An in-depth study of XPath injection, covering XPath syntax fundamentals, injection principles, exploitation techniques, and security defenses for querying XML data.
POSTS / ARCHIVE
Posts
Technical research and engineering practice, ordered by the latest update.
- Published
- Published
HnuSec Python web security material: setup, Flask, dynamic execution, object reflection, Jinja2 SSTI, object chains, CTF exercises, and remediation.
- Published
OpenHarmony ezAPP_And_SERVER: ABC decompilation, client interfaces, encoding, authentication logic, and server-side SQLite injection.
- Published
Initial range notes: ThinkPHP entry, sudo mysql escalation, intranet enumeration, Xinhu OA access through a proxy, and the first two flag segments.
- Published
Object storage access: AK/SK, pre-signed URLs, STS, IAM/RAM policies, and the d3invitation challenge's frontend credential leaks and excessive permissions.
- Published
TGCTF front-end challenges: Vite file-access bypasses in CVE-2025-30208, CVE-2025-31486, and CVE-2025-32395, with Vue debugging observations.
- Published
Reproducing Gradio CVE-2024-1561 in Vulhub: tracing /component_server method calls and cache-file access, recording local file reads, and testing Nuclei detection.
- Published
Godzilla Webshell traffic analysis and attribution: request and response formats, encryption mechanisms, and incident-response detection methods.