corpus.blog
41554 blogs · [ { "id": "01a08751-cf69-72fa-9cc3-ddf3931ca2ae", "title": "(繁中) The Art of PHP — My CTF Journey and Untold Stories!", "url": "https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/", "published_at": "2025-08-27T03:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf393d2dbdb", "title": "The Art of PHP — My CTF Journey and Untold Stories!", "url": "https://blog.orange.tw/posts/2025-08-the-art-of-php-en/", "published_at": "2025-08-27T02:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf3945fc9bf", "title": "從 Web 狗的視角看 OSEE — 從 0.1 開始的 Advanced Windows Exploitation 考試", "url": "https://blog.orange.tw/posts/2025-07-a-web-dog-guide-to-osee/", "published_at": "2025-07-01T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf3955355e0", "title": "WorstFit: Unveiling Hidden Transformers in Windows ANSI!", "url": "https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/", "published_at": "2025-01-09T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf3958f8245", "title": "(繁中) Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!", "url": "https://blog.orange.tw/posts/2024-08-confusion-attacks-ch/", "published_at": "2024-08-08T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39689a339", "title": "Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!", "url": "https://blog.orange.tw/posts/2024-08-confusion-attacks-en/", "published_at": "2024-08-08T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39767ff09", "title": "CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!", "url": "https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/", "published_at": "2024-06-06T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf3979bd1f7", "title": "從 2013 到 2023: Web Security 十年之進化與趨勢!", "url": "https://blog.orange.tw/posts/2023-08-2023-webconf-the-evolution-of-web-security/", "published_at": "2023-08-11T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf397c9f39f", "title": "A New Attack Surface on MS Exchange Part 4 - ProxyRelay!", "url": "https://blog.orange.tw/posts/2022-10-proxyrelay-a-new-attack-surface-on-ms-exchange-part-4/", "published_at": "2022-10-18T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf397ec89c0", "title": "Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!", "url": "https://blog.orange.tw/posts/2022-08-lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis/", "published_at": "2022-08-17T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf398763d40", "title": "A New Attack Surface on MS Exchange Part 3 - ProxyShell!", "url": "https://blog.orange.tw/posts/2021-08-proxyshell-a-new-attack-surface-on-ms-exchange-part-3/", "published_at": "2021-08-17T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf3990f2aa0", "title": "A New Attack Surface on MS Exchange Part 2 - ProxyOracle!", "url": "https://blog.orange.tw/posts/2021-08-proxyoracle-a-new-attack-surface-on-ms-exchange-part-2/", "published_at": "2021-08-06T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf399c4f3d1", "title": "A New Attack Surface on MS Exchange Part 1 - ProxyLogon!", "url": "https://blog.orange.tw/posts/2021-08-proxylogon-a-new-attack-surface-on-ms-exchange-part-1/", "published_at": "2021-08-05T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39a438e83", "title": "A Journey Combining Web Hacking and Binary Exploitation in Real World!", "url": "https://blog.orange.tw/posts/2021-02-a-journey-combining-web-and-binary-exploitation/", "published_at": "2021-02-23T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39a94f059", "title": "How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM", "url": "https://blog.orange.tw/posts/2020-09-how-i-hacked-facebook-again-mobileiron-mdm-rce/", "published_at": "2020-09-11T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39a9853d9", "title": "你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞", "url": "https://blog.orange.tw/posts/2019-11-HiNet-GPON-Modem-RCE/", "published_at": "2019-11-10T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39b32791a", "title": "An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)", "url": "https://blog.orange.tw/posts/2019-10-an-analysis-and-thought-about-recently/", "published_at": "2019-10-29T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39b65b42d", "title": "Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study!", "url": "https://blog.orange.tw/posts/2019-09-attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain/", "published_at": "2019-09-01T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39be6439a", "title": "Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN", "url": "https://blog.orange.tw/posts/2019-08-attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn/", "published_at": "2019-08-09T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39cd8816f", "title": "Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study!", "url": "https://blog.orange.tw/posts/2019-07-attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto/", "published_at": "2019-07-16T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39cec4299", "title": "A Wormable XSS on HackMD!", "url": "https://blog.orange.tw/posts/2019-03-a-wormable-xss-on-hackmd/", "published_at": "2019-03-11T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39d1e6c0a", "title": "Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!", "url": "https://blog.orange.tw/posts/2019-02-abusing-meta-programming-for-unauthenticated-rce/", "published_at": "2019-02-18T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39d8b6cc0", "title": "Hacking Jenkins Part 1 - Play with Dynamic Routing", "url": "https://blog.orange.tw/posts/2019-01-hacking-jenkins-part-1-play-with-dynamic-routing/", "published_at": "2019-01-15T16:00:00+00:00" }, { "id": "01a08751-cf69-72fa-9cc3-ddf39e3a61c7", "title": "HITCON CTF 2018 - One Line PHP Challenge", "url": "https://blog.orange.tw/posts/2018-10-hitcon-ctf-2018-one-line-php-challenge/", "published_at": "2018-10-23T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68b633239", "title": "How I Chained 4 Bugs (Features?) into RCE on Amazon Collaboration System", "url": "https://blog.orange.tw/posts/2018-08-how-i-chained-4-bugs-features-into-rce-on-amazon/", "published_at": "2018-08-10T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68b700ae5", "title": "圖床", "url": "https://blog.orange.tw/posts/2018-08-blog-post/", "published_at": "2018-08-05T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68b916e5c", "title": "Google CTF 2018 Quals Web Challenge - gCalc", "url": "https://blog.orange.tw/posts/2018-06-google-ctf-2018-quals-web-gcalc/", "published_at": "2018-06-26T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68ba570ee", "title": "Pwn a CTF Platform with Java JRMP Gadget", "url": "https://blog.orange.tw/posts/2018-03-pwn-ctf-platform-with-java-jrmp-gadget/", "published_at": "2018-03-25T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68c64e250", "title": "PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF", "url": "https://blog.orange.tw/posts/2018-01-php-cve-2018-5711-hanging-websites-by/", "published_at": "2018-01-20T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68d1f192b", "title": "How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!", "url": "https://blog.orange.tw/posts/2017-07-how-i-chained-4-vulnerabilities-on/", "published_at": "2017-07-27T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68db70172", "title": "GitHub Enterprise SQL Injection", "url": "https://blog.orange.tw/posts/2017-01-bug-bounty-github-enterprise-sql-injection/", "published_at": "2017-01-06T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68ddbfc10", "title": "[隨筆] Java Web 漏洞生態食物鏈", "url": "https://blog.orange.tw/posts/2016-12-java-web/", "published_at": "2016-12-06T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68e728623", "title": "Collection of CTF Web Challenges I made", "url": "https://blog.orange.tw/posts/2016-10-collection-of-ctf-web-challenges-i-made/", "published_at": "2016-10-12T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68eebf729", "title": "HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞", "url": "https://blog.orange.tw/posts/2016-07-hitcon-2016-slides-bug-bounty-hunter/", "published_at": "2016-07-22T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68f0358e3", "title": "How I Hacked Facebook, and Found Someone's Backdoor Script", "url": "https://blog.orange.tw/posts/2016-04-bug-bounty-how-i-hacked-facebook-and-found-someones-backdoor-script/", "published_at": "2016-04-20T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a68fbcd6aa", "title": "Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injection", "url": "https://blog.orange.tw/posts/2016-04-bug-bounty-uber-ubercom-remote-code_7/", "published_at": "2016-04-06T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a690a04eec", "title": "HITCON CTF 2015 Quals & Final 心得備份", "url": "https://blog.orange.tw/posts/2016-01-hitcon-ctf-2015-quals-final/", "published_at": "2016-01-13T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69146f8c3", "title": "Google & Facebook Bug Bounty GET", "url": "https://blog.orange.tw/posts/2015-09-google-facebook-bug-bounty-get/", "published_at": "2015-09-28T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a6919415c4", "title": "AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection)", "url": "https://blog.orange.tw/posts/2015-09-ais3-final-ctf-web-writeup-race/", "published_at": "2015-09-09T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a6921d7938", "title": "Remote Code Execution through GDB Remote Debugging Protocol", "url": "https://blog.orange.tw/posts/2015-08-remote-code-execution-on-gdb-remote/", "published_at": "2015-08-30T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a6929cdfaf", "title": "HITCON 2015 Community 演講投影片 - 那些 Web Hacking 中的奇技淫巧", "url": "https://blog.orange.tw/posts/2015-08-hitcon-2015-community-web-hacking/", "published_at": "2015-08-27T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a692aa3343", "title": "2015 烏雲峰會演講投影片 「關於 HITCON CTF 的那些事 之 Web 狗如何在險惡的 CTF 世界中存活？」", "url": "https://blog.orange.tw/posts/2015-07-2015-hitcon-ctf-web-ctf/", "published_at": "2015-07-17T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a692fea683", "title": "講個秘訣 - 0ctf Final 0cms", "url": "https://blog.orange.tw/posts/2015-05-0ctf-final-0cms/", "published_at": "2015-04-30T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a693f7454a", "title": "Web 狗沒人權 TAT?", "url": "https://blog.orange.tw/posts/2015-04-web/", "published_at": "2015-04-12T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a694869830", "title": "Bypassing open_basedir and disable_functions by Using PHP Use-After-Free Vulnerability", "url": "https://blog.orange.tw/posts/2015-03-bypassing-openbasedir-and/", "published_at": "2015-03-12T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a694e48410", "title": "Boston Key Party CTF 2015 [Harvard Square] [Andrew & Broadway] Write-ups", "url": "https://blog.orange.tw/posts/2015-03-boston-key-parcty-ctf-2015-harvard/", "published_at": "2015-03-01T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69532dac3", "title": "103 年資安技能金盾獎", "url": "https://blog.orange.tw/posts/2014-12-103/", "published_at": "2014-12-10T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a695c76c06", "title": "Hack in the Box 2014 CTF Writeup - KeygenMe with RSA", "url": "https://blog.orange.tw/posts/2014-10-hack-in-box-2014-ctf-writeup-keygenme/", "published_at": "2014-10-18T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a696b7e0ee", "title": "HITCON Won the 2nd in DEFCON 22 CTF Final", "url": "https://blog.orange.tw/posts/2014-08-hitcon-win-2nd-in-defcon-22-ctf-final/", "published_at": "2014-08-25T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a6978489ea", "title": "Defcon CTF Quals 2014 - Nonameyet write up", "url": "https://blog.orange.tw/posts/2014-05-defcon-ctf-quals-2014-nonameyet-write-up/", "published_at": "2014-05-18T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a697ac65e6", "title": "Pw3ed CTF LeaderBoard - Git Misconfiguration & SQL Injection", "url": "https://blog.orange.tw/posts/2014-03-pwned-ctf-leaderboard-git/", "published_at": "2014-03-30T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a698300d49", "title": "Volga CTF 2014 Web 400 write up", "url": "https://blog.orange.tw/posts/2014-03-volgactf-2014-web-400-write-up/", "published_at": "2014-03-29T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a698ce5e51", "title": "Olympic CTF 2014 CURLing 200 write up", "url": "https://blog.orange.tw/posts/2014-02-olympic-ctf-2014-curling-200-write-up/", "published_at": "2014-02-09T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69955da9c", "title": "Olympic CTF 2014 CURLing 400 write up", "url": "https://blog.orange.tw/posts/2014-02-olympic-ctf-2014-curling-400-write-up/", "published_at": "2014-02-09T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a6997d3cc3", "title": "MD5 for Fun - Fun with MD5 hashes", "url": "https://blog.orange.tw/posts/2013-12-md5-for-fun-fun-with-md5-hashes/", "published_at": "2013-12-24T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a699fcb48f", "title": "EXP.tw - 文章投稿、駭客資訊、資安文章", "url": "https://blog.orange.tw/posts/2013-11-exptw/", "published_at": "2013-11-23T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69af84964", "title": "Yahoo Bug Bounty Part 2 - *.login.yahoo.com Remote Code Execution 遠端代碼執行漏洞", "url": "https://blog.orange.tw/posts/2013-11-yahoo-bug-bounty-part-2-loginyahoocom/", "published_at": "2013-11-03T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69b4a03ef", "title": "Yahoo Bug Bounty Part 1 - 台灣 Yahoo Blog 任意檔案下載漏洞", "url": "https://blog.orange.tw/posts/2013-11-yahoo-bug-bounty-part-1-yahoo-blog/", "published_at": "2013-10-31T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69bbfaf41", "title": "PHPConf 2013 投影片 - 矛盾大對決！", "url": "https://blog.orange.tw/posts/2013-10-phpconf-2013/", "published_at": "2013-10-04T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69c0c82fc", "title": "這不是金盾獎Ｔ＿Ｔ", "url": "https://blog.orange.tw/posts/2013-09-blog-post/", "published_at": "2013-09-23T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69c4a5c2d", "title": "HITCON 2013 Wargame - Pwn3d 500 詳解", "url": "https://blog.orange.tw/posts/2013-07-hitcon-2013-wargame-pwn3d-500/", "published_at": "2013-07-20T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69cdecfd6", "title": "HITCON 2013 Wargame - Web 500 詳解", "url": "https://blog.orange.tw/posts/2013-07-hitcon-2013-wargame-web-500/", "published_at": "2013-07-20T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69d8d04d0", "title": "0-Day 輕鬆談 (0-Day Easy Talk) - Happy Fuzzing Internet Explorer", "url": "https://blog.orange.tw/posts/2013-07-0-day-0-day-easy-talk-happy-fuzzing/", "published_at": "2013-07-18T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69dcff9c7", "title": "Pycon2013 Slide - 駭客看 Django", "url": "https://blog.orange.tw/posts/2013-05-pycon2013-slide-django/", "published_at": "2013-05-25T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69e2a9398", "title": "CVE-2013-0305 Django Credit Get", "url": "https://blog.orange.tw/posts/2013-02-cve-2013-0305-django-credit-get/", "published_at": "2013-02-22T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69e7c0472", "title": "WebConf 2013「Best Practices - The Upload」投影片", "url": "https://blog.orange.tw/posts/2013-01-webconf-2013best-practices-upload/", "published_at": "2013-01-12T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69e889ddd", "title": "101 年全國大專院校資安技能金盾獎", "url": "https://blog.orange.tw/posts/2013-01-101/", "published_at": "2013-01-06T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69ecedce6", "title": "被微軟感謝了>< MS12-071 - CVE-2012-4775", "url": "https://blog.orange.tw/posts/2012-11-ms12-071-cve-2012-4775/", "published_at": "2012-11-13T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69faabe04", "title": "PHPCONF 2012 - Security in PHP 那些在滲透測試的小技巧", "url": "https://blog.orange.tw/posts/2012-11-phpconf-2012-security-in-php/", "published_at": "2012-11-02T16:00:00+00:00" }, { "id": "01a08751-cf6a-71ce-81e1-b0a69fae2778", "title": "Study-Area，「網頁安全 Web Security 入門」投影片", "url": "https://blog.orange.tw/posts/2012-09-satainan-web-security/", "published_at": "2012-09-28T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea61165662", "title": "OWST - Orange Web Security Toolkit v 2.01", "url": "https://blog.orange.tw/posts/2012-09-owst-orange-web-security-toolkit-v-201/", "published_at": "2012-09-17T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea617e4893", "title": "Hacks in Taiwan 2012 Potent Pwnables 3 出題詳解", "url": "https://blog.orange.tw/posts/2012-07-hacks-in-taiwan-2012-potent-pwnables-3/", "published_at": "2012-07-23T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea626b0bcf", "title": "Hacks in Taiwan 2012 Web Hacking 1 出題詳解", "url": "https://blog.orange.tw/posts/2012-07-hacks-in-taiwan-2012-web-hacking-1/", "published_at": "2012-07-22T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea62aac787", "title": "Defcon ctf 20 qual pp100 Writeup", "url": "https://blog.orange.tw/posts/2012-06-defcon-ctf-20-qual-pp100-writeup/", "published_at": "2012-06-18T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6305217c", "title": "一百年度全國大專院校資安技能金盾獎 XD", "url": "https://blog.orange.tw/posts/2011-12-xd/", "published_at": "2011-12-09T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea63844fb0", "title": "關於SQL Injection的那些奇淫異巧", "url": "https://blog.orange.tw/posts/2011-08-sql-injection/", "published_at": "2011-08-26T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea639a1477", "title": "台灣駭客年會 HITCON2011，Wargame Web 3出題心得 & 解法", "url": "https://blog.orange.tw/posts/2011-07-hitcon2011wargame-web-3/", "published_at": "2011-07-24T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea63a9c78c", "title": "台灣駭客年會 HITCON2011，Wargame Binary 3出題心得 & 解法", "url": "https://blog.orange.tw/posts/2011-07-hitcon2011wargame-binary-3/", "published_at": "2011-07-23T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea64a4d8bb", "title": "台灣駭客年會 HITCON2011，Wargame Web 4出題心得 & 解法", "url": "https://blog.orange.tw/posts/2011-07-hitcon2011wargame-web-4/", "published_at": "2011-07-23T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea652ac200", "title": "[Project] Web Security Toolkit", "url": "https://blog.orange.tw/posts/2011-05-project-web-security-toolkit/", "published_at": "2011-05-21T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea656a7410", "title": "整理", "url": "https://blog.orange.tw/posts/2011-04-blog-post/", "published_at": "2011-04-18T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea661a32cd", "title": "Download_Exec shellcode fix & for Windows 7", "url": "https://blog.orange.tw/posts/2011-04-downloadexec-shellcode-fix-for-windows/", "published_at": "2011-04-17T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea665f9644", "title": "第五屆全國大專院校資安技能金盾獎", "url": "https://blog.orange.tw/posts/2010-12-blog-post/", "published_at": "2010-12-10T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea671948cf", "title": "Hacks in Taiwan 第六屆台灣駭客年會", "url": "https://blog.orange.tw/posts/2010-07-hacks-in-taiwan/", "published_at": "2010-07-05T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea67467ab2", "title": "ram.exe", "url": "https://blog.orange.tw/posts/2010-05-ramexe/", "published_at": "2010-05-29T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea683005fe", "title": "動物園行", "url": "https://blog.orange.tw/posts/2010-05-blog-post_28/", "published_at": "2010-05-27T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6874a758", "title": "Hacks in Taiwan 2010 Conference", "url": "https://blog.orange.tw/posts/2010-05-hacks-in-taiwan-2010-conference/", "published_at": "2010-05-25T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea69603227", "title": "爽", "url": "https://blog.orange.tw/posts/2010-05-blog-post/", "published_at": "2010-05-11T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea69eec8c8", "title": "Note", "url": "https://blog.orange.tw/posts/2010-04-note/", "published_at": "2010-04-05T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6a798e75", "title": "Forensic Challenge 2010", "url": "https://blog.orange.tw/posts/2010-02-forensic-challenge-2010/", "published_at": "2010-02-20T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6a8e4944", "title": "好玩的圖XD", "url": "https://blog.orange.tw/posts/2010-02-xd/", "published_at": "2010-02-20T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6ab2edfc", "title": "這......?", "url": "https://blog.orange.tw/posts/2010-02-blog-post_18/", "published_at": "2010-02-17T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6b09d74f", "title": "增", "url": "https://blog.orange.tw/posts/2010-02-blog-post/", "published_at": "2010-02-15T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6b30db21", "title": "Orz", "url": "https://blog.orange.tw/posts/2010-02-orz/", "published_at": "2010-02-09T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6bee5ef8", "title": "0day~", "url": "https://blog.orange.tw/posts/2010-01-0day/", "published_at": "2010-01-27T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6cd43265", "title": "....", "url": "https://blog.orange.tw/posts/2010-01-blog-post_9987/", "published_at": "2010-01-21T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6d2209df", "title": "嘿", "url": "https://blog.orange.tw/posts/2010-01-blog-post_10/", "published_at": "2010-01-09T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6d5a7230", "title": "聖誕快樂", "url": "https://blog.orange.tw/posts/2009-12-blog-post_26/", "published_at": "2009-12-25T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6e0e83fa", "title": "搬家", "url": "https://blog.orange.tw/posts/2009-12-blog-post_3757/", "published_at": "2009-12-24T16:00:00+00:00" }, { "id": "01a08751-cf6b-73ca-a27f-c4ea6ea56b5c", "title": "Hacks in Taiwan Conference 2009 WarGame心得", "url": "https://blog.orange.tw/posts/2009-12-hacks-in-taiwan-conference-2009-wargame/", "published_at": "2009-12-24T16:00:00+00:00" } ] posts Claim your blog
Back to blog.orange.tw
Blog · corpus.blog/blogs/blog.orange.tw/posts

blog.orange.tw

blog.orange.tw

2025

(繁中) The Art of PHP — My CTF Journey and Untold Stories!original ↗
27 Aug 2025
The Art of PHP — My CTF Journey and Untold Stories!original ↗
27 Aug 2025
從 Web 狗的視角看 OSEE — 從 0.1 開始的 Advanced Windows Exploitation 考試original ↗
1 Jul 2025
WorstFit: Unveiling Hidden Transformers in Windows ANSI!original ↗
9 Jan 2025

2024

(繁中) Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!original ↗
8 Aug 2024
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!original ↗
8 Aug 2024
CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!original ↗
6 Jun 2024

2023

從 2013 到 2023: Web Security 十年之進化與趨勢!original ↗
11 Aug 2023

2022

A New Attack Surface on MS Exchange Part 4 - ProxyRelay!original ↗
18 Oct 2022
Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!original ↗
17 Aug 2022

2021

A New Attack Surface on MS Exchange Part 3 - ProxyShell!original ↗
17 Aug 2021
A New Attack Surface on MS Exchange Part 2 - ProxyOracle!original ↗
6 Aug 2021
A New Attack Surface on MS Exchange Part 1 - ProxyLogon!original ↗
5 Aug 2021
A Journey Combining Web Hacking and Binary Exploitation in Real World!original ↗
23 Feb 2021

2020

How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDMoriginal ↗
11 Sept 2020

2019

你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞original ↗
10 Nov 2019
An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)original ↗
29 Oct 2019
Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study!original ↗
1 Sept 2019
Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPNoriginal ↗
9 Aug 2019
Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study!original ↗
16 Jul 2019
A Wormable XSS on HackMD!original ↗
11 Mar 2019
Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!original ↗
18 Feb 2019
Hacking Jenkins Part 1 - Play with Dynamic Routingoriginal ↗
15 Jan 2019

2018

HITCON CTF 2018 - One Line PHP Challengeoriginal ↗
23 Oct 2018
How I Chained 4 Bugs (Features?) into RCE on Amazon Collaboration Systemoriginal ↗
10 Aug 2018
圖床original ↗
5 Aug 2018
Google CTF 2018 Quals Web Challenge - gCalcoriginal ↗
26 Jun 2018
Pwn a CTF Platform with Java JRMP Gadgetoriginal ↗
25 Mar 2018
PHP CVE-2018-5711 - Hanging Websites by a Harmful GIForiginal ↗
20 Jan 2018

2017

How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!original ↗
27 Jul 2017
GitHub Enterprise SQL Injectionoriginal ↗
6 Jan 2017

2016

[隨筆] Java Web 漏洞生態食物鏈original ↗
6 Dec 2016
Collection of CTF Web Challenges I madeoriginal ↗
12 Oct 2016
HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞original ↗
22 Jul 2016
How I Hacked Facebook, and Found Someone's Backdoor Scriptoriginal ↗
20 Apr 2016
Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injectionoriginal ↗
6 Apr 2016
HITCON CTF 2015 Quals & Final 心得備份original ↗
13 Jan 2016

2015

Google & Facebook Bug Bounty GEToriginal ↗
28 Sept 2015
AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection)original ↗
9 Sept 2015
Remote Code Execution through GDB Remote Debugging Protocoloriginal ↗
30 Aug 2015
HITCON 2015 Community 演講投影片 - 那些 Web Hacking 中的奇技淫巧original ↗
27 Aug 2015
2015 烏雲峰會演講投影片 「關於 HITCON CTF 的那些事 之 Web 狗如何在險惡的 CTF 世界中存活？」original ↗
17 Jul 2015
講個秘訣 - 0ctf Final 0cmsoriginal ↗
30 Apr 2015
Web 狗沒人權 TAT?original ↗
12 Apr 2015
Bypassing open_basedir and disable_functions by Using PHP Use-After-Free Vulnerabilityoriginal ↗
12 Mar 2015
Boston Key Party CTF 2015 [Harvard Square] [Andrew & Broadway] Write-upsoriginal ↗
1 Mar 2015

2014

103 年資安技能金盾獎original ↗
10 Dec 2014
Hack in the Box 2014 CTF Writeup - KeygenMe with RSAoriginal ↗
18 Oct 2014
HITCON Won the 2nd in DEFCON 22 CTF Finaloriginal ↗
25 Aug 2014
Defcon CTF Quals 2014 - Nonameyet write uporiginal ↗
18 May 2014
Pw3ed CTF LeaderBoard - Git Misconfiguration & SQL Injectionoriginal ↗
30 Mar 2014
Volga CTF 2014 Web 400 write uporiginal ↗
29 Mar 2014
Olympic CTF 2014 CURLing 200 write uporiginal ↗
9 Feb 2014
Olympic CTF 2014 CURLing 400 write uporiginal ↗
9 Feb 2014

2013

MD5 for Fun - Fun with MD5 hashesoriginal ↗
24 Dec 2013
EXP.tw - 文章投稿、駭客資訊、資安文章original ↗
23 Nov 2013
Yahoo Bug Bounty Part 2 - *.login.yahoo.com Remote Code Execution 遠端代碼執行漏洞original ↗
3 Nov 2013
Yahoo Bug Bounty Part 1 - 台灣 Yahoo Blog 任意檔案下載漏洞original ↗
31 Oct 2013
PHPConf 2013 投影片 - 矛盾大對決！original ↗
4 Oct 2013
這不是金盾獎Ｔ＿Ｔoriginal ↗
23 Sept 2013
HITCON 2013 Wargame - Pwn3d 500 詳解original ↗
20 Jul 2013
HITCON 2013 Wargame - Web 500 詳解original ↗
20 Jul 2013
0-Day 輕鬆談 (0-Day Easy Talk) - Happy Fuzzing Internet Exploreroriginal ↗
18 Jul 2013
Pycon2013 Slide - 駭客看 Djangooriginal ↗
25 May 2013
CVE-2013-0305 Django Credit Getoriginal ↗
22 Feb 2013
WebConf 2013「Best Practices - The Upload」投影片original ↗
12 Jan 2013
101 年全國大專院校資安技能金盾獎original ↗
6 Jan 2013

2012

被微軟感謝了>< MS12-071 - CVE-2012-4775original ↗
13 Nov 2012
PHPCONF 2012 - Security in PHP 那些在滲透測試的小技巧original ↗
2 Nov 2012
Study-Area，「網頁安全 Web Security 入門」投影片original ↗
28 Sept 2012
OWST - Orange Web Security Toolkit v 2.01original ↗
17 Sept 2012
Hacks in Taiwan 2012 Potent Pwnables 3 出題詳解original ↗
23 Jul 2012
Hacks in Taiwan 2012 Web Hacking 1 出題詳解original ↗
22 Jul 2012
Defcon ctf 20 qual pp100 Writeuporiginal ↗
18 Jun 2012

2011

一百年度全國大專院校資安技能金盾獎 XDoriginal ↗
9 Dec 2011
關於SQL Injection的那些奇淫異巧original ↗
26 Aug 2011
台灣駭客年會 HITCON2011，Wargame Web 3出題心得 & 解法original ↗
24 Jul 2011
台灣駭客年會 HITCON2011，Wargame Binary 3出題心得 & 解法original ↗
23 Jul 2011
台灣駭客年會 HITCON2011，Wargame Web 4出題心得 & 解法original ↗
23 Jul 2011
[Project] Web Security Toolkitoriginal ↗
21 May 2011
整理original ↗
18 Apr 2011
Download_Exec shellcode fix & for Windows 7original ↗
17 Apr 2011

2010

第五屆全國大專院校資安技能金盾獎original ↗
10 Dec 2010
Hacks in Taiwan 第六屆台灣駭客年會original ↗
5 Jul 2010
ram.exeoriginal ↗
29 May 2010
動物園行original ↗
27 May 2010
Hacks in Taiwan 2010 Conferenceoriginal ↗
25 May 2010
爽original ↗
11 May 2010
Noteoriginal ↗
5 Apr 2010
Forensic Challenge 2010original ↗
20 Feb 2010
好玩的圖XDoriginal ↗
20 Feb 2010
這......?original ↗
17 Feb 2010
增original ↗
15 Feb 2010
Orzoriginal ↗
9 Feb 2010
0day~original ↗
27 Jan 2010
....original ↗
21 Jan 2010
嘿original ↗
9 Jan 2010

2009

聖誕快樂original ↗
25 Dec 2009
搬家original ↗
24 Dec 2009
Hacks in Taiwan Conference 2009 WarGame心得original ↗
24 Dec 2009