https://seclab.cyshield.com/Recent content on Cyshield SeclabHugo -- gohugo.ioen© 2026 Cyshield.Mon, 27 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/waf-evasion-101-how-attackers-bypass-security-gates/Mon, 27 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/waf-evasion-101-how-attackers-bypass-security-gates/Attackers reshape the same malicious payload just enough that the WAF no longer recognizes it, while the backend still executes it exactly as intended. This post walks through the real evasion playbook (encoding tricks, token splitting, noise injection, and reinforcement-learning-driven automated probing) and shows why the problem is structural, not a matter of sloppy engineering.https://seclab.cyshield.com/posts/why-high-accuracy-can-still-mean-bad-security/Sun, 12 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/why-high-accuracy-can-still-mean-bad-security/High accuracy in security does not guarantee real-world protection. Through the WAMM research study, this post examines what accuracy metrics hide, how false positives and false negatives manifest in production environments, and what a security-grade evaluation framework should actually measure.https://seclab.cyshield.com/posts/augmenting-sr-bh-2020-a-technical-methodology-for-modern-threat-simulation/Wed, 08 Jul 2026 00:00:00 +0000https://seclab.cyshield.com/posts/augmenting-sr-bh-2020-a-technical-methodology-for-modern-threat-simulation/A comprehensive enhancement of the SR-BH 2020 dataset for WAF training, combining LLM-assisted labeling, diverse benign traffic, and targeted attack injection to improve training data quality.https://seclab.cyshield.com/posts/ran-attacks/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/ran-attacks/Part 2 of the RAN Security series. This post explores different attack surfaces, attack vectors, and attack scenarios across the RAN, explaining categories of threats and attacker TTPs supported by attack flow illustrations.https://seclab.cyshield.com/posts/can-ai-detect-web-attacks-better-than-rules/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/can-ai-detect-web-attacks-better-than-rules/The real challenge is not choosing rules or AI, but designing detection systems that can operate under uncertainty and adversarial pressure. This article examines web attack detection and WAF evasion through scientific research and real-world observations.https://seclab.cyshield.com/posts/cyctf-2023-secret-app-walkthrough/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/cyctf-2023-secret-app-walkthrough/A whitebox walkthrough of the CyCTF 2023 ‘Secret App v1.0’ challenge — chaining second-order blind SQL injection, a CAPTCHA logic flaw, and insecure session handling into a full admin account takeover.https://seclab.cyshield.com/posts/ran-introduction-and-criticality/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/ran-introduction-and-criticality/Part 1 of the RAN Security series. When people talk about mobile network security, the conversation almost always gravitates toward the core network. However, there is another part of the network that quietly sits in public spaces, exposed by design: the Radio Access Network (RAN).https://seclab.cyshield.com/posts/solarview-compact-rce-walkthrough/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/solarview-compact-rce-walkthrough/In this post, we demonstrate how we achieved Remote Code Execution (RCE) on a web server connected to a solar system monitoring firmware: SolarView Compact. This walkthrough covers four key stages: Firmware Extraction, Reconnaissance, Code Review, and Exploitation.https://seclab.cyshield.com/posts/sbom-practical-guide/Tue, 16 Jun 2026 00:00:00 +0000https://seclab.cyshield.com/posts/sbom-practical-guide/Software is built like a layer cake full of libraries, packages, and hidden dependencies. But when a security crisis hits, do you really know what’s inside your code? This is where a Software Bill of Materials (SBOM) becomes essential.https://seclab.cyshield.com/advisories/cve-2025-15517/Mon, 23 Mar 2026 00:00:00 +0000https://seclab.cyshield.com/advisories/cve-2025-15517/A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.https://seclab.cyshield.com/advisories/cve-2025-15605/Mon, 23 Mar 2026 00:00:00 +0000https://seclab.cyshield.com/advisories/cve-2025-15605/A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.https://seclab.cyshield.com/advisories/cve-2025-15518/Mon, 23 Mar 2026 00:00:00 +0000https://seclab.cyshield.com/advisories/cve-2025-15518/Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.https://seclab.cyshield.com/advisories/cve-2025-15519/Mon, 23 Mar 2026 00:00:00 +0000https://seclab.cyshield.com/advisories/cve-2025-15519/Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.