Chandrapal Badshah | Security Engineer on Chandrapal Badshah

AI Is the Best Thing to Happen to Security

Sun, 28 Jun 2026 00:00:00 +0530

LLMs have been around for a while now. When Anthropic released a statement that nation state attackers are using Claude for attacks, I read it with a lot of skepticism.

Let Attendees Say No to Conference Swag

Fri, 06 Mar 2026 00:00:00 +0530

TL;DR: Allow attendees to politely decline the conference freebies. I’ve attended quite a few tech conferences in India over the years, both as a speaker/trainer and attendee. Conferences can improve execution, meritocratic selection panels, and the ratio of sponsored to overall talks. These are mentioned as part of overall feedback to the event. But one thing is rarely questioned. The “swag.” You know what I mean - the badge, brochure, stickers, probably a t-shirt and a bag to carry everything.

How 'What Can Go Wrong?' Went Wrong

Wed, 10 Dec 2025 00:00:00 +0530

I recently spoke with a close friend who’s been in the security industry for over a decade. We discovered an interesting issue we both had, but never discussed. Both of us had become pessimistic. It’s not terminal pessimism. It’s not like there’s no point in living, doing anything, or initiatives. But it is subtle and strong enough to hinder growth. Let me tell you how I got here. After college, I got my first job as a Product Security Engineer.

Securing a SaaS Company's AWS Environment After a Breach

Tue, 15 Apr 2025 00:00:00 +0530

A growing SaaS company contacted me after a serious AWS breach. The attacker accessed staging and production accounts with administrator privileges and caused significant damage: Compromised databases Critical resources and backups deleted Data exfiltration By the time the CTO called me in, DevOps team contained the breach. The team recreated resources in a new AWS account. But significant damage was done - production disrupted for a week (in simple terms, no revenue), 1000+ developer hours gone and data exfiltrated.

The Key Factor Behind TablePlus's DDoS Resiliency

Tue, 23 Apr 2024 00:00:00 +0530

TablePlus published a blog post on how they did nothing to handle a DDoS attack. Their blog post titled “We are under DDoS attack and we do nothing” - published at the end of March 2024 - caught my eye when it quickly reached the top of Hacker News.

Ultimate Guide to Fail at Least Privilege in Cloud (and the Hard Lessons I Learned)

Mon, 26 Feb 2024 00:00:00 +0530

Least privilege is a defense-in-depth strategy that everyone talks about. While I first heard it a few years back this seemed to be a magical solution to a good number of security issues I faced.

Kickstarting in Cybersecurity: Strategic Advice for 2nd and 3rd Year Indian College Students

Tue, 23 Jan 2024 00:00:00 +0530

How to get started in cybersecurity?

This is the first question I get from many students attending Null Bangalore meetups, security conferences, and more.

Beyond the Basics: AWS WAF's Lesser-Known Limitations

Wed, 13 Sep 2023 00:00:00 +0530

AWS WAF service is an L7 firewall service offered by AWS. It’s easy to set up, seamlessly integrates with other AWS services (ALB, API Gateway, etc.), and comes with a handful of managed WAF rulesets and rate limit features.

My Key Takeaways from AWS re:Inforce 2023

Tue, 27 Jun 2023 00:00:00 +0530

The much-awaited AWS re:Inforce 2023 videos have finally landed on YouTube. You can now pick your favorite track and watch the sessions at your own pace here - https://www.youtube.com/@AWSEventsChannel/playlists?view=50&sort=dd&shelf_id=2.

The Risk You Can't Afford to Ignore: AWS SES and Email Spoofing

Thu, 11 May 2023 00:00:00 +0530

AWS SES is used in multiple ways - automated reminders, marketing emails, security automation & alerts, etc. There’s a risk with the domain verified on SES; often overlooked. A risk that falls at the intersection of Cloud and Enterprise risk.

My Love/Hate Relationship with Cloud Custodian

Mon, 10 Apr 2023 00:00:00 +0530

I’m a huge fan of the Cloud Custodian tool. If you hear the name for the first time - it’s an open-source rules engine for cloud security, cost optimization, and governance.

One important feature that Dependabot is missing

Sun, 11 Dec 2022 00:00:00 +0530

GitHub’s Dependabot feature allows you to detect and fix vulnerabilities in code dependencies for all your repositories (public and private). Despite being a handy tool in securing software supply chain, it’s missing a very important feature.

Did you completely remove secrets from git repository? Really?

Fri, 07 Oct 2022 00:00:00 +0530

Removing secrets from git repo is straightforward. With help of BFG Cleaner and privileges to force push the modified history, it’s a piece of cake.

I believed this until I found I was partially wrong - removing something from git history doesn’t remove them from git repository’s history.

GuardDuty - the Good, the Bad and the Ugly

Sun, 14 Aug 2022 00:00:00 +0530

If you listen to anyone discussing AWS security, you probably heard about Amazon GuardDuty. It’s an intelligent “threat detection” service from AWS. It’s similar to an IDS system because it detects issues but doesn’t prevent them.

What should you use - CloudQuery or Steampipe?

Fri, 29 Jul 2022 00:00:00 +0530

CloudQuery and Steampipe have very similar functionalities. The actual difference is with the way they work and the problems they solve. This blog post compares both the tools and helps you answer the question: What should I use - CloudQuery or Steampipe?

Things I wish I knew about AWS WAF - Bot Control

Mon, 11 Jul 2022 00:00:00 +0530

AWS WAF might be your first layer of defense for attacks on websites hosted on AWS. While WAF does its best at blocking web attacks, it doesn’t stop web abuses - like bot attacks involving API abuse. For example, submitting comments on pages, credential spraying, OTP bruteforce/resend, etc.

Vulnerable API writeup

Fri, 10 Jul 2020 00:00:00 +0530

Most of the applications I see these days heavily depend on APIs. Pentesting them is a bit different than that of web applications. In this writeup I will show you how I discovered the vulnerabilities in the “Vulnerable API” project.

How to remove DNS record takeover bug class ?

Sat, 06 Jun 2020 00:00:00 +0530

Dangling DNS records are not something new. They are just out-of-date DNS records which may have served its purpose in the past. This DNS record trash has been there for ages and was not considered a security issue. They are pointing to some resource (IP or DNS record) that was owned/trusted in the past. What makes the dangling DNS record deadly is the fact that others can seize the resources that the record is pointing to.

Adding Gitleaks to Gitlab CI Pipeline

Sun, 22 Mar 2020 00:00:00 +0530

Gitleaks has become quite popular. Its features gives a tough competition to its predecessor trufflehog. Some of its uber cool features are: Comparatively fast when scanning large repos (as it is a compiled Golang binary) It can run on all platforms that Golang supports. User can add custom regex to detect more secrets Allows whitelisting of detected secrets / false positives Allows audit of GitLab and GitHub repos, groups and orgs.

Creating a Cloud Function to publish messages to Pub/Sub

Sun, 23 Feb 2020 00:00:00 +0530

Every time I want a cloud managed message queue, I would look at AWS SQS service. It’s simple. Create a SQS queue, get the HTTP endpoint for the queue, start posting the messages using any HTTP client like curl. This time I made up my mind to give GCP’s counterpart a try. The GCP’s counterpart is Pub/Sub. On a high level, the queue is known as topic in the Pub/Sub terms.

Fast Reverse DNS Lookups using FDNS and MongoDB

Mon, 17 Feb 2020 00:00:00 +0530

As part of my research, I wanted a way to find all the DNS records which points to a particular IP address. Not only should it be fast, it should be cheap as well. If you are a DNS researcher you would know about the Rapid7’s free FDNS dataset. I was not able to find any online post that showed me how to get subdomains using IP address in the FDNS dataset.

Faster nmap scanning with the help of GNU parallel

Mon, 17 Feb 2020 00:00:00 +0530

When you give access to developers to create firewall rules, they generally open all sorts of ports to the internet. All they need to do / expected to do is get the product working. The rest doesn’t matter. This was the same with the company I worked with. There were tonnes of firewall rules in the GCP projects which opened many ports to the public internet. One could think of deleting firewall rules straight away and check if something is breaking on production.

Finding Route53 logs with the help of CloudTrail and Athena

Wed, 27 Nov 2019 00:00:00 +0530

If your company uses AWS Route53 to manage DNS records of its domains, there might a situation where you want to find which IAM user created / modified which DNS record. The reason for this could be anything: asset management, to find root cause of a security incident (like subdomain takeover) or simply to cleanup unused DNS records. This could be done with ease if you have CloudTrail logging enabled (atleast for us-east-1 region) and stored on an S3 bucket.

Backup and restore ElasticSearch data using GCS

Thu, 12 Sep 2019 00:00:00 +0530

You don’t know what you got until it’s gone. And unfortunately it’s the same with data. The importance of backup is mostly realised after loosing the data. After a few data incidents, I have made backups of all my ElasticSearch clusters. I have also made it a habit to create backups and then go ahead with using ES cluster to store data. In this article I will be using Google Cloud Storage (GCS) buckets for backup.

How I hosted a DNS server on AWS ?

Fri, 07 Jun 2019 00:00:00 +0530

Wait. I know what you are thinking now. Who on earth would do such a crazy thing ? Why would a person even host a DNS server on AWS when one could use Route53 to efficiently manage DNS records. The answer is simple: I’ve been a user of DNS since my first interaction with the internet, but have no clear idea on how DNS works. So I started learning how DNS works and more on how DNS server works.

Efficient way to pentest Android Chat Applications

Mon, 01 Apr 2019 00:00:00 +0530

Setting up a pentest environment for a single Android application to test its functionalities is simple. The process involves just setting up an Android emulator, installing the app, sending the traffic through a proxy tool like BurpSuite and playing with the traffic to find interesting behaviour. When it comes to setting up pentest environment for an Android chat application, the setup slightly differs. This is not the case only for chat apps but also for other apps whose functionality (like multi-user authorization) could be completely understood only when running the app in two or more devices simultaneously.

Managing Linux Users & SSH keys using Ansible

Tue, 23 Oct 2018 00:00:00 +0530

Today I was assigned a task to create user accounts on an EC2 instance (Ubuntu) and also add SSH public keys to the respective user account’s authorized key list. The EC2 instance would act as a gateway to access the internal network. (This is a basic setup in which the user creates an SSH tunnel to access resources on the internal network. It’s not a foolproof security solution but controls external access to some extent)

Bucket Policy for your Public S3 Bucket

Fri, 03 Aug 2018 00:00:00 +0530

Recently I came across multiple AWS S3 buckets with directory listing enabled. The content in the buckets ranged from simple images & js files to images of aadhaar ID, PAN cards, etc. Whats the reason ? Security is a non-functional requirement of business. What I have seen so far is that if a developer gets an idea, he/she will work to implement the idea without thinking much about the security of the product.

Talks

Thu, 01 Mar 2018 00:00:00 +0530

List of slidedecks and videos of my talks in past: 2025 Cloud Breach Tactics: Enumeration to Initial Access (Workshop @ Vulncon) [Slides] LLMs from Scratch for Security Engineers (Talk @ SecurityBoat Community) [Video] [Slides] 2024 With infinite scale comes infinite bill (and bankruptcy) (Talk @ Rootconf 2024) [Video] Well, it’s just an AWS Account ID! (Online Talk @ Null Coimbatore) [Slides] Securing the Cloud: Detecting and Reporting Sensitive Data in ECR Images (Talk @ BSides Goa 2024) [Slides] 2022 Automating Cloud Security - AWS Edition (Workshop @ BSides Delhi 2022) [Slides] CSPM Using Open Source Tools [Slides] Past Detecting secrets in code committed to Gitlab (in real time) [Slides] [Video] How to get started in InfoSec (intended for students) [Slides] Offensive OSINT mindset to defend your organization [Slides] Solving OWASP MSTG CrackMe using Frida [Slides] OWASP Serverless Top 10 [Slides] Pentesting Android Apps using Frida (Beginners) [Slides] Let’s hunt the target using OSINT [Slides] pwnd.

Explore