Research Category
Technical topics
Figure 1 uses MurphySec's JAR scanner to identify vulnerable components. Figures 2 and 3 cover unusual servlets and services worth checking in web.xml or xxxService.xml. Figure 4 is a shortcut for locating related classes, Figure 5 covers batch decompilation, and Figure 6 shows how to find route lists with keyword searches…
Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins…
0x01 Preface Every note in this series is based on Understanding JVM Bytecode in Depth by Zhang Ya and is intended only as a personal study summary. Readers studying Java security or JVM bytecode are strongly encouraged to purchase and read the official book. 0x02 Class-File Structure Java is cross-platform, although the JVM itself is platform-specific. JVM implementations hide those platform differences by compiling source code into platform-independent bytecode, so…
0. Preface This article mainly translates the Object Serialization Stream Protocol and summarizes the serialization format. 1. Overview The stream format has the following design goals: a compact structure for efficient reading; the ability to use the stream structure and format without detailed knowledge of the stream or invoking class code; and access and manipulation only through the stream…
0x01 Preface A few days ago I obtained XRAY Advanced and tried combining XRAY with AWVS to see whether I could rediscover vulnerabilities in a CMS listed by CNVD. CNVD advisories provide few details, so the vulnerable code must be located from the vulnerability type. If no filename is disclosed, this amounts to auditing the whole system from scratch…
Preface. Testing plugin changes directly in production can disrupt a community, so a local Discourse environment is useful for development and testing. Environment: Ubuntu 18.04.2 LTS x64 with at least 1 GB RAM, preferably 2 GB or more. Install Docker, then install Discourse by creating /var/discourse and cloning the official Docker repository…
Problem 1: the following issue occurred while running the AWVS installer. Solution: run the commands below. Problem 2: another issue occurred. Solution: download the missing GLIBCXX version; in my case GLIBC 2.18 was unavailable. Problem 3: the following issue occurred while compiling GLIBC. Solution: the build finally succeeded. [1]: /usr/uploads/2019/08/11348…
Background. My Alibaba Cloud subscription expired, so I had to migrate the site. Here are solutions to several problems I encountered. 1. For '500 Database Query Error,' change the database type around line 55 of config.inc.php from Mysql to Pdo_Mysql. 2. For 'Error establishing a database connection,' inspect the database…
I had been preparing for graduate entrance exams since the start of the year and had not updated the blog in a long time. While helping my school maintain a server during the holiday, I encountered an interesting problem. After migrating the server data and building the environment, the school website displayed an error on its home page. I opened the file and found the failing line: '&dmonth&'-'&dday&' | '&rs("dtitle")&' …
Preface This article records my study of the SVM algorithm in machine learning. It introduces SVM principles and simple applications, using hands-on experiments to build an understanding of SVM. I. Introduction 1.1 What Is Machine Learning? Machine learning has no single authoritative definition, but the field's pioneer Arthur Samuel informally defined it as a field of study that gives computers the ability to learn without being explicitly programmed for the problem…
0x01 Preface. I encountered this today and found almost no examples in this form despite extensive searching. A fellow researcher shared an overseas article, and with that reference I finally built a working PoC. 0x02 PoC. Submitting POST data with a form is simple, as shown below. This is a CSRF test! But this form leaves an unwanted equals sign. The following approach removes it…
0x01 Preface This records verification of a slow HTTP denial-of-service vulnerability. 0x02 What Is Slow HTTP DoS? It is an application-layer attack that uses large numbers of deliberately incomplete or slow HTTP requests until server resources are exhausted. Major variants are Slow Headers, Slow Body, and Slow Read…