我是BX，欢迎来到我的博客！这里分享网络安全、CTF、Web安全等技术研究。https://www.bx33661.com/https://www.bx33661.com/blog/oh-my-vul-1-0/https://www.bx33661.com/blog/oh-my-vul-1-0/记录 oh-my-vul 从两个安全研究 Skill 演进为证据优先漏洞研究工作台的过程，以及 Evidence、CLI、TUI、Codex 和 Claude Code 适配背后的设计考虑。Sat, 11 Jul 2026 00:00:00 GMThttps://www.bx33661.com/blog/agent-teams/https://www.bx33661.com/blog/agent-teams/探讨 Claude Code 的 Agent Teams 功能在代码安全审计中的应用与实践，以 Go 语言项目为例体验多智能体协作的优越性与局限性。Wed, 11 Mar 2026 00:00:00 GMThttps://www.bx33661.com/blog/go-net-http-source-analysis/https://www.bx33661.com/blog/go-net-http-source-analysis/从 Server 与 Client 两个视角梳理 Go net/http 的请求处理链路、路由分发与响应写回机制，结合源码理解关键设计。Thu, 26 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/wiz-cloud-hunting-games-writeup/https://www.bx33661.com/blog/wiz-cloud-hunting-games-writeup/记录 Wiz Cloud Hunting Games CTF 的完整调查过程：从 S3 数据外泄溯源，到 CloudTrail 追踪、Overlay 日志隐藏识别，再到持久化清除。Fri, 20 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/k8s-goat-walkthrough/https://www.bx33661.com/blog/k8s-goat-walkthrough/Kubernetes Goat 四个场景实战记录：代码仓库密钥泄露、DIND、Metadata Secrets 与容器逃逸。Thu, 19 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/redis-lua-script-part2/https://www.bx33661.com/blog/redis-lua-script-part2/整理 Lua 核心语法、Redis Lua 脚本执行模型（原子性、KEYS/ARGV、call/pcall）以及一个固定窗口限流实战示例，并补充 OpenResty 与 Lua 的关系。Wed, 18 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/redis-core-guide/https://www.bx33661.com/blog/redis-core-guide/深度总结 Redis 的核心知识点，涵盖五大基本数据类型的应用场景、Python 实战操作，以及缓存穿透、击穿、雪崩等经典问题的解决方案（布隆过滤器等）。Tue, 10 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/hnuctf-2026-ops/https://www.bx33661.com/blog/hnuctf-2026-ops/记录HnuCTF2026竞赛平台的搭建、运维过程，包括平台选择、服务器配置、代理设置以及比赛结果总结。Mon, 09 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/dos-at-psitransfer/https://www.bx33661.com/blog/dos-at-psitransfer/Analysis of a Denial of Service (DoS) vulnerability in psitransfer caused by improper exception handling in file upload logic.Thu, 05 Feb 2026 00:00:00 GMThttps://www.bx33661.com/blog/n8n-cve-2025-68613-analysis/https://www.bx33661.com/blog/n8n-cve-2025-68613-analysis/n8n未授权RCE漏洞(CVE-2025-68613)深度分析与复现。包含环境搭建、漏洞原理、Payload构造及官方修复方案分析。Sun, 18 Jan 2026 00:00:00 GMThttps://www.bx33661.com/blog/opencode-vulnerability-analysis/https://www.bx33661.com/blog/opencode-vulnerability-analysis/OpenCode 1.0.215版本RCE与任意文件读取漏洞深度分析,包含完整的漏洞复现步骤、代码审计细节以及安全防护建议。Sat, 17 Jan 2026 00:00:00 GMThttps://www.bx33661.com/blog/codeql-learning/https://www.bx33661.com/blog/codeql-learning/CodeQL静态污点分析、数据库创建（Python/C++）和查询执行完整实践指南，包含AI4CodeQL项目经验总结。Thu, 11 Dec 2025 00:00:00 GMThttps://www.bx33661.com/blog/ethereum-dex-sepolia/https://www.bx33661.com/blog/ethereum-dex-sepolia/在Sepolia测试网发行ERC-20代币、编写DEX合约与简易DApp的完整实践记录与踩坑总结。Tue, 09 Dec 2025 00:00:00 GMThttps://www.bx33661.com/blog/llm-attack-hackergame/https://www.bx33661.com/blog/llm-attack-hackergame/TinyStories 与 Hackergame 题复现：prompt 注入、accepted/hackergame/🐮 输出与 GCG 攻击实战Wed, 03 Dec 2025 00:00:00 GMThttps://www.bx33661.com/blog/spring-learning-analysis/https://www.bx33661.com/blog/spring-learning-analysis/深入理解Spring框架的设计理念，从传统Servlet容器到SpringBoot的演进过程，包括MVC架构、POJO规范、自动配置机制等核心概念。Thu, 30 Oct 2025 00:00:00 GMThttps://www.bx33661.com/blog/dify-coze-workflow/https://www.bx33661.com/blog/dify-coze-workflow/详细介绍Dify和Coze这两个AI应用开发平台的工作流搭建方法，包括GitHub用户信息查询工作流、CTF WP考点提取工作流等实际案例。涵盖HTTP请求节点、条件分支、LLM节点、代码节点的配置与使用，以及DSL导出、调试技巧等高级功能的实践应用。Fri, 19 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/p2p-bittorrent-protocol-deep-dive/https://www.bx33661.com/blog/p2p-bittorrent-protocol-deep-dive/全面解析P2P（点对点）网络和BitTorrent协议的核心技术原理，包括DHT分布式哈希表、节点发现机制、NAT穿透、资源定位算法、数据传输优化等关键技术。深入探讨去中心化网络架构如何实现高效的文件共享，以及BitTorrent协议中的Tit-for-Tat激励机制、分片传输策略和哈希校验等核心算法的实现细节。Tue, 09 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/ntlm-protocol-and-attack-techniques/https://www.bx33661.com/blog/ntlm-protocol-and-attack-techniques/深入分析NTLM协议及其常见的攻击手法，包括NTLM中继、哈希传递等，并提供相应的防御策略。Fri, 05 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/ssji-learning/https://www.bx33661.com/blog/ssji-learning/深入学习服务器端JavaScript代码注入漏洞的原理、利用技巧、沙箱绕过方法以及实际CTF案例分析。Fri, 05 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/csp-bypass-analysis/https://www.bx33661.com/blog/csp-bypass-analysis/深入分析CSP（内容安全策略）规则绕过技术，通过HTB CTF中的Cursed Secret Party题目详细讲解CSP绕过方法和防护机制。Thu, 04 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/nginx-cache-poisoning/https://www.bx33661.com/blog/nginx-cache-poisoning/缓存投毒（Cache Poisoning）是一种攻击技术，攻击者通过特定手段让缓存系统存储恶意或敏感的响应内容，然后其他用户访问时会获取到这些被污染的缓存内容Wed, 03 Sep 2025 00:00:00 GMThttps://www.bx33661.com/blog/htb-challenge/https://www.bx33661.com/blog/htb-challenge/HackTheBox CTF Challenge做题记录，涵盖WEB、MOBILE、CRYPTO、REVERSE等多个安全方向的深入分析与解题思路分享。Sat, 30 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/htb-ctf/https://www.bx33661.com/blog/htb-ctf/HTB-CTF是HackTheBox发起的一个CTF比赛，题目覆盖了多个领域，包括WEB、MOBILE、CRYPTO、REVERSE等。Sat, 30 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/claude-code/https://www.bx33661.com/blog/claude-code/Claude Code使用记录&随笔Mon, 25 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/mcp-security/https://www.bx33661.com/blog/mcp-security/深入探讨MCP（Model Context Protocol）在安全领域的应用，包括安全检查清单、IDA-Pro-MCP等安全工具的实践使用与配置指南。Fri, 15 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/juice-shop/https://www.bx33661.com/blog/juice-shop/OWAP Juice Shop 是一个用于学习和测试 Web 应用程序安全的开源项目。Mon, 11 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/jenkins-credential-crack/https://www.bx33661.com/blog/jenkins-credential-crack/Jenkins 是一个开源的**自动化服务器（Automation Server）**，主要用于**持续集成和持续交付（CI/CD）**。Sun, 10 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/mcp1/https://www.bx33661.com/blog/mcp1/MCP（Model Context Protocol）是由 Anthropic 于 2024 年 11 月推出的开源协议，旨在为大型语言模型（LLM）与外部工具、数据源之间建立统一、安全、标准化的通信接口。Sun, 10 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/passthehash/https://www.bx33661.com/blog/passthehash/Pass The Hash攻击学习，将窃取到的NTLM Hash作为凭据，直接用于认证和访问网络中的其他主机Sat, 02 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/tsclient/https://www.bx33661.com/blog/tsclient/Tsclient是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有3个flag，分布于不同的靶机。Fri, 01 Aug 2025 00:00:00 GMThttps://www.bx33661.com/blog/brute4road/https://www.bx33661.com/blog/brute4road/Brute4Road是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。Tue, 29 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/bxhttpSplit/https://www.bx33661.com/blog/bxhttpSplit/深入分析HTTP响应拆分漏洞（HTTP Response Splitting）的攻击原理、CRLF注入技术及防护措施，包含详细的攻击流程图解。Fri, 25 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/bx1go/https://www.bx33661.com/blog/bx1go/深入分析Go语言template模板引擎的SSTI（服务器端模板注入）漏洞，包括html/template和text/template的语法特性及安全利用技术。Wed, 23 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/bx33661http/https://www.bx33661.com/blog/bx33661http/HTTP请求走私研究与分析-HTTP1/1Wed, 23 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/bx33661xpath/https://www.bx33661.com/blog/bx33661xpath/深入学习XPath注入攻击技术，包括XPath语法基础、注入原理分析、漏洞利用方法及在XML数据查询中的安全防护。Wed, 23 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/bx33661dom/https://www.bx33661.com/blog/bx33661dom/深入学习DOM（Document Object Model）树形结构，了解浏览器如何解析HTML文档并为JavaScript提供访问接口的机制。Mon, 21 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/z8x9w23/https://www.bx33661.com/blog/z8x9w23/Python新人学习-安全分析-SummerSun, 20 Jul 2025 00:00:00 GMThttps://www.bx33661.com/blog/OpenHarmonyCTF/https://www.bx33661.com/blog/OpenHarmonyCTF/OpenHarmonyCTF-ezAPP_And_SERVER 主要是鸿蒙APP结合Web漏洞分析和学习Mon, 23 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/chunqiu-Initial/https://www.bx33661.com/blog/chunqiu-Initial/春秋云境Initial靶场渗透测试实战记录，涵盖端口扫描、ThinkPHP漏洞利用、SUID提权等内网渗透技术的详细分析。Mon, 16 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/k8x10w24/https://www.bx33661.com/blog/k8x10w24/储存桶的安全应用问题和题目分析讨论Mon, 16 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/bxvite/https://www.bx33661.com/blog/bxvite/Vite漏洞分析-CVE-2025-30208Sun, 15 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/CVE-2024-1561/https://www.bx33661.com/blog/CVE-2024-1561/CVE-2024-1561漏洞复现分析，详解gradio-app中/component_server端点的本地文件读取漏洞利用过程与防护措施。Sun, 15 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/k8x9w23/https://www.bx33661.com/blog/k8x9w23/深入分析哥斯拉Webshell的流量特征与溯源技术，包括请求响应格式、加密机制及应急响应中的检测方法。Sun, 15 Jun 2025 00:00:00 GMThttps://www.bx33661.com/blog/bxwebpack/https://www.bx33661.com/blog/bxwebpack/Webpack 渗透思路,反编查找Thu, 29 May 2025 00:00:00 GMThttps://www.bx33661.com/blog/bx33661win1/https://www.bx33661.com/blog/bx33661win1/Windows下安全分析和应急响应分析Thu, 15 May 2025 00:00:00 GMThttps://www.bx33661.com/blog/k8x9w26/https://www.bx33661.com/blog/k8x9w26/2025轩辕杯-WEB-题解,本次轩辕杯队伍排名情况如下，我们HnuSecStar排名第六欢迎大家关注 HnuSec 公众号 [官网](https://www.hnusec.com)Thu, 15 May 2025 00:00:00 GMThttps://www.bx33661.com/blog/summer-python-security/https://www.bx33661.com/blog/summer-python-security/Python安全学习课程，涵盖SSTI、反序列化、沙箱逃逸等安全知识Mon, 20 Jan 2025 00:00:00 GMThttps://www.bx33661.com/blog/k8burp/https://www.bx33661.com/blog/k8burp/Burp杂项，更好的使用工具Sat, 21 Sep 2024 00:00:00 GMThttps://www.bx33661.com/blog/java-algorithm-practice/https://www.bx33661.com/blog/java-algorithm-practice/Java算法练习记录，基于LeetCode经典题目的解题思路与代码实现，包括两数之和等算法题的多种解法分析。Fri, 26 Jul 2024 00:00:00 GMThttps://www.bx33661.com/blog/bxtcp/https://www.bx33661.com/blog/bxtcp/TCP/IP-Core ProtocolsSat, 15 Jun 2024 00:00:00 GMThttps://www.bx33661.com/blog/k8x9w22/https://www.bx33661.com/blog/k8x9w22/Webshell分析---蚁剑流量分析和溯源Mon, 15 Jan 2024 00:00:00 GMThttps://www.bx33661.com/blog/k8x9w2m7/https://www.bx33661.com/blog/k8x9w2m7/L3hCTF best_profile writeup - nginx cache and Flask ProxyFixMon, 15 Jan 2024 00:00:00 GMThttps://www.bx33661.com/blog/k8x9w55/https://www.bx33661.com/blog/k8x9w55/L3hCTF best_profile writeup - nginx cache and Flask ProxyFixMon, 15 Jan 2024 00:00:00 GMT