Posts

A Webpack penetration-testing guide to identifying bundles, recovering source with sourcemaps, and investigating sensitive APIs and exposed configuration.

• Webpack
• Learning Analysis
• JavaScript

Windows Server IIS, registry, handles, and directories: tracing anomalous processes and files with Resource Monitor, Task Scheduler, and Everything.

• Windows
• Security
• data

2025 Xuanyuan Cup Web and Misc writeups covering Flask injection, SSRF, file reading, PHP filter bypass, and media steganography.

• CTF
• 2025 Xuanyuan Cup
• Writeup

TryHackMe notes on DNS, WHOIS, FTP, SMTP, POP3, and IMAP: purposes, commands, interaction flows, packet captures, and Telnet observations.

• TCP
• Study Notes
• TryHackMe

Local AntSword traffic analysis: HTTP POST parameters, response formats, default/chr/rot13 encoding, and scripted response decoding.

• Webshell
• AntSword
• Traffic Analysis

Review L3HCTF best_profile, tracing Nginx cache configuration and Flask ProxyFix through cache poisoning and template injection.

• CTF
• Web Security
• Flask

TryHackMe notes on Metasploit module search, configuration, scanning, msfvenom payloads, sessions, and file transfer with a Python HTTP server.

• Metasploit
• Penetration Testing
• TryHackMe