Archives

2026 ⁸

August ²

You Bought the Hands, Not the Brain: After Analyzing Burp AT, I Built an Open-Source Burp MCP

2026-08-12 · 12 min · 2397 words · @Unc1e

Agents Can Now Take Action—Security Can’t Stay in the Conversation: Runtime Design at the Action Boundary

2026-08-02 · 6 min · 2677 words · @Unc1e

April ³

Reverse OpenRouter

2026-04-26 · 1 min · 208 words · @Unc1e

Stuffing OpenAI’s Privacy Filter Model into the Red Team Toolchain

2026-04-25 · 8 min · 1532 words · @Unc1e

A Survey of the Security Risks of File Hash Leaks

2026-04-22 · 36 min · 7507 words · @Unc1e

March ¹

From “Invalid Invite Code” to Binary Patching: A Tauri Reverse-Engineering Practice

2026-03-18 · 4 min · 788 words · @Unc1e

January ²

Android Reverse Engineering: LSPatch, the Root-Free Patch Mode

2026-01-14 · 3 min · 446 words · @Unc1e

Android Reverse Engineering in Practice: Attack and Defense of App State Machines, Seen Through Cracking “Movie Hunter”

2026-01-14 · 2 min · 976 words · @Unc1e

2025 ²

May ¹

Golang Gorilla/sessions Session Forgery Risk Analysis and Reproduction

2025-05-21 · 6 min · 1209 words · @Unc1e

April ¹

Red Team Essential! Frp Anti-Traceability Enhanced Build

2025-04-14 · 5 min · 901 words · @Unc1e

2024 ¹

September ¹

[SOC] Traffic Protection Effectiveness: How to Verify Whether Your Internal Network IDS Is Working Properly

2024-09-16 · 2 min · 370 words · @Unc1e

2023 ³

November ²

Stable Packet Capture: Intercepting Traffic from Various Devices via a Transparent Proxy (mitmproxy Usage)

2023-11-24 · 5 min · 872 words · @Unc1e

The Form Is a Honeypot, the PDF Is the Real Target: Bypassing Websites That Pretend You Need to Register

2023-11-03 · 3 min · 531 words · @Unc1e

August ¹

[SOC] Defending Against Apereo CAS Deserialization Attacks with Suricata

2023-08-08 · 2 min · 832 words · @Unc1e

2022 ²

August ¹

[CVE-2022-36804] Bitbucket Pre-auth RCE Vulnerability

2022-08-30 · 9 min · 1762 words · @Unc1e

March ¹

HackTheBox: Tenet Notes

2022-03-06 · 4 min · 765 words · @Unc1e

2021 ²⁴

October ²

A Look at AutoBinding Vulnerabilities in Spring MVC

2021-10-21 · 6 min · 1263 words · @Unc1e

pwnhub: Internal CTF [Unboxing Together - So_That_Login] Writeup

2021-10-21 · 3 min · 551 words · @Unc1e

September ³

CVE-2021-41714: Tipask PostAuth LFR

2021-09-23 · 2 min · 291 words · @Unc1e

pwnhub: [Mid-Autumn Festival] BabyExec writeup

2021-09-17 · 1 min · 420 words · @Unc1e

[Responsible Disclosure] Tipask Contains an Authenticated Arbitrary Local File Download Vulnerability

2021-09-16 · 2 min · 224 words · @Unc1e

August ²

How to Obtain Source Code During Penetration Testing

2021-08-31 · 7 min · 1471 words · @Unc1e

[CVE-2013-4730] Studying the PCMan’s FTP Server Buffer Overflow Vulnerability

2021-08-27 · 5 min · 2056 words · @Unc1e

July ²

Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php#2 (bypass of CVE-2020-35337)

2021-07-30 · 7 min · 1405 words · @Unc1e

Spring Actuator Unauthenticated Vulnerability Reproduction Notes

2021-07-07 · 7 min · 1335 words · @Unc1e

June ¹

A Look at the Classic SSI Injection

2021-06-11 · 5 min · 902 words · @Unc1e

May ⁴

【CVE-2016–3714】ImageMagick Command Execution Vulnerability

2021-05-30 · 6 min · 1101 words · @Unc1e

[CVE-2020-9496] Apache OfBiz Deserialization Command Execution Vulnerability

2021-05-25 · 5 min · 901 words · @Unc1e

HackTheBox: Monitors Notes

2021-05-18 · 14 min · 2792 words · @Unc1e

HackTheBox: Ready Notes

2021-05-09 · 4 min · 829 words · @Unc1e

April ¹

Attacking GraphQL — Learning GraphQL Security from the DVGA Range

2021-04-28 · 12 min · 2416 words · @Unc1e

March ²

Redis <= 5.0.5 Master-Slave Replication RCE Study Notes

2021-03-20 · 4 min · 686 words · @Unc1e

[CVE-2016-4977] Spring Security OAuth RCE Vulnerability Study

2021-03-18 · 4 min · 708 words · @Unc1e

February ²

[Translation] OWASP NodeJS Security

2021-02-09 · 1 min · 26 words · @Unc1e

[Guest Post] Code Audit Notes on an Ops System (Django+MongoDB+Redis)

2021-02-05 · 4 min · 1895 words · @Unc1e

January ⁵

[Guest Post] A Practical Java Servlet Audit

2021-01-24 · 9 min · 1721 words · @Unc1e

Spark Unauthorized Access RCE Vulnerability

2021-01-19 · 2 min · 379 words · @Unc1e

Bypassing Regular Expressions in PHP via PCRE Backtracking

2021-01-15 · 3 min · 1457 words · @Unc1e

Code-Breaking Audit Records [7/9]

2021-01-15 · 9 min · 4059 words · @Unc1e

Talking About Weak Typing in PHP

2021-01-11 · 3 min · 1287 words · @Unc1e

2020 ²⁶

December ³

SSRF Bypass Techniques

2020-12-29 · 4 min · 1810 words · @Unc1e

Flask Debug-Mode PIN Generation Mechanism: Security Reproduction Notes

2020-12-06 · 4 min · 795 words · @Unc1e

Thinksaas has a Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php

2020-12-03 · 5 min · 901 words · @Unc1e

November ³

SSRF: Principles and Remediation

2020-11-16 · 9 min · 1737 words · @Unc1e

A Hands-On Guide to Building a CTF Range Environment with Docker

2020-11-07 · 5 min · 2204 words · @Unc1e

Rsync Authentication Analysis Notes (with Brute-Force Script)

2020-11-05 · 7 min · 1302 words · @Unc1e

October ¹

[Guest Post] A Commissioned Product Security Test

2020-10-29 · 9 min · 1895 words · @Unc1e

August ¹

A Brief Discussion of DDoS Attacks

2020-08-03 · 7 min · 3504 words · @Unc1e

July ¹

HackTheBox Notes: Shocker

2020-07-05 · 6 min · 1205 words · @Unc1e

June ²

HackTheBox: Active Notes

2020-06-27 · 6 min · 2896 words · @Unc1e

HackTheBox: DevOops Notes

2020-06-06 · 3 min · 507 words · @Unc1e

May ⁴

HackTheBox: Sense Notes

2020-05-29 · 3 min · 553 words · @Unc1e

HackTheBox: Beep Notes

2020-05-25 · 3 min · 470 words · @Unc1e

HackTheBox: Legacy Notes

2020-05-18 · 3 min · 549 words · @Unc1e

HackTheBox: Solidstate Notes

2020-05-07 · 10 min · 2121 words · @Unc1e

April ⁸

HackTheBox: Postman Notes

2020-04-30 · 4 min · 778 words · @Unc1e

HackTheBox: October Notes (PWN)

2020-04-24 · 3 min · 1483 words · @Unc1e

HackTheBox: Grandpa Notes

2020-04-23 · 7 min · 1434 words · @Unc1e

HackTheBox: OpenAdmin Notes

2020-04-20 · 4 min · 754 words · @Unc1e

HackTheBox: Cronos Notes

2020-04-18 · 4 min · 1808 words · @Unc1e

HackTheBox: Bastard Notes

2020-04-15 · 7 min · 1368 words · @Unc1e

[Guest Post] MKCMS Code Audit Notes

2020-04-10 · 3 min · 1401 words · @Unc1e

SQLi-labs Study Notes

2020-04-05 · 31 min · 6426 words · @Unc1e

March ¹

WeCenter Code Audit

2020-03-24 · 6 min · 1224 words · @Unc1e

January ²

BlueCMS Code Audit Notes

2020-01-12 · 2 min · 543 words · @Unc1e

NexusPHP Code Audit Notes

2020-01-10 · 4 min · 697 words · @Unc1e

2019 ¹

December ¹

VulnHub GoldenEye Walkthrough Notes

2019-12-26 · 5 min · 954 words · @Unc1e

2026 8

August 2

You Bought the Hands, Not the Brain: After Analyzing Burp AT, I Built an Open-Source Burp MCP

Agents Can Now Take Action—Security Can’t Stay in the Conversation: Runtime Design at the Action Boundary

April 3

Reverse OpenRouter

Stuffing OpenAI’s Privacy Filter Model into the Red Team Toolchain

A Survey of the Security Risks of File Hash Leaks

March 1

From “Invalid Invite Code” to Binary Patching: A Tauri Reverse-Engineering Practice

January 2

Android Reverse Engineering: LSPatch, the Root-Free Patch Mode

Android Reverse Engineering in Practice: Attack and Defense of App State Machines, Seen Through Cracking “Movie Hunter”

2025 2

May 1

Golang Gorilla/sessions Session Forgery Risk Analysis and Reproduction

April 1

Red Team Essential! Frp Anti-Traceability Enhanced Build

2024 1

September 1

[SOC] Traffic Protection Effectiveness: How to Verify Whether Your Internal Network IDS Is Working Properly

2023 3

November 2

Stable Packet Capture: Intercepting Traffic from Various Devices via a Transparent Proxy (mitmproxy Usage)

The Form Is a Honeypot, the PDF Is the Real Target: Bypassing Websites That Pretend You Need to Register

August 1

[SOC] Defending Against Apereo CAS Deserialization Attacks with Suricata

2022 2

August 1

[CVE-2022-36804] Bitbucket Pre-auth RCE Vulnerability

March 1

HackTheBox: Tenet Notes

2021 24

October 2

A Look at AutoBinding Vulnerabilities in Spring MVC

pwnhub: Internal CTF [Unboxing Together - So_That_Login] Writeup

September 3

CVE-2021-41714: Tipask PostAuth LFR

pwnhub: [Mid-Autumn Festival] BabyExec writeup

[Responsible Disclosure] Tipask Contains an Authenticated Arbitrary Local File Download Vulnerability

August 2

How to Obtain Source Code During Penetration Testing

[CVE-2013-4730] Studying the PCMan’s FTP Server Buffer Overflow Vulnerability

July 2

Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php#2 (bypass of CVE-2020-35337)

Spring Actuator Unauthenticated Vulnerability Reproduction Notes

June 1

A Look at the Classic SSI Injection

May 4

【CVE-2016–3714】ImageMagick Command Execution Vulnerability

[CVE-2020-9496] Apache OfBiz Deserialization Command Execution Vulnerability

HackTheBox: Monitors Notes

HackTheBox: Ready Notes

April 1

Attacking GraphQL — Learning GraphQL Security from the DVGA Range

March 2

Redis <= 5.0.5 Master-Slave Replication RCE Study Notes

[CVE-2016-4977] Spring Security OAuth RCE Vulnerability Study

February 2

[Translation] OWASP NodeJS Security

[Guest Post] Code Audit Notes on an Ops System (Django+MongoDB+Redis)

January 5

[Guest Post] A Practical Java Servlet Audit

Spark Unauthorized Access RCE Vulnerability

Bypassing Regular Expressions in PHP via PCRE Backtracking

Code-Breaking Audit Records [7/9]

Talking About Weak Typing in PHP

2020 26

December 3

SSRF Bypass Techniques

Flask Debug-Mode PIN Generation Mechanism: Security Reproduction Notes

Thinksaas has a Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php

November 3

SSRF: Principles and Remediation

A Hands-On Guide to Building a CTF Range Environment with Docker

Rsync Authentication Analysis Notes (with Brute-Force Script)

October 1

[Guest Post] A Commissioned Product Security Test

August 1

A Brief Discussion of DDoS Attacks

2026 ⁸

August ²

April ³

March ¹

January ²

2025 ²

May ¹

April ¹

2024 ¹

September ¹

2023 ³

November ²

August ¹

2022 ²

August ¹

March ¹

2021 ²⁴

October ²

September ³

August ²

July ²

June ¹

May ⁴

April ¹

March ²

February ²

January ⁵

2020 ²⁶

December ³

November ³

October ¹

August ¹

July ¹

June ²

May ⁴

April ⁸

March ¹

January ²

2019 ¹

December ¹