Back home
中文

HUNTER-0X07 / SECURITY RESEARCH

Technical articles and notes

Organized by research area and content type, preserving the path from discovery to reproduction, debugging, and validation.

01VULNERABILITY RESEARCH

Vulnerability Research

Reproduction, root-cause analysis, exploitation paths, and remediation validation.

  • Understanding Java Memory Shells
  • Apache OFBiz RMI Deserialization Remote Code Execution Vulnerability Reproduction (CVE-2021-26295)
View 28 items
02ENDPOINT & ADVERSARY

Endpoint & Adversary Techniques

Endpoint tradecraft, privilege and persistence techniques, and adversary implementation research.

  • C Dynamic-Link Library Development
  • Notes (1)
View 63 items
03BAS & DETECTION

BAS & Detection Validation

Attack simulation scenarios, detection validation, and security control assessment.

  • Building a BAS IP-Blocking Scenario
  • apache-unomi_cve-2020-13942
View 7 items
04SECURITY TOOLING

Security Tooling & Engineering

Security tool internals, debugging methods, automation, and engineering practice.

  • How to debug Sliver?
  • API Secure
View 19 items
05CLOUD-NATIVE SECURITY

Cloud-Native Security

Research notes on containers, orchestration platforms, cloud environments, and cloud-native attack surfaces.

  • Using Kubectl to Create a Scheduled Task in a Kubernetes Cluster Container
  • Using kubectl to Execute Commands in a Specified container
View 6 items
06SYSTEMS & PROGRAMMING

Systems & Programming

Notes on programming languages, operating systems, environments, and low-level concepts.

  • How to Build a Java Web Application in Five Minutes
  • Solving the Graphics Driver Problem in Kali 2020.3
View 32 items
07

ALL NOTES

All published notes

01
Vulnerability Research · AnalysisUnderstanding Java Memory Shells
02
Vulnerability Research · ArticleApache OFBiz RMI Deserialization Remote Code Execution Vulnerability Reproduction (CVE-2021-26295)
03
Vulnerability Research · ArticleExchange Server SSRF Vulnerability Reproduction (CVE-2021-26855)
04
Vulnerability Research · ArticleF5 BIG-IP iControl REST Interface Remote Command Execution Vulnerability Reproduction (CVE-2021-22986)
05
Vulnerability Research · ArticleJoomla CMS Remote Code Execution Vulnerability Reproduction (CVE-2021-23132)
06
Vulnerability Research · ArticleXStream Arbitrary File Deletion Vulnerability Reproduction (CVE-2021-21343)
07
Vulnerability Research · ArticleXStream Remote Code Execution Vulnerability Reproduction (CVE-2021-21351)
08
Vulnerability Research · ArticleBugFree Reinstallation Vulnerability Case
09
Vulnerability Research · ArticleDiscuz CSRF Backup Database Dump Analysis
10
Vulnerability Research · ArticleArbitrary User Login in All ESPCMS Versions
11
Vulnerability Research · ArticleEspcms Search Injection Analysis
12
Vulnerability Research · ArticleEspcms Injection Discovery Case
13
Vulnerability Research · ArticleMetinfo File Inclusion Vulnerability Analysis
14
Vulnerability Research · ArticleApache Solr SSRF Leading to Arbitrary File Read Vulnerability Reproduction
15
Vulnerability Research · Articleupload-labs Lab Writeup (1-10)
16
Vulnerability Research · Notecve-2015-2080
17
Vulnerability Research · Notecve-2019-17571
18
Vulnerability Research · Notemetinfo_5.3_sqli
19
Vulnerability Research · Notemetinfo_arbitrary_file_read
20
Vulnerability Research · NoteCVE-2021-2109 Reproduction
21
Vulnerability Research · Noteall_vul
22
Vulnerability Research · Notebaota_unauthorized-access
23
Vulnerability Research · Procedure(CVE-2021-1732) Combining a Win10 Local Privilege Escalation Vulnerability with MSF to Obtain System Privileges
24
Vulnerability Research · AnalysisCVE-2021-32682 Vulnerability Analysis
25
Vulnerability Research · AnalysisUsing burpsuite to Brute-Force a Website's SMS Verification Code
26
Vulnerability Research · AnalysisExecuting an XSS Vulnerability Through a Malicious PDF
27
Vulnerability Research · AnalysisApache Unomi Remote Command Execution Vulnerability (CVE-2020-13942)
28
Vulnerability Research · AnalysisVulnerability Matrix
29
Endpoint & Adversary Techniques · NoteC Dynamic-Link Library Development
30
Endpoint & Adversary Techniques · NoteNotes (1)
31
Endpoint & Adversary Techniques · NoteWriting a dll Using a def File
32
Endpoint & Adversary Techniques · ProcedureMalicious Macro Launches a bat Script Through the Shell Function to Execute Commands
33
Endpoint & Adversary Techniques · ProcedureLaunching Calculator by Invoking Malicious Macro Code Through Word Template Injection
34
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task Through Macro Code
35
Endpoint & Adversary Techniques · ProcedureUsing Bad-PDF to Steal NTLM Hashes from a Windows Host
36
Endpoint & Adversary Techniques · ProcedureExporting Domain Credential Files Through Direct Volume Access with NinjaCopy
37
Endpoint & Adversary Techniques · ProcedureStealing Domain Users' Plaintext Passwords with a Windows Password Filter DLL
38
Endpoint & Adversary Techniques · ProcedureDumping Domain Cached Credentials (mscash) with cachedump
39
Endpoint & Adversary Techniques · ProcedureAbusing Security Support Provider (SSP) to Steal Domain Controller User Credentials
40
Endpoint & Adversary Techniques · ProcedureExporting User Credentials from the Proc File System Through MimiPenguin
41
Endpoint & Adversary Techniques · ProcedureObtaining Domain Password Credentials with NtdsAudit
42
Endpoint & Adversary Techniques · ProcedureUsing C++ to Call ntdll.RtlCompressBuffer to Compress Collected Data
43
Endpoint & Adversary Techniques · ProcedureSNMP Service Brute Force and Information Gathering
44
Endpoint & Adversary Techniques · ProcedureTesting Target Connectivity with the Test-Connection Function in PowerShell
45
Endpoint & Adversary Techniques · ProcedureCollecting Information on windows with powershell and Saving It to the File System as html
46
Endpoint & Adversary Techniques · ProcedureGathering Network Information on windows Systems Through Command Execution
47
Endpoint & Adversary Techniques · ProcedureVerifying a User's Working Environment by Counting Files in the Documents Directory
48
Endpoint & Adversary Techniques · ProcedureDetecting a Sandbox Environment by Calculating Active Window Titles and Checking a Specific Module
49
Endpoint & Adversary Techniques · Proceduremavinject.exe
50
Endpoint & Adversary Techniques · ProcedureArbitrary Command Execution Using the Mssql sp_procoption Stored Procedure
51
Endpoint & Adversary Techniques · ProcedureInjecting Malicious Code into a Legitimate Process Through Process Hollowing and Executing It
52
Endpoint & Adversary Techniques · ProcedureCreating a windows Service with powershell
53
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task with powershell
54
Endpoint & Adversary Techniques · ProcedureAchieving Persistence by Adding a Registry Startup Entry with a powershell Script
55
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Combining the Windows Screen Saver Feature with MSF
56
Endpoint & Adversary Techniques · ProcedureMaintaining Access to a Windows System with a Word WLL Add-In
57
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Creating a windows System Service Backdoor with powershell
58
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Abusing a systemd Timer to Create a Scheduled Task
59
Endpoint & Adversary Techniques · ProcedureCreating a Scheduled Task Through the ITaskService COM Component to Achieve Automatic Startup
60
Endpoint & Adversary Techniques · ProcedureMaintaining Access to a Windows System Through DLL Hijacking Combined with MSF
61
Endpoint & Adversary Techniques · ProcedureMaintaining Windows Access by Creating a VBS Backdoor with MSF persistence
62
Endpoint & Adversary Techniques · ProcedureSetting the Registry Startup Item to calc.exe Through a VBS Script
63
Endpoint & Adversary Techniques · ProcedureMaintaining Access by Executing a Backdoor Through Default File Associations
64
Endpoint & Adversary Techniques · ProcedureUsing the Local APPINFO RPC Service to Bypass Windows UAC and Launch a High-Privilege Application
65
Endpoint & Adversary Techniques · ProcedureBypassing UAC Through Registry Hijacking
66
Endpoint & Adversary Techniques · ProcedureModifying Process Access-Token Privileges with AdjustTokenPrivileges
67
Endpoint & Adversary Techniques · ProcedureDisabling UAC by Modifying the Registry
68
Endpoint & Adversary Techniques · ProcedureObtaining a High-Privilege Shell by Hijacking a Binary Used by the 7-Zip Installer
69
Endpoint & Adversary Techniques · ProcedureSystem Privilege Escalation by Obtaining windows Patch Information
70
Endpoint & Adversary Techniques · ProcedureObtaining a Host Shell by Executing a Payload with the Allowlisted Rundll32.exe
71
Endpoint & Adversary Techniques · ProcedureObtaining Shell Access by Executing a Payload with the Allowlisted zipfldr.dll
72
Endpoint & Adversary Techniques · ProcedureAbusing MSXSL.EXE to Execute an XSL File for Arbitrary Command Execution
73
Endpoint & Adversary Techniques · ProcedureAbusing the WindowsUpdate Program to Execute a Malicious DLL and Obtain Host Access
74
Endpoint & Adversary Techniques · ProcedureAbusing the Allowlisted IEexec.exe to Execute a Backdoor and Obtain Host Access
75
Endpoint & Adversary Techniques · ProcedureObtaining Windows System Privileges Through CLR Hijacking Combined with MSF
76
Endpoint & Adversary Techniques · ProcedureSide-Loading a Malicious duser.dll Through the Allowlisted rekeywiz.exe to Launch Calculator
77
Endpoint & Adversary Techniques · ProcedureListening on a Specified Port on Windows with PowerShell
78
Endpoint & Adversary Techniques · ProcedureCreating a New Directory on a Specified FTP Server Through powershell
79
Endpoint & Adversary Techniques · ProcedureDecoding a Server Port from Base64 Multiple Times with PowerShell
80
Endpoint & Adversary Techniques · ProcedureClearing Traces on Windows with a BAT Program
81
Endpoint & Adversary Techniques · ProcedureUsing powershell to Copy a File to a System Directory and Disguise It as a Normal File
82
Endpoint & Adversary Techniques · ProcedureUsing mklink to Execute a File's ADS Alternate Data Stream
83
Endpoint & Adversary Techniques · ProcedureStopping the Windows Volume Shadow Copy Service with PowerShell
84
Endpoint & Adversary Techniques · ProcedureSetting a File or Directory's Attributes to Hidden with PowerShell
85
Endpoint & Adversary Techniques · ProcedureDeleting Disk Volume Shadow Copies Through WMI
86
Endpoint & Adversary Techniques · ProcedureEvading Antivirus Detection with ADS Alternate Data Streams
87
Endpoint & Adversary Techniques · ProcedureDisabling Office Macro Warnings Through the Registry to Execute Macro Code More Stealthily
88
Endpoint & Adversary Techniques · AnalysisMoonBounce the dark side of UEFI firmware
89
Endpoint & Adversary Techniques · AnalysisA Game-Cheat Team Launches Cyberattacks Against Employees at Numerous Enterprises
90
Endpoint & Adversary Techniques · AnalysisSuspected HADES Group Launches a Military-Themed Attack Against Ukraine
91
Endpoint & Adversary Techniques · AnalysisAnalysis of Recent Attack Activity by a Suspected Taiwan-Related Group
92
BAS & Detection Validation · AnalysisBuilding a BAS IP-Blocking Scenario
93
BAS & Detection Validation · Noteapache-unomi_cve-2020-13942
94
BAS & Detection Validation · Notejumpserver_rce
95
BAS & Detection Validation · Notephpcms_v9-rce-2020hw
96
BAS & Detection Validation · Notesqlmap_xvwa
97
BAS & Detection Validation · Notesangfor_sslvpn_rce1
98
BAS & Detection Validation · Noteqizhi_loginbypass
99
Security Tooling & Engineering · ArticleHow to debug Sliver?
100
Security Tooling & Engineering · ProcedureAPI Secure
101
Security Tooling & Engineering · ProcedureAPIsec
102
Security Tooling & Engineering · ProcedureBanli
103
Security Tooling & Engineering · ProcedureBughound
104
Security Tooling & Engineering · ProcedureBurpDomain
105
Security Tooling & Engineering · ProcedureDarkEye
106
Security Tooling & Engineering · ProcedureFofaMap
107
Security Tooling & Engineering · ProcedureJNDI-Exploit-Kit
108
Security Tooling & Engineering · ProcedureNishang
109
Security Tooling & Engineering · ProcedureNtdsAudit Tool
110
Security Tooling & Engineering · ProcedureReadyAPI
111
Security Tooling & Engineering · ProcedureStowaway
112
Security Tooling & Engineering · ProcedureSynopsis API Scanner
113
Security Tooling & Engineering · Procedureappknox
114
Security Tooling & Engineering · Procedurepostman
115
Security Tooling & Engineering · Procedurewhohk
116
Security Tooling & Engineering · ProcedureOperating the Registry Through cmd.exe
117
Security Tooling & Engineering · ProcedureChanging the Desktop by Setting the Wallpaper Registry Value
118
Cloud-Native Security · NoteUsing Kubectl to Create a Scheduled Task in a Kubernetes Cluster Container
119
Cloud-Native Security · NoteUsing kubectl to Execute Commands in a Specified container
120
Cloud-Native Security · NoteEnumerating Kubernetes Secret Objects Through the Kubelet API Server
121
Cloud-Native Security · NoteUsing Kubectl to Obtain Kubernetes Service Account Token Information Through the Kubernetes API Server
122
Cloud-Native Security · NoteEscaping a Container by Mounting the Host Filesystem with the nsenter Command
123
Cloud-Native Security · Notenote
124
Systems & Programming · ArticleHow to Build a Java Web Application in Five Minutes
125
Systems & Programming · ArticleSolving the Graphics Driver Problem in Kali 2020.3
126
Systems & Programming · ArticleA Record of Installing and Fully Configuring My kail linux 2020
127
Systems & Programming · ArticleSetting Up a Personal Blog
128
Systems & Programming · Note2021.11.8
129
Systems & Programming · Note2022.2.17
130
Systems & Programming · Note2022.2.19
131
Systems & Programming · Note2022.2.18
132
Systems & Programming · NoteChapter 11: Strings and String Functions
133
Systems & Programming · NoteChapter 13: File Input and Output
134
Systems & Programming · NoteChapter 8: Character Input/Output and Input Validation
135
Systems & Programming · NoteChapter 4: Strings and Formatted Input/Output
136
Systems & Programming · Note2022.1.6
137
Systems & Programming · NoteLearning Website Records
138
Systems & Programming · Note2021.10.27
139
Systems & Programming · NoteDevelopment Environment Setup
140
Systems & Programming · Note2021.11.18
141
Systems & Programming · Note2021.11.2
142
Systems & Programming · Note2021.10.28
143
Systems & Programming · NoteChapter 10: Arrays and Pointers
144
Systems & Programming · NoteChapter 12: Storage Classes, Linkage, and Memory Management
145
Systems & Programming · Note2021.11.15
146
Systems & Programming · Note2022.2.16
147
Systems & Programming · NoteChapter 14: Structures and Other Data Forms
148
Systems & Programming · NoteChapter 5: Operators, Expressions, and Statements
149
Systems & Programming · NoteChapter 6: C Control Statements: Loops
150
Systems & Programming · NoteChapter 7: C Control Statements: Branching and Jumps
151
Systems & Programming · NoteChapter 9: Functions
152
Systems & Programming · NoteChapter 3: Data and C
153
Systems & Programming · NoteC Dynamic-Link Library Development
154
Systems & Programming · NoteWindows API Programming
155
Systems & Programming · NoteNote