Deepak Prasad

Create an authorized Gophish phishing simulation on Kali: sending profile, users, email template, landing page, campaign launch, event metrics, CSV export, and troubleshooting.

Learn social engineering attack types with a clear taxonomy by channel, targeting, technique, and objective — phishing vs spear phishing vs whaling, BEC, vishing vs smishing, baiting, physical methods, recognition …

Fix Terraform S3 CreateBucket 409 errors — tell BucketAlreadyExists from BucketAlreadyOwnedByYou, understand the global bucket namespace, import an existing bucket into state, or choose a new unique bucket name.

Fix Terraform Error acquiring the state lock on an S3 remote backend — tell S3 native .tflock locking apart from legacy DynamoDB locks, read lock metadata, clear stale locks safely, and fix backend and IAM settings.

Pentest a REST API with Postman and Burp Suite: import OpenAPI, proxy traffic, replay in Repeater, test BOLA with two JWT users, and check common JWT implementation mistakes on an authorized Flask lab.

Fix Terraform AWS ExpiredToken errors caused by expired STS credentials, stale AWS_SESSION_TOKEN variables, or IAM Identity Center sessions. Diagnose the active credentials and refresh them correctly.

Build a controlled WPA2 rogue AP honeypot on Kali with mac80211_hwsim, observe same-SSID different-BSSID behavior, and test directed deauthentication and wpa_supplicant reassociation.

Build an authorized evil twin on Kali with mac80211_hwsim, hostapd, dnsmasq, and a lab-only portal page, then compare WiFi-Pumpkin3 as an optional automation layer.

Capture a WPA/WPA2-Personal four-way handshake on an isolated mac80211_hwsim lab, verify EAPOL frames, and test candidate PSKs offline with Aircrack-ng on Kali.

Test IDOR and BOLA with two accounts: prove missing object-level authorization on reads and writes with Burp Repeater, show why UUIDs do not fix access control, and prevent broken authorization in APIs.

Learn how insecure deserialization works, how to detect serialized data, test untrusted PHP serialized state in a lab, understand gadget chains at a high level, and prevent unsafe reconstruction.

SSRF tutorial: how server-side request forgery works, find URL-fetch features, test against a controlled internal service, understand blind SSRF and metadata risk, and prevent unsafe server-side fetches.

Advanced CSRF testing on DVWA: missing empty and invalid tokens, session-bound tokens, method-dependent validation, weak Referer checks, non-session cookie patterns, and SameSite limits.

Learn AWS cloud penetration testing fundamentals: how IAM identity, EC2 Instance Metadata Service (IMDS), and the SSRF-to-role-credentials path differ from traditional network pentests.

Create an encrypted versioned S3 bucket with Terraform, migrate local state with terraform init -migrate-state, enable S3 native locking with use_lockfile on Terraform 1.10+, and verify remote state in the bucket.

CSRF tutorial on DVWA: how cross-site request forgery abuses cookie auth, prove a browser-delivered forged request, explain CSRF tokens and SameSite cookies, and prevent forged browser requests.

Learn which Docker configurations let a compromised container affect the host, how to inspect privileged mode, docker.sock, capabilities, and mounts, and how Docker Bench differs from CVE scanners.

Use Pacu 1.7.0 against CloudGoat iam_privesc_by_rollback to enumerate IAM permissions, interpret privilege-escalation findings, and validate a policy-version rollback path with AWS CLI evidence.

Run Prowler and ScoutSuite against the same AWS account with a shared read-only auditor identity that covers both tools’ documented permissions, compare IAM, S3, and EC2 findings, and manually validate mismatches before …

Local file inclusion (LFI) tutorial on DVWA: distinguish LFI from path traversal and RFI, confirm unsafe include behavior, test wrappers and controlled execution conditions, and prevent user-controlled includes.

Learn how to use DVWA for web penetration testing practice: navigate vulnerability modules, understand security levels, compare defenses, and follow focused lessons for each attack.

OS command injection tutorial: detect shell injection, confirm in-band and blind cases, compare Linux and Windows command context, use Burp Repeater, and prevent unsafe OS process calls.

SSTI tutorial: detect a server-side template injection vulnerability with benign payloads such as {{7*7}}, identify engines like Jinja2 from response behavior, and keep template source trusted.

XSS attack tutorial on Kali with DVWA: learn reflected, stored, and DOM XSS through the input-context-execution model, prove each type safely, then cover Burp checks, prevention, CSP, and XSS vs CSRF.

Fix Terraform AWS UnauthorizedOperation on Ubuntu — confirm which IAM identity runs plan and apply, decode the authorization failure message with the AWS CLI, read the denied API action, and request or attach the missing …

Fix Terraform destroy DependencyViolation on AWS VPC — find subnet ENI and gateway blockers with the AWS CLI, recover when child resources were removed from state with terraform import, and destroy in dependency order.

Reproduce and fix Terraform AWS provider No valid credential sources found on Ubuntu — shared credentials file, environment variables, named profiles, aws login export-credentials, IAM Identity Center SSO, EC2 instance …

SQL injection tutorial on Kali: understand the vulnerable query, confirm SQLi manually on DVWA, UNION and blind techniques, then automate with sqlmap cookies, Burp requests, and limited enumeration.

Burp Suite tutorial for beginners on Kali: Proxy, HTTP history, target scope, intercept, Repeater, Intruder, external browser setup, and troubleshooting with DVWA on localhost.

msfvenom encoders change payload bytes for bad characters, not AV evasion. See why shikata_ga_nai still gets detected and how to test encoding honestly in a lab.