improve execution, meritocratic selection panels, and the ratio of sponsored to overall talks. These are mentioned as part of overall feedback to the event. But one thing is rarely questioned. The…

How 'What Can Go Wrong?' Went Wrong

I recently spoke with a close friend who’s been in the security industry for over a decade. We discovered an interesting issue we both had, but never discussed. Both of us had become pessimistic. It’s not terminal pessimism. It’s not like there’s no point in living, doing anything, or initiatives. But it is subtle and strong enough to hinder growth. Let me tell you how I…

Securing a SaaS Company's AWS Environment After a Breach

A growing SaaS company contacted me after a serious AWS breach. The attacker accessed staging and production accounts with administrator privileges and caused significant damage: Compromised databases Critical resources and backups deleted Data exfiltration By the time the CTO called me in, DevOps team contained the breach. The team recreated resources in a new AWS account. But significant damage…

The Key Factor Behind TablePlus's DDoS Resiliency

TablePlus published a blog post on how they did nothing to handle a DDoS attack. Their blog post titled “ We are under DDoS attack and we do nothing ” - published at the end of March 2024 - caught my eye when it quickly reached the top of Hacker News .

Ultimate Guide to Fail at Least Privilege in Cloud (and the Hard Lessons I Learned)

Least privilege is a defense-in-depth strategy that everyone talks about. While I first heard it a few years back this seemed to be a magical solution to a good number of security issues I faced.

Kickstarting in Cybersecurity: Strategic Advice for 2nd and 3rd Year Indian College Students

How to get started in cybersecurity? This is the first question I get from many students attending Null Bangalore meetups, security conferences, and more.

Beyond the Basics: AWS WAF's Lesser-Known Limitations

AWS WAF service is an L7 firewall service offered by AWS. It’s easy to set up, seamlessly integrates with other AWS services (ALB, API Gateway, etc.), and comes with a handful of managed WAF rulesets and rate limit features.

My Key Takeaways from AWS re:Inforce 2023

The much-awaited AWS re:Inforce 2023 videos have finally landed on YouTube. You can now pick your favorite track and watch the sessions at your own pace here - https://www.youtube.com/@AWSEventsChannel/playlists?view=50&sort=dd&shelf_id=2 .

The Risk You Can't Afford to Ignore: AWS SES and Email Spoofing

AWS SES is used in multiple ways - automated reminders, marketing emails, security automation & alerts, etc. There’s a risk with the domain verified on SES; often overlooked. A risk that falls at the intersection of Cloud and Enterprise risk.

My Love/Hate Relationship with Cloud Custodian

I’m a huge fan of the Cloud Custodian tool. If you hear the name for the first time - it’s an open-source rules engine for cloud security, cost optimization, and governance.

One important feature that Dependabot is missing

GitHub’s Dependabot feature allows you to detect and fix vulnerabilities in code dependencies for all your repositories (public and private). Despite being a handy tool in securing software supply chain, it’s missing a very important feature.

Did you completely remove secrets from git repository? Really?

Removing secrets from git repo is straightforward. With help of BFG Cleaner and privileges to force push the modified history, it’s a piece of cake. I believed this until I found I was partially wrong - removing something from git history doesn’t remove them from git repository’s history.

GuardDuty - the Good, the Bad and the Ugly

If you listen to anyone discussing AWS security, you probably heard about Amazon GuardDuty . It’s an intelligent “threat detection” service from AWS. It’s similar to an IDS system because it detects issues but doesn’t prevent them.

What should you use - CloudQuery or Steampipe?

CloudQuery and Steampipe have very similar functionalities. The actual difference is with the way they work and the problems they solve. This blog post compares both the tools and helps you answer the question: What should I use - CloudQuery or Steampipe?

Things I wish I knew about AWS WAF - Bot Control

AWS WAF might be your first layer of defense for attacks on websites hosted on AWS. While WAF does its best at blocking web attacks, it doesn’t stop web abuses - like bot attacks involving API abuse. For example, submitting comments on pages, credential spraying, OTP bruteforce/resend, etc.

Vulnerable API writeup

Most of the applications I see these days heavily depend on APIs. Pentesting them is a bit different than that of web applications. In this writeup I will show you how I discovered the vulnerabilities in the “ Vulnerable API ” project.

How to remove DNS record takeover bug class ?

Dangling DNS records are not something new. They are just out-of-date DNS records which may have served its purpose in the past. This DNS record trash has been there for ages and was not considered a security issue. They are pointing to some resource (IP or DNS record) that was owned/trusted in the past. What makes the dangling DNS record deadly is the fact that others can seize the resources that…

Adding Gitleaks to Gitlab CI Pipeline

Gitleaks has become quite popular. Its features gives a tough competition to its predecessor trufflehog. Some of its uber cool features are: Comparatively fast when scanning large repos (as it is a compiled Golang binary) It can run on all platforms that Golang supports. User can add custom regex to detect more secrets Allows whitelisting of detected secrets / false positives Allows audit of…

Creating a Cloud Function to publish messages to Pub/Sub

Every time I want a cloud managed message queue, I would look at AWS SQS service. It’s simple. Create a SQS queue, get the HTTP endpoint for the queue, start posting the messages using any HTTP client like curl. This time I made up my mind to give GCP’s counterpart a try. The GCP’s counterpart is Pub/Sub. On a high level, the queue is known as topic in the Pub/Sub terms.

Fast Reverse DNS Lookups using FDNS and MongoDB

As part of my research, I wanted a way to find all the DNS records which points to a particular IP address. Not only should it be fast, it should be cheap as well. If you are a DNS researcher you would know about the Rapid7’s free FDNS dataset. I was not able to find any online post that showed me how to get subdomains using IP address in the FDNS dataset.

Faster nmap scanning with the help of GNU parallel

When you give access to developers to create firewall rules, they generally open all sorts of ports to the internet. All they need to do / expected to do is get the product working. The rest doesn’t matter. This was the same with the company I worked with. There were tonnes of firewall rules in the GCP projects which opened many ports to the public internet. One could think of deleting firewall…

Finding Route53 logs with the help of CloudTrail and Athena

If your company uses AWS Route53 to manage DNS records of its domains, there might a situation where you want to find which IAM user created / modified which DNS record. The reason for this could be anything: asset management, to find root cause of a security incident (like subdomain takeover) or simply to cleanup unused DNS records. This could be done with ease if you have CloudTrail logging…

Backup and restore ElasticSearch data using GCS

You don’t know what you got until it’s gone. And unfortunately it’s the same with data. The importance of backup is mostly realised after loosing the data. After a few data incidents, I have made backups of all my ElasticSearch clusters. I have also made it a habit to create backups and then go ahead with using ES cluster to store data. In this article I will be using Google Cloud Storage (GCS)…

How I hosted a DNS server on AWS ?

Wait. I know what you are thinking now. Who on earth would do such a crazy thing ? Why would a person even host a DNS server on AWS when one could use Route53 to efficiently manage DNS records. The answer is simple: I’ve been a user of DNS since my first interaction with the internet, but have no clear idea on how DNS works. So I started learning how DNS works and more on how DNS server works.

Efficient way to pentest Android Chat Applications

Setting up a pentest environment for a single Android application to test its functionalities is simple. The process involves just setting up an Android emulator, installing the app, sending the traffic through a proxy tool like BurpSuite and playing with the traffic to find interesting behaviour. When it comes to setting up pentest environment for an Android chat application, the setup slightly…

Managing Linux Users & SSH keys using Ansible

Today I was assigned a task to create user accounts on an EC2 instance (Ubuntu) and also add SSH public keys to the respective user account’s authorized key list. The EC2 instance would act as a gateway to access the internal network. (This is a basic setup in which the user creates an SSH tunnel to access resources on the internal network. It’s not a foolproof security solution but controls…

Bucket Policy for your Public S3 Bucket

Recently I came across multiple AWS S3 buckets with directory listing enabled. The content in the buckets ranged from simple images & js files to images of aadhaar ID, PAN cards, etc. Whats the reason ? Security is a non-functional requirement of business. What I have seen so far is that if a developer gets an idea, he/she will work to implement the idea without thinking much about the security of…

Talks

List of slidedecks and videos of my talks in past: 2025 Cloud Breach Tactics: Enumeration to Initial Access (Workshop @ Vulncon) [Slides] LLMs from Scratch for Security Engineers (Talk @ SecurityBoat Community) [Video] [Slides] 2024 With infinite scale comes infinite bill (and bankruptcy) (Talk @ Rootconf 2024) [Video] Well, it’s just an AWS Account ID! (Online Talk @ Null Coimbatore)…

Explore

Freebies

Coming Soon! Keep an eye on my LinkedIn profile!

Gooir

Kana

Mozar

Stay Fit

Trainings

Hands-on training is the fastest way to learn Cloud Security - let’s BREAK and FIX things together. My trainings are just about that. No death by PowerPoint - pure hands-on learning. How My Trainings Differ! Maximum Hands-On: Be it offense or defense - you learn by doing, not by just listening! Customized with End Goal: Training adapted to your team’s cloud environment and security…

Zorro