https://blog.nedtechie.com/ Hands-on writeups on cloud security, DevSecOps, Linux, and pentesting — real curl commands, real vulnerabilities, real production stories from Nedim, a DevOps engineer who got security-paranoid and never stopped. 2026-08-17T01:14:55+07:00 Nedim Hadzimahmutovic https://blog.nedtechie.com/ Jekyll © 2026 Nedim Hadzimahmutovic https://blog.nedtechie.com/assets/img/favicons/favicon.ico https://blog.nedtechie.com/assets/img/favicons/favicon-96x96.png 2026-05-23T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/i-wrote-ruby-and-the-compiler-made-it-10x-faster/ Nedim Terminal showing Spinel compiling Ruby to native binary with 10x speedup benchmark Terminal showing Spinel compiling Ruby to native binary with 10x speedup benchmark

I wrote a log analyzer in Ruby. Then I compiled it to a native binary. It ran 10 times faster than the same algorithm in CRuby, and 3 times faster than idiomatic Ruby with regex and each. The part that surprised me most was that the idiomatic Ruby version, the one with regex parsing and sort_by and Hash.new(0), was already 4.7x faster than the while-loop version running in CRuby. The interpret...

2026-04-24T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/your-s3-bucket-is-an-open-directory/ Nedim curl command listing S3 bucket contents with no credentials curl command listing S3 bucket contents with no credentials

One curl command can enumerate every file in your S3 bucket. No credentials. No login. Just an HTTP GET. Here is how to find it, why it matters more than you think, and the Terraform fix.

2026-04-23T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/breaking-my-own-infrastructure-what-i-found/ Nedim A terminal showing a completed pentest with findings summary A terminal showing a completed pentest with findings summary

Twelve days ago I opened a terminal, pointed curl at our staging API, and started breaking things. I didn’t have a plan. I didn’t have a timeline. I just had coffee, paranoia, and a vague sense that “it probably works fine” wasn’t good enough anymore. Here’s what I found. The Series at a Glance What started as “let me test this one form” turned into a full infrastructure security audit spann...

2026-04-22T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/what-dryrun-taught-me-about-confidence/ Nedim A door that looks locked from across the street but opens when you turn the handle A door that looks locked from across the street but opens when you turn the handle

I shipped a false positive to my team. In bold. With a CRITICAL severity tag. And I was wrong. Not “wrong about a detail” wrong. Wrong about the entire finding. The vulnerability I described didn’t exist. I had tested it with --dryrun, seen a “success,” and written it up with the confidence of someone who has never been humbled by AWS IAM. This post covers the 48 hours between “I found someth...

2026-04-21T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/the-load-balancer-that-trusted-everyone/ Nedim An ALB accepting X-Forwarded-For headers directly from the internet An ALB accepting X-Forwarded-For headers directly from the internet

Rate limiting is supposed to stop brute-force attacks. Ours didn’t. Not because the rate limiter was broken. It worked perfectly. The problem was that it was counting the wrong IP addresses. An attacker could make unlimited login attempts by adding one HTTP header to each request. No tools. No exploits. Just curl -H "X-Forwarded-For: random-ip". This is a story about trust proxy: 2, an ALB se...

2026-04-20T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/i-can-read-everyones-invoices/ Nedim Sequential ID enumeration revealing finance records with sensitive data Sequential ID enumeration revealing finance records with sensitive data

I was testing my own finance records. Checking that the API returned the right data for my user. Standard BOLA test: try accessing someone else’s record and confirm you get a 403. I didn’t get a 403. I got a 200. With someone else’s full accounting invoice, their billing email, their physical address, and, buried 38 fields deep in the response, a token that lets you log in as them without a p...

2026-04-19T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/the-refresh-token-that-wouldnt-die/ Nedim A refresh token being used five times with all five attempts succeeding A refresh token being used five times with all five attempts succeeding

I logged out. Then I used my old refresh token. It still worked. I used it again. Still worked. Five times. Ten times. A week later. Still worked. This is a story about a refresh token that refused to die, and why “we use JWTs” is not a security strategy. How Refresh Tokens Are Supposed to Work Quick primer for anyone who hasn’t thought about this in a while. When you log in, the server gi...

2026-04-18T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/3am-and-im-creating-thousand-invoices/ Nedim Terminal generating 1000 invoices at 3 AM with no rate limiting Terminal generating 1000 invoices at 3 AM with no rate limiting

I wasn’t supposed to be awake at 3 AM. But I’d had too much coffee and my brain wouldn’t shut off, so I figured I’d do one more test before bed. There’s something meditative about curling endpoints at night. The house is quiet. The terminal glows. You send a request and wait for the universe to answer. Tonight, the universe had opinions. The Endpoint That Shouldn’t Exist I’d found this endp...

2026-04-17T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/xss-payloads-in-my-support-tickets/ Nedim XSS payload in a support ticket rendering on the agent dashboard XSS payload in a support ticket rendering on the agent dashboard

The best part about doing security testing on your own systems is that you can be as reckless as you want. The worst part is realizing you just sent <script>alert(1)</script> to your own support platform. Sorry, past me. And sorry to whatever support agent has to review those tickets. The Contact Form I’d been poking at this contact form all morning. You know the type: name, emai...

2026-04-16T16:00:00+07:00 2026-08-10T02:33:57+07:00 https://blog.nedtechie.com/posts/when-your-internal-fields-arent-internal/ Nedim JSON payload with dangerous internal fields highlighted in red JSON payload with dangerous internal fields highlighted in red

I deleted my own account today. Not on purpose. I’m not that chaotic. I was testing something, and then I couldn’t log in anymore. The Profile Update Endpoint I was testing the user profile update functionality. You know, the thing where you change your name or update your email. Standard stuff. The request looks like this: PUT /api/users/12345 { "firstName": "Nedim", "lastName": "Hadz...