![First Post](data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="gFirst" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="%238b5cf6" /><stop offset="100%" stop-color="%23ec4899" /></linearGradient><filter id="fFirst"><feDropShadow dx="0" dy="2" stdDeviation="3" flood-opacity="0.3"/></filter></defs><circle cx="50" cy="50" r="45" fill="url(%23gFirst)" filter="url(%23fFirst)"/><circle cx="50" cy="50" r="38" fill="none" stroke="rgba(255,255,255,0.4)" stroke-width="2"/><path d="M60 30 C 50 30, 40 40, 35 55 L 30 70 L 45 65 C 60 60, 70 50, 70 40 C 70 35, 65 30, 60 30 Z" fill="%23ffffff" opacity="0.9"/><path d="M35 55 L 45 65" stroke="%23ec4899" stroke-width="2"/><circle cx="65" cy="25" r="3" fill="%23fef08a"/><path d="M65 15 L65 20 M65 30 L65 35 M55 25 L60 25 M70 25 L75 25" stroke="%23fef08a" stroke-width="2" stroke-linecap="round"/></svg>)
![Word Warrior](data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="gWord" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="%23b91c1c" /><stop offset="100%" stop-color="%23f87171" /></linearGradient><filter id="fWord"><feDropShadow dx="0" dy="2" stdDeviation="3" flood-opacity="0.3"/></filter></defs><circle cx="50" cy="50" r="45" fill="url(%23gWord)" filter="url(%23fWord)"/><circle cx="50" cy="50" r="38" fill="none" stroke="rgba(255,255,255,0.4)" stroke-width="2"/><path d="M25 60 L75 60 L70 75 L30 75 Z" fill="%23ffffff" opacity="0.9"/><path d="M50 20 L55 30 L55 70 L45 70 L45 30 Z" fill="%23ffffff" filter="url(%23fWord)"/><rect x="35" y="65" width="30" height="5" fill="%23b91c1c"/><rect x="45" y="70" width="10" height="15" fill="%237f1d1d"/></svg>)
![Author (Silver)](data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="gAuthsilver" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="%2364748b" /><stop offset="100%" stop-color="%23cbd5e1" /></linearGradient><filter id="fAuthsilver"><feDropShadow dx="0" dy="2" stdDeviation="3" flood-opacity="0.4"/></filter></defs><circle cx="50" cy="50" r="45" fill="url(%23gAuthsilver)" filter="url(%23fAuthsilver)"/><circle cx="50" cy="50" r="38" fill="none" stroke="%23334155" stroke-width="2" opacity="0.3"/><rect x="35" y="30" width="30" height="40" rx="2" fill="%23ffffff" opacity="0.8" transform="rotate(-10 50 50)"/><rect x="35" y="30" width="30" height="40" rx="2" fill="%23ffffff" filter="url(%23fAuthsilver)"/><line x1="42" y1="42" x2="58" y2="42" stroke="%2364748b" stroke-width="3" stroke-linecap="round"/><line x1="42" y1="50" x2="58" y2="50" stroke="%2364748b" stroke-width="3" stroke-linecap="round"/><line x1="42" y1="58" x2="52" y2="58" stroke="%2364748b" stroke-width="3" stroke-linecap="round"/></svg>)
@i0ved
Cloud Native & AI Sec Researcher Red Team | BAS | K8s | Evasion 20+ CVEs | CNVD/CNNVD Contributor 🛡️ AI-Driven Blue Team 👇 Works
📝RASP Confrontation RASP attack and defense practice introduce: Runtime Application Self-Protection (RASP) is a technology that secures applications ...
environment:runc <=1.1.11 Attack details: In affected versions of runc, some internal file descriptors are leaked during initialization, including ...
First published on the company’s official account:https://mp.weixin.qq.com/s/gKXoms9DTkdT73u7UkgW-Q Preface This article will deeply explore cloud sec...
I dug some openclaw vulnerabilities, some of which the official did not agree to include, such as sandbox escape, component-type ssrf bypass, etc., an...
Actual review based on the 2025 “1129” AI Penetration Competition author: cdxiaodong date: 2025/11/29 Competition name:Tencent Yunding AI Penetration ...
The reason is that we need to use claude-sdk to do some agent business development. , so it needs to be analyzed, but I am very troubled by their clos...
📝RASP Confrontation RASP attack and defense practice introduce: Runtime Application Self-Protection (RASP) is a technology that secures applications ...
Kubernetes Goat I only wrote some things that I have not encountered in my article. I will not mention those that I have encountered. 1Code base sensi...
environment:runc <=1.1.11 Attack details: In affected versions of runc, some internal file descriptors are leaked during initialization, including ...
First published on the company’s official account:https://mp.weixin.qq.com/s/gKXoms9DTkdT73u7UkgW-Q Preface This article will deeply explore cloud sec...
introduction: I am engaged in collecting various process injection principles and source codes. Collect these personal learning needs and automation n...
Directory structure: 1. Marker sketch on whiteboard prompt： 一个手绘涂鸦风格的复杂技术信息图，看起来像用彩色马克笔在白板上的草图。整个图表在白色背景上有着抖动的黑色轮廓线和扁平的纹理颜色。 布局是一个详细的流程图，分为几个带有虚线边框和标题...
—-codex5.3 pollution source map From "Exception Words" to "Data Supply Chain": My fourth round of tracing the Codex 5.3 contamination problem Ps: This...
Run Ebpf-Pe In docker docker run --cap-add SYS_ADMIN --cap-add NET_ADMIN --network=host -v /usr/lib/x86_64-linux-gnu/libelf.so.1:/usr/lib/x86_64-linux...
First entry summary: (for later testing) Low permissions Service permissions No write or upload permissions on the user directory 1.whoami的sqlserver是服...
LINK： ‣ send: #include <stdio.h> #include <windows.h> #include <math.h> #pragma comment(lib, "winmm.lib") #define AUDIO_BITS_PER_SAM...
To create and share charts through Plotly's Chart Studio (web version), you can follow these steps: 1. Log in or register for Plotly Chart Studio Open...
Allow self attachment (Attach Self): In Java 9 and later versions, processes are not allowed to attach themselves by default, and the code bypasses th...
Implementing network isolation in Kubernetes mainly involves using NetworkPolicy resources to manage the inbound and outbound traffic of Pods. This st...
APPLICATION AND COMPARISON OF DIFFERENT DEPTH LEARNING METHODS IN DATA FEATURE EXTRACTION ABSTRACT With the rapid development of single-cell sequencin...
Link:Cloud security risks from Party A’s perspective (cdxiaodong.life)
The article was accidentally deleted and I don’t want to restore it by becoming a member.
1. The host temporarily shuts down selinux. setenforce 0 The following operations are performed in the container 2.touch /etc/pam.d/sshd awk 'BEGIN { ...
Alibaba Cloud Interesting content can be added Alibaba Cloud OSS Bucket HTTP transmission startup scenario: provider "alicloud" { profile = "default" ...
[Container Security] Abuse of CAP_DAC_READ_SEARCH leads to container escape docker:{"cap_add":["DAC_READ_SEARCH"],"command":"sleep 9999"} k8s: apiVers...
Jhook: package com.binklac.jhook; import java.lang.instrument.Instrumentation; import java.lang.instrument.UnmodifiableClassException; import java.lan...
Link:CD's favorite Files (cdxiaodong.life)
Some source code collection ideas hunter搜索语句: web.title=="Everything"&&icpname =“xxxweb.title=="Index of /" web.title=="Directory List l web.t...
The address is:http://dev.huge-logistics.com Check the source code and find the hosted static website built by aws s3 ‣ Direct access to this site pro...
Identify the AWS Account ID from a Public S3 Bucket b Get account ID using S3 entrypoint: IP address: 54.204.171.32 Access Key ID: AKIAWHEOTHRFW4CEP7H...
Directly upload the code (supports all APIs of the openai package. It is recommended to use deepseek, which is cheap and easy to use) Analyze multiple...
Question to know the project‣There is a leak of .env file, which contains aksk and database keys. With this information: We can have a way 1.aws sts g...
Loot an exposed RDS instance: Scan portp3306,5432,1433,1521 blasting Hijack public RDS snapshots: Discover public snapshots： Using AWS CLI commandsaws...
background: Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe Huge Logist...
Recently, when I was in a cloud security group, I saw some learners newly learning about the "new technology" of k8s-sidecar injection. In fact, this ...
background: Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into public st...
Gave an IPV4:35.226.245.121 Direct access is a web site CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-retail/shop/im...
Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage web：http://dev.megabigtech.com/$web/index.html...
original:Hacking a Misconfigured Cloudflare R2 Bucket: A Complete Guide (intigriti.com) There are several ways to find or identify a Cloudflare R2 buc...
Recently, many Docker API unauthorized exploitation tools have become popular on Github, with an average of more than 200 stars. Thinking about why it...
people This year’s network security is still not optimistic. Fortunately, this period of our history is in the Kang wave cycle stage. Some people pred...
Principles and practical analysis of nine fatal vulnerabilities that penetrate chroot isolation 1. Essential flaws of the chroot isolation mechanism T...
Study address:The Ultimate Cloud Security Championship introduce WIZ is a company that everyone is familiar with. It is a cloud native security giant ...
Use Kubernetes probes for persistent attack and defense observation and protection 1. Introduction As the de facto standard for modern container orche...
Intranet penetration When you see that it is a bash terminal and it prompts for a container, you can quickly scan it with the scanning and detection t...
Breaking The Barriers PS: After getting the env information, you can put it on the terminal of your own host and execute it. The wiz platform network ...
In-depth analysisuevent_helperContainer escape vector Introduction: Recently, I encountered uevent_helper escape when doing WIZ-CTF questions, but I h...
introduction With the evolution of mobile communication technology, Rich Communication Services (RCS), as an upgraded version of SMS (Short Message Se...
Produce scenes and phenomena The inconsistency in floating-point calculations stems from the approximate representation of floating-point numbers unde...
Exploit Weak Bucket Policies for Privileged Access Exploiting risky bucket policies to gain privileged access The question means that there is a vulne...
background: In serverless architectures, it is common to use AWS Lambda with SQS to process messages, which can create dangerous situations if these u...
My top ten article recommendations in 2025: 1.How a hacker gang used a Raspberry Pi to hack into bank ATM systems and withdraw money for yearshttps://...
请注意，这是一个具有极高风险的通用漏洞，可能被用于钓鱼攻击或作为隐蔽的C2服务。请勿将其用于未经授权的攻击行为。但由于该问题只涉及用户信任边界，部分Agent厂商已更新了相应的用户手则。 0x00 前言 现代 AI 智能体（包括Claude Code、Codex CLI 、Gemini CLI、Op...
挖了一些openclaw的漏洞 有一些是官方不同意收录的，什么沙箱逃逸、组件型ssrf bypass等等，然后我后面发现官方后面又直接修复了，还好我有在用ai实时监控，为了防止再被捡漏 所以在此公开，并已提交相关pr修复(当然2026/3/15之修复了一个)。 漏洞统计概览 严重级别 数量 Crit...