Rrathsarainrr-cyber.hashnode.dev·4h ago · 13 min readGNU/Linux: Where Data Hides and How It's FoundA filesystem can tell an investigator that everything is consistent while still leaving data outside the paths that ordinary tools inspect. Hidden filenames are the easy case. More interesting cases i00
Rrathsarainrr-cyber.hashnode.dev·6h ago · 15 min readWindows: Where Data Hides and How It's FoundA file called Secret.exe reports 25 bytes on disk. Nothing in Explorer, nothing in a standard dir listing, and nothing in Task Manager disagrees with that number. Run dir /r instead of dir, and the sa00
Rrathsarainrr-cyber.hashnode.dev·Sep 5 · 7 min readAnonTestLab: Ten Years, Three Attempts, and One Idea That Wouldn't Let GoTL;DR: the tool is at hashtagrr.github.io/AnonTestLab. The rest of this is how it came to exist. Round one: an idea and no coding experience to build it I got my hands on the Tor Browser almost ten y00
Rrathsarainrr-cyber.hashnode.dev·Sep 3 · 11 min readWindows Memory Forensics: Finding a Live Infection with VolatilityPID 1484 had been running since boot. Nothing about that was unusual: it was Explorer.exe, the process every Windows machine on earth is running right now. What was unusual was the process hanging off00
Rrathsarainrr-cyber.hashnode.dev·Sep 3 · 9 min readGNU/Linux Memory Forensics: Is the Compromise Still Live?It's easy to think of memory forensics purely as a hunt for something malicious. On this case, a GNU/Linux server that had already been through a full attack chain, initial access, privilege escalatio00
Rrathsarainrr-cyber.hashnode.dev·Aug 31 · 19 min readOpenID Connect: The Identity Layer OAuth Was MissingBy the time I actually heard the word OIDC, I'd already been through OAuth and PKCE conversations I hadn't fully understood, years apart from each other, and this one arrived even later than those. It00
Eemmainjourney-my-blog.hashnode.dev·Aug 16 · 5 min readMy Journey in Cybersecurity My Journey Into Cybersecurity: What I'm Learning Along the Way Introduction My journey into cybersecurity is still in its early stages, but I have already learned how broad and interesting the field c00
Rrathsarainrr-cyber.hashnode.dev·Aug 15 · 10 min readWhat We Got: From Cloud Security Platform to Operational CapabilityA few months after the operationalizing work covered in the last article, it stopped being a project. It became part of how we worked. This article is about what changed once that happened. The Metri00
Rrathsarainrr-cyber.hashnode.dev·Aug 14 · 31 min readUnderstanding OAuth 2.0: Delegation, Grant Types, and the Attacks That Actually HappenThe first time I heard the term OAuth, I didn't know what it meant. I was in a conversation with a DBA lead about something adjacent to authentication and authorization, and he mentioned, almost in pa00
Rrathsarainrr-cyber.hashnode.dev·Aug 6 · 15 min readIdentity Foundations: Everything Before OAuthBefore any protocol makes sense on its own terms, a few things underneath it need to be settled first: what authentication and authorization actually are as distinct concepts, how identity gets carrie13N
