Shivasurya

2025 Wrapped Published 📰 Sourcegraph Blog: Lessons from building Sherlock: Automating security code reviews with Sourcegraph Built AI security agent around 2024 and wrote a blog post about it.

Vulnerability Overview Yesterday I came across this CVE-2025-64459 and I was bit skeptical about the severity of the issue as it was marked as critical.

AI-Powered Security Vulnerability Hunting at Scale SecureFlow CLI is an open-source agentic SAST security tool that uses AI-powered loops to autonomously hunt for vulnerabilities in codebases.

Back in 2017, I used to tease my friend about his machine learning work (training models, dataset operations, ML deployments) - “Come on, admit it, aren’t you just writing complex if-elif-else statements and calling yourself an ML engineer?”.

Model Context Protocol (MCP) and Tool Calling are revolutionizing the application layer of Large Language Models (LLMs), enabling AI to autonomously operate tools and MCP servers to complete tasks.

Originally published on the Code-Pathfinder Blog.

Originally published on the Sourcegraph Blog.

Introduction In a previous post on the Sherlock blog, I discussed leveraging large language models (LLMs) to assist with security code reviews.

Intro While there’s a lot of skepticism about using AI to automate tasks, I’ve found AI tools to be invaluable allies that enhance my results and handle niche tasks. 🤖 Reflecting on My LLM Usage I used to pay for OpenAI & Anthropic Claude API access and r…

2024 Wrapped Read 12 books Built Code-Pathfinder, Open-source alternative to GitHub CodeQL Received positive interest and interaction from various people working for Microsoft, GitHub, Elastic and TrailofBits Mind-blown to see people reaching out regarding

Books If you’re looking for a great device to read books, highlight important sections, and take notes, the Kindle Scribe is a fantastic option.

Introduction Recently, I have been thinking about aggregate functionality design for Code PathFinder, opensource alternative to GitHub CodeQL.

Intro Need for semi-autonomous security code reviews My job as a security engineer (application security context) is to read source code and perform security reviews.

This is the third part of the blog post series on building inter-procedural source sink analysis from scratch.

Overview In this post, we will explore code execution using Java & Kotlin Deserialization in Android Application.

2023: A Year of Unexpected Adventures and Rich Insights.

This is the second part of the blog post series on building inter-procedural source sink analysis from scratch.

Overview of Source Sink Analysis Source Sink Analysis is a type of basic static analysis that detects the flow of information from a source to a sink.

Imagine being a newcomer to Canada around 2019, relying on public transit to navigate the Waterloo region.

In high school (~2012), I made a significant upgrade from my Nokia 1600 to an Android Jelly Bean device, API 16.

If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Expl…

If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Expl…

If you haven’t set up your lab yet, feel free to check out my previous article on Exploit.education lab setup Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Expl…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Quick Overview Microsoft announced patch for CVE-2023-23397 which generally goes out usually on tuesday (Mar 14, 2023).

Quick Overview Active is one of the easy Active Directory focused Windows Box from TJNull OSCP Practice list.

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Quick Overview Jerry is one of the Windows Box from TJNull OSCP Practice list.

Quick Overview This blog post acts as Index of TJNull HackTheBox OSCP Practice list.

Quick Overview Bashed Box is one of the Linux Box from TJNull OSCP Practice list.

Android WebView widget provides APIs that help developers seamlessly integrate webpage contents within Android application.

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise Stack Four Writeup - Exploit E…

Previous Writeup: Stack Zero Writeup - Exploit Education Lab Exercise Stack One Writeup - Exploit Education Lab Exercise Stack Two Writeup - Exploit Education Lab Exercise Stack Three Writeup - Exploit Education Lab Exercise If you’re learning and writing…

If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah.

If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah.

If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah.

If you’re learning and writing binary exploits, I would strongly recommend you to take Architecture 1001: x86-64 Assembly course by Xeno Kovah.

Exploit.education binary exploitation exercise typically runs on ASLR (Address space layout randomization) disabled ubuntu based virtual machine with Data Execution Prevention turned off binaries.

Recently I was playing with overflow vulnerabilities help of exploit.education exercise which mostly covers basic heap, buffer overflow, use-after-free vulnerability patterns in a contained qemu based environment.

Content Provider is one of the powerful APIs which helps Android developers programmatically expose resource content within Android ecosystem via Intents.

Reflected XSS (Cross-Site Scripting) attack is my favorite vulnerability category as it’s relatively easy to exploit by checking for params as the source and rendering DOM as the sink.

As Javascript programming language popularity increases, platforms have already started adopting it from native desktop apps, mobile, browser to server-side, giving rise to exciting frameworks, style guides, tools.