← Back home
中文

HUNTER-0X07 / SECURITY RESEARCH

Technical articles and notes

Organized by research area and content type, preserving the path from discovery to reproduction, debugging, and validation.

01VULNERABILITY RESEARCH

Vulnerability Research

Reproduction, root-cause analysis, exploitation paths, and remediation validation.

  • Understanding Java Memory Shells
  • Apache OFBiz RMI Deserialization Remote Code Execution Vulnerability Reproduction (CVE-2021-26295)
View 28 items ↗
02ENDPOINT & ADVERSARY

Endpoint & Adversary Techniques

Endpoint tradecraft, privilege and persistence techniques, and adversary implementation research.

  • C Dynamic-Link Library Development
  • Notes (1)
View 63 items ↗
03BAS & DETECTION

BAS & Detection Validation

Attack simulation scenarios, detection validation, and security control assessment.

  • Building a BAS IP-Blocking Scenario
  • apache-unomi_cve-2020-13942
View 7 items ↗
04SECURITY TOOLING

Security Tooling & Engineering

Security tool internals, debugging methods, automation, and engineering practice.

  • How to debug Sliver?
  • API Secure
View 19 items ↗
05CLOUD-NATIVE SECURITY

Cloud-Native Security

Research notes on containers, orchestration platforms, cloud environments, and cloud-native attack surfaces.

  • Using Kubectl to Create a Scheduled Task in a Kubernetes Cluster Container
  • Using kubectl to Execute Commands in a Specified container
View 6 items ↗
06SYSTEMS & PROGRAMMING

Systems & Programming

Notes on programming languages, operating systems, environments, and low-level concepts.

  • How to Build a Java Web Application in Five Minutes
  • Solving the Graphics Driver Problem in Kali 2020.3
View 32 items ↗
07

ALL NOTES

All published notes

01
Vulnerability Research · AnalysisUnderstanding Java Memory Shells
↗
02
Vulnerability Research · ArticleApache OFBiz RMI Deserialization Remote Code Execution Vulnerability Reproduction (CVE-2021-26295)
↗
03
Vulnerability Research · ArticleExchange Server SSRF Vulnerability Reproduction (CVE-2021-26855)
↗
04
Vulnerability Research · ArticleF5 BIG-IP iControl REST Interface Remote Command Execution Vulnerability Reproduction (CVE-2021-22986)
↗
05
Vulnerability Research · ArticleJoomla CMS Remote Code Execution Vulnerability Reproduction (CVE-2021-23132)
↗
06
Vulnerability Research · ArticleXStream Arbitrary File Deletion Vulnerability Reproduction (CVE-2021-21343)
↗
07
Vulnerability Research · ArticleXStream Remote Code Execution Vulnerability Reproduction (CVE-2021-21351)
↗
08
Vulnerability Research · ArticleBugFree Reinstallation Vulnerability Case
↗
09
Vulnerability Research · ArticleDiscuz CSRF Backup Database Dump Analysis
↗
10
Vulnerability Research · ArticleArbitrary User Login in All ESPCMS Versions
↗
11
Vulnerability Research · ArticleEspcms Search Injection Analysis
↗
12
Vulnerability Research · ArticleEspcms Injection Discovery Case
↗
13
Vulnerability Research · ArticleMetinfo File Inclusion Vulnerability Analysis
↗
14
Vulnerability Research · ArticleApache Solr SSRF Leading to Arbitrary File Read Vulnerability Reproduction
↗
15
Vulnerability Research · Articleupload-labs Lab Writeup (1-10)
↗
16
Vulnerability Research · Notecve-2015-2080
↗
17
Vulnerability Research · Notecve-2019-17571
↗
18
Vulnerability Research · Notemetinfo_5.3_sqli
↗
19
Vulnerability Research · Notemetinfo_arbitrary_file_read
↗
20
Vulnerability Research · NoteCVE-2021-2109 Reproduction
↗
21
Vulnerability Research · Noteall_vul
↗
22
Vulnerability Research · Notebaota_unauthorized-access
↗
23
Vulnerability Research · Procedure(CVE-2021-1732) Combining a Win10 Local Privilege Escalation Vulnerability with MSF to Obtain System Privileges
↗
24
Vulnerability Research · AnalysisCVE-2021-32682 Vulnerability Analysis
↗
25
Vulnerability Research · AnalysisUsing burpsuite to Brute-Force a Website's SMS Verification Code
↗
26
Vulnerability Research · AnalysisExecuting an XSS Vulnerability Through a Malicious PDF
↗
27
Vulnerability Research · AnalysisApache Unomi Remote Command Execution Vulnerability (CVE-2020-13942)
↗
28
Vulnerability Research · AnalysisVulnerability Matrix
↗
29
Endpoint & Adversary Techniques · NoteC Dynamic-Link Library Development
↗
30
Endpoint & Adversary Techniques · NoteNotes (1)
↗
31
Endpoint & Adversary Techniques · NoteWriting a dll Using a def File
↗
32
Endpoint & Adversary Techniques · ProcedureMalicious Macro Launches a bat Script Through the Shell Function to Execute Commands
↗
33
Endpoint & Adversary Techniques · ProcedureLaunching Calculator by Invoking Malicious Macro Code Through Word Template Injection
↗
34
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task Through Macro Code
↗
35
Endpoint & Adversary Techniques · ProcedureUsing Bad-PDF to Steal NTLM Hashes from a Windows Host
↗
36
Endpoint & Adversary Techniques · ProcedureExporting Domain Credential Files Through Direct Volume Access with NinjaCopy
↗
37
Endpoint & Adversary Techniques · ProcedureStealing Domain Users' Plaintext Passwords with a Windows Password Filter DLL
↗
38
Endpoint & Adversary Techniques · ProcedureDumping Domain Cached Credentials (mscash) with cachedump
↗
39
Endpoint & Adversary Techniques · ProcedureAbusing Security Support Provider (SSP) to Steal Domain Controller User Credentials
↗
40
Endpoint & Adversary Techniques · ProcedureExporting User Credentials from the Proc File System Through MimiPenguin
↗
41
Endpoint & Adversary Techniques · ProcedureObtaining Domain Password Credentials with NtdsAudit
↗
42
Endpoint & Adversary Techniques · ProcedureUsing C++ to Call ntdll.RtlCompressBuffer to Compress Collected Data
↗
43
Endpoint & Adversary Techniques · ProcedureSNMP Service Brute Force and Information Gathering
↗
44
Endpoint & Adversary Techniques · ProcedureTesting Target Connectivity with the Test-Connection Function in PowerShell
↗
45
Endpoint & Adversary Techniques · ProcedureCollecting Information on windows with powershell and Saving It to the File System as html
↗
46
Endpoint & Adversary Techniques · ProcedureGathering Network Information on windows Systems Through Command Execution
↗
47
Endpoint & Adversary Techniques · ProcedureVerifying a User's Working Environment by Counting Files in the Documents Directory
↗
48
Endpoint & Adversary Techniques · ProcedureDetecting a Sandbox Environment by Calculating Active Window Titles and Checking a Specific Module
↗
49
Endpoint & Adversary Techniques · Proceduremavinject.exe
↗
50
Endpoint & Adversary Techniques · ProcedureArbitrary Command Execution Using the Mssql sp_procoption Stored Procedure
↗
51
Endpoint & Adversary Techniques · ProcedureInjecting Malicious Code into a Legitimate Process Through Process Hollowing and Executing It
↗
52
Endpoint & Adversary Techniques · ProcedureCreating a windows Service with powershell
↗
53
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task with powershell
↗
54
Endpoint & Adversary Techniques · ProcedureAchieving Persistence by Adding a Registry Startup Entry with a powershell Script
↗
55
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Combining the Windows Screen Saver Feature with MSF
↗
56
Endpoint & Adversary Techniques · ProcedureMaintaining Access to a Windows System with a Word WLL Add-In
↗
57
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Creating a windows System Service Backdoor with powershell
↗
58
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Abusing a systemd Timer to Create a Scheduled Task
↗
59
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task Through the ITaskService COM Component to Achieve Automatic Startup
↗
60
Endpoint & Adversary Techniques · ProcedureMaintaining Access to a Windows System Through DLL Hijacking Combined with MSF
↗
61
Endpoint & Adversary Techniques · ProcedureMaintaining Windows Access by Creating a VBS Backdoor with MSF persistence
↗
62
Endpoint & Adversary Techniques · ProcedureSetting the Registry Startup Item to calc.exe Through a VBS Script
↗
63
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Executing a Backdoor Through Default File Associations
↗
64
Endpoint & Adversary Techniques · ProcedureUsing the Local APPINFO RPC Service to Bypass Windows UAC and Launch a High-Privilege Application
↗
65
Endpoint & Adversary Techniques · ProcedureBypassing UAC Through Registry Hijacking
↗
66
Endpoint & Adversary Techniques · ProcedureModifying Process Access-Token Privileges with AdjustTokenPrivileges
↗
67
Endpoint & Adversary Techniques · ProcedureDisabling UAC by Modifying the Registry
↗
68
Endpoint & Adversary Techniques · ProcedureObtaining a High-Privilege Shell by Hijacking a Binary Used by the 7-Zip Installer
↗
69
Endpoint & Adversary Techniques · ProcedureSystem Privilege Escalation by Obtaining windows Patch Information
↗
70
Endpoint & Adversary Techniques · ProcedureObtaining a Host Shell by Executing a Payload with the Allowlisted Rundll32.exe
↗
71
Endpoint & Adversary Techniques · ProcedureObtaining Shell Access by Executing a Payload with the Allowlisted zipfldr.dll
↗
72
Endpoint & Adversary Techniques · ProcedureAbusing MSXSL.EXE to Execute an XSL File for Arbitrary Command Execution
↗
73
Endpoint & Adversary Techniques · ProcedureAbusing the WindowsUpdate Program to Execute a Malicious DLL and Obtain Host Access
↗
74
Endpoint & Adversary Techniques · ProcedureAbusing the Allowlisted IEexec.exe to Execute a Backdoor and Obtain Host Access
↗
75
Endpoint & Adversary Techniques · ProcedureObtaining Windows System Privileges Through CLR Hijacking Combined with MSF
↗
76
Endpoint & Adversary Techniques · ProcedureSide-Loading a Malicious duser.dll Through the Allowlisted rekeywiz.exe to Launch Calculator
↗
77
Endpoint & Adversary Techniques · ProcedureListening on a Specified Port on Windows with PowerShell
↗
78
Endpoint & Adversary Techniques · ProcedureCreating a New Directory on a Specified FTP Server Through powershell
↗
79
Endpoint & Adversary Techniques · ProcedureDecoding a Server Port from Base64 Multiple Times with PowerShell
↗
80
Endpoint & Adversary Techniques · ProcedureClearing Traces on Windows with a BAT Program
↗
81
Endpoint & Adversary Techniques · ProcedureUsing powershell to Copy a File to a System Directory and Disguise It as a Normal File
↗
82
Endpoint & Adversary Techniques · ProcedureUsing mklink to Execute a File's ADS Alternate Data Stream
↗
83
Endpoint & Adversary Techniques · ProcedureStopping the Windows Volume Shadow Copy Service with PowerShell
↗
84
Endpoint & Adversary Techniques · ProcedureSetting a File or Directory's Attributes to Hidden with PowerShell
↗
85
Endpoint & Adversary Techniques · ProcedureDeleting Disk Volume Shadow Copies Through WMI
↗
86
Endpoint & Adversary Techniques · ProcedureEvading Antivirus Detection with ADS Alternate Data Streams
↗
87
Endpoint & Adversary Techniques · ProcedureDisabling Office Macro Warnings Through the Registry to Execute Macro Code More Stealthily
↗
88
Endpoint & Adversary Techniques · AnalysisMoonBounce the dark side of UEFI firmware
↗
89
Endpoint & Adversary Techniques · AnalysisA Game-Cheat Team Launches Cyberattacks Against Employees at Numerous Enterprises
↗
90
Endpoint & Adversary Techniques · AnalysisSuspected HADES Group Launches a Military-Themed Attack Against Ukraine
↗
91
Endpoint & Adversary Techniques · AnalysisAnalysis of Recent Attack Activity by a Suspected Taiwan-Related Group
↗
92
BAS & Detection Validation · AnalysisBuilding a BAS IP-Blocking Scenario
↗
93
BAS & Detection Validation · Noteapache-unomi_cve-2020-13942
↗
94
BAS & Detection Validation · Notejumpserver_rce
↗
95
BAS & Detection Validation · Notephpcms_v9-rce-2020hw
↗
96
BAS & Detection Validation · Notesqlmap_xvwa
↗
97
BAS & Detection Validation · Notesangfor_sslvpn_rce1
↗
98
BAS & Detection Validation · Noteqizhi_loginbypass
↗
99
Security Tooling & Engineering · ArticleHow to debug Sliver?
↗
100
Security Tooling & Engineering · ProcedureAPI Secure
↗
101
Security Tooling & Engineering · ProcedureAPIsec
↗
102
Security Tooling & Engineering · ProcedureBanli
↗
103
Security Tooling & Engineering · ProcedureBughound
↗
104
Security Tooling & Engineering · ProcedureBurpDomain
↗
105
Security Tooling & Engineering · ProcedureDarkEye
↗
106
Security Tooling & Engineering · ProcedureFofaMap
↗
107
Security Tooling & Engineering · ProcedureJNDI-Exploit-Kit
↗
108
Security Tooling & Engineering · ProcedureNishang
↗
109
Security Tooling & Engineering · ProcedureNtdsAudit Tool
↗
110
Security Tooling & Engineering · ProcedureReadyAPI
↗
111
Security Tooling & Engineering · ProcedureStowaway
↗
112
Security Tooling & Engineering · ProcedureSynopsis API Scanner
↗
113
Security Tooling & Engineering · Procedureappknox
↗
114
Security Tooling & Engineering · Procedurepostman
↗
115
Security Tooling & Engineering · Procedurewhohk
↗
116
Security Tooling & Engineering · ProcedureOperating the Registry Through cmd.exe
↗
117
Security Tooling & Engineering · ProcedureChanging the Desktop by Setting the Wallpaper Registry Value
↗
118
Cloud-Native Security · NoteUsing Kubectl to Create a Scheduled Task in a Kubernetes Cluster Container
↗
119
Cloud-Native Security · NoteUsing kubectl to Execute Commands in a Specified container
↗
120
Cloud-Native Security · NoteEnumerating Kubernetes Secret Objects Through the Kubelet API Server
↗
121
Cloud-Native Security · NoteUsing Kubectl to Obtain Kubernetes Service Account Token Information Through the Kubernetes API Server
↗
122
Cloud-Native Security · NoteEscaping a Container by Mounting the Host Filesystem with the nsenter Command
↗
123
Cloud-Native Security · Notenote
↗
124
Systems & Programming · ArticleHow to Build a Java Web Application in Five Minutes
↗
125
Systems & Programming · ArticleSolving the Graphics Driver Problem in Kali 2020.3
↗
126
Systems & Programming · ArticleA Record of Installing and Fully Configuring My kail linux 2020
↗
127
Systems & Programming · ArticleSetting Up a Personal Blog
↗
128
Systems & Programming · Note2021.11.8
↗
129
Systems & Programming · Note2022.2.17
↗
130
Systems & Programming · Note2022.2.19
↗
131
Systems & Programming · Note2022.2.18
↗
132
Systems & Programming · NoteChapter 11: Strings and String Functions
↗
133
Systems & Programming · NoteChapter 13: File Input and Output
↗
134
Systems & Programming · NoteChapter 8: Character Input/Output and Input Validation
↗
135
Systems & Programming · NoteChapter 4: Strings and Formatted Input/Output
↗
136
Systems & Programming · Note2022.1.6
↗
137
Systems & Programming · NoteLearning Website Records
↗
138
Systems & Programming · Note2021.10.27
↗
139
Systems & Programming · NoteDevelopment Environment Setup
↗
140
Systems & Programming · Note2021.11.18
↗
141
Systems & Programming · Note2021.11.2
↗
142
Systems & Programming · Note2021.10.28
↗
143
Systems & Programming · NoteChapter 10: Arrays and Pointers
↗
144
Systems & Programming · NoteChapter 12: Storage Classes, Linkage, and Memory Management
↗
145
Systems & Programming · Note2021.11.15
↗
146
Systems & Programming · Note2022.2.16
↗
147
Systems & Programming · NoteChapter 14: Structures and Other Data Forms
↗
148
Systems & Programming · NoteChapter 5: Operators, Expressions, and Statements
↗
149
Systems & Programming · NoteChapter 6: C Control Statements: Loops
↗
150
Systems & Programming · NoteChapter 7: C Control Statements: Branching and Jumps
↗
151
Systems & Programming · NoteChapter 9: Functions
↗
152
Systems & Programming · NoteChapter 3: Data and C
↗
153
Systems & Programming · NoteC Dynamic-Link Library Development
↗
154
Systems & Programming · NoteWindows API Programming
↗
155
Systems & Programming · NoteNote
↗