Research
Technical write-ups and vulnerability analysis. Subscribe via RSS.
- AI Coding Agent Workbench: Setup and Field Practice
Wrapping coding agents like Claude Code in four engineering layers — rules, memory, capabilities, and a ledger — turns them into a pipeline that keeps producing gradeable reports against authorized targets: a field methodology spanning cold start through Web / mini-program / APP target types.
- Windows Client RCE Hunting Methodology: A Full-Spectrum Playbook
A complete methodology covering attack-surface mapping, unconventional entry points (clipboard/OLE/Deep Link/file semantics), component trust boundaries (Electron/WebView2/COM/RPC), fuzzing, crash triage, and non-destructive PoC — spanning the full workflow for hunting RCE in Windows desktop clients.
- The Trouble with Spring Authorization Bypasses
Starting from the routing-matching source in DispatcherServlet, this explains why authorizing on getRequestURI/getRequestURL — or blacklist-validating paths — in Spring is easy to bypass.
- Kubernetes Attack Playbook
A Kubernetes penetration-testing quick-reference: service fingerprinting, unauthorized access (Dashboard/API Server/Kubelet/Etcd/Docker API), and post-access persistence, log cleanup, and privileged-container escape techniques.