Study server-side JavaScript injection through dynamic execution, context access, constructor chains, and the HTB Breathtaking View challenge.
POSTS / ARCHIVE
Posts
Technical research and engineering practice, ordered by the latest update.
- Published
- Published
HTB Cursed Secret Party: template output, jsDelivr allowlists, and XSS exploitation, with a review of CSP directives, nonces, and script hashes.
- Published
Nginx cache keys and hits: CDNio and best_profile illustrate how inputs outside cache keys and proxy trust settings enable cache poisoning.
- Published
HTB writeups for Spookifier, Trapped Source, Breathtaking View, and Primed for Action, covering template injection, source analysis, SSJI, and primes.
- Published
HTB CTF Try Out Web and ICS write-ups: command and template injection, and hidden information in Modbus/TCP captures analyzed with Wireshark.
- Published
Claude Code usage, CLAUDE.md context, commands, agents, and examples connecting GLM, DeepSeek, and MCP services over different transports.
- Published
Configure IDA-Pro-MCP and CloudSword-MCP, review MCP security practices, and inspect tools, prompts, and resources with the SDK and FastMCP.
- Published
Deploying OWASP Juice Shop with Docker and Node.js and practicing one-star challenges involving the score board, XSS, sensitive files, and encoding, plus SQL and NoSQL injection.