Peachy Cloud Security logoPCS
    Peachy Cloud Security logo

    Blog

    Deep dives, tutorials, and insights on cloud security. All articles published on Medium.

    All
    AWS
    Anjali
    CTF
    Cloud
    DevSecOps
    Divyanshu
    GCP
    Kubernetes
    OWASP
    Pentesting
    Threat Modeling
    Tutorial
    Web Security
    Yoga

    68 articles found

    Cloud Security Articles

    source-code
    pentest-web
    owasp

    How I Found a Path Traversal in the Rancher Dashboard via HAR Replay

    The issue is considered as a hardening gap by the Rancher Security team, as it resides within a feature limited to dev mode in Rancher Dashboard. Finding bugs isn’t always about breaking into a live ...

    Feb 25, 2026•Divyanshu
    aws-eks
    security
    aws

    EKS Moved To containerd, GuardDuty’s Runtime Alert Stayed Behind. Here’s Why That Matters.

    Why this matters especially for startups relying on AWS GuardDuty? Why I’m Writing This Amazon EKS has moved to from 1.24 and later. Kubernetes removed dockershim in v1.24. Docker as a runtime is leg...

    Nov 8, 2025•Divyanshu
    cloud-security
    security-engineering
    threat-modeling

    Threat Modeling 102: Applying STRIDE to Payments Architecture

    Threat Modelling 102: Applying STRIDE to Payments Architecture Credit : This is my solution to the Threat Modelling exercise provided in the repository Security Engineering Training, created by Jeeva...

    Sep 12, 2024•Divyanshu
    stride
    bug-bounty
    owasp

    Threat Modelling 101: Mapping OWASP Top 10 to STRIDE

    This blog provides only the foundational overview of threat modelling concepts including OWASP top 10 2024 mapping to STRIDE. It serves as an introduction to advance topics, including hands-on exerci...

    Aug 13, 2024•Divyanshu
    simple-email-service
    cognito-user-pools
    aws

    Integrating SES with AWS Cognito

    Cognito sends only 50 emails per day for verifying users, what if you need to send 1000 email a day? AWS SES is your solution!! AWS Simple Mail Service( SES ) is a cloud based email sending service t...

    Jul 27, 2024•Anjali
    aws
    authentication
    cognito-user-pools

    AWS Cognito User Pools: A Beginner’s Step-by-Step Setup Guide

    Amazon Cognito is an identity platform for web and mobile applications where users can authenticate and authorize themselves and can access the app and aws services. AWS Cognito user pools is used on...

    Jul 8, 2024•Anjali
    bedrock
    genai
    amazon

    Generative AI Web App using Python Flask with Amazon Bedrock

    Let’s create a generative AI-enabled web application from scratch using Python Flask. The application will provide a cloud security tip of the day by integrating with Amazon Bedrock using the amazon....

    Jul 3, 2024•Divyanshu
    Kubernetes
    AWS
    Divyanshu

    EKS Moved to Containerd: GuardDuty's Runtime Alerts Stayed Behind

    Understanding why GuardDuty runtime alerts lagged when EKS moved to containerd and why that matters for security monitoring.

    Jan 20, 2024•Divyanshu
    Threat Modeling
    Divyanshu

    Threat Modeling 102: Applying STRIDE to Payments Architecture

    Practical application of STRIDE threat modeling methodology to payments architecture for identifying and mitigating security risks.

    Jan 18, 2024•Divyanshu
    Threat Modeling
    OWASP
    Divyanshu

    Threat Modeling 101: Mapping OWASP Top 10 to STRIDE

    Introduction to threat modeling by mapping OWASP Top 10 vulnerabilities to STRIDE threat categories for comprehensive security analysis.

    Jan 15, 2024•Divyanshu
    AWS
    Tutorial
    Divyanshu

    Generative AI Web App Using Python Flask with Amazon Bedrock

    Step-by-step guide to building a generative AI web application using Python Flask integrated with Amazon Bedrock for AI capabilities.

    Jan 12, 2024•Divyanshu
    AWS
    Anjali

    Integrating SES with AWS Cognito

    Learn how to integrate Amazon SES with AWS Cognito User Pools for custom email functionality in your authentication flow.

    Jan 10, 2024•Anjali
    Yoga
    Divyanshu

    How Yoga & Ayurveda Helped Me Handle Burnout

    Personal journey of using yoga and Ayurveda practices to manage and overcome professional burnout in the tech industry.

    Jan 8, 2024•Divyanshu
    AWS
    Tutorial
    Anjali

    AWS Cognito User Pools: A Beginner's Step-by-Step Setup Guide

    A comprehensive beginner-friendly guide to setting up AWS Cognito User Pools from scratch with step-by-step instructions.

    Jan 5, 2024•Anjali
    Web Security
    Divyanshu

    HTML and Hyperlink Injection via Share Option in Microsoft OneNote

    Security research on HTML and hyperlink injection vulnerability discovered in Microsoft OneNote's share functionality.

    Dec 28, 2023•Divyanshu
    Web Security
    Cloud
    Divyanshu

    Alibaba Cloud WAF Command Injection Bypass via Wildcard Payload

    Technical analysis of command injection bypass techniques in Alibaba Cloud WAF using wildcard payloads in all built-in rule sets.

    Dec 25, 2023•Divyanshu
    Kubernetes
    Tutorial
    Divyanshu

    Kubernetes 101: Setting Up Kubernetes Cluster Locally

    Beginner-friendly tutorial on setting up a local Kubernetes cluster for learning and development purposes.

    Dec 22, 2023•Divyanshu
    Kubernetes
    CTF
    Anjali

    EKSClusterGames Walkthrough

    Complete walkthrough of EKSClusterGames CTF challenge covering Kubernetes security concepts and EKS cluster configurations.

    Dec 20, 2023•Anjali
    Pentesting
    AWS
    GCP

    Module 3: Pentesting & Bypassing AWS Azure GCP Cloud WAF

    Module 3 of the comprehensive series on pentesting and bypassing cloud WAF solutions across AWS, Azure, and GCP platforms.

    Dec 20, 2023•Divyanshu
    Pentesting
    AWS
    GCP

    Module 2: Pentesting & Bypassing AWS Azure GCP Cloud WAF

    Module 2 covering advanced techniques for pentesting and bypassing cloud WAF solutions in multi-cloud environments.

    Dec 18, 2023•Divyanshu
    CTF
    Cloud
    AWS

    Cloud Village CTF 2023 Write-up

    Detailed write-up of Cloud Village CTF 2023 challenges covering various cloud security scenarios and exploitation techniques.

    Dec 15, 2023•Anjali
    OWASP
    Web Security
    Divyanshu

    Secure Code Review 1: Cheat Sheet for Python Injection Flaws

    Comprehensive cheat sheet for identifying and preventing injection vulnerabilities in Python code during security reviews.

    Dec 15, 2023•Divyanshu
    Pentesting
    AWS
    GCP

    Module 1: Introduction to Pentesting & Bypassing Cloud WAF

    Module 1 introduction to pentesting and bypassing cloud WAF solutions across major cloud providers for security testing.

    Dec 12, 2023•Divyanshu
    AWS
    Anjali

    AWS Amazon Inspector: Vulnerability Management

    Deep dive into AWS Amazon Inspector for automated vulnerability assessment and security compliance checking in your AWS environment.

    Dec 10, 2023•Anjali
    AWS
    Tutorial
    Divyanshu

    Hands-on Tutorial: Amazon Simple Notification Service (SNS)

    Practical hands-on tutorial covering Amazon SNS setup, configuration, and integration for notification services in AWS.

    Dec 10, 2023•Divyanshu
    DevSecOps
    Tutorial
    Divyanshu

    Quick Guide: Running Clair Scanner via Katacoda

    Quick guide to running Clair scanner for container image vulnerability scanning using Katacoda interactive labs.

    Dec 8, 2023•Divyanshu
    Pentesting
    Divyanshu

    Burp Automation: Automating Burp Scanning via REST API & Robot Framework

    Guide to automating Burp Suite scanning using REST API and Robot Framework with Python3 for efficient security testing.

    Dec 5, 2023•Divyanshu
    GCP
    Divyanshu

    GCP Inspector: Auditing Publicly Exposed GCP Bucket

    Using GCP Inspector tools to audit and identify publicly exposed Google Cloud Storage buckets for security assessment.

    Dec 2, 2023•Divyanshu
    Pentesting
    Divyanshu

    Pentesting iOS: Starting with iOS Emulator, Corellium & Re-signing IPA

    Introduction to iOS pentesting using emulators, Corellium platform, and IPA re-signing techniques for security testing.

    Nov 30, 2023•Divyanshu
    Pentesting
    Divyanshu

    How to Setup Advanced Nessus Network Scan

    Step-by-step guide to setting up and configuring advanced Nessus network scanning for comprehensive vulnerability assessment.

    Nov 28, 2023•Divyanshu
    AWS
    Anjali

    Analyzing Latest WhatsApp Scam: Leaking S3 Bucket

    Analysis of a recent WhatsApp scam that led to S3 bucket data leaks, covering attack vectors and prevention strategies.

    Nov 25, 2023•Anjali
    Pentesting
    Divyanshu

    Automating Burp Suite 3: Creating Macro to Replace CSRF Token

    Creating Burp Suite macros to automatically replace CSRF tokens from response body to request parameters for automated testing.

    Nov 25, 2023•Divyanshu
    Pentesting
    Divyanshu

    Automating Burp Suite 4: Customizing Custom Header via Burp Macro

    Understanding and customizing custom headers from response via Burp Suite macros for advanced automation workflows.

    Nov 22, 2023•Divyanshu
    AWS
    Cloud
    Anjali

    AWS Deep Dive into ECS Part 1

    First part of a comprehensive deep dive into Amazon ECS covering architecture, security best practices, and container orchestration.

    Nov 20, 2023•Anjali
    Pentesting
    Divyanshu

    Automating Burp Suite 2: Automated Authenticated Login and Scanning

    Automating authenticated login and scanning workflows in Burp Suite using macros for efficient security testing.

    Nov 20, 2023•Divyanshu
    Pentesting
    Divyanshu

    Automating Burp Suite 1: Capturing CSRF Token via Macro

    First part of Burp Suite automation series covering how to capture CSRF tokens automatically using macros.

    Nov 18, 2023•Divyanshu
    AWS
    Cloud
    Anjali

    Testing Cloud AWS Azure WAF Capabilities Against Log4Shell CVE-2021-44228

    Comprehensive testing and comparison of AWS and Azure WAF capabilities in protecting against Log4Shell vulnerability exploitation.

    Nov 15, 2023•Anjali
    Pentesting
    Divyanshu

    Pentesting ISP 101: How I Hacked & Fixed My ISP

    Educational walkthrough of pentesting an ISP network, identifying vulnerabilities, and responsible disclosure practices.

    Nov 15, 2023•Divyanshu
    Web Security
    Divyanshu

    Injecting Punycode URL via Comment Box in Google Photos Sharing

    Security research on injecting Punycode URLs within arbitrary text via comment box in Google Photos sharing functionality.

    Nov 12, 2023•Divyanshu
    DevSecOps
    Anjali

    Learn Anchore with Katacoda

    Hands-on tutorial on using Anchore for container image security scanning and vulnerability management with Katacoda labs.

    Nov 10, 2023•Anjali
    Web Security
    Divyanshu

    Blocked User Can Send Notification: Logical Bug in Instagram

    Discovery of a logical bug in Instagram allowing blocked users to send notifications, demonstrating access control issues.

    Nov 10, 2023•Divyanshu
    Tutorial
    Divyanshu

    osTicket on CentOS 6 Installation with PHP 5.6

    Step-by-step guide to installing osTicket ticketing system on CentOS 6 with PHP 5.6 configuration.

    Nov 8, 2023•Divyanshu
    cloud
    kubernetes
    kubernetes-security

    AWS EKS Challenge: Walkthrough of EKSClusterGames.com CTF

    EKSClusterGames is an entertaining and instructive series of ctf challenges meant to assess your proficiency with AWS and Kubernetes by wiz.io. Every task is designed to impart knowledge on Amazon EK...

    Nov 6, 2023•Anjali
    Web Security
    OWASP
    Divyanshu

    Dank Writeup: Broken Access Control on Indian Startup

    Detailed writeup of broken access control vulnerability discovered in an Indian startup's application during security assessment.

    Nov 5, 2023•Divyanshu
    Web Security
    Divyanshu

    URL Bar Spoofing in Safari for iOS 12.3 and iOS 13 Beta (CVE-2019-8727)

    Security research on URL bar spoofing vulnerability in Safari for iOS 12.3 and iOS 13 beta, assigned CVE-2019-8727.

    Nov 2, 2023•Divyanshu
    CTF
    Anjali

    Out of Band RCE CTF Walkthrough

    Step-by-step walkthrough of an out-of-band Remote Code Execution CTF challenge covering advanced exploitation techniques.

    Oct 30, 2023•Anjali
    Web Security
    Divyanshu

    Time-Based Blind SQL Injection in GraphQL

    Technical analysis of time-based blind SQL injection vulnerabilities in GraphQL implementations and exploitation techniques.

    Oct 30, 2023•Divyanshu
    Web Security
    Divyanshu

    How I Found XSS by Searching in Shodan

    Creative approach to finding XSS vulnerabilities by leveraging Shodan search capabilities for target discovery and testing.

    Oct 28, 2023•Divyanshu
    Tutorial
    Anjali

    Linux OS Hardening: CIS Benchmarks

    Comprehensive guide to Linux OS hardening following CIS benchmarks for improved security posture and compliance.

    Oct 25, 2023•Anjali
    Web Security
    Divyanshu

    Opera Android Address Bar Spoofing (CVE-2019-12278)

    Security research on address bar spoofing vulnerability in Opera Android browser, assigned CVE-2019-12278.

    Oct 25, 2023•Divyanshu
    Tutorial
    Divyanshu

    Installing OpenVPN 2.4.7 on Ubuntu 16.04 Xenial

    Step-by-step guide to installing OpenVPN 2.4.7 on Ubuntu 16.04 Xenial for secure VPN server setup.

    Oct 22, 2023•Divyanshu
    Web Security
    Divyanshu

    Shopping Products for Free: Parameter Tampering Vulnerability

    Security research on parameter tampering vulnerability that allowed purchasing products for free in e-commerce applications.

    Oct 20, 2023•Divyanshu
    Web Security
    Divyanshu

    Not Applicable: Homograph Attack via WhatsApp Status

    Security research on homograph attack vulnerability discovered in WhatsApp status feature for phishing and social engineering.

    Oct 18, 2023•Divyanshu
    Web Security
    Divyanshu

    Tale of Account Takeover in Multiple Websites

    Comprehensive analysis of account takeover vulnerabilities discovered across multiple websites and common attack patterns.

    Oct 15, 2023•Divyanshu
    Web Security
    Divyanshu

    IDOR, Content Spoofing & URL Redirection via Unsubscribe Email in Confluent

    Security research on IDOR, content spoofing, and URL redirection vulnerabilities found in Confluent's unsubscribe email functionality.

    Oct 12, 2023•Divyanshu
    AWS
    Divyanshu

    S3 Bucket Misconfiguration in Amazon

    Analysis of common S3 bucket misconfigurations in Amazon Web Services that lead to data exposure and security risks.

    Oct 10, 2023•Divyanshu
    cloud-security
    cloud
    defcon-31

    Cloud Village CTF 2023 Write up

    Last week, my team participated in cloud CTF, Cloud Village 2023 @defcon31. It was an online event, opened for 3 days and had challenges on three cloud platform i.e. AWS, Azure and GCP. Here is a wal...

    Aug 14, 2023•Anjali
    infosec
    yoga

    How Yoga & Ayurveda Helped Me To Handle Burnout

    As a member of the infosec community, I have observed that many individuals are experiencing exhaustion and burnout for various reasons. Each person may have unique circumstances leading to these fee...

    Mar 22, 2023•Divyanshu
    information-technology
    alibabacloud
    cloud

    Alibaba Cloud WAF Command Injection Bypass via Wildcard Payload in All 1,462 Built-in Rule Set

    Alibaba WAF version 3.0 was tested and very common payload was found bypassing command injection. While testing the capabilities of the firewall itself it was found that it was possible to bypass the...

    Mar 17, 2023•Divyanshu
    aws-inspector
    ecr
    aws

    AWS Amazon Inspector: Vulnerability Management

    Amazon Inspector is a cloud native service for continuous scanning of Elastic Compute Cloud (EC2) and container workloads. It identifies software vulnerabilities and unintended network exposure which...

    Mar 8, 2023•Anjali
    scams-to-avoid
    cybersecurity-awareness
    cybersecurity

    Analyzing Latest WhatsApp Scam Leaking S3 Bucket

    This is a quick blog about an amazon scam going on WhatsApp. In search of data, I found the S3 bucket which is publicly available. Since these scammers use victims’ data for personal use, I will be u...

    Jan 18, 2023•Anjali
    aws-ecs
    docker
    ssm-agent

    AWS | Deep Dive into ECS: Part 1

    ECS (Elastic Container Service), an AWS managed service that provides container orchestration and makes it easy for us to deploy, manage, and scale containerized applications. In this blog, let’s dis...

    Jan 9, 2023•Anjali
    security
    microsoft
    bug-bounty

    HTML and Hyperlink Injection via Share Option In Microsoft Onenote Application

    Hyperlink Injection it’s when attacker injecting a malicious link when sending an email invitation. HTML injection attack is injecting HTML code through the vulnerable parts of the website. The Malic...

    Jun 28, 2022•Divyanshu
    kind
    bug-bounty
    k8s

    Kubernetes 101 | Setting up Kubernetes Cluster Locally

    This blog is about setting the local Kubernetes cluster for learning & testing using multiple tools like Kind, Minikube, Kubeadm & K3s. Image from https://www.jambit.com/en/latest-info/toilet...

    Jun 1, 2022•Divyanshu
    firewall
    security
    gcp

    Module-3 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit

    1. Setting up Vulnerable Application For AWS WAF We will be setting custom DVWA for pentesting WAF. 1.1. We need to set up the ec2 instance where we will host DVWA. Let’s start by creating the instan...

    May 25, 2022•Divyanshu
    log4j
    hacking
    security

    Testing Cloud (AWS & Azure) WAF Capabilities Against log4shell(CVE-2021–44228)

    Log4j shell or Log4Shell or LogJam[CVE-2021–44228] is a zero day that allows hackers to execute remote code execution(RCE). It exploits JNDI Api that uses LDAP protocol. Some organization might be th...

    Dec 16, 2021•Anjali
    anchore
    katacoda
    containers

    Learn Anchore with Katakoda

    This blog will help you in installing an Anchore and scanning docker images. Here, I have used openjdk and debian docker images to perform the scan. For a demo, follow the link https://www.katacoda.c...

    Oct 25, 2021•Anjali
    security
    ctf-writeup
    bug-bounty

    Out-Of-Band RCE: CTF Walkthrough

    So, this is my writeup on how I was able to achieve my first Remote Code Execution. Also after reviewing the code I was able to understand more about malicious code execution via OS functions. Finall...

    Jul 21, 2020•Divyanshu

    Where AI, AppSec and cloud security meet hands-on labs.

    Support Our Work

    Subscribe, like, and share our videos.

    No Spam. Only updates.

    Join peachycloudsecurity