Popular

"I tried creating a bulletin board app that can use HTML tags!" What if a work by a beginner engineer would be "taken over" with just one line post? This time, we will be using an example of "Cross-site Scripting (XSS)," which is the basics of security, to see how vulnerable they are...

This time, we will enumerate shared Samba, manipulate vulnerable versions of proftpd, and escalate privileges by manipulating path variables. "TryHackMe-Kenobi: https://tryhackme.com/room/kenobi" Please note that the explanation is a spoiler. Preparation First, start with "Start Machine...

It wasn't a very good result, but I participated in the SECCON Beginners CTF 2024, so I'll leave a Writeup as a memo. ssrforlfi source check The folder structure after unzipping tar.gz is as follows. $ find ./ ./ ./docker-compose.yml ./.env ./app...

I was thinking of creating an AR app with WebXR, but the current situation is that iOS does not officially support WebXR. So, I used Variant Launch, which was also featured in the official React Three XR, to support WebXR AR on iOS as well. Does it work on iOS?WebXR fo...

"I want to create a more professional service, but I don't think I can write code..." For non-engineers who want to get serious about vibe coding, Lovable is the perfect development platform for the next step. Recently, there's been a lot of talk about AI-generated landing pages and UIs...

Template engines are widely used in web applications to combine HTML and data to generate displays. For example, template engines are used on the backend to embed usernames, post contents, and other information into HTML. However,...

This time, we will try "Elevation of privileges by misusing backups of history files, config files, and important files." The target machine uses the Room below of TryHackMe. "TryHackMe-Linux PrivEsc: https://tryhackme.com/room/linuxprivesc" here...

We live in an age where AI is acting as a proxy for human decision-making. What would happen if we could "trick" that AI just a little? This time, we took on the challenge of a CTF to break through international travel screening using AI. We used prompt injection, a technique that exploits a weakness in large-scale language models (LLMs).

The evolution of AI has already gone beyond simply conversing with humans. Recent large-scale language models (LLMs) can call external functions and APIs in response to user requests, running actual systems and services. OpenAI's Function Calling feature...

We are now in an era where AI is no longer just a "conversational partner" but can also be a tool for attackers. In recent years, even in the world of ransomware, AI negotiation bots have appeared that automate interactions with victims, streamlining ransom payments. However, the authority and information that this AI possesses...