00. Security & Hacking
// OFFENSIVE — Technical depth × practicality
01. Validating SSRF Quickly with OAST
When you identify a possible SSRF sink, the key is to check immediately whether it produces outbound DNS or HTTP traffic. OAST (Out-of-Band Application Security Testing) works by triggering an external request and observing its trace, leaving evidence even when a WAF or filter blocks the visible response.
02. LD_PRELOAD Runtime Hooking at a Glance
When patching a binary is difficult in the early stages of reverse engineering, LD_PRELOAD is often the fastest bypass. It overrides functions with a preloaded shared library when the dynamic linker resolves symbols.
03. A Fast Browser Extension Reversing Routine
For Chrome/Edge browser extensions, extracting CRX → ZIP gets you almost to the finish line. Even when the source is obfuscated, establishing the structure first dramatically speeds up analysis.
04. A Quick Feel for SROP: Setting Every Register with sigreturn
SROP (Sigreturn Oriented Programming) calls sysrtsigreturn to make the kernel restore the sigcontext on the stack verbatim. It can shorten a ROP chain or set all registers at once when gadgets are scarce. The key is to place a fake signal frame on the stack and trigger rt_sigreturn with syscall; ret.
05. ret2csu Mini Cheatsheet
When ROP gadgets are scarce in a PIE/NX environment, you can build a function call with two gadgets
06. Shadow DOM XSS Hunting Points
Modern frontends use Web Components to encapsulate UI inside the Shadow DOM. However, some sanitizers inspect only the light DOM. In that case, injecting unsafe HTML through a root exposed with attachShadow({mode:"open"}) can lead to XSS.
07. A Quick Feel for AES-CBC Bit-Flipping Attacks
In CBC mode, the preceding ciphertext block is XORed into the plaintext of the next block. This
08. Quickly Identifying Binary Protections with checksec in CTFs
When solving reversing or pwn challenges, the task for the first 30 seconds is to inspect the protection options with checksec. Whether NX, PIE, and Canary are enabled completely changes the exploitation strategy.
09. DNS Rebinding: The Boundary Between Origin and Endpoint
DNS Rebinding is an attack in which an attacker changes DNS answers for a hostname they control so that a browser first receives code from an external server and later connects through the same hostname to an internal-network or loopback service. The key is not hacking DNS itself, but exploiting the gap between a web origin's identity and its actual network endpoint.
10. ECB Cut-and-Paste Attack Notes
Because AES-ECB encrypts each block independently, identical plaintext blocks map to identical
11. Quick Checks for Host Header Attacks
Web applications often use the Host value to build redirect URLs, absolute links, and email or password-reset links. If the trust boundaries between the proxy, cache, and application do not align, this can lead to Open Redirects, link hijacking, or cache poisoning.
12. Accelerating Web Reverse Engineering with Source Maps
Even when a production JavaScript bundle is obfuscated, leaving a .map file behind exposes the original structure. From an attacker's perspective, it is a shortcut to finding hidden APIs, feature flags, and debug routes*.
13. Notes on OAuth redirect_uri Pitfalls
Loose validation of redirect_uri in OAuth/OIDC can lead to token theft or account-linking
14. Applying the RSA Common-Modulus Vulnerability in CTFs
If RSA reuses the same N (modulus) while encrypting with different values of e, the plaintext can
15. Finding Reverse-Engineering Clues in Ten Minutes with strace and ltrace
Running strace and ltrace before static analysis gives you an immediate view of I/O flow and library calls. They are excellent for narrowing down key-verification routines quickly in CTF crackmes.
16. Bypassing Path Traversal Filters with Unicode Normalization
When a web server or API filters only ../, differences in Unicode normalization (NFC/NFKC) may
17. Building Reversing Signatures with YARA Rules
YARA is a tool for declaratively matching patterns in binaries and memory dumps. During reversing,
18. A Quick Guide to Zip Slip Vulnerabilities
Zip Slip is a vulnerability that enables arbitrary file writes when ../ paths are not properly removed during archive extraction. If a web upload feature extracts ZIP files, an entry such as ../../../../var/www/html/shell.jsp can overwrite files on the server.
19. A Taste of Symbolic Execution with angr
In reverse engineering, symbolic execution is a technique that finds valid solutions by treating input conditions as variables and tracing execution paths. It is especially powerful for CTF crackmes and obfuscated branches.
20. Notes on Bypassing ptrace Anti-Debugging
A reverse-engineering target will often terminate immediately when it detects a debugger with ptrace(PTRACE_TRACEME). The key is to control the call site and return value.
21. Extracting Flags Through Log Leaks in CTFs
A surprisingly powerful vector in web and reversing CTFs is the log leak. The key is to identify quickly what gets logged and where.
22. GraphQL Introspection Abuse Points
In GraphQL, the schema is the API documentation itself. If introspection is enabled, an attacker can map the entire query surface. It is also a common early clue in CTFs.
23. Finding N-day Vulnerabilities Through Patch Diffing
Immediately after a patch is released, the diff is the best clue. The key is comparing binaries or
24. The Core Flow of ELF PLT/GOT Hijacking
In reversing and CTFs, a GOT overwrite remains a powerful bypass point. Once the dynamic-linking flow is clear, you can cleanly redirect the call path.
25. ret2dlresolve: A ROP Trick That Turns the Symbol Resolver Against Itself
ret2dlresolve abuses the dynamic linker's (ld.so) symbol-resolution process to call through ROP even functions that are absent from the binary. It is especially powerful in CTF binaries with limited PLT/GOT entries.
26. Identifying Function Boundaries in Stripped Binaries
Stripped binaries lack function names and debugging information, making control-flow inference essential. When automatic analysis in Ghidra or IDA becomes unreliable, the following routine helps establish the outline quickly.
27. WAF Bypass Playbook: Small Variations That Disrupt Signatures
WAFs generally block requests using regular expressions/signatures. The key bypass strategy is therefore to “change the form while preserving the function.” The following variations are common in CTFs and real-world testing.
28. Finding Web Security Issues by Reversing WASM
Modern frontends often hide sensitive logic in WebAssembly. WASM runs in the browser, but it is
29. Getting a Feel for HTTP Request Smuggling
Request smuggling occurs when a proxy or load balancer and its backend interpret request boundaries differently. A common combination is disagreement over Content-Length and Transfer-Encoding: chunked.
30. A Routine for Solving CTF Crypto Puzzles with Z3
Cryptography CTFs often reach a point where "the equations are there, but the answer will not come
31. Binary Diffing: A Fast Routine for Finding Vulnerabilities in Patches
When a patch is released, the fastest vulnerability-analysis routine is binary diffing. Knowing only “which function changed” can reveal the attack point.
32. CTF Crackme Reversing Patterns in 5 Minutes
Crackmes repeat patterns that can be solved with static analysis alone. Running through the checklist below in Ghidra/IDA is enough to speed up the process.
33. CSP Bypass Notes: nonces, strict-dynamic, and Mistakes
CSP reduces XSS, but configuration mistakes immediately become bypass opportunities. These are only
34. Hash Length Extension: The Key to Bypassing MD5/SHA1 Signatures
A web signature of the form hash(secret || msg) is vulnerable to length extension. Using the
35. Building a Hybrid Reversing Routine with Ghidra + Frida
Static analysis shows structure, while dynamic analysis shows real behavior. Combining the two tools in CTFs or real-world analysis dramatically increases speed.
36. Padding Oracle: Secrets Revealed by Ciphertext
A padding oracle is a decryption interface whose external behavior reveals whether the padding of
37. Web Cache Poisoning: Turning a CDN into an Attack Surface
Web caches improve performance, but a misconfigured cache becomes a target for cache poisoning. The key is to “produce different responses for the same URL, then plant one of those responses in the cache.”
38. Android APK Reverse Engineering
With a single APK, you can extract all of an app's secrets. This is a recurring topic in CTF mobile categories.
39. Introduction to Linux Kernel Exploitation: The World of LPE
Kernel exploitation is called the pinnacle of hacking. LPE (Local Privilege Escalation), which obtains root from ordinary user privileges, appears regularly in the pwn category of CTFs and is also a key stage in real APT attacks.
40. Use-After-Free: Reclaim Freed Memory
UAF (Use-After-Free) is a vulnerability that occurs when a pointer continues to be used after its heap memory has been freed with free(). It is continually found in modern browsers, kernels, and server software, and it is a recurring CTF topic.
41. API Security Testing: A Practical Guide
Modern applications rely heavily on APIs for communication between services, making API security
42. Buffer Overflow Basics: The First Step in Binary Exploitation
A buffer overflow is one of the most fundamental vulnerabilities in software security and essential
43. CORS Misconfigurations and Practical Exploitation
CORS (Cross-Origin Resource Sharing) is a browser mechanism that controls access to resources from other origins. A misconfiguration can let an attacker steal an authenticated user's data.
44. Introduction to Cryptographic Attack Techniques: From Padding Oracles to Bit-Flipping
Encrypted cookies and tokens appear often in CTFs. Assuming "it is encrypted, so it must be safe" is a
45. CTF Reconnaissance: Mastering OSINT Techniques
OSINT (open-source intelligence) is a core skill in CTF competitions, penetration testing, and security
46. Deserialization Vulnerabilities — Triggering RCE Through Object Deserialization
What is deserialization?
47. Format String Vulnerabilities: A Recurring CTF Bug
Format string vulnerabilities are old bugs, but they remain a staple of CTFs. Once you understand the mechanism, they can enable everything from memory disclosure to arbitrary writes.
48. Getting Started with Dynamic Analysis Using Frida
Dynamic analysis is the technique of observing and modifying a program's behavior while it runs. Frida
49. Reverse Engineering with Ghidra: A Practical Guide
Ghidra is an open-source reverse-engineering framework released by the NSA, and it has become an essential tool for security researchers, CTF participants, and malware analysts alike. This guide covers practical techniques for analyzing binaries with Ghidra.
50. Heap Exploitation: An Introduction to tcache Attack Techniques
TL;DR: Understanding glibc's tcache gets you halfway through a heap exploit. This article summarizes
51. JWT Security Vulnerabilities: Common Mistakes and Exploitation Techniques
JWTs (JSON Web Tokens) are everywhere in modern web applications. They are convenient, stateless, and easy to implement—which is exactly why they are often implemented incorrectly. Let's examine JWT vulnerabilities commonly found in CTFs and real applications.
52. Prototype Pollution: JavaScript's Hidden Vulnerability
Prototype Pollution is an attack technique that changes an application's overall behavior by polluting JavaScript's prototype chain. The name may be unfamiliar, but it appears fairly often in real-world CTFs and bug bounty programs.
53. Exploiting CTF Binaries with Pwntools
Binary exploitation is one of the most challenging yet rewarding CTF categories. Understanding the underlying vulnerability matters, but having the right tools can make the difference between solving a challenge and getting stuck. Enter pwntools, the Python library that has become the de facto standard for CTF binary exploitation.
54. Solving CTF Binaries with Radare2
Radare2 (r2) is a powerful open-source reverse-engineering framework that has become essential for players tackling CTF binary-exploitation challenges. While Ghidra and IDA Pro offer polished GUIs, radare2's command-line interface and scripting capabilities provide incredible flexibility for fast analysis.
55. ROP Chains: How to Bypass a Stack Canary
Modern binaries are protected by NX (Non-Executable Stack) and Stack Canary.
56. Shellcode Writing Basics — From Assembly to Bytes
Shellcode is a raw sequence of machine-code bytes intended to execute while exploiting a vulnerability. It is inserted as a payload in a buffer overflow or ROP chain and is also a recurring CTF subject.
57. Side-Channel Attacks: Silent Hacking
Even when a cryptographic algorithm is mathematically perfect, its implementation can be breached. Side-Channel Attacks target that exact gap.
58. SSTI: Complete Analysis of Server-Side Template Injection
SSTI (Server-Side Template Injection) is a vulnerability that occurs when a template engine interprets user input as code. It looks like XSS, but it executes on the server and can lead to RCE.
59. Web Application Fuzzing: Finding Hidden Bugs
Fuzzing is a technique that sends unexpected input to an application to discover vulnerabilities, hidden endpoints, and edge cases. This guide covers practical fuzzing techniques for web security testing and CTF competitions.
60. Essential Web Security Testing Tools
Knowing good tools is fundamental to web hacking. Whether for CTFs or real bug bounties, these tools are essential.
61. WebSocket Security: Hidden Vulnerabilities in Real-Time Communication
Unlike HTTP, WebSocket provides persistent, bidirectional communication. It is widely used in modern web applications for chat, games, and real-time dashboards, but its security design is often weak.
62. XSS Hunting: From Basics to Bug Bounties
Cross-Site Scripting (XSS) remains one of the most common vulnerabilities in web applications today. Although it has been known for decades, developers keep repeating the same mistakes, making XSS hunting a profitable skill for bug bounty hunters and CTF players alike.
63. XXE Injection: When XML Becomes an Attack Vector
XML External Entity (XXE) Injection is an attack that abuses an XML parser's external-entity processing. It is a classic that has consistently appeared in the OWASP Top 10, yet it is still found in countless services.
64. Reverse Engineering 101
How to read binaries.
65. Mastering SQL Injection — An Essential Web Hacking Skill
TL;DR: SQL Injection remains one of the most dangerous web vulnerabilities. This practical guide
66. Complete SSRF Guide - Turning a Server Against Itself
TL;DR: Server-Side Request Forgery (SSRF) is a vulnerability that makes a server send requests to arbitrary URLs chosen by an attacker. It can enable access to internal networks, theft of cloud metadata, port scanning, and other attacks.
Review of Hijacking Bitcoin: Routing Attacks on Cryptocurrencies
When Internet routing becomes unstable, the decentralized overlay above it moves with it.
Decrypting Saved DBeaver Passwords
DBeaver stores database connection passwords locally with AES encryption. If you know the key, you can decrypt them.
67. Function Hooking: A Reverse Engineer's Secret Weapon
Function hooking may sound intimidating at first, but it becomes an incredibly powerful tool once you understand it. From malware debugging and anti-cheat bypasses to CTF challenges, hooking lets you intercept and modify a program's behavior at runtime.