-
Orange Tsai
https://blog.orange.tw/ -
Assetnote Research Notes
https://www.assetnote.io/resources/research
-
Supported Protocols and Wrappers
https://www.php.net/manual/en/wrappers.php -
How an obscure PHP footgun led to RCE in Craft CMS
https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms -
HITCON CTF 2018 - One Line PHP Challenge
https://blog.orange.tw/posts/2018-10-hitcon-ctf-2018-one-line-php-challenge/
- A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
https://www.youtube.com/watch?v=R9pJ2YCXoJQ
- Abusing HTTP hop-by-hop request headers
https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers
- Inline Style Exfiltration: leaking data with chained CSS conditionals
https://portswigger.net/research/inline-style-exfiltration
- My-CTF-Web-Challenges
https://github.com/orangetw/My-CTF-Web-Challenges