# Chandrapal Badshah

> Security Engineer specializing in cloud, cloud-native, and AI-driven security. From penetration testing and threat modeling to training teams to build secure systems.

Cloud Security Consultant with 7+ years of experience specializing in AWS security audits, threat modeling, and DevSecOps for startups. Based in Bengaluru, India.

## Blog Posts
- [The Hunt for an Open Source AI Workflow Tool](https://badshah.io/blog/hunt-for-open-source-ai-workflow-tool/index.md): Seven workflow automation platforms marketed as open source. Six aren't - and the gating always lands on the features a security team needs. One holds up.
- [AI Is the Best Thing to Happen to Security](https://badshah.io/blog/ai-is-the-best-thing-to-happen-to-security/index.md): AI makes attackers more capable, developers faster, and attack surfaces bigger. The asymmetry between offense and defense grows - and that's why security as a domain is about to get a lot more investment.
- [Let Attendees Say No to Conference Swag](https://badshah.io/blog/let-attendees-say-no-to-conference-swag/index.md): Most tech conference freebies like badges, stickers, and branded items are useless clutter after the event. It's time conferences let attendees opt out of swag.
- [How 'What Can Go Wrong?' Went Wrong](https://badshah.io/blog/what-can-go-wrong-went-wrong/index.md): How the security threat modeling mindset of constantly asking 'what can go wrong?' seeped into my personal life, creating subtle pessimism, and how I broke the cycle.
- [The Key Factor Behind TablePlus's DDoS Resiliency](https://badshah.io/blog/key-factor-behind-tableplus-ddos-resiliency/index.md): How TablePlus survived a DDoS attack at zero cost by using Cloudflare R2 instead of AWS S3. The same attack on AWS would have cost $650+ in bandwidth charges.
- [Ultimate Guide to Fail at Least Privilege in Cloud (and the Hard Lessons I Learned)](https://badshah.io/blog/ultimate-guide-to-fail-at-least-privilege-cloud/index.md): Real-world mistakes and hard lessons from implementing least privilege in cloud, from treating it as binary to lacking rollback mechanisms in automation.
- [Kickstarting in Cybersecurity: Strategic Advice for 2nd and 3rd Year Indian College Students](https://badshah.io/blog/kickstarting-in-cybersecurity-for-indian-students/index.md): Practical career advice for Indian college students breaking into cybersecurity, covering domains, first roles, networking, coding skills, and choosing the right company.
- [Beyond the Basics: AWS WAF's Lesser-Known Limitations](https://badshah.io/blog/aws-waf-lesser-known-limitations-revealed/index.md): Lesser-known AWS WAF limitations from production experience: 8 KB body inspection limit, inflexible rate-limiting, sensitive header logging, and more.
- [My Key Takeaways from AWS re:Inforce 2023](https://badshah.io/blog/aws-reinforce-2023/index.md): Key takeaways from AWS re:Inforce 2023, covering zero trust, data security, incident response, and new launches like CodeGuru Security, Security Lake, and Bedrock.
- [The Risk You Can't Afford to Ignore: AWS SES and Email Spoofing](https://badshah.io/blog/aws-ses-and-email-spoofing/index.md): Verifying a domain in AWS SES lets any IAM user with SES permissions spoof emails from any address on that domain. Here's the risk and how to fix it.
- [My Love/Hate Relationship with Cloud Custodian](https://badshah.io/blog/my-love-hate-relationship-with-cloud-custodian/index.md): A year of production experience with Cloud Custodian. Its strengths in real-time detection and auto-remediation, and its pain points in docs and multi-account setup.
- [One important feature that Dependabot is missing](https://badshah.io/blog/important-dependabot-feature/index.md): GitHub Dependabot lacks a central dashboard for prioritizing alerts across repos. Here's how to build one with GraphQL API, Postgres, and Apache Superset.
- [Did you completely remove secrets from git repository? Really?](https://badshah.io/blog/remove-secrets-from-git-repo/index.md): Removing secrets from git history is straightforward. With help of BFG Cleaner and privileges to force push the modified history, it's a piece of cake. I believed this until I found I was partially wrong - removing something from git history doesn't remove them from git repository.
- [GuardDuty - the Good, the Bad and the Ugly](https://badshah.io/blog/guardduty-good-bad-ugly/index.md): If you listen to anyone discussing AWS security, you probably heard about Amazon GuardDuty. It's an intelligent "threat detection" service from AWS. Should you enable GuardDuty? I hope you'll reach closer to your answer by the end of this blog post.
- [What should you use - CloudQuery or Steampipe?](https://badshah.io/blog/cloudquery-vs-steampipe/index.md): CloudQuery and Steampipe have very similar functionalities. The actual difference is with the way they work and the problems they solve. This blog post compares both the tools and helps you answer the question: What should I use - CloudQuery or Steampipe?
- [Things I wish I knew about AWS WAF - Bot Control](https://badshah.io/blog/things-i-wish-i-knew-aws-waf-bot-control/index.md): Lessons from testing AWS WAF Bot Control with 10M+ weekly requests. It can double your WAF bill and is easily bypassed with a valid browser User-Agent.
- [Vulnerable API writeup](https://badshah.io/writeup/vulnerable-api/index.md): Most of the applications I see these days heavily depend on APIs. Pentesting them is a bit different than that of web applications. In this writeup I will show you how I discovered the vulnerabilities in the “Vulnerable API” project.
- [How to remove DNS record takeover bug class ?](https://badshah.io/blog/remove-domain-takeover-bug-class/index.md): There are so many resources around domain and subdomain takeovers but none around how to remove this bug class. In this blog post, I will walk you through the (sub)domain takeover bug class, the different types of takeovers, and finally the mitigations.
- [Adding Gitleaks to Gitlab CI Pipeline](https://badshah.io/experiment/adding-gitleaks-to-gitlab-pipeline/index.md): How to integrate Gitleaks into a GitLab CI pipeline to scan only new commits for secrets, instead of scanning the entire repository history on every push.
- [Creating a Cloud Function to publish messages to Pub/Sub](https://badshah.io/experiment/cloud-function-to-pub-sub/index.md): Step-by-step guide to creating a GCP Cloud Function with an HTTP endpoint that publishes messages to a Google Pub/Sub topic using Python.
- [Fast Reverse DNS Lookups using FDNS and MongoDB](https://badshah.io/experiment/fast-reverse-dns-lookups-using-fdns-and-mongodb/index.md): Perform fast reverse DNS lookups by loading Rapid7's FDNS dataset into MongoDB. Find all DNS records pointing to any IP in seconds.
- [Faster nmap scanning with the help of GNU parallel](https://badshah.io/experiment/faster-nmap-scanning-with-the-help-of-gnu-parallel/index.md): Use GNU Parallel to run nmap scans across 1000+ public IPs simultaneously, reducing scan time drastically and identifying unused firewall rules.
- [Finding Route53 logs with the help of CloudTrail and Athena](https://badshah.io/blog/finding-route53-logs-with-the-help-of-cloudtrail-and-athena/index.md): Learn how to query AWS CloudTrail logs using Athena to find which IAM user created, modified, or deleted Route53 DNS records, with ready-to-use SQL queries.
- [Backup and restore ElasticSearch data using GCS](https://badshah.io/blog/backup-and-restore-elasticsearch-cluster-using-gcs/index.md): You don’t know what you got until it’s gone. And unfortunately it’s the same with data. Backup before it’s too late. Checkout this article to know more on how to backup and restore ElasticSearch data with the help of GCS buckets.
- [How I hosted a DNS server on AWS ?](https://badshah.io/blog/how-i-hosted-a-dns-server-on-aws/index.md): A hands-on guide to hosting an authoritative BIND9 DNS server on AWS EC2, from setting up glue records to configuring zone files with a bash script.
- [Efficient way to pentest Android Chat Applications](https://badshah.io/blog/efficient-way-to-pentest-android-chat-applications/index.md): How to set up a pentest environment for Android chat apps using multiple Genymotion emulators and BurpSuite with separate proxy listeners for each instance.
- [Managing Linux Users & SSH keys using Ansible](https://badshah.io/blog/managing-linux-users-ssh-keys-using-ansible/index.md): An Ansible playbook for managing Linux user accounts and SSH keys on EC2 that automatically removes revoked users without maintaining a separate revocation list.
- [Bucket Policy for your Public S3 Bucket](https://badshah.io/blog/bucket-policy-for-your-public-s3-bucket/index.md): Enabling public read access on S3 also enables directory listing, exposing all files. Here's a bucket policy that allows file access while preventing listing.

## Case Studies
- [Securing a SaaS Company's AWS Environment After a Breach](https://badshah.io/case-studies/saas-aws-breach/index.md)

## Optional