The Curious Engineer

All blogs / Security

Orange Tsai

blog.orange.tw

This is 🍊 Speaking!

SecurityWeb developmentWindows internals

’10’15’20’25
Posts
101 from 24 Dec 2009 to 26 Oct 2026
Posting
now and then (1 in the last year)
Kind
personal blog
Feed
https://blog.orange.tw/atom.xml

2026 1

  1. The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

2025 4

  1. (繁中) The Art of PHP — My CTF Journey and Untold Stories!
  2. The Art of PHP — My CTF Journey and Untold Stories!
  3. 從 Web 狗的視角看 OSEE — 從 0.1 開始的 Advanced Windows Exploitation 考試
  4. WorstFit: Unveiling Hidden Transformers in Windows ANSI!

2024 3

  1. (繁中) Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
  2. Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
  3. CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!

2023 1

  1. 從 2013 到 2023: Web Security 十年之進化與趨勢!

2022 2

  1. A New Attack Surface on MS Exchange Part 4 - ProxyRelay!
  2. Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!

2021 4

  1. A New Attack Surface on MS Exchange Part 3 - ProxyShell!
  2. A New Attack Surface on MS Exchange Part 2 - ProxyOracle!
  3. A New Attack Surface on MS Exchange Part 1 - ProxyLogon!
  4. A Journey Combining Web Hacking and Binary Exploitation in Real World!

2020 1

  1. How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM

2019 8

  1. 你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞
  2. An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)
  3. Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study!
  4. Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN
  5. Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study!
  6. A Wormable XSS on HackMD!
  7. Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!
  8. Hacking Jenkins Part 1 - Play with Dynamic Routing

2018 6

  1. HITCON CTF 2018 - One Line PHP Challenge
  2. How I Chained 4 Bugs (Features?) into RCE on Amazon Collaboration System
  3. 2018 08 blog post
  4. Google CTF 2018 Quals Web Challenge - gCalc
  5. Pwn a CTF Platform with Java JRMP Gadget
  6. PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF

2017 2

  1. How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
  2. GitHub Enterprise SQL Injection

2016 6

  1. [隨筆] Java Web 漏洞生態食物鏈
  2. Collection of CTF Web Challenges I made
  3. HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞
  4. How I Hacked Facebook, and Found Someone's Backdoor Script
  5. Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injection
  6. HITCON CTF 2015 Quals & Final 心得備份

2015 9

  1. Google & Facebook Bug Bounty GET
  2. AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection)
  3. Remote Code Execution through GDB Remote Debugging Protocol
  4. HITCON 2015 Community 演講投影片 - 那些 Web Hacking 中的奇技淫巧
  5. 2015 烏雲峰會演講投影片 「關於 HITCON CTF 的那些事 之 Web 狗如何在險惡的 CTF 世界中存活？」
  6. 講個秘訣 - 0ctf Final 0cms
  7. Web 狗沒人權 TAT?
  8. Bypassing open_basedir and disable_functions by Using PHP Use-After-Free Vulnerability
  9. Boston Key Party CTF 2015 [Harvard Square] [Andrew & Broadway] Write-ups

2014 8

  1. 103 年資安技能金盾獎
  2. Hack in the Box 2014 CTF Writeup - KeygenMe with RSA
  3. HITCON Won the 2nd in DEFCON 22 CTF Final
  4. Defcon CTF Quals 2014 - Nonameyet write up
  5. Pw3ed CTF LeaderBoard - Git Misconfiguration & SQL Injection
  6. Volga CTF 2014 Web 400 write up
  7. Olympic CTF 2014 CURLing 200 write up
  8. Olympic CTF 2014 CURLing 400 write up

2013 13

  1. MD5 for Fun - Fun with MD5 hashes
  2. EXP.tw - 文章投稿、駭客資訊、資安文章
  3. Yahoo Bug Bounty Part 2 - *.login.yahoo.com Remote Code Execution 遠端代碼執行漏洞
  4. Yahoo Bug Bounty Part 1 - 台灣 Yahoo Blog 任意檔案下載漏洞
  5. PHPConf 2013 投影片 - 矛盾大對決！
  6. 這不是金盾獎Ｔ＿Ｔ
  7. HITCON 2013 Wargame - Pwn3d 500 詳解
  8. HITCON 2013 Wargame - Web 500 詳解
  9. 0-Day 輕鬆談 (0-Day Easy Talk) - Happy Fuzzing Internet Explorer
  10. Pycon2013 Slide - 駭客看 Django
  11. CVE-2013-0305 Django Credit Get
  12. WebConf 2013「Best Practices - The Upload」投影片
  13. 101 年全國大專院校資安技能金盾獎

2012 7

  1. 被微軟感謝了>< MS12-071 - CVE-2012-4775
  2. PHPCONF 2012 - Security in PHP 那些在滲透測試的小技巧
  3. Study-Area，「網頁安全 Web Security 入門」投影片
  4. OWST - Orange Web Security Toolkit v 2.01
  5. Hacks in Taiwan 2012 Potent Pwnables 3 出題詳解
  6. Hacks in Taiwan 2012 Web Hacking 1 出題詳解
  7. Defcon ctf 20 qual pp100 Writeup

2011 8

  1. 一百年度全國大專院校資安技能金盾獎 XD
  2. 關於SQL Injection的那些奇淫異巧
  3. 台灣駭客年會 HITCON2011，Wargame Web 3出題心得 & 解法
  4. 台灣駭客年會 HITCON2011，Wargame Binary 3出題心得 & 解法
  5. 台灣駭客年會 HITCON2011，Wargame Web 4出題心得 & 解法
  6. [Project] Web Security Toolkit
  7. 2011 04 blog post
  8. Download_Exec shellcode fix & for Windows 7

2010 15

  1. 第五屆全國大專院校資安技能金盾獎
  2. Hacks in Taiwan 第六屆台灣駭客年會
  3. ram.exe
  4. 2010 05 blog post 28
  5. Hacks in Taiwan 2010 Conference
  6. 2010 05 blog post
  7. 2010 04 note
  8. Forensic Challenge 2010
  9. 2010 02 xd
  10. 這......?
  11. 2010 02 blog post
  12. 2010 02 orz
  13. 2010 01 0day
  14. 2010 01 blog post 9987
  15. 2010 01 blog post 10

2009 3

  1. 2009 12 blog post 26
  2. 2009 12 blog post 3757
  3. Hacks in Taiwan Conference 2009 WarGame心得