h4fan security

h4fan security

blog about security, tech

count

h4fan • 2025

Learning XXE with gosecure

Gosecure的XXE环境学习记录

Posted on December 27, 2020

LAB 1: Basic XXE ./gradlew build 没有反应，修改版本 21_rssviewer_xxe/gradle/wrapper/gradle-wrapper.properties distributionUrl=https\://services.gradle.org/distributions/gradle-4.8.1-all.zip 重新build即可。 [Read More]
Tags:
- xxe
- websec
Learning SSTI with gosecure

Gosecure的SSTI环境学习记录

Posted on December 25, 2020

环境地址 gosecure 的ssti教程地址template-injection-workshop [Read More]
Tags:
- ssti
- websec
Intigriti XSS Challenge-2020 Writeup

Posted on December 15, 2020

Intigriti’s December XSS Challenge https://challenge-1220.intigriti.io/ [Read More]
Tags:
- xss
An unsuccessful expressjs SSTI story

Posted on December 14, 2020

Recon Response Header x-powered-by: express. An expressjs website. [Read More]
Tags:
- ssti
- expressjs
alert 1337 - jquery prototype pollution

Posted on November 5, 2020

challenge here https://msrkp.github.io/ [Read More]
Tags:
- xss
- prototype pollution