Avinash Jain (@logicbomb) – Medium

Avinash Jain (@logicbomb)

Avinash Jain (@logicbomb)

A bug worth 1.75Lacs — AWS SSRF to RCE

How I escalated well known AWS SSRF to perform Remote Code Execution (RCE) in one of the India’s growing startups.

3 min readOct 27, 2022

--

4

A bug worth 1.75Lacs — AWS SSRF to RCE

--

4

Avinash Jain (@logicbomb)

A misconfigured Apache Airflow to AWS Account Compromise

This is about how I was able to exploit a security misconfig of Apache Airflow and escalated it to access sensitive pages & credentials!

5 min readFeb 2, 2022

--

A misconfigured Apache Airflow to AWS Account Compromise

--

Avinash Jain (@logicbomb)

Shift Left with AWS Codepipleine — Scanning every single code change

In the agile world, where continuous iteration of development and testing happens throughout the SDLC (software development lifecycle)…

7 min readMay 18, 2021

--

Shift Left with AWS Codepipleine — Scanning every single code change

--

Avinash Jain (@logicbomb)

OTP Bypass Account Takeover to Admin Panel — Ft. Header Injection

It looks like this year has great promises at least the starting is good. Already 3 bug bounty in the pipeline(just showing off:P) and…

4 min readJan 27, 2021

--

1

OTP Bypass Account Takeover to Admin Panel — Ft. Header Injection

--

1

Avinash Jain (@logicbomb)

Tale of 3 vulnerabilities to account takeover

The whole writeup in 1 liner, I bypassed the rate limiting by bypassing cloudflare by reaching to orgin sever IP via SSRF xmlrpc.php…

5 min readNov 17, 2020

--

1

Tale of 3 vulnerabilities to account takeover

--

1

Avinash Jain (@logicbomb)

Securing Container using Threat Modelling— STRIDE

The increased adoption of containers has given rise to a wide range of potential threats to microservices apps that run in containers. If…

5 min readOct 7, 2020

--

Securing Container using Threat Modelling— STRIDE

--

Avinash Jain (@logicbomb)
in
Lambda by Blinkit

How Continuous Github Code Hacking Keeps Grofers Secure

Security shouldn’t be treated as an after-thought.

5 min readJul 29, 2020

--

How Continuous Github Code Hacking Keeps Grofers Secure

--

Avinash Jain (@logicbomb)

Phone Number Privacy? We don’t do that here: Google Hangout Call

Google Hangout Calls and Exposing Phone Numbers

4 min readMay 28, 2020

--

1

Phone Number Privacy? We don’t do that here: Google Hangout Call

--

1

Avinash Jain (@logicbomb)

Docker Registries and their secrets

Never leave your docker registry publicly exposed! Recently, I have been exploring dockers a lot in search of misconfigurations that…

4 min readApr 9, 2020

--

Docker Registries and their secrets

--

Avinash Jain (@logicbomb)

Hacking ‘Docker’, the Shodan way!

Never leave your docker host publicly exposed!

4 min readJan 10, 2020

--

1

Hacking ‘Docker’, the Shodan way!

--

1

Avinash Jain (@logicbomb)

Avinash Jain (@logicbomb)

Security Engineer @Microsoft | DevSecOps | Speaker | Breaking stuff to learn | Featured in Forbes, BBC| Acknowledged by Google, NASA, Yahoo, UN etc

Following

Help
Status
About
Careers
Blog
Privacy
Terms
Text to speech
Teams