Archive
Complete index of all 135 security research publications, threat modeling deconstructions, vulnerability analyses, and Blue Team defense architectures published on blogs.redwan.work by Md Redwan Ahmed.
AWS & Cloud Infrastructure Security 19 Guides
IAM architecture, privilege escalation vectors, AWS EKS IRSA, and cross-account federation defenses.
- AWS ECS Defense: Task Definition Hardening Guide
- AWS ECS Privilege Escalation: Task Definition Overrides
- Hardening AWS EKS IRSA: Blue Team OIDC & Pod Identity Guide
- AWS EKS IRSA: Deconstructing OIDC Federation & IAM Escalation
- Hardening Kubernetes Ingress: Blue Team Ingress-NGINX Defense Guide
- Kubernetes Ingress-NGINX: Deconstructing Annotation Injection RCE
- Hardening AWS IAM: Blue Team PassRole Defense Guide
- AWS IAM Privilege Escalation: Deconstructing PassRole Abuse
- Hardening AWS EKS Pod Identity: Blue Team Defense Guide
- AWS EKS Pod Identity: Deconstructing Workload Token Interception
- Hardening GCP Service Accounts: Blue Team Defense Guide
- GCP IAM: Service Account Impersonation Deep-Dive
- Linux Kernel eBPF: Deconstructing Verifier Logic Flaws
- Hardening Azure Managed Identity: Blue Team Defense Guide
- Azure Managed Identity: Exploiting IMDS for Cloud Escalation
- Hardening Kubernetes RBAC: Blue Team Defense Guide
- Kubernetes RBAC Privilege Escalation: Pod to Cluster Takeover
- Hardening AWS IAM Trust Policies: Blue Team Defense Guide
- AWS IAM Trust Policies: Exploiting Cross-Account Role Assumption
Active Directory, Windows & Identity Security 23 Guides
Kerberos abuse, ticket forgery, AD CS certificate template exploitation, and LSASS protection.
- Windows Token Impersonation: SeImpersonate Guide
- Windows Token Defense: SeImpersonate Hardening Guide
- Hardening Active Directory: Blue Team Kerberos Diamond Ticket Defense
- Kerberos Diamond Ticket: Deconstructing TGT PAC Forgery Architecture
- Hardening Windows LSASS: Blue Team PPL & Credential Guard Guide
- Windows LSASS: Deconstructing PPL Bypasses and Memory Dump Forensics
- Hardening Active Directory: Blue Team Unconstrained Delegation Guide
- Active Directory: Deconstructing Unconstrained Delegation Takeover
- Hardening Active Directory: Blue Team DPAPI Defense Guide
- Active Directory DPAPI: Deconstructing Domain Backup Key Theft
- Hardening Active Directory Kerberos: PAC Validation & Diamond Ticket Defense
- Kerberos Diamond Ticket: Deconstructing TGT Forgery Architecture
- Hardening AD CS Web Enrollment: Blue Team Defense Guide
- AD CS ESC8: Deconstructing NTLM Relay to Web Enrollment
- Hardening Active Directory: Blue Team DCSync Defense Guide
- Active Directory DCSync: Deconstructing MS-DRSR Architecture
- Hardening Active Directory: Blue Team RBCD Defense Guide
- Active Directory RBCD: Deconstructing Kerberos Delegation
- Hardening Active Directory: Shadow Credentials Defense Guide
- Active Directory Shadow Credentials: msDS-KeyCredentialLink Abuse
- AD CS ESC1: Weaponizing Subject Alternative Name for Domain Admin
- Hardening AD CS: Blue Team Defense Guide
- Breaking Active Directory Certificate Services: ESC1 Exploitation Mechanics, SAN Impersonation, and PKI Hardening
Linux Kernel, Low-Level & OS Security 24 Guides
Kernel memory safety, UAF vulnerability analysis, route cache corruption, and eBPF/auditd telemetry.
- Process Hollowing Defense: Memory Hardening Guide
- Process Hollowing Forensics: PEB & VAD Memory Guide
- Linux io_uring Defense: CVE-2024-0582 Hardening Guide
- Linux Kernel CVE-2024-0582: io_uring UAF Exploitation
- Hardening Linux Kernel: Blue Team CVE-2024-36971 Defense Guide
- Linux Kernel CVE-2024-36971: Route Cache UAF Exploitation
- Hardening Linux Dynamic Linker: glibc CVE-2023-4911 Blue Team Guide
- Hardening LangGraph Agents: Blue Team Memory Poisoning Defense Guide
- LangGraph: Deconstructing Agent Memory Poisoning RCE
- Hardening Linux Against OverlayFS: Blue Team Defense Guide
- Linux OverlayFS: Deconstructing CVE-2023-0386 SUID Privilege Escalation
- Hardening Linux Against Dirty Pipe: Blue Team Defense Guide
- Linux Kernel Dirty Pipe: Deconstructing Page Cache Overwrite Mechanics
- Hardening Linux Kernel eBPF: Blue Team Defense Guide
- Hardening Linux Binaries: Blue Team Defense Guide
- Hardening Linux Kernel nf_tables: Blue Team Defense Guide
- Linux Kernel CVE-2024-1086: Deconstructing the nf_tables UAF
- Hardening Linux Memory: Blue Team Defense Guide
- Linux Memory Forensics: Deconstructing eBPF Rootkit Mechanics
- Linux io_uring: Asynchronous Kernel Privilege Escalation
- Hardening Linux io_uring: Blue Team Defense Guide
- BYOVD EDR Evasion: Weaponizing Validly Signed Drivers to Blind Kernel Telemetry
- Linux User Namespaces: The Security Paradox of Unprivileged Container Isolation
- Kernel Privilege Escalation via eBPF Verifier Bypass and Defensive Telemetry
Kubernetes, CI/CD & DevSecOps Architecture 18 Guides
Kubernetes RBAC, container escapes, ArgoCD GitOps threat modeling, and GitLab CI/CD supply chain hardening.
- BuildKit Defense: CVE-2024-23651 Hardening Guide
- BuildKit CVE-2024-23651: Mount Cache Container Breakout
- Hardening GitLab CI/CD: Blue Team CVE-2024-6385 Pipeline Defense
- GitLab: Threat Modeling CVE-2024-6385 CI/CD Pipeline Takeover
- Hardening Git SCM: Blue Team Submodule Hook RCE Defense Guide
- Git SCM: Deconstructing CVE-2024-32002 Submodule Hook RCE
- Hardening Sonatype Nexus 3: Blue Team Supply Chain Defense Guide
- Sonatype Nexus 3: Deconstructing CVE-2024-4956 Traversal to RCE
- Hardening GitLab CI/CD: Blue Team Pipeline Defense Guide
- GitLab: Deconstructing CI/CD Pipeline Impersonation
- Hardening Jenkins Controllers: Blue Team Defense Guide
- Jenkins Core: Deconstructing the CLI File Read RCE Chain
- Hardening TeamCity: Blue Team Defense Guide
- TeamCity: Deconstructing CI/CD Pipeline RCE
- Hardening Argo CD: GitOps Pipeline Blue Team Defense Guide
- Argo CD Repo-Server: Threat Modeling GitOps Pipeline Takeover
- Hardening GitHub Actions: Blue Team Defense Guide
- GitHub Actions: Poisoned Pipeline Execution
AI Security & LLM Multi-Agent Defense 21 Guides
Multi-agent frameworks, prompt injection sandboxing, Microsoft AutoGen, and CrewAI security modeling.
- LlamaIndex CVE-2024-3098: PandasQueryEngine RCE Guide
- Flowise AI Defense: CVE-2024-58351 Hardening Guide
- Flowise AI CVE-2024-58351: overrideConfig Agent RCE
- Hardening Microsoft AutoGen: Blue Team Multi-Agent Sandbox Guide
- AutoGen: Deconstructing Multi-Agent Code Execution Sandbox Escapes
- Cisco IOS XE: Deconstructing Web UI Zero-Day and Lua Implant Chains
- Hardening Container Runtimes: Blue Team Leaky Vessels Defense Guide
- runc CVE-2024-21626: Deconstructing Leaky Vessels Container Escape
- Hardening CrewAI: Blue Team AI Agent Sandbox Guide
- CrewAI CVE-2026-2275: Deconstructing Agent RCE Chains
- Hardening LiteLLM AI Gateway: Blue Team Defense Guide
- LiteLLM: Deconstructing AI Gateway MCP RCE Chain
- Hardening Ray AI Clusters: Blue Team Defense Guide
- Ray AI Framework: Deconstructing ShadowRay Cluster RCE
- Ivanti Connect Secure: Deconstructing the Edge Zero-Day Chain
- Hardening Ollama: Blue Team Defense Guide
- Ollama: Deconstructing the Probllama RCE
- vLLM CVE-2026-22778: Deconstructing Multimodal RCE in AI Clusters
- Hardening Vector Databases: Blue Team Defense Guide
- Vector Database Poisoning: Exploiting Semantic Retrieval in RAG
- Edge Appliance Compromise: Threat Modeling the SonicWall SMA1000 Pre-Auth SSRF and RCE Chain
Threat Modeling, Web & Database Security 30 Guides
PostgreSQL RLS bypasses, TMUI smuggling, protocol dissection, and enterprise defense guides.
- PAN-OS CVE-2024-3400: GlobalProtect Command Injection
- Hardening Windows Services: Blue Team Defense Guide
- Windows Token Impersonation: Deconstructing SeImpersonatePrivilege
- Hardening F5 BIG-IP TMUI: Blue Team Defense Guide
- F5 BIG-IP TMUI: Deconstructing AJP Smuggling RCE
- Hardening ConnectWise ScreenConnect: Blue Team CVE-2024-1709 Defense
- ScreenConnect: Threat Modeling CVE-2024-1709 Pre-Auth RCE
- glibc: Deconstructing CVE-2023-4911 Looney Tunables LPE
- Hardening Windows ETW: Blue Team Telemetry Blinding Defense Guide
- Windows ETW: Deconstructing EtwEventWrite Telemetry Blinding
- Hardening Cisco IOS XE: Blue Team Web UI Zero-Day Defense Guide
- Hardening Entra ID: Blue Team Token Protection Guide
- Entra ID Primary Refresh Token: Deconstructing Pass-the-PRT
- Hardening Check Point Gateways: Blue Team Defense Guide
- Check Point Quantum Gateway: CVE-2024-24919 Traversal
- Hardening AD FS: Blue Team Golden SAML Defense Guide
- Golden SAML: Deconstructing ADFS Token Forgery Architecture
- Hardening Citrix NetScaler: Blue Team Defense Guide
- Hardening Ivanti Connect Secure: Blue Team Defense Guide
- XZ Utils: Deconstructing the IFUNC Backdoor
- Hardening FortiManager: Blue Team Defense Guide
- FortiManager FortiJump: Threat Modeling the FGFM Zero-Day
- Hardening PAN-OS GlobalProtect: Blue Team Defense Guide
- PAN-OS GlobalProtect: Deconstructing In-the-Wild Pre-Auth RCE
- Hardening Model Context Protocol: Deterministic Tool Firewalls & Defense Guide
- Model Context Protocol: Threat Modeling Indirect Prompt Injection and Tool Hijacking
- Hardening SonicWall SMA1000: WAF Signatures, eBPF Telemetry & RCE Defenses
- PostgreSQL Row-Level Security: Threat Modeling Multi-Tenant Bypasses and Optimizer Leaks
- XDP and eBPF Packet Filtering: Mitigating Multi-Gigabit DDoS at the Driver Layer
- Dissecting Kerberoasting: Protocol Mechanics, Telemetry Blindspots, and Modern Detection Engineering