Physical connectors as an attack surface
Charge contacts and USB ports are often treated as power-only, but they can carry data, debug signals and glitchable supply lines. Here is what to review.
Read moreAll posts
Every note in the archive, newest first: 45 posts from 2011 to today.
2026
IoT device hardening: a practical checklist
A practical, ordered checklist for hardening connected devices, starting with the fixes that remove the most risk for the least effort.
Read moreSecuring debug and test interfaces on circuit boards
Exposed JTAG, SWD and UART access is one of the quickest ways into a device. This note covers how it is abused and how to close it without breaking factory test.
Read more2015
Hiding data in Base64 padding: an RCTF crypto challenge
A look at an RCTF cryptography challenge that hid its answer inside the padding bits Base64 normally discards.
Read moreUnpacking a layered crack-me: RCTF reverse engineering 300
Notes on a crack-me that stacked packing, anti-disassembly tricks and a multi-step encoding scheme before the real check.
Read moreFilename injection and a four-step privilege escalation: two RCTF web challenges
A filename-based SQL injection bypassing keyword filters, plus a four-stage privilege escalation chain ending in a filtered file upload.
Read moreFireEye's FLARE-On 2015: an eleven-challenge reverse engineering gauntlet
A round-up of the themes across FireEye's eleven-stage 2015 FLARE-On reverse-engineering competition.
Read moreWhen Baidu's traffic was hijacked to flood GitHub
How a March 2015 network-level hijack turned Baidu analytics traffic into an unwitting denial-of-service tool against GitHub.
Read moreBadIRET: a Linux kernel privilege escalation rooted in a CPU instruction quirk
An analysis of BadIRET (CVE-2014-9322), a Linux kernel flaw where a mishandled CPU exception let a local process redirect a kernel-internal pointer.
Read more2014
CySCA 2014: four web challenges from an Australian student CTF
Four 2014 CySCA web challenges, covering trust-the-client access control, markdown XSS, CSRF-protected SQL injection, and hash length extension.
Read moreA history of PaX: the hardening project that predicted modern exploit mitigations
A retrospective on PaX, the long-running Linux hardening patch whose early-2000s ideas anticipated ASLR, NX and other mainstream mitigations.
Read moreAutomatically finding XSS inside Flash files
A dynamic testing approach that loads Flash files in a scriptable headless browser and watches for JavaScript execution to flag XSS.
Read moreWhat a QQ group data lookup tool reveals about aggregation risk
An old lookup tool for QQ group membership data illustrates how aggregating many small public details can create a privacy exposure no single data point suggests on its own.
Read more2013
WordPress brute-force attacks: how they work and how to stop them
A look at how attackers enumerate WordPress usernames and brute-force logins, and the defences that stop it: rate limiting, disabling XML-RPC multicall, and two-factor authentication.
Read moreWhy an exposed Tomcat AJP connector is a firewall bypass waiting to happen
Tomcat's AJP connector on port 8009 trusts whoever connects to it; firewalling off the usual HTTP port while leaving AJP reachable quietly defeats the protection entirely.
Read moreWhy software-defined radio put RF hacking within reach of researchers
A short conference note on an RF-focused security talk, and why software-defined radio made wireless protocol research accessible to far more researchers.
Read moreWhen a VPN silently falls back to plaintext under interference
If the negotiation traffic an IPSec/L2TP VPN needs to agree encryption is blocked, some clients fall back to an unencrypted tunnel instead of refusing to connect at all.
Read moreWhat a multi-threaded network scanner actually does, conceptually
A conceptual walkthrough of how ping sweeps, threaded port scanning and service fingerprinting combine into a network reconnaissance workflow, and why it requires explicit authorisation.
Read moreWhy app server credential encryption is reversible, and what that means
Application servers like JBoss and WebLogic encrypt stored credentials reversibly rather than hashing them, because the server must get the plaintext back to connect; that design has real limits.
Read moreHow software-defined radio exposed weak wireless keyboard security
Older wireless keyboards transmitted keystrokes over radio with little real encryption; software-defined radio turned intercepting and decoding that signal into an accessible research exercise.
Read moreWhy physical memory matters as much as the disk in forensic work
A short primer on why volatile memory, not just the disk, holds evidence forensic investigators need, and why capturing it correctly and early matters.
Read moreWhy a one-line find command is a post-compromise goldmine
A tiny shell one-liner that hunts a compromised Linux box for config and history files shows why post-exploitation enumeration is cheap and effective.
Read moreThe internal network scanner idea behind a PHP intranet tool
An old PHP scanning and credential-guessing concept, built to run from inside a compromised web host, illustrates internal-network risk after a breach.
Read moreCVE-2013-1464: XSS in the WordPress Audio Player plugin's SWF
CVE-2013-1464: an unsanitised flashvar in the Audio Player WordPress plugin's bundled SWF allowed script execution in the page context.
Read moreCVE-2013-1463: XSS in WP-Table Reloaded's zeroclipboard SWF
CVE-2013-1463: the zeroclipboard SWF shipped with WP-Table Reloaded passed an unsanitised id parameter into an ActionScript call, enabling script injection.
Read moreBrowser security notes: why URL parsing quirks matter
A brief look at why browsers and backends disagreeing on how to parse the same URL is still a quiet source of security bugs.
Read more2012
Attack and defence in web games: a structured overview
A tour of the recurring weak points in browser-based games: tamperable network protocols, memory edits, save-file edits, and account or payment fraud.
Read moreHow malicious Android apps used activity hijacking to steal data
A look at activity hijacking: a non-root Android technique where a malicious app watches for a target app, then overlays a convincing fake login screen.
Read moreA lesson in privilege escalation from an old Novell directory service
A legacy Novell/ConsoleOne environment illustrates how group self-enrolment and concurrent sessions turn modest access into full account takeover.
Read moreAnti-debugging techniques from Hack.lu's mealtime challenge
A tour of the anti-debugging tricks in Hack.lu's mealtime CTF binary: PEB-flag checks, deferred VEH registration, and injection across two processes.
Read moreClassic character and filter bypass patterns in cross-site scripting
Overview of how testers historically got around single-character filtering and browser XSS filters, and what it taught defenders about input handling.
Read moreHow a PHP escaping feature undermined a browser XSS filter
How an old PHP input-escaping feature changed request content in a way a browser's XSS filter did not account for, allowing a bypass.
Read moreDEF CON CTF forensics: finding a key inside a router firmware image
A firmware-analysis CTF challenge solved by identifying the device, extracting its filesystem, and locating a flag file inside it.
Read moreReverse engineering an unfamiliar instruction set under CTF time pressure
A CTF binary challenge shipped a packet capture plus an executable for an unfamiliar architecture, solved mainly through protocol-flow reasoning.
Read moreMimikatz and why Windows stopped trusting lsass.exe with plaintext
Mimikatz showed that lsass.exe held reversibly encrypted credentials, not just hashes, and that discovery reshaped how Windows protects memory.
Read moreCVE-2012-0053: a quiet reminder that httponly is not absolute
Apache's handling of oversized headers once echoed full cookie values back in an error page, defeating the httponly flag that was meant to hide them from scripts.
Read moreWhen a bundled upload component ships without its own checks
A reported flaw in a CMS's upload component showed how outsourcing an upload widget's front end can leave its backend endpoint unchecked.
Read moreHow an oversized-cookie error page turned into an httponly bypass
Exploiting the Apache cookie-disclosure flaw needed a second weaker XSS, not a direct document.cookie read, to push the cookie jar over the server's size limit.
Read more2011
Notes on a 2011 network-forensics CTF challenge style
A look at the typical structure and skills behind 2011-era network-forensics CTF challenges, built around reading a packet capture end to end.
Read moreA login check that ran the page anyway
A large web portal's admin backend sent a login redirect but never stopped executing, so blocking the redirect client-side exposed the page anyway.
Read moreWordPress theme path disclosure through PHP error messages
Leaving PHP error display on let a WordPress site leak its full server directory path whenever a theme file threw a warning.
Read moreRFID security themes from the early 2010s conference circuit
An overview of the RFID security concerns that dominated conference talks around 2011: weak card crypto, cloning, and relay attacks.
Read moreConference notes: the security research scene around 2011
A neutral recap of the topics that characterised the regional security-conference circuit in 2011, without attributing any specific talk or speaker.
Read moreA framework for thinking about file upload attack classes
A conceptual breakdown of how file-upload vulnerabilities tend to be grouped, and the layered defences that address each class.
Read moreRunning an internal security tech day that people actually attend
A practical format for an internal security tech day, built around short rotating talks that keep a small research team's knowledge moving.
Read more