OpenCode 1.0.215: unauthenticated session creation, command execution, and file reads, traced through server.ts, process calls, and CORS settings.
POSTS / ARCHIVE
Posts
Technical research and engineering practice, ordered by the latest update.
- Published
- Published
A practical guide to CodeQL static taint analysis, database creation for Python and C++, and query execution, including lessons from the AI4CodeQL project.
- Published
A hands-on record of issuing ERC-20 tokens on Sepolia, writing DEX contracts, and building a simple DApp, including lessons learned.
- Published
Reproductions of TinyStories and Hackergame challenges: prompt injection, accepted/hackergame/🐮 outputs, and hands-on GCG attacks.
- Published
Spring's evolution from Servlet containers to Spring Boot, covering its design, MVC, POJO conventions, and auto-configuration.
- Published
Build Dify workflows for GitHub user lookup and CTF writeup extraction, covering HTTP, branching, LLM and code nodes, debugging, and DSL export.
- Published
BitTorrent notes on peer discovery, connection setup, resource lookup, and piece transfer. Explains DHT, Trackers, and NAT traversal, with torrent and magnet-link experiments.
- Published
NTLM negotiation, challenge, and response; rainbow tables, salts, Pass the Hash, Python hash examples, Impacket, Mimikatz, and defenses.