Wisdom War 2025: A Complete Review of the Tencent Cloud AI Penetration Competition
Actual review based on the 2025 “1129” AI Penetration Competition author: cdxiaodong date: 2025/11/29 Competition name:Tencent Yunding AI Pe...
Aug 12, 2026
![First Post](data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="gFirst" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="%238b5cf6" /><stop offset="100%" stop-color="%23ec4899" /></linearGradient><filter id="fFirst"><feDropShadow dx="0" dy="2" stdDeviation="3" flood-opacity="0.3"/></filter></defs><circle cx="50" cy="50" r="45" fill="url(%23gFirst)" filter="url(%23fFirst)"/><circle cx="50" cy="50" r="38" fill="none" stroke="rgba(255,255,255,0.4)" stroke-width="2"/><path d="M60 30 C 50 30, 40 40, 35 55 L 30 70 L 45 65 C 60 60, 70 50, 70 40 C 70 35, 65 30, 60 30 Z" fill="%23ffffff" opacity="0.9"/><path d="M35 55 L 45 65" stroke="%23ec4899" stroke-width="2"/><circle cx="65" cy="25" r="3" fill="%23fef08a"/><path d="M65 15 L65 20 M65 30 L65 35 M55 25 L60 25 M70 25 L75 25" stroke="%23fef08a" stroke-width="2" stroke-linecap="round"/></svg>)
![Word Warrior](data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="gWord" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="%23b91c1c" /><stop offset="100%" stop-color="%23f87171" /></linearGradient><filter id="fWord"><feDropShadow dx="0" dy="2" stdDeviation="3" flood-opacity="0.3"/></filter></defs><circle cx="50" cy="50" r="45" fill="url(%23gWord)" filter="url(%23fWord)"/><circle cx="50" cy="50" r="38" fill="none" stroke="rgba(255,255,255,0.4)" stroke-width="2"/><path d="M25 60 L75 60 L70 75 L30 75 Z" fill="%23ffffff" opacity="0.9"/><path d="M50 20 L55 30 L55 70 L45 70 L45 30 Z" fill="%23ffffff" filter="url(%23fWord)"/><rect x="35" y="65" width="30" height="5" fill="%23b91c1c"/><rect x="45" y="70" width="10" height="15" fill="%237f1d1d"/></svg>)
31 min
Subscribe to I0veD's Newsletter
Get new articles and engineering posts delivered to your inbox.
Claude Code v2.1.71: Complete Architecture Analysis Report
The reason is that we need to use claude-sdk to do some agent business development. , so it needs to be analyzed, but I am very troubled by ...
Aug 12, 2026
22 min
Breaking Through the Defense: From Conventional RASP Bypass to Dynamic ASM Hook Removal
📝RASP Confrontation RASP attack and defense practice introduce: Runtime Application Self-Protection (RASP) is a technology that secures app...
Aug 12, 2026
3 min
Kubernetes Goat
Kubernetes Goat I only wrote some things that I have not encountered in my article. I will not mention those that I have encountered. 1Code ...
Aug 12, 2026
2 min
CVE-2024-21626
environment:runc <=1.1.11 Attack details: In affected versions of runc, some internal file descriptors are leaked during initialization, inc...
Aug 12, 2026
2 min
A New Direction for BAS Security Validation from a Cloud-Native Attack and Defense Perspective
First published on the company’s official account:https://mp.weixin.qq.com/s/gKXoms9DTkdT73u7UkgW-Q Preface This article will deeply explore...
Aug 12, 2026
31 min
50 Types of Terminal Process Injection: Principles and Source Code
introduction: I am engaged in collecting various process injection principles and source codes. Collect these personal learning needs and au...
Aug 12, 2026
3 min
Best Practices for AI-Assisted PPT Reports and Presentations
Directory structure: 1. Marker sketch on whiteboard prompt： 一个手绘涂鸦风格的复杂技术信息图，看起来像用彩色马克笔在白板上的草图。整个图表在白色背景上有着抖动的黑色轮廓线和扁平的纹理颜色。 布局是一个详细的流程图，分为几...
Aug 12, 2026
3 min
From Gray-Market Data to the Data Supply Chain: Four Rounds of Tracing Codex 5.3 Contamination
—-codex5.3 pollution source map From "Exception Words" to "Data Supply Chain": My fourth round of tracing the Codex 5.3 contamination proble...
Aug 12, 2026
9 min
Quick MSSQL Penetration
First entry summary: (for later testing) Low permissions Service permissions No write or upload permissions on the user directory 1.whoami的s...
Aug 12, 2026
8 min
Transferring Data Between Computers Using Audio on Windows 11
LINK： ‣ send: #include <stdio.h> #include <windows.h> #include <math.h> #pragma comment(lib, "winmm.lib") #define AUDIO_BITS_PER_SAMPLE 16 #...
Aug 12, 2026
5 min
Creating Sunburst Charts with AI, Plotly, Python, Notion, or Feishu
To create and share charts through Plotly's Chart Studio (web version), you can follow these steps: 1. Log in or register for Plotly Chart S...
Aug 12, 2026
2 min
Network Isolation in Kubernetes Security
Implementing network isolation in Kubernetes mainly involves using NetworkPolicy resources to manage the inbound and outbound traffic of Pod...
Aug 12, 2026
9 min
Applications and Comparison of Deep Learning Methods for Data Feature Extraction
APPLICATION AND COMPARISON OF DIFFERENT DEPTH LEARNING METHODS IN DATA FEATURE EXTRACTION ABSTRACT With the rapid development of single-cell...
Aug 12, 2026
21 min
Container Security: Hiding a Backdoor in an SSH .so File
1. The host temporarily shuts down selinux. setenforce 0 The following operations are performed in the container 2.touch /etc/pam.d/sshd awk...
Aug 12, 2026
2 min
TerraformGoat Training
Alibaba Cloud Interesting content can be added Alibaba Cloud OSS Bucket HTTP transmission startup scenario: provider "alicloud" { profile = ...
Aug 12, 2026
6 min
Container Security: Multiple Kubernetes Misconfigurations in YAML
[Container Security] Abuse of CAP_DAC_READ_SEARCH leads to container escape docker:{"cap_add":["DAC_READ_SEARCH"],"command":"sleep 9999"} k8...
Aug 12, 2026
3 min
Changing Java Class Names at Runtime with Javassist
Jhook: package com.binklac.jhook; import java.lang.instrument.Instrumentation; import java.lang.instrument.UnmodifiableClassException; impor...
Aug 12, 2026
2 min
How I Found Vulnerabilities in 17 Closed-Source Java Systems Over Six Months
Some source code collection ideas hunter搜索语句: web.title=="Everything"&&icpname =“xxxweb.title=="Index of /" web.title=="Directory List l web...
Aug 12, 2026
25 min
AWS S3 Enumeration Basics
The address is:http://dev.huge-logistics.com Check the source code and find the hosted static website built by aws s3 ‣ Direct access to thi...
Aug 12, 2026
2 min
Identifying an AWS Account ID from a Public S3 Bucket
Identify the AWS Account ID from a Public S3 Bucket b Get account ID using S3 entrypoint: IP address: 54.204.171.32 Access Key ID: AKIAWHEOT...
Aug 12, 2026
3 min
Building AI API-Powered Office Automation Bots
Directly upload the code (supports all APIs of the openai package. It is recommended to use deepseek, which is cheap and easy to use) Analyz...
Aug 12, 2026
3 min
AWS PwnLab: Summary of Remaining Techniques
Loot an exposed RDS instance: Scan portp3306,5432,1433,1521 blasting Hijack public RDS snapshots: Discover public snapshots： Using AWS CLI c...
Aug 12, 2026
2 min
AWS: Leveraging Insecure Storage and Backups for Profit
background: Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe H...
Aug 12, 2026
3 min
Cloud Security: Four Backdoor Injection Methods in Kubernetes Containers
Recently, when I was in a cloud security group, I saw some learners newly learning about the "new technology" of k8s-sidecar injection. In f...
Aug 12, 2026
4 min
Revealing Hidden Files in Google Cloud Storage
background: Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into...
Aug 12, 2026
2 min
Exploiting SSRF with Gopher for GCP Initial Access
Gave an IPV4:35.226.245.121 Direct access is a web site CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-reta...
Aug 12, 2026
4 min
Azure Blob Container to Initial Access
Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage web：http://dev.megabigtech.com/$web/...
Aug 12, 2026
4 min
Cloudflare R2 Bucket Detection (Cooked Meat)
original:Hacking a Misconfigured Cloudflare R2 Bucket: A Complete Guide (intigriti.com) There are several ways to find or identify a Cloudfl...
Aug 12, 2026
2 min
2024 Year-End Summary
people This year’s network security is still not optimistic. Fortunately, this period of our history is in the Kang wave cycle stage. Some p...
Aug 12, 2026
5 min
Nine Secret Techniques for Escaping the chroot Jail: Principles and Practical Code
Principles and practical analysis of nine fatal vulnerabilities that penetrate chroot isolation 1. Essential flaws of the chroot isolation m...
Aug 12, 2026
3 min
WIZ-2025 Competition - Phase 1 (June)
Study address:The Ultimate Cloud Security Championship introduce WIZ is a company that everyone is familiar with. It is a cloud native secur...
Aug 12, 2026
5 min
Persistent Attack and Defense Monitoring and Protection with Kubernetes Probes
Use Kubernetes probes for persistent attack and defense observation and protection 1. Introduction As the de facto standard for modern conta...
Aug 12, 2026
11 min
WIZ-2025 Competition - Phase 2 (Contain Me If You Can)
Intranet penetration When you see that it is a bash terminal and it prompts for a container, you can quickly scan it with the scanning and d...
Aug 12, 2026
7 min
WIZ-2025 Competition - Phase 3 (Breaking The Barriers)
Breaking The Barriers PS: After getting the env information, you can put it on the terminal of your own host and execute it. The wiz platfor...
Aug 12, 2026
6 min
In-depth analysis of uevent_helper container escape vector
In-depth analysisuevent_helperContainer escape vector Introduction: Recently, I encountered uevent_helper escape when doing WIZ-CTF question...
Aug 12, 2026
8 min
The principle and utilization of RCS SMS protocol phishing
introduction With the evolution of mobile communication technology, Rich Communication Services (RCS), as an upgraded version of SMS (Short ...
Aug 12, 2026
4 min
Floating point calculations in AI Agent lead to inconsistent results: causes, impacts and optimization strategies
Produce scenes and phenomena The inconsistency in floating-point calculations stems from the approximate representation of floating-point nu...
Aug 12, 2026
5 min
AWS: Exploiting Weak Bucket Policies for Privileged Access
Exploit Weak Bucket Policies for Privileged Access Exploiting risky bucket policies to gain privileged access The question means that there ...
Aug 12, 2026
3 min
AWS SQS and Lambda SQL Injection
background: In serverless architectures, it is common to use AWS Lambda with SQS to process messages, which can create dangerous situations ...
Aug 12, 2026
8 min
2025 Summary
My top ten article recommendations in 2025: 1.How a hacker gang used a Raspberry Pi to hack into bank ATM systems and withdraw money for yea...
Aug 12, 2026
6 min
The trust dilemma of tool invocation: How AI programming agents become “blind followers”
请注意，这是一个具有极高风险的通用漏洞，可能被用于钓鱼攻击或作为隐蔽的C2服务。请勿将其用于未经授权的攻击行为。但由于该问题只涉及用户信任边界，部分Agent厂商已更新了相应的用户手则。 0x00 前言 现代 AI 智能体（包括Claude Code、Codex CLI 、Gem...
Aug 12, 2026
12 min
OpenClaw 17 vulnerability attack surfaces, only one fixed at the time of publishing this article
挖了一些openclaw的漏洞 有一些是官方不同意收录的，什么沙箱逃逸、组件型ssrf bypass等等，然后我后面发现官方后面又直接修复了，还好我有在用ai实时监控，为了防止再被捡漏 所以在此公开，并已提交相关pr修复(当然2026/3/15之修复了一个)。 漏洞统计概览 严重...
Aug 12, 2026
10 min