Home on Bryce Alan Hayes — Security Researchhttps://brycealanhayes.com/Recent content in Home on Bryce Alan Hayes — Security ResearchHugoen-usSun, 20 Sep 2026 00:00:00 +0000AI 编程智能体工作台：搭建与实战https://brycealanhayes.com/research/ai-agent-workbench/Sun, 20 Sep 2026 00:00:00 +0000https://brycealanhayes.com/research/ai-agent-workbench/把 Claude Code 这类编程智能体套上规则、记忆、能力、台账四层工程设施，变成一条能对授权目标持续产出可定级报告的流水线：从冷启动到 Web / 小程序 / APP 三种目标形态的实战方法论。Windows 客户端 RCE 挖掘方法全景手册https://brycealanhayes.com/research/windows-client-rce-playbook/Mon, 17 Aug 2026 00:00:00 +0000https://brycealanhayes.com/research/windows-client-rce-playbook/从攻击面测绘、偏门入口（剪贴板/OLE/Deep Link/文件语义）、组件信任边界（Electron/WebView2/COM/RPC），到 Fuzzing、崩溃研判与无破坏 PoC 的完整方法论，覆盖 Windows 桌面客户端 RCE 挖掘的全流程。Spring 权限绕过的那些事儿https://brycealanhayes.com/research/spring-auth-bypass/Sat, 01 Aug 2026 00:00:00 +0000https://brycealanhayes.com/research/spring-auth-bypass/从 DispatcherServlet 的路由匹配源码出发，讲清楚为什么在 Spring 框架下用 getRequestURI/getRequestURL 做鉴权、或用黑名单校验路径，容易被绕过。Kubernetes 攻击操作手册https://brycealanhayes.com/research/kubernetes-attack-playbook/Wed, 15 Jul 2026 00:00:00 +0000https://brycealanhayes.com/research/kubernetes-attack-playbook/一份 Kubernetes 渗透测试速查手册：从服务指纹识别、未授权访问（Dashboard/API Server/Kubelet/Etcd/Docker API），到拿到权限后的持久化、痕迹清理与权限下的容器逃逸技巧。Example Write-up: Replace With Your Own Researchhttps://brycealanhayes.com/research/example-writeup/Mon, 01 Jan 2024 00:00:00 +0000https://brycealanhayes.com/research/example-writeup/A placeholder post demonstrating layout, syntax highlighting, and table of contents. Replace or delete before publishing.