/blog

Field notes

Research and security engineering notes.

Research, practical testing notes, and observations from security engineering work.

From Search Results to Two CERT-In Recognitions

A restrained account of using indexed government-domain pages as reconnaissance leads, preserving evidence, and separating two CERT-In recognitions from unsupported conclusions.

Research & Findings

Firsthand findings, case studies, validation, and engineering retrospectives.

7 posts

Jun 4My Honeypot Dashboard Was Lying to Me for Two Weeks (and I Wrote It)16 min read
Aug 28From an Exposed Service to an Unresolved SQL Injection Lead6 min read
Jul 19Five Findings That Looked Small Until I Followed the State8 min read
Jul 5I Thought I Found a Subdomain Takeover. I Had Not.7 min read
Jun 19When Object Authorization and Output Encoding Fail Together8 min read
Jun 15The Invoice Number Changed. Did the Authorization Decision?6 min read

Guides & Fundamentals

First-party operational guides and durable technical explanations.

2 posts

Jun 5Deploy Your Own SSH Honeypot in 10 Minutes with ShardLure11 min read
Apr 24What Google Can Reveal About Your Attack Surface—and What It Cannot15 min read

Threat Intelligence & Operations

Honeypots, attacker telemetry, campaigns, malware observation, and defensive operations.

4 posts

Aug 17How a Pirate "Free Netflix" App Smuggles Video Inside .jpg Files9 min read
May 26I Built a Honeypot Framework, Deployed It for 5 Days, and the Internet Showed Up With Malware and Opinions22 min read
Apr 29I Mass-Accepted SSH Logins for 48 Hours and Catalogued Everything That Walked In18 min read
Apr 25SSH Under Siege: 30 Days of Brute-Force Telemetry on an Exposed VM 🌐6 min read