PHPrayush Hadainprayush.hashnode.dev·Aug 3 · 6 min readBreaking the Trust Boundary: AWS Cognito Guest-to-Authenticated Role Escalation Write up Introduction AWS Cognito Identity Pools are commonly used in mobile and web applications to provide temporary AWS credentials without exposing long-term access keys. The idea is simple: Anonymous use00
PHPrayush Hadainprayush.hashnode.dev·May 2 · 7 min readFrom Reading the Kernel to Breaking It — Dirty Cow (CVE-2016-5195) End to EndI've been reading Robert Love's Linux Kernel Development. Chapter 15 covers the memory subsystem — virtual memory areas, page faults, Copy-on-Write. It's dense. I got through it, understood it concept00
PHPrayush Hadainprayush.hashnode.dev·Apr 8 · 7 min readBuild an ARP Toolkit — Attack and Detection in CI spend a lot of time looking at alerts that say "possible MITM activity" or "ARP anomaly detected." They show up in the SIEM, get triaged, and usually turn out to be benign — a NIC failover, a miscon00
PHPrayush Hadainprayush.hashnode.dev·Mar 18 · 9 min readFrom Log Reader to Packet Crafter — Building DNS from Scratch in CIt's me again! As a SOC Analyst, I spend my days staring at logs I don't fully understand. So I decided to build the thing that generates them. Why I built this? I was on my desk staring at Fortigate00
PHPrayush Hadainprayush.hashnode.dev·Feb 23 · 4 min readBeyond the Inbox: 5 Counter-Intuitive Truths from the SOC FrontlinesAbout the Author I am Prayush Hada, a SOC Analyst in CryptoGen Nepal. This post synthesizes my findings during my SOC internship, where I moved from following alerts to investigating the human logic b00