关于代码、安全，以及那些值得记录的探索。https://blog.sari3l.com/zh-CNhttps://blog.sari3l.com/posts/bc626227/https://blog.sari3l.com/posts/bc626227/记录一次漏洞分析与探索的过程。Wed, 08 Jun 2022 13:58:58 GMThttps://blog.sari3l.com/posts/b6c4d907/https://blog.sari3l.com/posts/b6c4d907/关于代码审计、数据流与安全研究的笔记。Thu, 30 Dec 2021 06:32:20 GMTCodeQLhttps://blog.sari3l.com/posts/91764dea/https://blog.sari3l.com/posts/91764dea/用查询理解代码，记录实践中的思考。Mon, 27 Dec 2021 13:23:51 GMTCodeQLhttps://blog.sari3l.com/posts/9e42d867/https://blog.sari3l.com/posts/9e42d867/首先根据这两个commits 基本可以确定最终是通过lookup执行了JNDI攻击Mon, 13 Dec 2021 17:32:35 GMThttps://blog.sari3l.com/posts/55ea3bd4/https://blog.sari3l.com/posts/55ea3bd4/使用 docker hub 已有的漏洞环境，IDEA 配置 Remote DebugSun, 23 Aug 2020 05:06:09 GMThttps://blog.sari3l.com/posts/c5e878c3/https://blog.sari3l.com/posts/c5e878c3/CobaltStrike Argue 原理 - 翻译文，Sariel.D 的技术研究与实践笔记。Tue, 04 Aug 2020 09:26:01 GMTcobaltstirkehttps://blog.sari3l.com/posts/afd91327/https://blog.sari3l.com/posts/afd91327/今天实在被 github page 的加载速度恶心到了，测试了几个CDN效果，虽然有免费流量等活动，总感觉被收割了什么Sat, 01 Aug 2020 16:54:48 GMThttps://blog.sari3l.com/posts/76ce816c/https://blog.sari3l.com/posts/76ce816c/由于到手的非原版，可能有些错误的地方、没有破解到的位置，欢迎各位师傅指正~~Fri, 31 Jul 2020 02:51:55 GMTcobaltstirkehttps://blog.sari3l.com/posts/b7ea5c49/https://blog.sari3l.com/posts/b7ea5c49/注意到，题目提供了Mon, 13 Jul 2020 08:32:42 GMT智能合约https://blog.sari3l.com/posts/58a67794/https://blog.sari3l.com/posts/58a67794/从通告中可以明确几个点Mon, 06 Jul 2020 02:45:39 GMTF5CVE-2020-5902https://blog.sari3l.com/posts/608d18f0/https://blog.sari3l.com/posts/608d18f0/UClient 提供了 JVM 参数设置，在里面直接添加Wed, 17 Jun 2020 05:21:18 GMThttps://blog.sari3l.com/posts/d4fb29f2/https://blog.sari3l.com/posts/d4fb29f2/关于反汇编时函数显示 pltSun, 14 Jun 2020 14:54:02 GMTpwnhttps://blog.sari3l.com/posts/ecb4dfa2/https://blog.sari3l.com/posts/ecb4dfa2/首先构造 rmi 服务端，以便观察数据包Wed, 01 Apr 2020 08:16:44 GMTWeblogichttps://blog.sari3l.com/posts/e32c5d3e/https://blog.sari3l.com/posts/e32c5d3e/注意：wlfullclient.jar在12.1.3版本后被移除，点此查看具体信息，但可以通过以下命令生成Fri, 20 Mar 2020 04:43:47 GMTRCEWeblogicDeserializehttps://blog.sari3l.com/posts/fa80d225/https://blog.sari3l.com/posts/fa80d225/CVE-2020-2555 简单分析，Sariel.D 的技术研究与实践笔记。Thu, 12 Mar 2020 14:47:39 GMTRCEWeblogicDeserializehttps://blog.sari3l.com/posts/91ba290f/https://blog.sari3l.com/posts/91ba290f/简单记忆:Mon, 02 Mar 2020 14:47:18 GMThttps://blog.sari3l.com/posts/56fcf5d8/https://blog.sari3l.com/posts/56fcf5d8/修改application/index/controller/Index.php内容Wed, 26 Feb 2020 07:49:46 GMT代码审计PHPThinkPHPhttps://blog.sari3l.com/posts/7d9ef63e/https://blog.sari3l.com/posts/7d9ef63e/根据官方文档，很容易编写 POCSat, 22 Feb 2020 14:58:15 GMTRCETomcatLFIhttps://blog.sari3l.com/posts/2cc5b12d/https://blog.sari3l.com/posts/2cc5b12d/在 JDBC URL 语法中，是可以类似于 get 设置请求属性的Fri, 17 Jan 2020 11:42:17 GMTMysqlRCEDeserializehttps://blog.sari3l.com/posts/f0f80c65/https://blog.sari3l.com/posts/f0f80c65/关键在于实现中中Thu, 16 Jan 2020 06:18:12 GMTMysqlRCEhttps://blog.sari3l.com/posts/f33694e6/https://blog.sari3l.com/posts/f33694e6/回顾 2019，感觉给自己定的目标都没有实现，整体上颓废了一年，看着别人的进步眼馋却也没有执行的动力Tue, 31 Dec 2019 16:00:00 GMT随笔https://blog.sari3l.com/posts/418c3786/https://blog.sari3l.com/posts/418c3786/对于 cookie 的相关内容还可以在网上找些相关资料，就上面的PDF放几张图简单了解一下Wed, 25 Dec 2019 05:54:35 GMThttps://blog.sari3l.com/posts/1e8439b5/https://blog.sari3l.com/posts/1e8439b5/下面这张图能够直观的理解各种类型的攻击，但还是要认真看原文全部内容Wed, 18 Dec 2019 04:35:11 GMThttps://blog.sari3l.com/posts/b61194b/https://blog.sari3l.com/posts/b61194b/由于官方已删除 framework v5.2.x-dev，导致无法复现环境，只能靠现有文章理解了 https://xz.aliyun.com/t/6619#toc-2Tue, 10 Dec 2019 13:46:46 GMT代码审计PHPThinkPHPhttps://blog.sari3l.com/posts/4457d4a3/https://blog.sari3l.com/posts/4457d4a3/ThinkPHP 5.1.x 反序列化简析，Sariel.D 的技术研究与实践笔记。Sat, 07 Dec 2019 08:38:32 GMT代码审计PHPThinkPHPhttps://blog.sari3l.com/posts/a3557ae1/https://blog.sari3l.com/posts/a3557ae1/最近有点偷懒严重，博客更新也断了好久，反正浏览量也不多不是Thu, 31 Oct 2019 08:03:54 GMT随笔https://blog.sari3l.com/posts/9622f295/https://blog.sari3l.com/posts/9622f295/首先需要了解一下数据库结构，在 Mysql 中，默认库有三个Thu, 12 Sep 2019 13:12:11 GMTMysqlSQLihttps://blog.sari3l.com/posts/a62f29f1/https://blog.sari3l.com/posts/a62f29f1/持久化 XSS 的常见姿势有Tue, 03 Sep 2019 14:07:36 GMTxsshttps://blog.sari3l.com/posts/66ad34dc/https://blog.sari3l.com/posts/66ad34dc/解析器：Fri, 23 Aug 2019 15:44:41 GMThttps://blog.sari3l.com/posts/13977d3a/https://blog.sari3l.com/posts/13977d3a/一句话总结：HTML 在解析 svg 节点下的 script 时，会暂停原有html标准解析，并使用xml标准解析svg-script，导致了实体引用被解析执行。Wed, 07 Aug 2019 06:40:17 GMThttps://blog.sari3l.com/posts/76496c2b/https://blog.sari3l.com/posts/76496c2b/首先奉上廖大大的fastjson经典流程图Tue, 06 Aug 2019 02:24:36 GMT漏洞分析fastjsonhttps://blog.sari3l.com/posts/85fdfb64/https://blog.sari3l.com/posts/85fdfb64/先上一张老图:3Tue, 16 Jul 2019 12:20:35 GMTSSRFhttps://blog.sari3l.com/posts/d8415c32/https://blog.sari3l.com/posts/d8415c32/源码下载地址：http://discuz.ml/downloadSat, 13 Jul 2019 01:41:59 GMTDiscuzhttps://blog.sari3l.com/posts/fb0090e/https://blog.sari3l.com/posts/fb0090e/总的下来，利用主从连接断开恢复后全量备份写入 so 进行加载调用Wed, 10 Jul 2019 07:01:21 GMTRedishttps://blog.sari3l.com/posts/8dea0d95/https://blog.sari3l.com/posts/8dea0d95/以下是基于 php-web 的 os-shell 流程分析Tue, 02 Jul 2019 07:14:21 GMThttps://blog.sari3l.com/posts/6fee1744/https://blog.sari3l.com/posts/6fee1744/常见的 SID 列表：well-known-security-identifiers-in-windows-operating-systemsSat, 15 Jun 2019 14:59:36 GMT内网RedTeamhttps://blog.sari3l.com/posts/caf0d20c/https://blog.sari3l.com/posts/caf0d20c/http://nextphp.2019.rctf.rois.ioTue, 21 May 2019 03:56:26 GMTctfwriteuphttps://blog.sari3l.com/posts/73ecd8cc/https://blog.sari3l.com/posts/73ecd8cc/DockerWed, 08 May 2019 16:15:37 GMTjavajenkinshttps://blog.sari3l.com/posts/65a5a87a/https://blog.sari3l.com/posts/65a5a87a/这个题目第一眼看着和 DDCTF 里面的 homebrew event loop题目很像(名字都很像)，为方便测试将 PoW 函数直接 returnTue, 07 May 2019 09:53:33 GMTctfwriteuphttps://blog.sari3l.com/posts/243b6098/https://blog.sari3l.com/posts/243b6098/常用模式Fri, 26 Apr 2019 16:21:45 GMThttps://blog.sari3l.com/posts/7a31e713/https://blog.sari3l.com/posts/7a31e713/LOAD DATAFri, 19 Apr 2019 10:06:03 GMTMysqlctfhttps://blog.sari3l.com/posts/8e809579/https://blog.sari3l.com/posts/8e809579/DDCTF 2019 部分 writeup，Sariel.D 的技术研究与实践笔记。Fri, 12 Apr 2019 10:41:04 GMTctfwriteuphttps://blog.sari3l.com/posts/6fdffa73/https://blog.sari3l.com/posts/6fdffa73/karaf + jolokiaSat, 30 Mar 2019 03:04:12 GMTctfwriteuphttps://blog.sari3l.com/posts/1b4ade61/https://blog.sari3l.com/posts/1b4ade61/列表Mon, 18 Mar 2019 11:17:06 GMThttps://blog.sari3l.com/posts/469de5e6/https://blog.sari3l.com/posts/469de5e6/Remote Method Invocation 是专为Java环境设计的远程方法调用机制，远程服务器实现具体的Java方法并提供接口，客户端本地仅需根据接口类的定义，提供相应的参数即可调用远程方法。RMI依赖的通信协议为JRMP(Java Remote Message Protocol ，Java 远程消息交换协议)，该协议为Java定Sun, 10 Mar 2019 06:14:15 GMThttps://blog.sari3l.com/posts/284d4995/https://blog.sari3l.com/posts/284d4995/fastjson是一个java编写的高性能功能非常完善的JSON库，应用范围非常广，在github上star数都超过8k，在2017年3月15日，fastjson官方主动爆出fastjson在1.2.24及之前版本存在远程代码执行高危安全漏洞。攻击者可以通过此漏洞远程执行恶意代码来入侵服务器。Thu, 07 Mar 2019 01:42:26 GMT漏洞分析fastjsonhttps://blog.sari3l.com/posts/fdaf04b/https://blog.sari3l.com/posts/fdaf04b/SMTP 协议是的默认端口 25，可以使用 telnet 或 nc 直接连接，推荐ncWed, 06 Mar 2019 11:54:04 GMThttps://blog.sari3l.com/posts/9b1f3ba/https://blog.sari3l.com/posts/9b1f3ba/对于固定元素，可以通过chrome自带功能快速获取Wed, 06 Feb 2019 01:28:32 GMTcodinghttps://blog.sari3l.com/posts/4ffb62e5/https://blog.sari3l.com/posts/4ffb62e5/Erlang 之父 Joe Armstrong 用一张5岁小孩都能看懂的图解释了并发与并行的区别Thu, 31 Jan 2019 13:44:56 GMTcodinghttps://blog.sari3l.com/posts/83241730/https://blog.sari3l.com/posts/83241730/为方便 hook 准备两份代码Tue, 29 Jan 2019 06:19:20 GMTFridahttps://blog.sari3l.com/posts/b11f7440/https://blog.sari3l.com/posts/b11f7440/为什么安装这个，adb wifi 连接测试机后远程操作才是王道_(:з」∠)_Fri, 25 Jan 2019 06:31:39 GMTsmalihttps://blog.sari3l.com/posts/76594cbe/https://blog.sari3l.com/posts/76594cbe/原因是Android为了对网络状态进行检测，采用了captive detection进行网络状态检测，即构造一个http请求到指定服务器，获取响应码进行网络判断。Thu, 24 Jan 2019 05:24:04 GMThttps://blog.sari3l.com/posts/5da99ec5/https://blog.sari3l.com/posts/5da99ec5/对于apk反编译有很多直接的工具可以使用，但是微信使用AndResGuard对资源文件进行混淆，导致直接使用apktool反编译后无法获取资源文件，即使使用apktool -r d保持资源文件，重打包的微信也不能直接运行，因为微信启动后会对dex文件进行校验Sat, 19 Jan 2019 06:47:19 GMTFridahttps://blog.sari3l.com/posts/d55cdeb2/https://blog.sari3l.com/posts/d55cdeb2/来自于Awesome Frida的介绍Wed, 16 Jan 2019 02:09:15 GMTFridahttps://blog.sari3l.com/posts/446263e2/https://blog.sari3l.com/posts/446263e2/weibo.comTue, 01 Jan 2019 14:31:16 GMTspiderhttps://blog.sari3l.com/posts/27a5d990/https://blog.sari3l.com/posts/27a5d990/希望新的一年一切都能慢慢好起来，给自己定个ToDoListMon, 31 Dec 2018 16:00:00 GMT随笔https://blog.sari3l.com/posts/9dafb9a3/https://blog.sari3l.com/posts/9dafb9a3/在利用方面主要根据场景不同而有所区别，以滑动验证码为例Sun, 30 Dec 2018 11:43:44 GMTOpenCVhttps://blog.sari3l.com/posts/2fefc8f7/https://blog.sari3l.com/posts/2fefc8f7/实验对象: https://v.6.cn/模式: 滑动验证码Mon, 24 Dec 2018 09:04:56 GMTCAPTCHAhttps://blog.sari3l.com/posts/f8004910/https://blog.sari3l.com/posts/f8004910/先放上request的生命周期图Fri, 21 Dec 2018 03:22:15 GMTcodingextensionChromehttps://blog.sari3l.com/posts/fedef51/https://blog.sari3l.com/posts/fedef51/先搬上先知的一段总结Wed, 19 Dec 2018 10:11:20 GMTXXEhttps://blog.sari3l.com/posts/90979812/https://blog.sari3l.com/posts/90979812/添加自定义的tab需要调用的接口是ITab，需要调用addSuiteTab注册tabFri, 14 Dec 2018 11:19:33 GMTBurp suitecodingextensionhttps://blog.sari3l.com/posts/81dfbfaf/https://blog.sari3l.com/posts/81dfbfaf/出现??即NULL合并运算符，所以是php7环境Sat, 01 Dec 2018 11:02:42 GMT代码审计PHPhttps://blog.sari3l.com/posts/4a17b156/https://blog.sari3l.com/posts/4a17b156/这么久才开始搭博客，归根还是因为菜。Fri, 23 Nov 2018 07:58:31 GMT随笔https://blog.sari3l.com/posts/970fcb23/https://blog.sari3l.com/posts/970fcb23/其它的 Ognl 的表达式可以参考 Ognl 的语言手册。Thu, 08 Nov 2018 06:54:55 GMThttps://blog.sari3l.com/posts/d34dbe44/https://blog.sari3l.com/posts/d34dbe44/影响版本Tue, 06 Nov 2018 02:28:55 GMTjavastrutshttps://blog.sari3l.com/posts/626780ce/https://blog.sari3l.com/posts/626780ce/影响版本Fri, 02 Nov 2018 02:50:55 GMTjavastrutshttps://blog.sari3l.com/posts/617314e9/https://blog.sari3l.com/posts/617314e9/S2-033 影响版本Wed, 31 Oct 2018 06:15:55 GMTjavastrutshttps://blog.sari3l.com/posts/9cab2514/https://blog.sari3l.com/posts/9cab2514/影响版本：Fri, 26 Oct 2018 07:40:55 GMTjavastrutshttps://blog.sari3l.com/posts/e0ca00cf/https://blog.sari3l.com/posts/e0ca00cf/影响版本：Wed, 17 Oct 2018 08:28:55 GMTjavastrutshttps://blog.sari3l.com/posts/2b51554f/https://blog.sari3l.com/posts/2b51554f/影响版本：Thu, 11 Oct 2018 04:13:55 GMTjavastrutshttps://blog.sari3l.com/posts/dd92b54a/https://blog.sari3l.com/posts/dd92b54a/影响版本：Tue, 09 Oct 2018 09:36:55 GMTjavastrutshttps://blog.sari3l.com/posts/c43e3a51/https://blog.sari3l.com/posts/c43e3a51/这里需要注意两点Mon, 08 Oct 2018 09:17:55 GMTjavastruts