krash.dev

DNS Over HTTPS (DoH): What, Why, and How It Works

Tue, 23 Jun 2026 00:00:00 +0000

You’re at a coffee shop. You join the free Wi-Fi, type bank.example.com, and start checking your balance. The connection to your bank is locked behind that reassuring little padlock — TLS, encrypted, private.

Except the question you asked first wasn’t private at all.

Before your browser could open that encrypted tunnel, it had to ask a simple question:

“What’s the IP address for bank.example.com?”

That question — a DNS lookup — left your laptop unencrypted, in a 40-year-old format (RFC 1035 ), for anyone on that Wi-Fi (and your ISP, and a few hops in between) to read, log, or quietly change.

Securing MCP Servers: A Threat Modeling Guide for Security Engineers

Fri, 12 Jun 2026 00:00:00 +0000

Model Context Protocol servers are appearing inside organizations faster than most security teams have a review process for them.

They often look like small, polite integrations: a package, a few tool definitions, some outbound API calls, and a README.

That framing is the problem.

An MCP server is not a passive integration. It is an execution surface exposed to a language model. It may hold credentials, read sensitive data, call internal APIs, write to downstream systems, and act on instructions that came from untrusted text.

Before Your Code Runs: Node.js

Sun, 29 Mar 2026 00:00:00 +0000

This post is part of the Before Your Code Runs series, cataloguing the hidden, implicit code execution surfaces in programming language runtimes and toolchains.

Node.js and npm sit underneath a huge chunk of the modern web. It’s the runtime that made JavaScript a “real” backend language, and npm is the largest package registry in the world. That’s a lot of trust in a lot of code.

Here’s roughly what happens when Node starts:

Before Your Code Runs: Python

Sun, 29 Mar 2026 00:00:00 +0000

This post is part of the Before Your Code Runs series, cataloguing the hidden, implicit code execution surfaces in programming language runtimes and toolchains.

Python is probably the most beloved language in the world right now. It’s everywhere: data science, web backends, DevOps glue, AI/ML pipelines, you name it. And because it’s everywhere, attackers love it too. The thing is, most Python developers think execution starts when you type python app.py. It doesn’t. Not even close.

YubiKey OTP Best Practices

Sun, 15 Mar 2026 00:00:00 +0000

If you use a YubiKey for one-time passwords (OTP), you’ve probably done it at least once: you meant to type something, touched the key, and a long modhex string landed in Slack, a commit message, or an email. Annoying for everyone, and worse, it’s a real security risk.

This post pulls together practical ways to reduce accidental triggers and what to do when a code gets out, plus how YubiOTP compares to TOTP so you can use both wisely. We also cover FIDO2 / WebAuthn and how to use them alongside OTP.

Navigating the Ethereum Yellow Paper

Mon, 23 Feb 2026 00:00:00 +0000

I’ll be honest with you: I attempted to read the Yellow Paper four times before I actually finished it. The first three times, I opened the PDF, saw equations like Υ(σ, T) ≡ σ', and promptly closed it, convinced it was written for people far smarter than me.

The fourth time, I changed my approach entirely. Instead of trying to understand it linearly, I treated it like - “I don’t have an option but to understand this”. This post is the map I wish I’d had.

Blockchain Architecture: Layers

Mon, 29 Dec 2025 00:00:00 +0000

In the last two blogs, we looked at the pieces that make a blockchain work and how the network agrees on what is true .

In here, we will look at how all those pieces sit together as layers, how blockchains are structured, and how Layer 1 and Layer 2 actually differ in practice. Once we know what each layer is responsible for, concepts like rollups, sequencers, proofs and scaling start making sense.

Consensus: How Blockchains Agree

Sun, 28 Dec 2025 00:00:00 +0000

Decentralization sounds simple until you realise every node acts on its own. In a blockchain each node holds its own copy of the ledger and processes data independently. Nodes see transactions at different times, some go offline, some behave incorrectly and some may try to cheat. Without a way to agree the network would split into a thousand truths. Consensus is what keeps all those independent nodes and all those independent ledgers marching in the same direction.

Blockchain Components

Sat, 27 Dec 2025 00:00:00 +0000

If you’re still asking ‘Why do I even need to learn Blockchain security? ’ No worries. I wrote this blog to answer exactly that. Give it a read, then come back and we’ll dive into Blockchain 101 together.

Now that you are here, let’s start by understanding what is Blockchain?

But wait, a bit of warning, there is way too much text in the entire blog - I tried putting some AI generated images (which make sense for the blog), but they also were not able to do much, so all the best!

Why Learn Blockchain & Blockchain Security?

Fri, 12 Sep 2025 00:00:00 +0000

In the world of AI, I’m gonna go rebel and talk about Blockchains. Why? Because I’ve been learning and tinkering with it, and I thought it’d be fun to share. Honestly, this is as much for my own notes as it is for anyone reading.

Blockchain isn’t as shiny as AI right now, but it’s still a big deal. Here’s the thing: blockchain is too important to ignore, but too risky to approach without understanding security. It’s not just a playground for developers writing smart contracts. Entrepreneurs building products, investors betting on tokens, policy makers drafting regulations, and security folks trying to protect users, they all have skin in the game.

Production Grade Bash Scripts

Wed, 16 Apr 2025 00:00:00 +0000

Most shell scripts start innocent, just a few lines to glue things together. Blink twice, and it’s deploying infrastructure, rotating secrets, restarting servers, and possibly provisioning a small nation-state. It’s doing things for the people, by the people, held together by echo.

This isn’t another “bash scripting 101” tutorial. You already know how to loop over a list and grep things. This is about writing scripts that survive real-world conditions: bad input, missing dependencies, flaky networks, and humans.

Reputation Farming in OSS: A Threat to Building Trust

Thu, 27 Jun 2024 00:00:00 +0000

This issue complicates the open source and supply chain security space. For attacks like xz, such strategies can be used by attackers to build “fake” trust among fellow OSS community members.

A few days ago, this discussion ignited in the OSSF Slack, which talked about the issue of credibility farming in several open source repositories.

So, the issue revolves around GitHub (or equivalent platforms) accounts approving or commenting on old pull requests and issues that were already resolved or closed, where these meaningless contributions show up prominently on the user’s profile and activity feed, making their involvement seem more significant than it actually is, without closer look.

Two Bits on the xz Vulnerability

Mon, 01 Apr 2024 00:00:00 +0000


GitHub Repository	xz (Suspended)
Source Code	https://git.tukaani.org/?p=xz.git
Threat Actor	Jia Tan (GitHub)
CVE Number	CVE-2024-3094 (CVSS 10.0)
Vulnerability Type	Remote Code Execution
Attack Category	Social Engineering, Supply Chain Attack

What does `xz` module do?#

XZ Utils is a set of free and open-source data compression utilities that provide high compression ratios and fast decompression. It primarily uses the LZMA compression algorithm , which is an algorithm for lossless data compression.

Handling Deprecated Dependencies In Your Project

Tue, 07 Nov 2023 00:00:00 +0000

Disclaimer: Just a heads up, while we’re diving into ways to tackle the problem of dependency depreciation, there’s no one-size-fits-all solution here. It’s a bit of a wild ride dealing with supply chain security and those pesky deprecated dependencies, so don’t expect a quick fix!

The issue of using deprecated dependencies has persisted for quite some time, and it’s gaining increased attention. Many projects continue to incorporate deprecated dependencies.

I was inspired to write this blog after coming across a LinkedIn post by Rory McCune and several other posts over the past few weeks.

VS Code Security: Looking at the IDE from Security Lens

Thu, 14 Sep 2023 00:00:00 +0000

While perusing StackOverflow's 2023 Developer Survey (yes, we developers have our own version of celebrity gossip), I couldn’t help but notice that our trusty VSCode is still riding high as the undisputed IDE champ. With a whopping 73% of the developer vote, it’s safe to say that VSCode has firmly planted its flag. But, like any superstar, it’s not immune to the spotlight’s glare, especially when it comes to security. And in this blog, we’ll explore the security aspects that every VSCode user should consider.

Investigating Reported Vulnerabilities: A Closer Look!

Sun, 30 Jul 2023 00:00:00 +0000

In vulnerability scanners or penetration testing reports, you might come across statements like “Service version x.y.z is vulnerable to CVE-YYYY-ABCD.” However, it’s essential to delve deeper to confirm the actual vulnerability.

Let’s consider a real example:

We received a vulnerability report indicating a vulnerability (CVE-2023-23916) in curl v7.74.0 within the Debian 11 environment.

The CVE documentation mentions:

Affected versions: curl 7.57.0 to and including 7.87.0

At first glance, it appears that v7.74.0 is indeed vulnerable. But is that really the case?

Kubernetes Components

Sun, 18 Jun 2023 00:00:00 +0000

In this blog post, we are going to talk about different components used in Kubernetes and what purpose each component serve. We will be talking about the following -

Pods
Service
Ingress
ConfigMap
Secret
Deployment
StatefulSet
ReplicaSet
DaemonSet

Use-case that will be used througout the blog will be hosting a web application with application code and database in different pods.

Before starting this blog, if you want to learn about the underlying concepts - Read “Kubernetes Concept ”

My Experiments with Raspberry Pi Pico - Poor Man's Rubber Ducky

Sat, 04 Feb 2023 00:00:00 +0000

Mr. Robot Season 2 Episode 9 - “Rubber Duckie, You’re The One” - I was fascinated by this piece of technology when I first saw it many years ago. Then I looked it up on the internet to learn more about it, and it turned out to be HID, or Human Interface Device. It basically imitates users and executes code or performs actions in their place.

Since the real rubber ducky was out of my budget, I looked for alternatives and discovered that similar behaviour to the rubber ducky can be achieved using a less expensive piece of hardware - the Raspberry Pi Pico (7$).

Docker Security

Thu, 02 Feb 2023 00:00:00 +0000

Last Updated on 2nd Feb 2023.

Containers?#

Why do we need containers over VMs -

Efficient Resource Consumption between containers
Once License for services/OS
Low Compute Overhead

What does docker engine does?

Emulates Filesystem
Gives each container unique process ID
Isolation of container process

Communication between the architecture components -

Components
- Docker client (The one user interacts with)
- Docker Host
  - Docker Daemon
  - Images
  - Containers
- Registry
Docker client using serveral API calls sends the commands to Docker Engine which is being forwarded to containerd.
Commuication between docker daemon and containerd is facilated through gRPC calls.
Docker Client communicates with the Docker Daemon through a domain socket (if local) and through a TCP Socket (if remote).

What does runc do?

Zone Identifier - Is your file downloaded from the internet?

Thu, 06 Oct 2022 00:00:00 +0000

Have you ever wondered, why your file is not working after downloading it from the internet? How does system know if the file is downloaded from the internet?

The answers to this is Zone.Identifiers.

What are Zone Identifiers?#

Zone Identifiers is an alternate data stream that points, from where the file came on the users’ computer.

Note: Alternate Data Streams are included with files on WIndows. This is typically the case with downloaded and blocked files.

Understanding DKIM - Email Security Series

Tue, 26 Jul 2022 00:00:00 +0000

DKIM is a technological advancement in the field of email security. SPF prevents non-authorized servers from sending emails, but it does not prevent all attempts at spoofing. This is where our next level of security comes into play.

DKIM or Domain Keys Identified Mail aids to the security of the email as it adds a digital signature to every outgoing message, allowing receiving servers to verify that the message came from your organization. It ensures that the content of the email remains untampered/compromised and can be trusted.

Understanding SPF - Email Security Series

Mon, 25 Jul 2022 00:00:00 +0000

Sender Policy Framework or SPF is an email authentication platform. It helps in specifying who is allowed to send emails from your domain. Making it harder for fraudsters to spoof sender information.

Note

RFC 7208 - https://datatracker.ietf.org/doc/html/rfc7208

SPF Records are used to specify the origin of the email to the world. It can be considered as a public list that specifies where an email is sent from.

How does SPF records look like?#

SPF is configured and managed as a TXT record inside the DNS server your domain uses.

Linux - Command Line Struggles

Mon, 04 Jul 2022 00:00:00 +0000

Configure Network Using `ip` Command in Ubuntu Server#

Temporary Method -

 bash
 
 
$ ip a # to get the interface name after connecting LAN
$ sudo ip a add 192.168.1.8/24 dev <network-interface-name>
$ ip link set dev <network-interface-name> up
$ sudo ip route add default via 192.168.1.1

Permanent Solution - Ref: https://netplan.io/examples/

gRPC: We are not RESTing Anymore

Sat, 02 Jul 2022 00:00:00 +0000

gRPC is a framework which is being used to build scalable and fast APIs. The framework from which it derives most of its positives is from the protocol it uses - HTTP/2. Apart from HTTP/2, it uses protocol buffer (protobuf) for the communication.

gRPC can be useful in circumstances like -

large-scale microservices connections
real-time communication
Low power & low bandwidth systems
Multi-language environments

Why Should We Care? Let’s talk Benefits#

The use of HTTP/2 over the TLS end-to-end encryption connection in gRPC ensures API security.
gRPC provides built-in support for commodity features, such as metadata exchange, encryption, authentication, deadline/timeouts and cancellations, interceptors, load balancing, service discovery, and so much more.
The prime feature of gRPC methodology is the native code generation for client/server applications.
gRPC tools and libraries are designed to work with multiple platforms and programming languages, including Java, JavaScript, Ruby, Python, Go, Dart, Objective-C, C#, and more.
Parsing with Protobuf requires fewer CPU resources since data is converted into a binary format, and encoded messages are lighter in size. So, messages are exchanged faster, even in machines with a slower CPU, such as mobile devices.
Request and Response Multiplexing - Multiple requests/response in one single connection.

Underlying Concepts#

Protocol Buffers#

aka protobuf . It’s Google’s serialization/deserialization protocol that enables easy definition of services and auto-generation of client libraries. It is an IDL (Interface Definition Language).

How is XSS different from CSRF?

Tue, 28 Jun 2022 00:00:00 +0000

An interesting discussion, led me to realize this is one of the commonly discussed topic and I thought a blog post for it might be helpful for someone.

Cross-site request forgery and Cross-site scripting are both client side attacks which performs action on behalf of users.

Just some context here -

Cross-site scripting (or XSS) allows an attacker to execute arbitrary JavaScript within the browser of a victim user. The attack happen because of the acceptance of the malicious code by the sites.
Cross-site request forgery (or CSRF) allows an attacker to induce a victim user to perform actions that they do not intend to. This attack can be performed by the code hosted on any third party attacker controlled site.

Before diving into the differences, let’s see what conditions needs to be met in order for both the attacks to be successful.

Kubernetes Concept

Mon, 17 Jan 2022 00:00:00 +0000

I have been wanting to learn about ~~kubernetes~~ k8s since long, and create this blog series. Here we are finally started (thanks to null cloud security study group ), so without wasting too much time let’s get started. I am learning this having a security mindset, to find common misconfigurations and understand the development process to understand the mitigation.

K8s is a container orchestrator. Before diving too much into the depth let’s see what orchestrators/orchestrations are.

Anonymous Challenge Write-Up: WinjaCTF c0c0n 2021

Mon, 15 Nov 2021 00:00:00 +0000

WinjaCTF at c0c0n [2021]: I developed an easy challenge - called “Anonymous” - the challenge was based upon browser forensics.

TL;DR#

Intended Way - Download the zip > Extract it > Navigate the Linux directory structure > To find a directory called .config > google-chrome > Default > Open the History File in SQL Browser > Search for URLs and upon up the URL to get a file with the name - formatted like flag.

This is why you need a personal Collaborator Client!

Tue, 22 Jun 2021 00:00:00 +0000

If you have used Burp’s collaborator client for your Out-of-band testing, you know it’s awesome. Then why there is a need for a personal collaborator client? There are a few things that need to be addressed.

Companies have started to blacklist burp collaborator’s domain, making it difficult for OOB vulnerabilities detection. (Read here)
Collaborator client is not available for the community/free edition of BurpSuite.

This brings the need for having a personal collaborator client, with no to minimal investments, that will help us in the detection of any out-of-band/blind vulnerabilities, and I have linked an amazing cheatsheet below that will guide in OOB Exploitation. So, let’s get started. Below are the things required for our recipe to cook:

How does burp proxy work?

Mon, 07 Jun 2021 00:00:00 +0000

What’s a proxy?#

A proxy acts as a gateway between you and the internet. The internet traffic flow back and forth if a proxy is setup in the middle. So, what is the need of proxy? There are several reasons organizations and individuals use proxies:

Control and monitor internet usage
Proxy servers can give better speed and bandwidth by caching websites
Proxy servers can also be setup along with VPNs to provide anonymity and better security

There are different types of proxies, but a specific type of proxy that we are going to talk about in this blog is interception proxy.

NULLCON 2021 Training: DEVSECOPS

Sat, 27 Mar 2021 00:00:00 +0000

You don’t need money to buy expensive things, sometimes hard work pays off. And yes nullcon trainings are still expensive for me xD and I am grateful that I got this chance to attend one.

One year ago, I was going through the nullcon training schedule, and trying to understand the structure, and how much I can learn from it, because it was too expensive for me to get the actual training. Cut to March 1st , 2021, where I was attending a nullcon Training called – “DEVSECOPS – AUTOMATING SECURITY IN DEVOPS by Rohit Salecha”, not only as an attendee but also as a moderator for the event, because I was the one of the employees at Payatu.

Exam Experience: CEH v10

Fri, 27 Nov 2020 00:00:00 +0000

July 6th, 2020: It all started with this mail. I received a scholarship for CEH Practical (applied two times xD) and I had to pay $99 to take the exam.

I guess it was worth it. Battling with college and other stuff, I used to think I am not ready yet and kept on postponing it until 6th of November, 2020. I finally took the exam and passed it easily, and now that I look back, I could have done it then as well, but yeah.

Bug Bounty Summit CTF Writeup

Mon, 02 Nov 2020 00:00:00 +0000

The CTF is live on Hacker101 as Grayhatcon CTF – Hacker101 CTF

The CTF was built upon real vulnerabilities found during bug bounties. It had four flags – 250 points each.

Objective - Hackerone’s Username and Password database has been leaked and put on an auction. Our task was to delete the auction listing before anyone buys it.

We were given an IP, which resolved to a web application. On performing some basic information gathering, I found out some stuff.

Hacking Is Not Black & White

Sun, 01 Nov 2020 00:00:00 +0000

This is related to a talk given by me and pre & post-event activities, that were conducted at Developer Circles, Pune and Bengaluru.

It all started with DEFCON 2020 Red Team Village CTF, my team and I reached the Top 50 and it was just amazing for all of us. It was an enriching experience, solving challenges from a wide range of categories and learning new stuff in the process. One section of the CTF dealt with Malware Analysis and I was fascinated by this domain of security and have been learning about it.

Search

Mon, 01 Jan 0001 00:00:00 +0000

krash.dev

DNS Over HTTPS (DoH): What, Why, and How It Works

Securing MCP Servers: A Threat Modeling Guide for Security Engineers

Before Your Code Runs: Node.js

Before Your Code Runs: Python

YubiKey OTP Best Practices

Navigating the Ethereum Yellow Paper

Blockchain Architecture: Layers

Consensus: How Blockchains Agree

Blockchain Components

Why Learn Blockchain & Blockchain Security?

Production Grade Bash Scripts

Reputation Farming in OSS: A Threat to Building Trust

Two Bits on the xz Vulnerability

What does xz module do?#

Handling Deprecated Dependencies In Your Project

VS Code Security: Looking at the IDE from Security Lens

Investigating Reported Vulnerabilities: A Closer Look!

Kubernetes Components

My Experiments with Raspberry Pi Pico - Poor Man's Rubber Ducky

Docker Security

Containers?#

Zone Identifier - Is your file downloaded from the internet?

What are Zone Identifiers?#

Understanding DKIM - Email Security Series

Understanding SPF - Email Security Series

How does SPF records look like?#

Linux - Command Line Struggles

Configure Network Using ip Command in Ubuntu Server#

gRPC: We are not RESTing Anymore

Why Should We Care? Let’s talk Benefits#

Underlying Concepts#

Protocol Buffers#

How is XSS different from CSRF?

Kubernetes Concept

Anonymous Challenge Write-Up: WinjaCTF c0c0n 2021

TL;DR#

This is why you need a personal Collaborator Client!

How does burp proxy work?

What’s a proxy?#

NULLCON 2021 Training: DEVSECOPS

Exam Experience: CEH v10

Bug Bounty Summit CTF Writeup

Hacking Is Not Black & White

Search

What does `xz` module do?#

Configure Network Using `ip` Command in Ubuntu Server#