Hacking – category –

With xServer VPS, you can quickly set up a GUI environment by simply selecting the Ubuntu desktop (LXDE) as your operating system. However, LXDE is a somewhat outdated desktop environment, so this time we will replace it with its successor, LXQt. Migrating to LXQt is as simple as switching the desktop environment...

When trying to use Kali Linux on a VPS, it's surprisingly common to find that Kali isn't an option. It's not uncommon for Japanese VPSs, in particular, to not even have Kali available in their OS templates. So, a realistic option is to install Ubuntu and then...

Web applications are often deemed "secure" simply by implementing mechanisms such as authentication and tokens. However, in reality, there are many cases where a simple error in the authorization design, which determines which users' data can be accessed, can lead directly to account takeover.

"Vibe coding," a modern development style that focuses on quickly building apps with a focus on getting them working, is gaining popularity. BaaS services like Supabase and Firebase, in particular, allow you to complete authentication and database operations with just a few lines of code, making them ideal for rapid prototyping and UI improvement.

We are now in an era where AI not only "learns and makes decisions," but also the models that make those decisions are themselves targets of attack. In particular, the weights and biases of machine learning models are central to determining their output, and tampering with these can intentionally distort prediction results. Such models...

We are now in an era where AI is no longer just a "conversational partner" but can also be a tool for attackers. In recent years, even in the world of ransomware, AI negotiation bots have appeared that automate interactions with victims, streamlining ransom payments. However, the authority and information that this AI possesses...

The evolution of AI has already gone beyond simply conversing with humans. Recent large-scale language models (LLMs) can call external functions and APIs in response to user requests, running actual systems and services. OpenAI's Function Calling feature...

We live in an age where AI is acting as a proxy for human decision-making. What would happen if we could "trick" that AI just a little? This time, we took on the challenge of a CTF to break through international travel screening using AI. We used prompt injection, a technique that exploits a weakness in large-scale language models (LLMs).

Template engines are widely used in web applications to combine HTML and data to generate displays. For example, template engines are used on the backend to embed usernames, post contents, and other information into HTML. However,...

Many people who are aspiring to become security engineers and want to improve their skills through CTFs may have become interested in Hack the Box (HTB) with this in mind. However, when you actually look at the official website, you'll see a wide variety of services (Labs, Academy, CTF, Business, etc.) lined up...