Practitioner-grade cybersecurity content
Technical playbooks, war stories, and how-to-think guides — written by practitioners, anchored to the Indian context.
Want structured, step-by-step learning instead? Explore the Academy (guided courses) or the AI security hub.
Latest articles
Most recent practitioner playbooks across every track. Filter by topic in the sidebar, or use search.
S3 Bucket Misconfigurations: Why 30% of Indian Startups Still Leak Customer Data
Five S3 misconfigurations we actually find on Indian startup audits — Block Public Access disabled, broad bucket-policy Principal, pre-signed URL leakage, object-level…
Cloud SecurityAWS EC2 SSRF: How One Curl Command Becomes a Cloud Compromise
One missing input filter on a server-side request lets an attacker reach 169.254.169.254 from your EC2 instance. From that single curl: IAM…
Cloud SecurityAWS IAM Privilege Escalation: 7 Paths from Read-Only to AdministratorAccess
From a leaked low-privilege AWS access key to AdministratorAccess in eight minutes. Seven well-known IAM privilege escalation paths — CreateLoginProfile, AttachUserPolicy, PutPolicy,…
Active DirectoryGolden vs Silver vs DCShadow: Which Persistence Wins (Defender’s View 2026)
Three post-Domain-Admin persistence techniques, compared from the defender's lens — operational profile, what each leaves behind, what detects each, and which one…
Active DirectoryActive Directory Threat Modeling: Where Attackers Will Hit First (2026)
Most defensive AD work happens reactively after a pentest. Threat modeling AD means thinking the way attackers do before the pentest. Empirical…
Blue Team7 SIEM Rules That Actually Catch Lateral Movement (Splunk, Elastic, Sigma)
Average dwell time before detection in Indian enterprise environments: 14 to 42 days, mostly spent on lateral movement. Seven specific, tunable SIEM…
Active DirectoryNTDS.dit Extraction in 2026: 4 Methods, 5 SIEM Rules, 1 Domain at Stake
Domain hash extraction is the de-facto endgame of an AD-focused engagement. Four methods red-teamers actually use — DCSync, VSS+ntdsutil, SAM hive pivot,…
Red TeamingBypassing AppLocker and WDAC with LOLBins: A 2026 Field Guide
Microsoft signs hundreds of binaries that ship with Windows. Many can execute arbitrary code under AppLocker. This is the practitioner's catalogue of…
Active DirectoryPass-the-Hash in 2026: Why Microsoft’s Mitigations Aren’t Enough
Pass-the-Hash is a 1997 attack that should have died in 2014. It still works in most Indian enterprise environments because the mitigations…
Active Directory7 BloodHound Cypher Queries That Find Real AD Privilege Paths (Not the Default Ones)
Default BloodHound queries miss 80% of the real privilege chains in your Active Directory. Seven custom Cypher queries — for sessions, custom-group…