Breaking My Own Infrastructure: 12 Days, 19 Findings, 3 False Positives
Twelve days ago I opened a terminal, pointed curl at our staging API, and started breaking things. I didn’t have a plan. I didn’t have a ...
NedTechie
NedTechie
/
Blog
Deep dives into cloud security, infrastructure & DevOps
Practical engineering articles on Linux, AWS, penetration testing, and the tools that keep modern systems running.
13
Articles
17
Topics
Featured
Master Linux File Permissions and File Types While Your Coffee Brews
Linux Permissions and File Types Explained by Infographic and Exercises. Perfect for Your Morning Coffee Read.
Latest Articles
View all
What --dryrun Taught Me About Confidence
I shipped a false positive to my team. In bold. With a CRITICAL severity tag. And I was wrong. Not “wrong about a detail” wrong. Wrong a...
The Load Balancer That Trusted Everyone
Rate limiting is supposed to stop brute-force attacks. Ours didn’t. Not because the rate limiter was broken – it worked perfectly. The pr...
I Can Read Everyone's Invoices (and Found a Backdoor Inside)
I was testing my own finance records. Checking that the API returned the right data for my user. Standard BOLA test – try accessing someo...
The Refresh Token That Wouldn't Die
I logged out. Then I used my old refresh token. It still worked. I used it again. Still worked. Five times. Ten times. A week later. Sti...
It's 3 AM and I'm Creating a Thousand Invoices
I wasn’t supposed to be awake at 3 AM. But I’d had too much coffee and my brain wouldn’t shut off, so I figured I’d do one more test befo...
I Just Sent XSS Payloads to the Support Team
The best part about doing security testing on your own systems is that you can be as reckless as you want. The worst part is realizing yo...
When Your Internal Fields Aren't Internal: The Day I Deleted My Own Account
I deleted my own account today. Not on purpose. I’m not that chaotic. I was testing something, and then… I couldn’t log in anymore. Let...
The CORS Rabbit Hole I Didn't Want to Go Down
I was supposed to be testing SQL injection. That’s what my notes said: “Test for SQL injection in search endpoints.” But you know how it ...