Trace Go net/http server source through ListenAndServe, Serve, and Handler; review request routing, response headers, JSON output, and middleware.
POSTS / ARCHIVE
Posts
Technical research and engineering practice, ordered by the latest update.
- Published
- Published
Wiz Cloud Hunting Games CTF investigation: S3 exfiltration, CloudTrail activity, IAM privilege escalation, and cross-account access.
- Published
Hands-on Kubernetes Goat scenarios, including secret leakage, DIND, Metadata Secrets, and container escape.
- Published
Covers core Lua syntax, the Redis Lua execution model (atomicity, KEYS/ARGV, call/pcall), a fixed-window rate-limiting example, and the relationship between OpenResty and Lua.
- Published
Redis commands, TTL, batch operations, and pipelines; Python Hash, List, and ZSet examples; cache penetration, breakdown, avalanche, and mitigations.
- Published
Documents setup and operation of the HNUCTF 2026 competition platform, including platform selection, server configuration, proxy setup, and a summary of competition results.
- Published
An upload PATCH request for an uninitialized file can crash PsiTransfer through an unhandled rejection. This note traces lib/store.js, reproduces the crash, and reviews the fix.
- Published
Analyzes n8n CVE-2025-68613 expression and sandbox behavior, reproduces command execution, and examines the fix's restrictions on this and prototype-property access.