Notes on a 2011 network-forensics CTF challenge style
A look at the typical structure and skills behind 2011-era network-forensics CTF challenges, built around reading a packet capture end to end.
Read moreArchive: 2011
Notes first published in 2011.
A login check that ran the page anyway
A large web portal's admin backend sent a login redirect but never stopped executing, so blocking the redirect client-side exposed the page anyway.
Read moreWordPress theme path disclosure through PHP error messages
Leaving PHP error display on let a WordPress site leak its full server directory path whenever a theme file threw a warning.
Read moreRFID security themes from the early 2010s conference circuit
An overview of the RFID security concerns that dominated conference talks around 2011: weak card crypto, cloning, and relay attacks.
Read moreConference notes: the security research scene around 2011
A neutral recap of the topics that characterised the regional security-conference circuit in 2011, without attributing any specific talk or speaker.
Read moreA framework for thinking about file upload attack classes
A conceptual breakdown of how file-upload vulnerabilities tend to be grouped, and the layered defences that address each class.
Read moreRunning an internal security tech day that people actually attend
A practical format for an internal security tech day, built around short rotating talks that keep a small research team's knowledge moving.
Read more