Web Security
WAF Evasion 101: How Attackers Bypass “Security Gates”
Attackers reshape the same malicious payload just enough that the WAF no longer recognizes it, while the backend still executes it exactly as intended. This post walks through the real evasion playbook (encoding tricks, token splitting, noise injection, and reinforcement-learning-driven automated probing) and shows why the problem is structural, not a matter of sloppy engineering.
Augmenting SR-BH 2020: A Technical Methodology for Modern Threat Simulation
A comprehensive enhancement of the SR-BH 2020 dataset for WAF training, combining LLM-assisted labeling, diverse benign traffic, and targeted attack injection to improve training data quality.
CyCTF 2023 Challenge: A Whitebox Walkthrough of "The Secret App v1.0"
A whitebox walkthrough of the CyCTF 2023 'Secret App v1.0' challenge — chaining second-order blind SQL injection, a CAPTCHA logic flaw, and insecure session handling into a full admin account takeover.