Explore HTTP/1.1 upgrades, messages versus frames, local echo tests, text and binary traffic, connection closure, and editing or replaying messages in Yakit and Burp.
POSTS / ARCHIVE
Posts
Technical research and engineering practice, ordered by the latest update.
- Published
- Published
Explore JVM bytecode and Java agents through four experiments, trace OpenRASP's SQL injection detection, and examine its bypass surfaces.
- Published
Read CyberGym scores through real vulnerability reproduction, pre/post-patch validation, and the differences between its benchmark and CTF tasks.
- Published
Trust boundaries in path configuration, webhooks, and admin endpoints: attacker control, permissions, deployment, and AI audit false positives and misses.
- Published
WeChat miniapp auditing: package collection and recovery, attack-surface mapping, agent collaboration, dynamic verification, and traceable evidence.
- Published
Analysis of LG NAS command injection CNVD-2026-20654: root cause, local setup, real-device reproduction, and affected firmware versions.
- Published
oh-my-vul's evolution into an evidence-first research workbench: design choices for Evidence, CLI, TUI, and Codex and Claude Code support.
- Published
Using Claude Code Agent Teams for security auditing: multi-agent collaboration, its boundaries, and an initial Go project audit.