Rohit Salecha
Sixteen Years In, Still Learning Over sixteen years in IT I have changed roles more than once, but one move stands out as the hardest and most instructive: from security consulting to security engineering . The two look adjacent from the outside. They are not — they are two different crafts, breaking and building, aimed at the same goal from opposite sides. Here is the idea this whole post rests…
Motivation Security teams often need the same answer across many repositories: “Where else does this pattern show up?” That might be a bug-bounty SQLi variant, a zero-day in a dependency, or a custom policy you encode as Semgrep rules. Running Semgrep repo-by-repo means scripting discovery, cloning, execution, and reporting yourself. semhound automates that loop at GitHub org (or user) scale: you…
👋 Introduction Following a successful MVP demonstration, a startup recently obtained significant funding. The next step involves a soft launch where security poses a crucial challenge. The initial PoC lacks basic security standards needed for customer trust and compliance for ex: secrets are strewn all across the code, everyone is having admin privileges to AWS and Kubernetes, Compute…
In today’s rapidly evolving technology landscape, ensuring the security of modern applications is a daunting task. With code running on containers in cloud environments, security engineers face the challenge of protecting not just the application itself but also its underlying infrastructure. Manual evaluation of security vulnerabilities is impractical given the volume and complexity of…
Motivation For quite some time I’ve primarily been using *nix terminal (Ubuntu-WSL2 and MacOS) and VSCode for most of my research/pentest and day-to-day work. I like to keep my base machine as clean as possible with the least number of softwares needed like just the CLI and browser. I would use this bare-minimum software to connect to my cloud machine where most of my softwares/services are…
Motivation This blog is a leaf out of my book Practical GitOps where I discuss how one can manage AWS infrastructure using Terraform and orchestrate it with Github Actions. As part of my book I’ve deployed a working SpringBoot application on AWS EKS as a base for explaining everything around it right from AWS Organizations to Secrets Management, IRSA to setting up an observability stack. This blog…
Motivation In 2018, I heard the term Kubernetes for the first time, and the only understanding I had of AWS was that we can run machines in the cloud that can be accessed from anywhere. Being in the security domain, hearing new technology terms and learning about these technologies has been an undying passion of mine. It took me two years to understand DevOps, and I created a small hobby project…
Introduction I wanted to extract the AWS Inventory spread out over multiple regions and accounts. Offcourse there are many solutions and different ways to do this but in this post I’d like to share how I was able to do this using an opensource tool called as CloudQuery To put in extremely simple words , CloudQuery converts your Cloud(AWS,GCP and many more) asset information into a SQL…
Security strategies today for most organisations is to Shift Security left more towards the developers Engage developers/architects in security processes so as to scale up Both these points are mutually inclusive i.e. need to be done hand-in-hand. One cannot scaleup security without shifting more towards the left and vice versa. If focus is trained on any one of them then the organisation will…
Kubernetes, is one of the most popular and most used container orchestration tool. Kubernetes Workloads are the actual applications that are executed like a simple nginx server or maybe a cron job. Kubernetes Deployments is the most commonly used workload as it can be easily updated,scaled and managed. The recently released Kubernetes Hardening Guide is an excellent resource that provides a proper…
Today on 29th December I passed my CKA(Certified Kubernetes Administrator) course ! I’d like to share my experience and some tips,tricks and notes for attempting this certification through this post. Before you begin you need to to first ask yourself, why you need to do this certification? Motivation I wanted to learn Kubernetes primarily from two perspectives I have been learning about…
Collection of things i wish to reference during pentests. None of the data here is mine. Everything is dervied from various sources over the internet. I have tried to reference as much as possible. Please comment below if you would like your work to be referenced. Burp Suite Extensions My complete list of Burpsuite extensions Token Conversions Token to Hex echo "token" | base64 -d | xxd -p –u Hex…
Collection of stuff that I wish to store for future uses and also content which is so small that donot deserve a separate blogpost Ubuntu Network Configuration I run ubuntu machines in VMWare and many times the VM fails to resume for god knows what reasons.Worst if i ever manage to get it started the networking configuration is erased. Hence saving below configurations for future. General Way cat…
In this blog i’ll discuss continuous monitoring using tools like Elasticsearch,logstash,kibana and filebeat. Here we’ll look at the configurations for each of these tools and how application developers can help the operations team to collaborate better by throwing relevant data real-time. Before We Begin I’ve created an entire DevOps Lab which can act as a good reference to reinforce…
In this blog we’ll explore one of the most popular software in DevOps world i.e. Jenkins. Here we’ll understand more on the ‘Pipeline as Code’ concept which is implemented using the Jenkins pipeline feature where all the instructions are fed into the ‘Jenkinsfile’ for complete automation. So most of our discussion in this blog will be understanding the Jenkinsfile. Before We Begin I’ve…
In this blog we’ll explore about Source Code Management using git, tokenization of credentials using Hashicorp Vault and how to avoid leakage of sensitive information using Talisman. Before We Begin I’ve created an entire DevOps Lab which can act as a good reference to reinforce learning for the purpose of this blog. If you’ve landed to this page directly i recommend reading my previous blog…
Infrastructure as Code(IaC) is a process of creating and managing systems using simple lines of code.In this blogpost we shall explore IaC through three technologies viz.. Vagrant Ansible Docker I’ve created an entire DevOps Lab which can act as a good reference to reinforce learning for the purpose of this blog. Vagrant As a security professional playing around with virtual machines was…
Motivation “DevOps” is one of the biggest buzzwords in the IT industry and is gaining considerable momentum in terms of technology,salaries,products and solutions every day. Being a security professional I was very much interested in learning about the allied technologies that are used in a DevOps environment as it offers a completely different attack surface. This blog series is my endeavour at…
Having a space to express your thoughts or share your knowledge is a soul satisfying endeavour for many. Hence there are multiple blogging platforms like Blogger,Wordpress etc… where we can easily create a website and start writing. I previously used Wordpress(hosted) and Blogger but eventually moved to having a platform which is more flexible to my needs and requirements. Issues with hosted…
This blogpost is actually a compilation of my efforts at making my Windows environment a lot more CLI and open source friendly. The idea of writing this post is that it serves as a reference for me in the future and for others who would wish to have a more CLI friendly windows. When I started to learn about DevOps I found myself increasingly using CLI for almost everything git,docker,vagrant…
When i was in IT , working for an MNC , i used to develop Web Applications in the J2EE domain. Development is fun and passionate developers make websites like twitter , facebook etc. But , i was always inquisitive of knowing behind the scenes action , as to how really a request reaches a server , and how is it processed in the server , how the database communication actually takes place , how…
For one of a project, i was required to learn and trained on Agile-Scrum framework for Software development. Being a security professional, it wasn’t much of use for me but i really wanted to know what exactly is this new framework all about so that everyone on the team is on the same page. More importantly, I wanted to understand how is it different from the traditional SDLC process of…
Add your privacy policy here and set draft: false to publish it. Otherwise, delete this file if you don’t need it.
Add your terms here and set draft: false to publish it. Otherwise, delete this file if you don’t need it.
On 11th July 2016 , I “provisionally” passed my CISSP exam after almost 5-6 Months of preparation. I am still waiting for them to send me the confirmation post submission of my endorsement form. ISC2 describes CISSP as “inch deep and mile wide”. Thats enough to confuse the hell out of you. Add to it the Big Fat books and the plethora of websites which help you prepare…
Dubai economy is growing at a fast pace due to the Dubai Expo 2020 . Owing to this fast pace growth there are a plenty of Job and Business opportunities cropping up in the city. If your relocating to Dubai for a business opportunity or for a Job , following are some of my experiences that i would like to share to help you in taking the leap ! Before you land in Dubai or make a decision to relocate…