Ashish Gupta

What an honor to be in that list of "Super Honorable mentions" for my report submission to @SANSInstitute HHC 2022 out of 16K participants! 2nd time in 2 years. Thank you @CounterHackSec @edskoudis @chriselgee @evanbooth @JF0LKINS for the terrific experience @KringleCon

Its awesome to be in the "Super Honorable Mentions" list and part of 0.8% who completed the all the challenges in SANS Holiday Hack Challenge 2025. :-) @edskoudis @CounterHackSec @SANSInstitute guptaashish.com/2026/01/06/san…

@k_firsov @FearsOff Very neat research! In this case, both the hosts below have the same base domain name fearsoff.net and potentially the cert has both domains below otherwise you would see Cloudflare 526 error? bypass-grafana.fearsoff.org grafana.fearsoff.net

9) If you want a pentest from an elite team of ethical hackers, feel free to reach out @FearsOff. Happy bug hunting! fearsoff.org/research/cloud…

How to access servers behind Cloudflare by bypassing the firewall? @FearsOff #bugbountytips #cloudflare #firewall #bypass 1) Found a sweet hostname but Cloudflare Firewall blocks you? There's a neat trick attackers can use if the origin is misconfigured.

Cloudflare Workers offer a simple, efficient way to serve sorry/maintenance pages for any app behind Cloudflare. Here is the design and end-to-end implementation. guptaashish.com/2025/08/31/imp… @Cloudflare @CloudflareDev #Cloudflare

@edskoudis saw this in a local store! 😊🎅#holidayhack

@otter_ai the OtterPilot still joins the meeting and transcribes even though all settings are off to auto join etc. .Sent an email to support and no avail. Need help! This is clearly a security and privacy issue.

@NathanMcNulty We typically explicitly exclude accounts. I recall that as recommendation in the docs unless something has changed.

Do you explicitly exclude emergency access accounts from CA policies, or do you put them in a group and exclude the group? I've always been worried about what happens when CA can't retrieve group membership from Entra due to service issues, but maybe that's not how it works?

What a pleasant surprise to see you here ⁦@DaleSteyn62⁩ 😊

@NathanMcNulty @merill And this license is not included in E5?

@ashishrocks @merill That is correct :( It was free during preview but removed at GA. A good note though is that Premium also includes risk events for service principals ;) learn.microsoft.com/en-us/entra/id…

@NathanMcNulty @merill Is the only way to implement ip restriction for azure AD app requests(e.g via graph api) by using workload ID premium? guptaashish.com/2024/02/12/imp…

@merill @NathanMcNulty Fixed it. Thank you.🙏

@NathanMcNulty @ashishrocks The embed doesn't work for me too but copying the url and opening it worked. Could be something to do with the embed code.

Getting a handle on Entra ID apps and their permissions. @merill @NathanMcNulty guptaashish.com/2024/02/01/170…

@NathanMcNulty @merill Thank you. 🙏 strange it loaded for me in YouTube. It really worked well. @merill explained it so well in the video. I wouldn’t have done any better.

@ashishrocks @merill Looks great Ashish :) The video for Merill wasn't loading, and I'll rewrite an example of that in Graph PS for you later We also have App Governance that can help if people are licensed Will share this out later today ;)

Folks I haven’t event listened the whole thing but still recommend it - just for that phone call. podcasts.apple.com/us/podcast/dar…

@JackRhysider I’m just literally laughing as I’m typing this after listening to your phone call to your dad in the latest “Axact” episode in @DarknetDiaries. You sir are awesome!

@LiveOverflow But…but..the db server is behind the next generation firewall! That should be enough right? 😊

Cleartext passwords in a database is not a security vulnerability

@merill “Azure AD”, @merill? 😊

7/8

Windows LAPS just went GA today! Here's a refresher and quick walkthrough on what it is and how you can start using it. 🧵⬇️

@reprise_99 Epic! reddit.com/r/CricketShitp…

@reprise_99 Ricky Ponting has a valid point about the replacement ball. Nowhere close to the old ball.

Going into the days cricket at The Oval and maybe the last day of the series, I am extremely confident in the Australian's retaining the Ashes🏏 #Ashes2023