blog.orange.tw 9. 8. 2024[中文] Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! – blog.orange.tw 9. 8. 2024[EN] Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! – blog.orange.tw 6. 6. 2024CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again! – blog.orange.tw 12. 8. 2023從 2013 到 2023: Web Security 十年之進化與趨勢! – blog.orange.tw 19. 10. 2022A New Attack Surface on MS Exchange Part 4 - ProxyRelay! – blog.orange.tw 17. 8. 2022Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS! – blog.orange.tw 18. 8. 2021A New Attack Surface on MS Exchange Part 3 - ProxyShell! – blog.orange.tw 6. 8. 2021A New Attack Surface on MS Exchange Part 2 - ProxyOracle! – blog.orange.tw 6. 8. 2021A New Attack Surface on MS Exchange Part 1 - ProxyLogon! – blog.orange.tw 24. 2. 2021A Journey Combining Web Hacking and Binary Exploitation in Real World! – blog.orange.tw 12. 9. 2020How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM – blog.orange.tw 11. 11. 2019你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞 – blog.orange.tw 29. 10. 2019An analysis and thought about recently PHP-FPM RCE(CVE-2019-11043) – blog.orange.tw 2. 9. 2019Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study! – blog.orange.tw 9. 8. 2019Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN – blog.orange.tw 17. 7. 2019Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study! – blog.orange.tw 12. 3. 2019A Wormable XSS on HackMD! – blog.orange.tw 19. 2. 2019Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE! – blog.orange.tw 16. 1. 2019Hacking Jenkins Part 1 - Play with Dynamic Routing – blog.orange.tw 23. 10. 2018HITCON CTF 2018 - One Line PHP Challenge – blog.orange.tw 10. 8. 2018How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System – blog.orange.tw 27. 6. 2018Google CTF 2018 Quals Web Challenge - gCalc – blog.orange.tw 26. 3. 2018Pwn a CTF Platform with Java JRMP Gadget – blog.orange.tw 21. 1. 2018PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF – blog.orange.tw 28. 7. 2017How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! – blog.orange.tw 7. 1. 2017GitHub Enterprise SQL Injection – blog.orange.tw 7. 12. 2016[隨筆] Java Web 漏洞生態食物鏈 – blog.orange.tw 13. 10. 2016Collection of CTF Web Challenges I made – blog.orange.tw 23. 7. 2016HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞 – blog.orange.tw 21. 4. 2016How I Hacked Facebook, and Found Someone's Backdoor Script – blog.orange.tw 6. 4. 2016Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injection – blog.orange.tw 14. 1. 2016HITCON CTF 2015 Quals & Final 心得備份 – blog.orange.tw 29. 9. 2015Google & Facebook Bug Bounty GET – blog.orange.tw 10. 9. 2015AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection) – blog.orange.tw
9. 8. 2024[中文] Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! – blog.orange.tw 9. 8. 2024[EN] Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! – blog.orange.tw 6. 6. 2024CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again! – blog.orange.tw 12. 8. 2023從 2013 到 2023: Web Security 十年之進化與趨勢! – blog.orange.tw 19. 10. 2022A New Attack Surface on MS Exchange Part 4 - ProxyRelay! – blog.orange.tw 17. 8. 2022Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS! – blog.orange.tw 18. 8. 2021A New Attack Surface on MS Exchange Part 3 - ProxyShell! – blog.orange.tw 6. 8. 2021A New Attack Surface on MS Exchange Part 2 - ProxyOracle! – blog.orange.tw 6. 8. 2021A New Attack Surface on MS Exchange Part 1 - ProxyLogon! – blog.orange.tw 24. 2. 2021A Journey Combining Web Hacking and Binary Exploitation in Real World! – blog.orange.tw 12. 9. 2020How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM – blog.orange.tw 11. 11. 2019你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞 – blog.orange.tw 29. 10. 2019An analysis and thought about recently PHP-FPM RCE(CVE-2019-11043) – blog.orange.tw 2. 9. 2019Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study! – blog.orange.tw 9. 8. 2019Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN – blog.orange.tw 17. 7. 2019Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study! – blog.orange.tw 12. 3. 2019A Wormable XSS on HackMD! – blog.orange.tw 19. 2. 2019Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE! – blog.orange.tw 16. 1. 2019Hacking Jenkins Part 1 - Play with Dynamic Routing – blog.orange.tw 23. 10. 2018HITCON CTF 2018 - One Line PHP Challenge – blog.orange.tw 10. 8. 2018How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System – blog.orange.tw 27. 6. 2018Google CTF 2018 Quals Web Challenge - gCalc – blog.orange.tw 26. 3. 2018Pwn a CTF Platform with Java JRMP Gadget – blog.orange.tw 21. 1. 2018PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF – blog.orange.tw 28. 7. 2017How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! – blog.orange.tw 7. 1. 2017GitHub Enterprise SQL Injection – blog.orange.tw 7. 12. 2016[隨筆] Java Web 漏洞生態食物鏈 – blog.orange.tw 13. 10. 2016Collection of CTF Web Challenges I made – blog.orange.tw 23. 7. 2016HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞 – blog.orange.tw 21. 4. 2016How I Hacked Facebook, and Found Someone's Backdoor Script – blog.orange.tw 6. 4. 2016Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injection – blog.orange.tw 14. 1. 2016HITCON CTF 2015 Quals & Final 心得備份 – blog.orange.tw 29. 9. 2015Google & Facebook Bug Bounty GET – blog.orange.tw 10. 9. 2015AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection) – blog.orange.tw