Shivasurya
Recent content on Shivasurya
Latest posts
Same Bug, Different Endpoint: Finding Path Traversal in Langflow with Code Pathfinder
CVE-2026-33186: Bypassing gRPC-Go Authorization with a Missing Slash
2025 Wrapped
2025 Wrapped Published 📰 Sourcegraph Blog: Lessons from building Sherlock: Automating security code reviews with Sourcegraph Built AI security agent around 2024 and wrote a blog post about it. Tried out Multi-Turn Reinforcement Learning for security vulnerability analysis using verifier framework. Turns out it’s amazing and has lot of stuffs to explore and learn. Shipped 🚀 Secureflow AI ,…
Some thoughts around Django SQL Injection CVE-2025-64459
Vulnerability Overview Yesterday I came across this CVE-2025-64459 and I was bit skeptical about the severity of the issue as it was marked as critical. So I decided to do a deep dive into the issue and see if it was a real issue or not. Turns out it was a real issue only if you’re meeting the following conditions: You’re using Django Affected versions >= 5.2a1, < 5.2.8 >= 5.0a1, <…
Claude Code for Security Analysis: Introducing SecureFlow CLI to Hunt Security Vulnerabilities
AI-Powered Security Vulnerability Hunting at Scale SecureFlow CLI is an open-source agentic SAST security tool that uses AI-powered loops to autonomously hunt for vulnerabilities in codebases. Built on the same principles as Cline/Cursor/Windsurf/Claude-Code for Security Analysis, it leverages LLMs and tools to navigate code, gather context, and identify security issues. Example: WordPress Plugin…
Exploring fun parts of Neural Network
Back in 2017, I used to tease my friend about his machine learning work (training models, dataset operations, ML deployments) - “Come on, admit it, aren’t you just writing complex if-elif-else statements and calling yourself an ML engineer?”. While Google was bringing ML models to mobile devices using tensorflow, I remained indifferent as I couldn’t grasp the underlying…
Rethinking MCP or Tool Calling Through Permission Based System
Model Context Protocol (MCP) and Tool Calling are revolutionizing the application layer of Large Language Models (LLMs), enabling AI to autonomously operate tools and MCP servers to complete tasks. While these capabilities are typically distributed as npm packages or hosted remotely, this distribution method poses potential security risks through malicious code. Despite these concerns, Tool…
Static Analysis Isn't Enough: Understanding Library Interactions for Effective Data Flow Tracking
Originally published on the Code-Pathfinder Blog .
Lessons from Building Sherlock: Automating Security Code Reviews with Sourcegraph
Originally published on the Sourcegraph Blog .
LLM-Powered Security Reviews: Insights and Challenges
Introduction In a previous post on the Sherlock blog , I discussed leveraging large language models (LLMs) to assist with security code reviews. There’s no doubt that LLMs outperform traditional static application security testing (SAST) tools in several ways, enhancing the security review process by: Reducing false positive rates Increasing the accuracy of findings Uncovering previously…
How I Use AI to Streamline/Assist My Work
Intro While there’s a lot of skepticism about using AI to automate tasks, I’ve found AI tools to be invaluable allies that enhance my results and handle niche tasks. 🤖 Reflecting on My LLM Usage I used to pay for OpenAI & Anthropic Claude API access and regularly automated several tasks until recently when DeepSeek-v3 was released, cutting costs by at least 50% while maintaining the…
2024 Wrapped
2024 Wrapped Read 12 books Built Code-Pathfinder , Open-source alternative to GitHub CodeQL Received positive interest and interaction from various people working for Microsoft, GitHub, Elastic and TrailofBits Mind-blown to see people reaching out regarding the project :) Welcomed our beautiful baby girl into the world! 👸 Grateful to Grand River Hospital staff & volunteers for the exceptional…
Books I read in 2024
Books If you’re looking for a great device to read books, highlight important sections, and take notes, the Kindle Scribe is a fantastic option. It’s especially handy for times like waiting at the airport/hospital, traveling by flight/train. Pro tip: You can always send pdf/epub to kindle and read it on kindle. Security & Programming Building a Large Language Model from Scratch Building…
CodeQL: Eindhoven Quantifier Notation
Introduction Recently, I have been thinking about aggregate functionality design for Code PathFinder , opensource alternative to GitHub CodeQL . SQL aggregate functions such as SUM , AVG , MIN , MAX are combined with WHERE and GROUP BY to generate aggregate queries. However, I was wondering if there is a way to generate aggregate queries without using WHERE and GROUP BY . While going through…
Sherlock: Automate security code reviews with Cody AI
Intro Need for semi-autonomous security code reviews My job as a security engineer (application security context) is to read source code and perform security reviews. Most of the time, mainly corelate the source code with frameworks & libraries, understand context where the code executes and enumerate all security risks. While there are lot of second generation SAST scanning tools in the market…
Defining Boundaries & Sinks for Inter-procedural Source Sink Analysis - Part 3
This is the third part of the blog post series on building inter-procedural source sink analysis from scratch. In the first part, we have built the intra-procedural source sink analysis . In this blog post, I’ll discuss about defining boundaries, configs and sinks for inter-procedural analysis. ✨ This idea of defining boundaries and sinks is inspired from the CodeQL library and while…
Deep dive on Android Java / Kotlin Deserialization Code Execution with Semgrep Detection
Overview In this post, we will explore code execution using Java & Kotlin Deserialization in Android Application. Additionally, We will discuss the Gadget Chain, Detection and Exploitation technique specific to Android. Achieving code execution in server side application via Java deserialization has higher chance of success than in client side android application. This is due to limitation of…
2023 Wrap - Year in Review
2023: A Year of Unexpected Adventures and Rich Insights. Here’s a glimpse into my journey and the accomplishments, lessons I’ve gathered along the way. Well this blog doesn’t feature lot of stuff, but I’m trying to keep it simple. Trimming Down: Weight Loss Journey 🏋️ “Psychology for Money shapes your wealth; Noom shapes your health.” It’s been an…
Building Inter-procedural Source Sink Analysis from Scratch - Part 2
This is the second part of the blog post series on building inter-procedural source sink analysis from scratch. In the first part, we have built the intra-procedural source sink analysis . In this blog post, we will be building the inter-procedural source sink analysis. Plan We’ll be parsing whole java project source code and generate AST using JavaParser. While traversing the AST, we will…
Building A Simple Source-Sink Analysis in Java from Scratch - Part 1
Overview of Source Sink Analysis Source Sink Analysis is a type of basic static analysis that detects the flow of information from a source to a sink. A source is a place where the information is coming from and a sink is a place where the information is going to. For example, a source can be a user input and a sink can be a database query. If the user input is not sanitized, it can lead to SQL…
From ArcGIS to Mapbox: How Cody AI Made My Web App Shine
Imagine being a newcomer to Canada around 2019, relying on public transit to navigate the Waterloo region. Like many others, I found myself frustrated with the occasional unreliability of Google Maps when searching for public transit options. However, my luck changed when I stumbled upon a cool command line tool developed by a UWaterloo student that predicted the next bus or LRT arrival time…
Building A Simple OpenAI Powered Personal Assistant
In high school (~2012), I made a significant upgrade from my Nokia 1600 to an Android Jelly Bean device, API 16. I was fascinated by the apps available on the Play Store and became curious about creating my own. That’s when I discovered Adobe PhoneGap and ventured into HTML5 app development using jQuery Mobile. It was a thrilling and rewarding experience, culminating in the deployment of my…
Heap Two Writeup - Exploit Education Lab Exercise
If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack…
Heap One Writeup - Exploit Education Lab Exercise
If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack…
Heap Zero Writeup - Exploit Education Lab Exercise
If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack…
Format Four Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise Stack Six Writeup - Exploit Education Lab Exercise Format Zero Writeup…
Format Three Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise Stack Six Writeup - Exploit Education Lab Exercise Format Zero Writeup…
Format Two Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise Stack Six Writeup - Exploit Education Lab Exercise Format Zero Writeup…
Format One Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise Stack Six Writeup - Exploit Education Lab Exercise Format Zero Writeup…
CVE-2023-23397 - Zero Click Net-NTLMv2 Credential Hash Leak on Outlook Client
Quick Overview Microsoft announced patch for CVE-2023-23397 which generally goes out usually on tuesday (Mar 14, 2023). This particular vulnerability caught my eyes due to the fact that I actively work on Active Directory based HackTheBox machines and this one is something similar to Android Application Exploits where attacker passes random url to activities or services and the outbound network…
HackTheBox Active Writeup - Active Directory - OSCP Practice
Quick Overview Active is one of the easy Active Directory focused Windows Box from TJNull OSCP Practice list . It’s one of those easy machine where you get initial foothold via SMB Replication share leak & escalate privileges using Active Directory weakness. Enumeration NMapAutomator Started with enumerating the target with NMapAutomator script since it helps in automating all possible ports…
Format Zero Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise Stack Six Writeup - Exploit Education Lab Exercise If you haven’t…
Stack Six Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise Stack Five Writeup - Exploit Education Lab Exercise If you’re learning and writing binary exploits, I would strongly…
HackTheBox Jerry Writeup - OSCP Practice
Quick Overview Jerry is one of the Windows Box from TJNull OSCP Practice list . It’s one of those quite easy machine where you get initial foothold & privilege escalation in a single hop. Enumeration NMapAutomator Started with enumerating the target with NMapAutomator script since it helps in automating all possible ports with vulnerability scripts from nmap . Additionally, NmapAutomator can…
HackTheBox OSCP Writeups - Shivasurya.me
Quick Overview This blog post acts as Index of TJNull HackTheBox OSCP Practice list . I myself enjoyed solving all those HackTheBox VM and started writing writeups to help other folks out there striving hard to crack OSCP exam 🎮 Index Closing Note: I hope this post is helpful for folks preparing for Offensive Security Certified Professional certification exam. For bugs,hugs & discussion, DM in…
HackTheBox Bashed Writeup - OSCP Practice List
Quick Overview Bashed Box is one of the Linux Box from TJNull OSCP Practice list . It’s one of those quite easy machine where you get initial foothold in one hop and privilege escalation in second hop. Enumeration NMapAutomator Started with enumerating the target with NMapAutomator script since it helps in automating all possible ports with vulnerability scripts from nmap . Additionally,…
Detecting Android WebView Vulnerable Configurations with Semgrep Rules - Part 1
Android WebView widget provides APIs that help developers seamlessly integrate webpage contents within Android application. Advancement in Webview & Chrome Custom Tabs lead to exponential growth in webview based mobile development platforms such as Ionic framework , JQuery Mobile , Adobe Phonegap later open-sourced as Cordova Project , React Native . However the race to capture the mobile…
Stack Five Writeup (Code Execution) - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit Education Lab Exercise If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64…
Stack Four Writeup - Exploit Education Lab Exercise
Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah . They cover a wide…
Stack Three Writeup - Exploit Education Lab Exercise
If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah . They cover a wide variety of learning assembly instructions which will be really helpful to understand the exploits. If you haven’t done setting-up your lab, feel free to check out my previous article on Exploit.education lab setup Previous…
Stack Two Writeup - Exploit Education Lab Exercise
If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah . They cover a wide variety of learning assembly instructions which will be really helpful to understand the exploits. If you haven’t done setting-up your lab, feel free to check out my previous article on Exploit.education lab setup Previous…
Stack One Writeup - Exploit Education Lab Exercise
If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah . They cover a wide variety of learning assembly instructions which will be really helpful to understand the exploits. If you haven’t done setting-up your lab, feel free to check out my previous article on Exploit.education lab setup Previous…
Stack Zero Writeup - Exploit Education Lab Exercise
If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah . They cover a wide variety of learning assembly instructions which will be really helpful to understand the exploits. If you haven’t done setting-up your lab, feel free to check out my previous article on Exploit.education lab setup Quick…
Exploit Education Lab Setup - Windows & MacOS
Exploit.education binary exploitation exercise typically runs on ASLR (Address space layout randomization) disabled ubuntu based virtual machine with Data Execution Prevention turned off binaries. In order to setup the exploit.education lab, You’ll have to either use virtualbox or qemu based virtual machine emulator setup to easily test and debug the exercises. Installation For both MacOS…
Binary Search and Hidden Overflow 🪲
Recently I was playing with overflow vulnerabilities help of exploit.education exercise which mostly covers basic heap, buffer overflow, use-after-free vulnerability patterns in a contained qemu based environment. However, I was searching for Integer overflow patterns and articles around it “how to succesfully convert a integer overflow into a remote code execution”. While reading…
Detecting Android Content Provider APIs with Semgrep Rules
Content Provider is one of the powerful APIs which helps Android developers programmatically expose resource content within Android ecosystem via Intents. One could easily write those queries easily by extending the ContentProvider class and implementing those methods and accessing via URI (example: android://com.zoho.example/database/:_data ). Though these Content Provider is a cupcake for…
Cross-Site Scripting attack on Leetcode
Reflected XSS (Cross-Site Scripting) attack is my favorite vulnerability category as it’s relatively easy to exploit by checking for params as the source and rendering DOM as the sink. Problem The core problem of the Reflected Cross-Site scripting attack is appending the URL parameter values in the DOM without validation or filtering. Though the reflected XSS requires user interaction by…
Securing an ExpressJS server - Part 1
As Javascript programming language popularity increases, platforms have already started adopting it from native desktop apps, mobile, browser to server-side, giving rise to exciting frameworks, style guides, tools. To JavaScript—you weren’t born with a silver spoon in your mouth, but you’ve outclassed every language that’s challenged you in the browser. ExpressJS is not an…
About
I’m a senior software security engineer based in Waterloo, Canada. I work at Carta where I build security features for customers, including identity, access management, and authentication systems. Previously at Sourcegraph, Dropbox, and Yelp. I believe open-source levels the playing field in security. That’s why I build Code Pathfinder , a static code analysis engine designed for…