OpenBMC security, vulnerability research, binary exploitation, and CTF writeups.https://suzu.tw/zh-TWhttps://suzu.tw/posts/2026-09-13-%E8%A8%88%E7%AE%97%E6%A9%9F%E7%B5%90%E6%A7%8B_%E7%AD%86%E8%A8%98week1_isa_%E6%8C%87%E4%BB%A4%E9%9B%86%E6%9E%B6%E6%A7%8B/https://suzu.tw/posts/2026-09-13-%E8%A8%88%E7%AE%97%E6%A9%9F%E7%B5%90%E6%A7%8B_%E7%AD%86%E8%A8%98week1_isa_%E6%8C%87%E4%BB%A4%E9%9B%86%E6%9E%B6%E6%A7%8B/Lecturer: jserv / Course: Computer Architecture 2026Sun, 13 Sep 2026 00:00:00 GMT計算機結構Learninghttps://suzu.tw/books/%E5%AD%A4%E7%8D%A8%E5%85%AD%E8%AC%9B//books/孤獨六講/#2026-08-30-0從情慾、語言、革命、暴力、思維與倫理六個面向，讓我們知道在現今嘈雜的世界裡，要怎麼樣才能找回內在的平靜，在這個世界裡面安頓我們的身心。Sun, 30 Aug 2026 00:00:00 GMThttps://suzu.tw/posts/pwnable-tw-start/https://suzu.tw/posts/pwnable-tw-start/Writeup by Suzu.Tue, 18 Aug 2026 00:00:00 GMTCTFWriteupPwnpwnable.twhttps://suzu.tw/posts/2026-07-29-windows-internaldllmain/https://suzu.tw/posts/2026-07-29-windows-internaldllmain/DllMain 的相關說明、用途、實作。Wed, 29 Jul 2026 00:00:00 GMTLearningWindows InternalDLLhttps://suzu.tw/posts/2026-07-28-windows-internalcallback-function/https://suzu.tw/posts/2026-07-28-windows-internalcallback-function/關於 CallBack Function 的細節跟原理Tue, 28 Jul 2026 00:00:00 GMTLearningWindows Internalhttps://suzu.tw/posts/2026-07-28-windows-internalsetwindowshookex%E8%88%87dll-%E6%B3%A8%E5%85%A5/https://suzu.tw/posts/2026-07-28-windows-internalsetwindowshookex%E8%88%87dll-%E6%B3%A8%E5%85%A5/SetWindowsHookEx 與 DLL 注入Tue, 28 Jul 2026 00:00:00 GMTLearningWindows InternalDLLhttps://suzu.tw/posts/2026-07-26-windows-internalmount-point/https://suzu.tw/posts/2026-07-26-windows-internalmount-point/Reparse Point 的一種Sun, 26 Jul 2026 00:00:00 GMTLearningWindows Internalhttps://suzu.tw/posts/2026-07-26-windows-internalreparse-point/https://suzu.tw/posts/2026-07-26-windows-internalreparse-point/Reparse Point 重新解析點Sun, 26 Jul 2026 00:00:00 GMTLearningWindows Internalhttps://suzu.tw/books/naval-almanack/https://suzu.tw/books/naval-almanack/從白手起家到財務自由，矽谷傳奇創投家納瓦爾的投資哲學與人生智慧。Thu, 11 Jun 2026 00:00:00 GMT思維財務https://suzu.tw/posts/2026-05-26-ais3-pre-exam-2026-blooockchain/https://suzu.tw/posts/2026-05-26-ais3-pre-exam-2026-blooockchain/A pwn writeup for blooockchain, covering raw SHA-256 digests, strncat, an OOB leak, and saved RIP overwrite.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnhttps://suzu.tw/posts/2026-05-26-ais3-pre-exam-2026-writeup%E5%89%8D%E8%A8%80/https://suzu.tw/posts/2026-05-26-ais3-pre-exam-2026-writeup%E5%89%8D%E8%A8%80/AIS3 Pre-Exam 2026 Writeups。Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteuphttps://suzu.tw/posts/2026-05-26-cryptoeasyfault/https://suzu.tw/posts/2026-05-26-cryptoeasyfault/A crypto writeup for EasyFAULT, recovering the hidden RSA structure with lattice-style analysis.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupCryptoRSALatticehttps://suzu.tw/posts/2026-05-26-cryptoeasyjwt/https://suzu.tw/posts/2026-05-26-cryptoeasyjwt/A crypto writeup for EasyJWT, focusing on JWT signing, verification, and token forgery.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupCryptoJWThttps://suzu.tw/posts/2026-05-26-cryptoeasypaint/https://suzu.tw/posts/2026-05-26-cryptoeasypaint/A crypto writeup for EasyPAINT, extracting the Nuitka app logic and recovering the cryptographic path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupCryptoNuitkahttps://suzu.tw/posts/2026-05-26-cryptoeasyweb/https://suzu.tw/posts/2026-05-26-cryptoeasyweb/A crypto writeup for EasyWEB, analyzing the encrypted cookie/session behavior.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupCryptoWebhttps://suzu.tw/posts/2026-05-26-cryptoeasyzkp/https://suzu.tw/posts/2026-05-26-cryptoeasyzkp/A crypto writeup for EasyZKP, covering the proof protocol and final forgery.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupCryptoZKPhttps://suzu.tw/posts/2026-05-26-misc%C9%9Bsi-s%C7%9D%C9%94%C9%B9%C7%9D%CA%87-%E2%85%8El%C9%90%C6%83-s%C9%A5od/https://suzu.tw/posts/2026-05-26-misc%C9%9Bsi-s%C7%9D%C9%94%C9%B9%C7%9D%CA%87-%E2%85%8El%C9%90%C6%83-s%C9%A5od/A misc writeup for ƐSI∀ Sǝɔɹǝʇ Ⅎlɐƃ Sɥod, following the hidden host and service clues.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscWebhttps://suzu.tw/posts/2026-05-26-mischacked-by-lazarus-group/https://suzu.tw/posts/2026-05-26-mischacked-by-lazarus-group/A misc writeup for Hacked by Lazarus Group, using proxy/header behavior to reach the flag.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscHTTP Headershttps://suzu.tw/posts/2026-05-26-miscjail/https://suzu.tw/posts/2026-05-26-miscjail/A misc writeup for Jail, focusing on the Python jail request shape and execution trick.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscPyjailhttps://suzu.tw/posts/2026-05-26-miscjail-revenge/https://suzu.tw/posts/2026-05-26-miscjail-revenge/A misc writeup for Jail-Revenge, abusing the Flask body handling and Python execution path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscPyjailhttps://suzu.tw/posts/2026-05-26-misckernel0day/https://suzu.tw/posts/2026-05-26-misckernel0day/A misc writeup for Kernel0Day, from QEMU environment triage to the final privilege path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscKernelhttps://suzu.tw/posts/2026-05-26-miscwelcome/https://suzu.tw/posts/2026-05-26-miscwelcome/A misc writeup for Welcome, solving the QR-code based warmup challenge.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscQR Codehttps://suzu.tw/posts/2026-05-26-misc%E3%82%A2%E3%83%83%E3%82%B7%E3%82%A7%E3%83%B3%E3%83%86-/https://suzu.tw/posts/2026-05-26-misc%E3%82%A2%E3%83%83%E3%82%B7%E3%82%A7%E3%83%B3%E3%83%86-/A misc writeup for アッシェンテ！, analyzing the Minecraft mod and RNG path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscMinecrafthttps://suzu.tw/posts/2026-05-26-misc%E6%83%B3%E5%9C%A8%E9%9B%AA%E4%B8%AD%E4%BE%86%E6%9D%AF%E4%B8%8B%E5%8D%88%E8%8C%B6%E5%97%8E/https://suzu.tw/posts/2026-05-26-misc%E6%83%B3%E5%9C%A8%E9%9B%AA%E4%B8%AD%E4%BE%86%E6%9D%AF%E4%B8%8B%E5%8D%88%E8%8C%B6%E5%97%8E/A misc writeup for 想在雪中來杯下午茶嗎?, using OSINT to identify the location.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupMiscOSINThttps://suzu.tw/posts/2026-05-26-pwndg-server/https://suzu.tw/posts/2026-05-26-pwndg-server/A pwn writeup for DG-Server, from HTTP parser triage to the final exploit path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnDNShttps://suzu.tw/posts/2026-05-26-pwnooonvifd/https://suzu.tw/posts/2026-05-26-pwnooonvifd/A pwn writeup for ooonvifd, focusing on the ONVIF parser bug and exploitation flow.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnONVIFHeaphttps://suzu.tw/posts/2026-05-26-pwnstd-print/https://suzu.tw/posts/2026-05-26-pwnstd-print/A pwn writeup for std-print, using the binary symbols, ROP, and flag memory leak path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnROPhttps://suzu.tw/posts/2026-05-26-pwn%E7%89%B9%E5%88%A5%E7%9A%84%E6%84%9B%E7%B5%A6%E7%89%B9%E5%88%A5%E7%9A%84%E4%BD%A0/https://suzu.tw/posts/2026-05-26-pwn%E7%89%B9%E5%88%A5%E7%9A%84%E6%84%9B%E7%B5%A6%E7%89%B9%E5%88%A5%E7%9A%84%E4%BD%A0/A pwn writeup for 特別的愛給特別的你, covering the QEMU/raw-disk execution model and exploit path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnKernelQEMUhttps://suzu.tw/posts/2026-05-26-pwn%E7%8D%A8%E5%B1%AC%E6%96%BC%E4%BD%A0%E7%9A%84%E9%AD%94%E6%B3%95/https://suzu.tw/posts/2026-05-26-pwn%E7%8D%A8%E5%B1%AC%E6%96%BC%E4%BD%A0%E7%9A%84%E9%AD%94%E6%B3%95/A pwn writeup for 獨屬於你的魔法, using one arbitrary write and glibc internals to reach shell.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupPwnglibchttps://suzu.tw/posts/2026-05-26-reversedg-server/https://suzu.tw/posts/2026-05-26-reversedg-server/A reverse writeup for DG-Server, covering the custom verifier and DNSSEC-like chain.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupReverseDNShttps://suzu.tw/posts/2026-05-26-reverselua/https://suzu.tw/posts/2026-05-26-reverselua/A reverse writeup for the Lua bytecode challenge and its custom opcode mapping.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupReverseLuahttps://suzu.tw/posts/2026-05-26-reversetetris/https://suzu.tw/posts/2026-05-26-reversetetris/A reverse writeup for tetris, analyzing the static ELF and hidden flag path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupReverseELFhttps://suzu.tw/posts/2026-05-26-reverse%E5%93%87%E9%87%91%E8%89%B2%E5%82%B3%E8%AA%AAhidden-in-the-cloak/https://suzu.tw/posts/2026-05-26-reverse%E5%93%87%E9%87%91%E8%89%B2%E5%82%B3%E8%AA%AAhidden-in-the-cloak/A reverse writeup for the Unity challenges 哇!金色傳說 and Hidden-in-the-Cloak.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupReverseUnityhttps://suzu.tw/posts/2026-05-26-webgive-me-flag/https://suzu.tw/posts/2026-05-26-webgive-me-flag/A web writeup for Give-Me-Flag, reversing the .NET service behavior and callback path.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWeb.NEThttps://suzu.tw/posts/2026-05-26-weblinkedout/https://suzu.tw/posts/2026-05-26-weblinkedout/A web writeup for Linkedout, from file read to the final application exploit chain.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWebFlaskhttps://suzu.tw/posts/2026-05-26-webmass-rapid-transit/https://suzu.tw/posts/2026-05-26-webmass-rapid-transit/A web writeup for Mass-Rapid-Transit, covering admin access, payload testing, and the final route.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWebXSShttps://suzu.tw/posts/2026-05-26-webmygox-ave-mujica%E5%9C%96%E5%BA%AB/https://suzu.tw/posts/2026-05-26-webmygox-ave-mujica%E5%9C%96%E5%BA%AB/A web writeup for MyGO!!!!! x Ave Mujica 圖庫, chaining SQL injection and file read.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWebSQLiLFIhttps://suzu.tw/posts/2026-05-26-webpdf-converter/https://suzu.tw/posts/2026-05-26-webpdf-converter/A web writeup for PDF-Converter, focusing on PHP, PDF generation, and file-read behavior.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWebPHPSSRFhttps://suzu.tw/posts/2026-05-26-webtea-god-adventure/https://suzu.tw/posts/2026-05-26-webtea-god-adventure/A web writeup for Tea-God-Adventure, using prompt injection and internal blackbox probing.Tue, 26 May 2026 00:00:00 GMTAIS3CTFWriteupWebPrompt Injectionhttps://suzu.tw/posts/2026-05-15-openbmc-bmcweb-multipart-parser-cves/https://suzu.tw/posts/2026-05-15-openbmc-bmcweb-multipart-parser-cves/A practical, slide-backed analysis of CVE-2022-2809 and CVE-2022-3409 in the bmcweb multipart parser.Fri, 15 May 2026 00:00:00 GMTOpenBMCbmcwebCVEParserSecurityhttps://suzu.tw/posts/2026-05-15-openbmc-security-architecture-and-lab/https://suzu.tw/posts/2026-05-15-openbmc-security-architecture-and-lab/A practical and slide-backed walkthrough of OpenBMC architecture, attack surface, D-Bus, and a QEMU lab setup.Fri, 15 May 2026 00:00:00 GMTOpenBMCBMCSecurityFirmwareRedfishhttps://suzu.tw/posts/2026-05-15-openbmc-slpd-lite-cve-2024-41660/https://suzu.tw/posts/2026-05-15-openbmc-slpd-lite-cve-2024-41660/A practical, slide-backed analysis of CVE-2024-41660 in OpenBMC slpd-lite, focusing on SLP length fields and memory corruption.Fri, 15 May 2026 00:00:00 GMTOpenBMCslpd-liteCVEMemory CorruptionSecurityhttps://suzu.tw/posts/2026-01-18-cve-2024-2961-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/https://suzu.tw/posts/2026-01-18-cve-2024-2961-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/CVE-2024-2961 主要是 glibc 的 iconv 函式，在進行字元轉換時，因為呼叫 Escape Sequence 到輸出時沒有檢查邊界問題，因此可以造成 OOB Write，後續也利用這個 Off by one 來打達成 PHP 的 LFI to RCE 漏洞。Sun, 18 Jan 2026 00:00:00 GMTCVEiconvHeapLearningResearchhttps://suzu.tw/posts/2025-10-14-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday30%E5%A4%A2%E7%9A%84%E7%B5%82%E9%BB%9E%E5%8F%AA%E6%98%AF%E6%97%85%E9%80%94%E7%9A%84%E9%96%8B%E7%AB%AF/https://suzu.tw/posts/2025-10-14-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday30%E5%A4%A2%E7%9A%84%E7%B5%82%E9%BB%9E%E5%8F%AA%E6%98%AF%E6%97%85%E9%80%94%E7%9A%84%E9%96%8B%E7%AB%AF/《30 天深入 LOLBAS》系列完結篇：回顧選題動機、LOLBAS Project 資料蒐集流程，以及每篇文章背後的研究日常，為 30 天鐵人賽畫下句點。Tue, 14 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsRed TeamRetrospectivehttps://suzu.tw/posts/2025-10-13-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday29%E9%99%84%E9%8C%84%E4%B8%89vba-%E8%88%87-dde---office-%E6%96%87%E4%BB%B6%E6%94%BB%E6%93%8A%E6%8A%80%E8%A1%93/https://suzu.tw/posts/2025-10-13-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday29%E9%99%84%E9%8C%84%E4%B8%89vba-%E8%88%87-dde---office-%E6%96%87%E4%BB%B6%E6%94%BB%E6%93%8A%E6%8A%80%E8%A1%93/深入解析 Office 文件攻擊的兩大手法：VBA 巨集（自動執行、下載並執行 Payload、資訊收集、持久化）與 DDE/DDEAUTO 無巨集命令執行，附完整範例程式碼與微軟修補現況。Mon, 13 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsVBADDEhttps://suzu.tw/posts/2025-10-12-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday28%E9%99%84%E9%8C%84%E4%BA%8Chta-%E5%9F%BA%E7%A4%8E%E8%AA%9E%E6%B3%95%E8%88%87%E5%AF%A6%E6%88%B0%E6%87%89%E7%94%A8/https://suzu.tw/posts/2025-10-12-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday28%E9%99%84%E9%8C%84%E4%BA%8Chta-%E5%9F%BA%E7%A4%8E%E8%AA%9E%E6%B3%95%E8%88%87%E5%AF%A6%E6%88%B0%E6%87%89%E7%94%A8/HTA（HTML Application）基礎語法完整教學：HTA:APPLICATION 屬性、VBScript/JScript 核心語法，以及偽裝更新、資訊收集、註冊表持久化等攻擊實戰應用。Sun, 12 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsHTAVBScripthttps://suzu.tw/posts/2025-10-11-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday27%E9%99%84%E9%8C%84%E4%B8%80dll-%E5%9F%BA%E7%A4%8E%E8%AA%9E%E6%B3%95%E8%88%87%E5%AF%A6%E6%88%B0%E6%87%89%E7%94%A8/https://suzu.tw/posts/2025-10-11-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday27%E9%99%84%E9%8C%84%E4%B8%80dll-%E5%9F%BA%E7%A4%8E%E8%AA%9E%E6%B3%95%E8%88%87%E5%AF%A6%E6%88%B0%E6%87%89%E7%94%A8/從 DLL 基礎概念與載入方式講起，示範 DllMain、匯出函數、LoadLibrary 遠端執行緒注入、SetWindowsHookEx 與 Inline Hook 等 Win32 實戰語法。Sat, 11 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsDLL InjectionWin32 APIhttps://suzu.tw/posts/2025-10-10-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday26lolbas-%E6%94%BB%E6%93%8A%E9%8F%88%E5%BE%9E-excel-%E5%88%B0%E5%AE%8C%E5%85%A8%E6%8E%A7%E5%88%B6/https://suzu.tw/posts/2025-10-10-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday26lolbas-%E6%94%BB%E6%93%8A%E9%8F%88%E5%BE%9E-excel-%E5%88%B0%E5%AE%8C%E5%85%A8%E6%8E%A7%E5%88%B6/示範一條完整的 LOLBAS 攻擊鏈：從惡意 Excel VBA 巨集出發，用 certutil 下載並執行 PowerShell，寫入 Run 登錄機碼建立持久化，最後自刪清理痕跡，並附上各階段的藍隊偵測方法。Fri, 10 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsAttack ChainPowerShellhttps://suzu.tw/posts/2025-10-09-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday25sftpexeproxycommand-%E4%BB%BB%E6%84%8F%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C/https://suzu.tw/posts/2025-10-09-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday25sftpexeproxycommand-%E4%BB%BB%E6%84%8F%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C/Windows 10/11 內建的 sftp.exe 其 ProxyCommand 選項可被濫用執行任意系統命令，無需實際 SSH 連線。本文示範攻擊手法，並提供偵測與防禦方式。Thu, 09 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsSFTPOpenSSHhttps://suzu.tw/posts/2025-10-08-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday24cipherexe%E5%8F%8D%E9%91%91%E8%AD%98%E6%B8%85%E7%90%86%E5%B7%A5%E5%85%B7/https://suzu.tw/posts/2025-10-08-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday24cipherexe%E5%8F%8D%E9%91%91%E8%AD%98%E6%B8%85%E7%90%86%E5%B7%A5%E5%85%B7/介紹 Windows 內建 cipher.exe 的 /w 參數如何三階段覆寫磁碟未使用空間，抹除已刪除檔案的殘留痕跡，並提供對應的稽核與偵測 IOCs。Wed, 08 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsAnti-ForensicsCipherhttps://suzu.tw/posts/2025-10-07-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday23explorerexe%E6%AA%94%E6%A1%88%E7%B8%BD%E7%AE%A1%E7%9A%84%E6%8C%81%E4%B9%85%E5%8C%96%E6%94%BB%E6%93%8A/https://suzu.tw/posts/2025-10-07-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday23explorerexe%E6%AA%94%E6%A1%88%E7%B8%BD%E7%AE%A1%E7%9A%84%E6%8C%81%E4%B9%85%E5%8C%96%E6%94%BB%E6%93%8A/介紹 Explorer.exe 如何在使用者登入時處理 Run 註冊表機碼，攻擊者只需普通權限即可寫入 HKCU Run 機碼達成持久化，並附上偵測腳本、群組原則防禦方式與 IOC。Tue, 07 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsPersistenceRegistryhttps://suzu.tw/posts/2025-10-06-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday22excelexe%E8%BE%A6%E5%85%AC%E5%AE%A4%E7%92%B0%E5%A2%83%E7%9A%84%E8%90%AC%E8%83%BD%E6%94%BB%E6%93%8A%E5%B7%A5%E5%85%B7/https://suzu.tw/posts/2025-10-06-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday22excelexe%E8%BE%A6%E5%85%AC%E5%AE%A4%E7%92%B0%E5%A2%83%E7%9A%84%E8%90%AC%E8%83%BD%E6%94%BB%E6%93%8A%E5%B7%A5%E5%85%B7/透過 VBA 巨集與 DDE 公式，Excel 可成為免額外工具的程式執行平台。本文示範 Workbook_Open 自動執行巨集與 DDE 命令執行，並提供子進程偵測與停用設定。Mon, 06 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsExcelVBAhttps://suzu.tw/posts/2025-10-05-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday21workfoldersexe%E7%9B%B8%E5%B0%8D%E8%B7%AF%E5%BE%91%E5%8A%AB%E6%8C%81%E5%A6%82%E4%BD%95%E6%88%90%E7%82%BA%E4%B8%80%E5%80%8B%E6%BC%8F%E6%B4%9E%E7%99%BC%E6%8E%98%E5%AE%B6/https://suzu.tw/posts/2025-10-05-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday21workfoldersexe%E7%9B%B8%E5%B0%8D%E8%B7%AF%E5%BE%91%E5%8A%AB%E6%8C%81%E5%A6%82%E4%BD%95%E6%88%90%E7%82%BA%E4%B8%80%E5%80%8B%E6%BC%8F%E6%B4%9E%E7%99%BC%E6%8E%98%E5%AE%B6/介紹 Windows 內建 WorkFolders.exe 的相對路徑劫持手法：在當前目錄放置偽造的 control.exe 即可被其執行，並示範如何用 Procmon 篩選事件、親手挖出這類 LOLBAS 漏洞。Sun, 05 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsWorkFoldersSysinternalshttps://suzu.tw/posts/2025-10-04-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday20bashexewsl-%E7%9A%84%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8/https://suzu.tw/posts/2025-10-04-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday20bashexewsl-%E7%9A%84%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8/介紹 WSL 入口程式 bash.exe 的攻擊利用方式：以 bash.exe -c 在 Windows 上執行 Linux 指令、枚舉檔案，並示範 /dev/tcp Reverse Shell，最後給出偵測與防禦建議。Sat, 04 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsWSLReverseShellhttps://suzu.tw/posts/2025-10-03-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday19sdcltexe%E5%82%99%E4%BB%BD%E5%B7%A5%E5%85%B7%E7%9A%84-uac-bypass-%E6%94%BB%E6%93%8A%E6%89%8B%E6%B3%95%E8%A7%A3%E6%9E%90/https://suzu.tw/posts/2025-10-03-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday19sdcltexe%E5%82%99%E4%BB%BD%E5%B7%A5%E5%85%B7%E7%9A%84-uac-bypass-%E6%94%BB%E6%93%8A%E6%89%8B%E6%B3%95%E8%A7%A3%E6%9E%90/解析 Windows 備份工具 Sdclt.exe 如何透過劫持 HKCU\Software\Classes\Folder\shell\open\command 登錄機碼與 DelegateExecute 值，利用 auto-elevate 特性執行高權限命令，達成 UAC Bypass（T1548.002）。Fri, 03 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsUAC BypassRegistryhttps://suzu.tw/posts/2025-10-02-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday18esentutlexe%E6%BF%AB%E7%94%A8%E8%B3%87%E6%96%99%E5%BA%AB%E5%B7%A5%E5%85%B7%E9%80%B2%E8%A1%8C%E6%AA%94%E6%A1%88%E7%AB%8A%E5%8F%96/https://suzu.tw/posts/2025-10-02-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday18esentutlexe%E6%BF%AB%E7%94%A8%E8%B3%87%E6%96%99%E5%BA%AB%E5%B7%A5%E5%85%B7%E9%80%B2%E8%A1%8C%E6%AA%94%E6%A1%88%E7%AB%8A%E5%8F%96/介紹 Windows 內建 ESE 資料庫工具 Esentutl.exe 如何被濫用複製鎖定中的檔案，竊取瀏覽器密碼資料庫與 SAM 登錄檔，並提供偵測與防禦方法。Thu, 02 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsEsentutlCredential Accesshttps://suzu.tw/posts/2025-10-01-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday17tpmtool---%E6%BF%AB%E7%94%A8tpm%E7%AE%A1%E7%90%86%E5%B7%A5%E5%85%B7%E9%80%B2%E8%A1%8C%E6%AA%94%E6%A1%88%E6%93%8D%E4%BD%9C/https://suzu.tw/posts/2025-10-01-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday17tpmtool---%E6%BF%AB%E7%94%A8tpm%E7%AE%A1%E7%90%86%E5%B7%A5%E5%85%B7%E9%80%B2%E8%A1%8C%E6%AA%94%E6%A1%88%E6%93%8D%E4%BD%9C/介紹 Windows 內建 TPMTool.exe 的 gatherlogs 功能如何被濫用來建立掩護目錄結構與檔案載體，包含攻擊 Demo、偵測策略與防禦建議。Wed, 01 Oct 2025 00:00:00 GMTLOLBASSecurityWindowsTPMDefense Evasionhttps://suzu.tw/posts/2025-09-30-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday16netshexe%E9%80%8F%E9%81%8E-helper-dll-%E6%B3%A8%E5%85%A5%E5%9F%B7%E8%A1%8C%E6%83%A1%E6%84%8F%E7%A8%8B%E5%BC%8F%E7%A2%BC/https://suzu.tw/posts/2025-09-30-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday16netshexe%E9%80%8F%E9%81%8E-helper-dll-%E6%B3%A8%E5%85%A5%E5%9F%B7%E8%A1%8C%E6%83%A1%E6%84%8F%E7%A8%8B%E5%BC%8F%E7%A2%BC/介紹攻擊者如何註冊惡意 Netsh Helper DLL，讓 Windows 內建的 netsh.exe 在每次執行時載入並執行任意程式碼，達成持久化與繞過白名單，並提供 Sysmon、AppLocker 等偵測與防禦建議。Tue, 30 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsNetshPersistencehttps://suzu.tw/posts/2025-09-29-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday15scexewindows%E6%9C%8D%E5%8B%99%E6%8E%A7%E5%88%B6%E7%AE%A1%E7%90%86%E5%99%A8%E7%9A%84%E6%94%BB%E9%98%B2%E6%8A%80%E8%A1%93/https://suzu.tw/posts/2025-09-29-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday15scexewindows%E6%9C%8D%E5%8B%99%E6%8E%A7%E5%88%B6%E7%AE%A1%E7%90%86%E5%99%A8%E7%9A%84%E6%94%BB%E9%98%B2%E6%8A%80%E8%A1%93/深入解析 Windows 內建服務管理工具 sc.exe 的攻防兩面：從建立後門服務、修改服務路徑提權、遠端服務橫向移動到服務 DLL 劫持，並提供 Event ID、Sysmon、Sigma 與 YARA 的檢測與防禦方法。Mon, 29 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsWindows ServicesPersistencehttps://suzu.tw/posts/2025-09-28-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday14eventvwrexeuac%E7%B9%9E%E9%81%8E%E7%9A%84%E6%AC%8A%E9%99%90%E6%8F%90%E5%8D%87%E6%8A%80%E8%A1%93/https://suzu.tw/posts/2025-09-28-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday14eventvwrexeuac%E7%B9%9E%E9%81%8E%E7%9A%84%E6%AC%8A%E9%99%90%E6%8F%90%E5%8D%87%E6%8A%80%E8%A1%93/解析 eventvwr.exe 利用 mscfile 登錄檔劫持與 auto-elevate 機制繞過 UAC 的經典提權技術，包含攻擊原理、PowerShell PoC、Windows 11 現況測試，以及登錄檔監控、Sysmon 等偵測防禦方法。Sun, 28 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsUACPrivilege Escalationhttps://suzu.tw/posts/2025-09-27-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday13schtasksexe%E6%8E%92%E7%A8%8B%E4%BB%BB%E5%8B%99%E7%9A%84%E6%8C%81%E7%BA%8C%E6%80%A7%E6%94%BB%E6%93%8A%E6%8A%80%E8%A1%93/https://suzu.tw/posts/2025-09-27-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday13schtasksexe%E6%8E%92%E7%A8%8B%E4%BB%BB%E5%8B%99%E7%9A%84%E6%8C%81%E7%BA%8C%E6%80%A7%E6%94%BB%E6%93%8A%E6%8A%80%E8%A1%93/解析攻擊者如何濫用 Windows 內建 Schtasks.exe 建立排程任務達成持續性滲透（MITRE ATT&CK T1053.005），涵蓋偽裝系統任務、XML 匯入、事件觸發等技巧，以及對應的偵測與防禦方法。Sat, 27 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsSchtasksPersistencehttps://suzu.tw/posts/2025-09-26-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday12forfilesexe%E6%89%B9%E6%AC%A1%E6%AA%94%E6%A1%88%E8%99%95%E7%90%86%E5%B7%A5%E5%85%B7%E7%9A%84%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%8A%80%E5%B7%A7/https://suzu.tw/posts/2025-09-26-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday12forfilesexe%E6%89%B9%E6%AC%A1%E6%AA%94%E6%A1%88%E8%99%95%E7%90%86%E5%B7%A5%E5%85%B7%E7%9A%84%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%8A%80%E5%B7%A7/介紹 Windows 內建批次檔案處理工具 Forfiles.exe 如何被濫用於任意命令執行與防禦繞過，包含 LOLBAS 攻擊手法、Windows 11 實測，以及 Sysmon 與 AppLocker 偵測防禦建議。Fri, 26 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsForfilesDefense Evasionhttps://suzu.tw/posts/2025-09-25-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday11msdtexe%E5%BE%AE%E8%BB%9F%E8%A8%BA%E6%96%B7%E5%B7%A5%E5%85%B7%E7%9A%84-rce-%E6%BC%8F%E6%B4%9E/https://suzu.tw/posts/2025-09-25-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday11msdtexe%E5%BE%AE%E8%BB%9F%E8%A8%BA%E6%96%B7%E5%B7%A5%E5%85%B7%E7%9A%84-rce-%E6%BC%8F%E6%B4%9E/解析 Windows 內建診斷工具 msdt.exe 的攻擊面：ms-msdt: URL 協議、Answer File 濫用，以及 2022 年 Follina（CVE-2022-30190）零時差 RCE 漏洞的攻擊鏈與防禦方式。Thu, 25 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsMSDTCVE-2022-30190https://suzu.tw/posts/2025-09-24-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday10%E7%89%B9%E5%88%A5%E4%BC%81%E5%8A%83%E4%B9%8B%E5%A4%B1%E6%95%97%E4%BA%86%E6%88%91%E9%82%84%E6%98%AF%E6%83%B3%E6%94%BE%E4%B8%8A%E4%BE%86odbcconfexeodbc-%E8%A8%AD%E5%AE%9A%E5%B7%A5%E5%85%B7%E5%9F%B7%E8%A1%8C%E6%83%A1%E6%84%8F-dll-%E6%94%BB%E6%93%8A/https://suzu.tw/posts/2025-09-24-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday10%E7%89%B9%E5%88%A5%E4%BC%81%E5%8A%83%E4%B9%8B%E5%A4%B1%E6%95%97%E4%BA%86%E6%88%91%E9%82%84%E6%98%AF%E6%83%B3%E6%94%BE%E4%B8%8A%E4%BE%86odbcconfexeodbc-%E8%A8%AD%E5%AE%9A%E5%B7%A5%E5%85%B7%E5%9F%B7%E8%A1%8C%E6%83%A1%E6%84%8F-dll-%E6%94%BB%E6%93%8A/實作利用 Windows 內建 Odbcconf.exe 載入惡意 DLL 取得 Reverse Shell，涵蓋 ODBC 架構、DllRegisterServer 攻擊點、LOLBAS 偵測指標與 AppLocker 防禦方式。Wed, 24 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsODBCOdbcconfhttps://suzu.tw/posts/2025-09-23-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday9msiexecexe%E4%BD%BF%E7%94%A8-wix-toolset-%E6%89%93%E9%80%A0%E6%83%A1%E6%84%8F%E5%AE%89%E8%A3%9D%E5%8C%85/https://suzu.tw/posts/2025-09-23-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday9msiexecexe%E4%BD%BF%E7%94%A8-wix-toolset-%E6%89%93%E9%80%A0%E6%83%A1%E6%84%8F%E5%AE%89%E8%A3%9D%E5%8C%85/介紹如何用 WiX Toolset v3 打造內含 WixQuietExec 自訂動作的惡意 MSI 安裝包，讓 msiexec.exe 在靜默安裝時執行任意程式，並提供偵測指標與防火牆、AppLocker 防禦設定。Tue, 23 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsMsiexecMSIhttps://suzu.tw/posts/2025-09-22-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday8cscript-wscript%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows-script-host%E7%9A%84%E6%83%A1%E6%84%8F%E5%88%A9%E7%94%A8/https://suzu.tw/posts/2025-09-22-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday8cscript-wscript%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows-script-host%E7%9A%84%E6%83%A1%E6%84%8F%E5%88%A9%E7%94%A8/實測 Windows 11 上 Cscript/Wscript（Windows Script Host）的惡意利用：本地與遠端執行 VBScript/JScript、Echo 落地繞過、mshta 組合技，以及對應的偵測與防禦建議。Mon, 22 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsCscriptWSHhttps://suzu.tw/posts/2025-09-21-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday7mshtaexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0hta%E6%87%89%E7%94%A8%E7%A8%8B%E5%BC%8F%E7%9A%84%E6%83%A1%E6%84%8F%E5%9F%B7%E8%A1%8C/https://suzu.tw/posts/2025-09-21-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday7mshtaexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0hta%E6%87%89%E7%94%A8%E7%A8%8B%E5%BC%8F%E7%9A%84%E6%83%A1%E6%84%8F%E5%9F%B7%E8%A1%8C/深入實測 mshta.exe 的三大危險技巧：直接執行遠端 HTA、inline JavaScript/VBScript 無檔案執行，以及對應的偵測指標與 AppLocker 防禦方式。Sun, 21 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsMshtaHTAhttps://suzu.tw/posts/2025-09-20-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday6regsvr32exe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0squiblydoo%E6%94%BB%E6%93%8A/https://suzu.tw/posts/2025-09-20-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday6regsvr32exe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0squiblydoo%E6%94%BB%E6%93%8A/在 Windows 11 實測 regsvr32.exe 的 Squiblydoo 攻擊：利用 /s /n /u /i: 參數搭配 scrobj.dll 載入遠端 SCT scriptlet 執行任意程式，並提供事件日誌、網路連線與 AppLocker 等偵測防禦建議。Sat, 20 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsRegsvr32Squiblydoohttps://suzu.tw/posts/2025-09-19-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday5rundll32exe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0dll%E7%9A%84%E8%90%AC%E8%83%BD%E5%9F%B7%E8%A1%8C%E5%99%A8/https://suzu.tw/posts/2025-09-19-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday5rundll32exe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0dll%E7%9A%84%E8%90%AC%E8%83%BD%E5%9F%B7%E8%A1%8C%E5%99%A8/實測 Windows 內建 rundll32.exe 的三大濫用手法：透過 mshtml 執行 JavaScript、以 shell32/advpack/pcwutl 代理執行指令，以及對應的偵測與 AppLocker、Sysmon 防禦設定。Fri, 19 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsRundll32Proxy Executionhttps://suzu.tw/posts/2025-09-18-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday4powershell%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows-11-%E4%B8%8A%E7%9A%84%E6%94%BB%E9%98%B2%E5%B0%8D%E6%8A%97/https://suzu.tw/posts/2025-09-18-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday4powershell%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows-11-%E4%B8%8A%E7%9A%84%E6%94%BB%E9%98%B2%E5%B0%8D%E6%8A%97/在 Windows 11 實測 PowerShell 三大仍然有效的攻擊技巧：記憶體執行、Base64 編碼、WMIC 替代方案，並提供 Script Block Logging 等偵測與防禦建議。Thu, 18 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsPowerShellhttps://suzu.tw/posts/2025-09-17-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday3bitsadminexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows%E6%9B%B4%E6%96%B0%E6%9C%8D%E5%8B%99%E7%9A%84%E6%9A%97%E9%BB%91%E9%9D%A2/https://suzu.tw/posts/2025-09-17-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday3bitsadminexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0windows%E6%9B%B4%E6%96%B0%E6%9C%8D%E5%8B%99%E7%9A%84%E6%9A%97%E9%BB%91%E9%9D%A2/深入實測 Windows 內建 bitsadmin.exe 的三種攻擊手法：一行指令下載、分段隱密傳輸、偽裝成系統更新，並從 BITS 任務、事件日誌與網路特徵整理出可落地的藍隊偵測與防禦建議。Wed, 17 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsBITSRed Teamhttps://suzu.tw/posts/2025-09-16-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday2certutilexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0%E8%AD%89%E6%9B%B8%E5%B7%A5%E5%85%B7%E7%9A%84%E9%9A%B1%E8%97%8F%E5%8A%9F%E8%83%BD/https://suzu.tw/posts/2025-09-16-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday2certutilexe%E6%B7%B1%E5%BA%A6%E5%AF%A6%E6%88%B0%E8%AD%89%E6%9B%B8%E5%B7%A5%E5%85%B7%E7%9A%84%E9%9A%B1%E8%97%8F%E5%8A%9F%E8%83%BD/深入實測 Windows 內建 certutil.exe 的三大 LOLBAS 隱藏功能：-urlcache 直接下載檔案、Base64 解碼繞過偵測、偽裝成憑證處理，並整理對應的偵測特徵、痕跡調查與防禦建議。Tue, 16 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsCertutilDetectionhttps://suzu.tw/posts/2025-09-15-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday1%E6%8F%AD%E9%96%8Bliving-off-the-land%E6%94%BB%E6%93%8A%E7%9A%84%E7%A5%9E%E7%A7%98%E9%9D%A2%E7%B4%97/https://suzu.tw/posts/2025-09-15-lolbas%E9%90%B5%E4%BA%BA%E8%B3%BDday1%E6%8F%AD%E9%96%8Bliving-off-the-land%E6%94%BB%E6%93%8A%E7%9A%84%E7%A5%9E%E7%A7%98%E9%9D%A2%E7%B4%97/LOLBAS（Living Off The Land Binaries, Scripts and Libraries）入門第一篇：介紹「就地取材」攻擊的核心概念、常被濫用的 Windows 內建工具、LOLBAS Project 專案，以及真實世界 APT 組織的運用情況。Mon, 15 Sep 2025 00:00:00 GMTLOLBASSecurityWindowsMITRE ATT&CKhttps://suzu.tw/posts/2025-08-16-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-7%E5%AF%AB%E4%B8%80%E5%80%8B%E7%B0%A1%E6%98%93%E5%AD%97%E5%85%B8%E6%94%BB%E6%93%8A%E5%99%A8%E6%B8%AC%E8%A9%A6%E5%BC%B1%E5%AF%86%E7%A2%BC/https://suzu.tw/posts/2025-08-16-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-7%E5%AF%AB%E4%B8%80%E5%80%8B%E7%B0%A1%E6%98%93%E5%AD%97%E5%85%B8%E6%94%BB%E6%93%8A%E5%99%A8%E6%B8%AC%E8%A9%A6%E5%BC%B1%E5%AF%86%E7%A2%BC/其實，Sat, 16 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-15-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-6%E7%88%AC%E8%9F%B2%E8%87%AA%E5%8B%95%E6%90%9C%E5%B0%8B%E6%95%8F%E6%84%9F%E8%B3%87%E8%A8%8A/https://suzu.tw/posts/2025-08-15-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-6%E7%88%AC%E8%9F%B2%E8%87%AA%E5%8B%95%E6%90%9C%E5%B0%8B%E6%95%8F%E6%84%9F%E8%B3%87%E8%A8%8A/如果去看常見的一些資安事件，Fri, 15 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-14-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-5%E5%9F%BA%E6%9C%AC-html-%E8%A7%A3%E6%9E%90%E6%89%BE%E5%87%BA%E6%BD%9B%E5%9C%A8%E6%94%BB%E6%93%8A%E9%BB%9E/https://suzu.tw/posts/2025-08-14-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-5%E5%9F%BA%E6%9C%AC-html-%E8%A7%A3%E6%9E%90%E6%89%BE%E5%87%BA%E6%BD%9B%E5%9C%A8%E6%94%BB%E6%93%8A%E9%BB%9E/找到 Web 服務之後，下一步就是分析網頁內容了。Thu, 14 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-13-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-4%E4%BD%BF%E7%94%A8-http-%E8%AB%8B%E6%B1%82%E5%81%B5%E6%B8%AC-web-%E6%9C%8D%E5%8B%99%E7%8B%80%E6%85%8B/https://suzu.tw/posts/2025-08-13-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-4%E4%BD%BF%E7%94%A8-http-%E8%AB%8B%E6%B1%82%E5%81%B5%E6%B8%AC-web-%E6%9C%8D%E5%8B%99%E7%8B%80%E6%85%8B/在做滲透測試的時候，只知道 port 開著還不夠，Wed, 13 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-12-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-3banner-grabbing-%E6%8A%93%E5%8F%96%E6%9C%8D%E5%8B%99%E8%B3%87%E8%A8%8A/https://suzu.tw/posts/2025-08-12-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-3banner-grabbing-%E6%8A%93%E5%8F%96%E6%9C%8D%E5%8B%99%E8%B3%87%E8%A8%8A/在偵查的時候，知道某個 Port 有沒有開還不夠，通常還會去看背後是什麼服務、版本是多少。Tue, 12 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-10-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-2%E7%94%A8%E5%A4%9A%E5%9F%B7%E8%A1%8C%E7%B7%92%E5%8A%A0%E9%80%9F-port-scanner/https://suzu.tw/posts/2025-08-10-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-2%E7%94%A8%E5%A4%9A%E5%9F%B7%E8%A1%8C%E7%B7%92%E5%8A%A0%E9%80%9F-port-scanner/在資安方面，很多任務都是 I/O 密集型（例如網路掃描、HTTP 請求），Sun, 10 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-08-09-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-1%E7%94%A8-ruby-%E5%AF%AB%E4%B8%80%E5%80%8B%E7%B0%A1%E6%98%93-port/https://suzu.tw/posts/2025-08-09-30%E5%A4%A9%E5%AD%B8%E7%BF%92%E6%96%B0%E8%AA%9E%E8%A8%80-rubyday-1%E7%94%A8-ruby-%E5%AF%AB%E4%B8%80%E5%80%8B%E7%B0%A1%E6%98%93-port/先講一下 Ruby 跟其他語言的差別好了，Sat, 09 Aug 2025 00:00:00 GMTLearningRuby30天學Ruby挑戰https://suzu.tw/posts/2025-06-02-ais3-pre-exam-2025-writeups/https://suzu.tw/posts/2025-06-02-ais3-pre-exam-2025-writeups/Writeup of 2025 AIS3 Pre-Exam Challenges by owl_d.Mon, 02 Jun 2025 00:00:00 GMTWriteupsCTFAIS3https://suzu.tw/posts/2025-03-27-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%B8%89/https://suzu.tw/posts/2025-03-27-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%B8%89/登入頁面的sqliThu, 27 Mar 2025 00:00:00 GMTCTFLearningWriteupshttps://suzu.tw/posts/2025-03-26-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%BA%8C/https://suzu.tw/posts/2025-03-26-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%BA%8C/發現這題的path traversal重點在這個區間Wed, 26 Mar 2025 00:00:00 GMTCTFLearningWriteupshttps://suzu.tw/posts/2025-03-07-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%B8%80/https://suzu.tw/posts/2025-03-07-%E7%B6%B2%E8%B7%AF%E5%AE%89%E5%85%A8%E5%AF%A6%E5%8B%99%E8%88%87%E7%A4%BE%E6%9C%83%E5%AF%A6%E8%B8%90%E4%BD%9C%E6%A5%AD%E4%B8%80/> 此次 Lab 共為兩題Fri, 07 Mar 2025 00:00:00 GMTCTFLearningWriteupshttps://suzu.tw/posts/2025-01-31-portswigger-sqli-writeup/https://suzu.tw/posts/2025-01-31-portswigger-sqli-writeup/1. 開始會需要用到 Burp Suite Repeater 來幫忙轉成 URL Encoding 了（而且也比較方便看 response）Fri, 31 Jan 2025 00:00:00 GMTPortSwiggerLearningWriteupshttps://suzu.tw/posts/2025-01-16-2025-tscctf-writeup/https://suzu.tw/posts/2025-01-16-2025-tscctf-writeup/Writeup of 2025 TSCCTF Challenges.Thu, 16 Jan 2025 00:00:00 GMTWriteupsCTF