2025
- WorstFit: Unveiling Hidden Transformers in Windows ANSI!
2024
- Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
- CVE-2024-4577 - Yet Another PHP RCE: Make PHP-CGI Argument Injection Great Again!
2023
- 從 2013 到 2023: Web Security 十年之進化與趨勢!
2022
- A New Attack Surface on MS Exchange Part 4 - ProxyRelay!
- Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!
2021
- A New Attack Surface on MS Exchange Part 3 - ProxyShell!
- A New Attack Surface on MS Exchange Part 2 - ProxyOracle!
- A New Attack Surface on MS Exchange Part 1 - ProxyLogon!
- A Journey Combining Web Hacking and Binary Exploitation in Real World!
2020
- How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM
2019
- 你用它上網，我用它進你內網! 中華電信數據機遠端代碼執行漏洞
- An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)
- Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study!
- Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN
- Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study!
- A Wormable XSS on HackMD!
- Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!
- Hacking Jenkins Part 1 - Play with Dynamic Routing
2018
- HITCON CTF 2018 - One Line PHP Challenge
- How I Chained 4 Bugs (Features?) into RCE on Amazon Collaboration System
- Google CTF 2018 Quals Web Challenge - gCalc
- Pwn a CTF Platform with Java JRMP Gadget
- PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF
2017
- How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
- GitHub Enterprise SQL Injection
2016
- [隨筆] Java Web 漏洞生態食物鏈
- Collection of CTF Web Challenges I made
- HITCON 2016 投影片 - Bug Bounty 獎金獵人甘苦談 那些年我回報過的漏洞
- How I Hacked Facebook, and Found Someone's Backdoor Script
- Uber 遠端代碼執行- Uber.com Remote Code Execution via Flask Jinja2 Template Injection
- HITCON CTF 2015 Quals & Final 心得備份
2015
- Google & Facebook Bug Bounty GET
- AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection)
- Remote Code Execution through GDB Remote Debugging Protocol
- HITCON 2015 Community 演講投影片 - 那些 Web Hacking 中的奇技淫巧
- 2015 烏雲峰會演講投影片 「關於 HITCON CTF 的那些事 之 Web 狗如何在險惡的 CTF 世界中存活？」
- 講個秘訣 - 0ctf Final 0cms
- Web 狗沒人權 TAT?
- Boston Key Party CTF 2015 [Harvard Square] [Andrew & Broadway] Write-ups