Cyku

a.k.a. cy
White-Hat Hacker / Web Lover / Pentester / Red Teamer / CTF player / 黑魔法少女.
Chinese / English

[CODE WHITE GmbH @codewhitesec]

Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti https://t.co/weWtiB72Dv

[Cyku @cyku_tw]

嘿！你知道嗎？

某些 HTML 標籤閉合的優先順序可能高於屬性的雙引號，例如「<xmp><img src="</xmp><svg onload=alert()>">」會在 chrome 上彈窗，看似神奇但當你將 xmp 改為 script 就可理解是 parser 不一致所導致，這特性曾被人應用在 Google Search 上的 XSS 漏洞

#紅隊豆知識 #RedTeamDoYouKnow

[Cyku @cyku_tw]

嘿！你知道嗎？

SSH 的 port forwarding 功能用於 tunneling 非常便利，OpenSSH 在 6.7 以後開始支援將流量轉發到 Unix socket，只要使用 "ssh -L 2376:/var/run/docker.sock" 就可以讓你在本機連到伺服器上的 docker，或許在 sandbox escape 時會有意想不到的用途。

#紅隊豆知識 #RedTeamDoYouKnow

[Cyku @cyku_tw]

嘿！你知道嗎？

Windows 為了檔案系統的相容性 (例如：FAT會用空白字元去填充沒有用到的檔名字串空間)，大部分時候在建立檔案時，會自動移除檔名末端的點(.)和空白字元，所以如果測試上傳漏洞遇到副檔名有黑名單的話，不妨試試看上傳 "webshell.aspx." 吧！

#紅隊豆知識 #RedTeamDoYouKnow

[Cyku @cyku_tw]

@Noth72013441 真的 現在紅隊越來越苦了

[Cyku @cyku_tw]

參與紅隊無數次打 Windows AD 的經驗總結下來，
我得到了四個字的滲透心法：花式登入。

不是隨時都有 ZeroLogon、CVE-2022–26923 這種無視限制可以直搗黃龍的漏洞，所以平時滲透的不二法門果然還是想盡辦法撈到密碼登入就對了！

[Cyku @cyku_tw]

I feel so energized. It's gonna be a great time at work with my new keyboard😺

[Cyku @cyku_tw]

My new keyboard 🥰

[Cyku @cyku_tw]

https://t.co/csYgdfuio9

It's time to play 🤓

[Cyku @cyku_tw]

I've prepared 3 easy wargame challenges for HITCON CMT 2024 event, plus my coworker's challenge for a total of 7 challenges. I hope everyone enjoys them🥳

[Cyku @cyku_tw]

I've prepared 3 easy wargame challenges for HITCON CMT 2024 event, plus my coworker's challenge for a total of 7 challenges. I hope everyone enjoys them🥳

[Cyku @cyku_tw]

被 Wordware AI 嗆自己解不開自己做的 CTF 題目，
但事實上 .. .. 是真的，
今年老樣子為 HITCON 做了 Wargame，我還真的解不開，
有沒有會來 HITCON 2024 的朋友幫我解一下🥹

[Cyku @cyku_tw]

It's a short story about how do I perform a strange MSSQL Injection when the database doesn't even exist.

I'm trying to write in English this time, and I had a hard time writing. I hope everyone can still like it.

https://t.co/ULeMDfCFfT

[Cyku @cyku_tw]

It's been almost a year since my last blog post. I wanna update something but have no idea what to write about🤔

[Cyku @cyku_tw]

@fwarashi sounds great, I'll subsribe both!

[Cyku @cyku_tw]

@_r3st sad🐸

[Cyku @cyku_tw]

If an attacker exploits 0day to compromise service and leaves backdoor. After some time, victim fixes 0day but leaves backdoor behind. Then another attacker exploits new vuln to find backdoor and uses it to compromise enterprise, how do you describe second attack in ATT&CK?

[Cyku @cyku_tw]

@logonfail 感謝，這作為參考對我很有幫助！

[Cyku @cyku_tw]

@logonfail If 2 attacks are by 2 different attack group, would you still choose technique under "Persistence"? or choose technique under "Initial Access"?

[Cyku @cyku_tw]

@CRUD_Machine 沒錯！但如果表是指字典檔，一樣無法阻擋，如果是預先計算好的一個記滿雜湊的表跟它對應的原文密碼，那個加鹽的雜湊幾乎不可能會出現在表裡

[Web Security Academy @WebSecAcademy]

🎄SQLi was first reported 25 years ago, by a researcher once known as Rain Forest Puppy, in Phrack Magazine on this day in 1998.

🎁 Happy birthday SQLi! 🎁

🐛Despite being around for 25 years, it's still essential knowledge for pentesters.