分类
Security & WAF
本分类下的所有工具与文章，集中在一处。
工具
CSP evaluator
Paste a Content-Security-Policy, as a header value, a whole header line, a Report-Only header, a meta element or several at once, and read it the way CSP Level 3 reads it: each directive named and explained, each source expression classified by the grammar (keyword, nonce, hash, scheme, host and its wildcards), the effective source list per destination through the fallback chain, and a graded list of findings, each quoting the specification: 'unsafe-inline' and 'unsafe-eval', wildcard, data: and http: sources, missing object-src, base-uri and frame-ancestors, short nonces, 'strict-dynamic' without a nonce, keywords without quotes, missing semicolons, duplicate, unknown and obsolete directives, directives ignored in meta or in Report-Only, and whether the policy meets the specification's own Strict CSP. Decode and grade only, offline: nothing is fetched.
CVSS vector decoder
Paste a CVSS v3.1 or v3.0 vector and get the score computed and mapped to a severity, with every metric spelled out. Local and offline; nothing is sent anywhere.
HTTP header-order fingerprint
Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.
ZscalerPing IdentityJA3 / JA3N passive TLS fingerprint
Paste a JA3 string and it recomputes the JA3 hash, computes the permutation-stable JA3N, decodes the fields, and flags GREASE values.
ZscalerPing IdentityJA4 / JA3 TLS fingerprint decoder
Decode a JA4 TLS client fingerprint or a JA3 fingerprint into its fields, compute the hashed JA4 from raw values, or compute a JA3 MD5. It auto-detects which you paste. All in your browser.
ZscalerPing IdentityOGNL injection decoder
Paste an OGNL payload you found in a WAF or application log and read what it was trying to do. Separates a sandbox escape from an execution call, names the advisory family the shape is consistent with, and always states what it did not determine. Decodes only - it never evaluates the payload and holds no templates.
PAN-OS policy evaluation order
Put a Panorama rulebase into the order PAN-OS actually evaluates it, trace a flow to the deciding rule, and find the rules that never fire because something above them already matched.
SAML Decoder
Paste a SAML Response or assertion (raw, base64, or URL-encoded) and decode its issuer, status, subject, conditions, audience, and attributes, with signature and weak-algorithm checks. Hardened against XXE.
Ping IdentitySecure Headers Analyzer
Paste an HTTP response and get a graded breakdown of its security headers, cookie flags, and cross-origin policy, checked against OWASP, RFC 6797, CSP Level 3, and RFC 6265bis.
SSRF URL classifier
Paste a URL and see where it actually points: loopback, a private or link-local range, a cloud metadata endpoint, CGNAT, any block of the IANA special-purpose registries, or the public internet. Decimal, octal and hex IP obfuscation is decoded, so is an IPv4 address hidden inside an IPv6 one (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo); dangerous schemes and embedded credentials are flagged, and an SSRF risk level is shown. It never resolves DNS and never sends the request.
User-Agent entropy analyzer
Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.
ZscalerPing IdentityXML Decoder
Paste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
文章
HTTP Security Headers: The Defense-in-Depth Layer
What HTTP security headers are, why they form a layer of defense on top of secure code rather than a replacement for it, the headers that carry the most weight, and how to read a response's posture at a glance.
阅读Regex Quantifiers and Character Classes
A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.
阅读SAML 2.0: How Browser SSO Works
What a SAML assertion is, the roles of the identity provider and service provider, the SP-initiated Web Browser SSO flow end to end, and the difference between the HTTP-POST and HTTP-Redirect bindings that carry the messages.
阅读The Fingerprint That Broke, and the One Its Author Wrote to Replace It
Chrome started shuffling its TLS extensions in 2023 and JA3 stopped identifying Chrome. The fix came from the same person who wrote JA3, and the reason it works is one word: sorted.
阅读Content Security Policy, Directive by Directive
How CSP works as a control against cross-site scripting and injection: the shape of a policy, why default-src matters, what 'unsafe-inline' and 'unsafe-eval' give away, how nonces and hashes allow specific inline code safely, and what report-only mode is for.
阅读Inside a SAML Assertion: Subject, Conditions, and Audience
The anatomy of a SAML assertion: the Subject and NameID formats, bearer SubjectConfirmation and the NotOnOrAfter / Recipient / InResponseTo checks, the Conditions validity window, the AudienceRestriction, and the AuthnStatement, with the validation a service provider must perform on each.
阅读Regex Groups, Backreferences, and Lookarounds
Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and, with a question mark prefix, let you assert what comes before or after without consuming it.
阅读A Content Security Policy, read the way the browser reads it
A CSP header is a sentence in a small formal language, and the browser reads it with an algorithm the specification spells out: split on semicolons, lower-case the names, ignore a directive that repeats, read every token of a value against a grammar. Most broken policies break at exactly those steps, and quietly: a keyword without quotes becomes a host name, a missing semicolon folds two directives into one, a default-src that looks protective governs nothing once script-src is set, 'unsafe-inline' beside a nonce is silently ignored. Here is CSP Level 3's own reading, step by step, with the fallback chain, the matching rules for wildcards, schemes and IP addresses, what 'strict-dynamic' switches off, and the three-directive policy the specification itself calls Strict CSP.
阅读Catastrophic Backtracking and ReDoS
Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot.
阅读HSTS and HTTPS Enforcement
How Strict-Transport-Security closes the HTTP downgrade window, what max-age, includeSubDomains, and preload each do, the trust-on-first-use gap that preloading removes, and the configuration mistakes that quietly disable it.
阅读SAML Signatures and XML-DSig
How a SAML message is signed with XML Signature: the enveloped ds:Signature, the SignatureMethod and DigestMethod algorithms, why SHA-1 is weak, the difference between signing the Response and signing the Assertion, and how XML signature wrapping attacks work.
阅读Cookie Security Flags
How Secure, HttpOnly, and SameSite protect session cookies, what each SameSite value means, why SameSite=None requires Secure, and how the __Host- and __Secure- prefixes enforce those guarantees at the browser level.
阅读Regex Anchors and Boundaries
Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause.
阅读XXE and Why a SAML Parser Rejects DOCTYPE
How XML External Entity (XXE) attacks work, the billion-laughs denial-of-service, why both depend on a DTD, and why a hardened SAML decoder rejects any DOCTYPE or entity declaration outright rather than trying to parse it safely.
阅读Clickjacking and Frame Control
What clickjacking is, how framing makes it possible, the difference between the legacy X-Frame-Options header and the modern CSP frame-ancestors directive, why ALLOW-FROM is obsolete, and how the two controls interact.
阅读Regex Flags and Modes
A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion.
阅读SAML Bindings and SP vs IdP Initiation
A SAML flow can start at the service or at the identity provider, and the messages can travel by two different bindings: an HTTP redirect with the message packed into the URL, or an auto-submitting HTML form that POSTs it. Which binding carries which message, and where the flow begins, explains a lot of SSO behavior.
阅读The SAML Proxy: Inserting an Identity Layer into a Session
A SAML proxy sits in the SSO flow rather than the packet path: it terminates the user's request, forces authentication against an identity provider, and only then lets the session through, using SAML's browser-redirect model. It can act as a service provider to the IdP and an identity provider to the app at once (a proxy or broker), which is how one login federates many downstream systems. This explains the roles, the flow, and why it is a proxy at all.
阅读Reading OGNL in a WAF Log: What the Payload Was Trying to Do
An OGNL payload in a log has two halves worth telling apart: something that tries to switch off the expression sandbox, and something that tries to run a command. A payload with both is an exploitation attempt. A payload with only the second is usually a scanner working through a list. A payload with neither is a probe checking whether input gets evaluated at all - and that answer decides whether anything else in the list could ever work.
阅读XXE and External Entities
XML lets a document declare entities, and an external entity can point at a file or URL. A parser that resolves one can be tricked into reading local files or making server-side requests, the XXE vulnerability. The fix is blunt and effective: do not process a DOCTYPE at all.
阅读Billion Laughs and Entity Expansion
Entities can reference other entities, and if each one multiplies the last, a tiny document can expand to gigabytes and exhaust memory. The billion laughs attack weaponizes this into a denial of service. The defense is to cap expansion or refuse the DOCTYPE outright.
阅读How CVSS Scoring Works
CVSS turns a short vector string into a 0 to 10 severity number using a fixed formula. The Base score is built from two sub-scores: Exploitability (how reachable and easy the flaw is) and Impact (how bad the outcome is). Everything else refines that base. This is arithmetic, not opinion, which is why a calculator can reproduce any published score exactly.
阅读The CVSS Base Metrics, Explained
The Base score comes from eight metrics in two families. Four exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) describe how hard the attack is, and four impact metrics (Scope, plus Confidentiality, Integrity, Availability) describe the damage. Scope is the subtle one: it is what lets a score exceed the vulnerable component's own boundary.
阅读CVSS Temporal and Environmental Scores
The Base score is only the starting point. Temporal metrics lower it as facts emerge, such as a patch being released, and can only reduce the score. Environmental metrics let an organization re-score the flaw for its own systems by raising or lowering the importance of confidentiality, integrity, and availability and by overriding base metrics. Both are optional but produce a more honest number.
阅读Reading a CVSS Vector String
A CVSS vector is a compact, self-describing string: a version prefix followed by slash-separated metric:value pairs. Learning to read it directly, rather than trusting a rendered score, lets you spot transcription errors and understand exactly what a vendor claimed. The Base metrics are mandatory and the rest are optional.
阅读CVSS Severity Bands, and What the Score Does Not Tell You
The 0 to 10 number maps to five qualitative bands from None to Critical. That mapping is useful for triage, but a CVSS Base score measures severity, not risk. It says nothing about whether a flaw is being exploited, how valuable the asset is, or what controls you have. Treating the base number as a priority queue is the most common way teams misuse CVSS.
阅读CVSS v3.0, v3.1, and v4.0: What Changed
This decoder computes CVSS v3.0 and v3.1. The two v3 releases share a formula but differ in rounding and one environmental term, so scores can differ by a tenth. CVSS v4.0, released in 2023, is a larger redesign with new metric groups and no Scope metric, and its vectors are not compatible with v3 tooling. CVSS v2 is retired.
阅读Passive TLS Fingerprinting: JA3, GREASE, and the Churn That Led to JA4
A ClientHello announces the client in the clear, and the combination of versions, ciphers, and extensions is characteristic of the software that sent it. This covers how JA3 turns that into a hash, why GREASE has to be stripped, how extension-order randomization broke JA3 (the churn), how JA3N and JA4 restore stability, and where a TLS fingerprint fits as a signal for secure web gateways and adaptive authentication.
阅读What Is Server-Side Request Forgery (SSRF)
SSRF is a vulnerability where an attacker makes a server issue an HTTP request to a destination of the attacker's choosing. Because the request originates inside the server's network, it can reach internal services, cloud metadata, and loopback addresses that the attacker could never reach directly. The fix is to validate the destination, not the URL string.
阅读Private, Reserved, and Public IP Ranges
IANA records every special-purpose IPv4 and IPv6 block, from loopback, link-local and private-use space to shared address space, documentation and the translation prefixes, and two columns of its registries, Destination and Globally Reachable, decide whether an address is a public destination. After reading, you can read those columns, classify an address only after turning its spelling into the number a client connects to, explain how a public destination can still lead inside through a second DNS lookup or a redirect, name the cloud metadata addresses, and test an SSRF filter.
阅读IP Address Obfuscation Tricks
One IP address can be written in many forms: plain decimal, octal, hexadecimal, short-hand, and IPv4-mapped IPv6. Each form parses back to the same address, which is how attackers slip an internal target past a filter that only blocks the dotted-decimal spelling. This is why SSRF checks must decode, not string-match.
阅读Cloud Metadata Endpoints and SSRF
Every major cloud gives an instance a metadata service at a fixed link-local address, and it can return temporary credentials for the instance's role. That makes it the single highest-value SSRF target. Knowing the endpoints, and the IMDSv2-style defenses, is essential for both attack understanding and defense.
阅读Defending Against SSRF with Allow-Lists
The durable SSRF defense is an allow-list of intended destinations, combined with resolving the address before you trust it and re-checking after redirects. Block-lists of internal ranges help, but they lose to obfuscation and DNS rebinding. This is the layered approach that holds up.
阅读Dangerous URL Schemes in SSRF
SSRF is not limited to http. Schemes like file, gopher, dict, and ftp let an attacker read local files or craft raw bytes to internal services such as Redis and SMTP. A URL fetcher that does not restrict the scheme hands an attacker a far more powerful primitive than a plain web request.
阅读SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It
To inspect encrypted outbound traffic, a forward proxy performs a controlled man-in-the-middle: it terminates the user's TLS session, opens its own to the real server, and forges a certificate for that server signed by a private CA the organization's own devices trust. This explains the mechanics, the trust model that makes it safe (and dangerous), and why pinning, HSTS, and mutual TLS defeat it.
阅读The LGPD for Engineers: The Vocabulary That Matters
Brazil's data protection law assigns you a role, gives you ten legal bases instead of one, and puts a three-working-day clock on breach notification. What controlador, operador, and encarregado mean when you are the one running the systems.
阅读Hacking in the 20th century: a field guide to the people who took things apart
From a blind boy whistling into a telephone in the 1960s to seven hackers testifying to the US Senate under their handles in 1998 - the whole arc, in one place. Who the people were, what they actually did, which stories are true, and how a criminalised subculture ended up building the security industry that now employs it.
阅读Passive Fingerprinting: What You Emit Without Being Asked
Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.
阅读Phreaking: the network that whistled its own passwords
Before anyone hacked a computer, they hacked the phone company - because the long-distance network carried its control tones on the same wire as the voice, and a toy whistle from a cereal box happened to sing the magic frequency. Joybubbles, Captain Crunch, the Esquire article that lit the fuse, the blue box two kids named Steve sold before they founded Apple, and the architectural lesson the industry paid dearly to learn: never put the control plane in the data plane.
阅读The Morris Worm: the night the internet found out it was fragile
On 2 November 1988 a Cornell graduate student released 99 lines of C to measure how big the internet was. A single arithmetic decision about reinfection turned the measurement into the first internet-scale disaster, birthed the CERT system, produced the first conviction under the brand-new Computer Fraud and Abuse Act, and taught the network a lesson about monoculture and trust it is still relearning.
阅读The Cuckoo's Egg: 75 cents, ten months, and the invention of incident response
In 1986 an astronomer was handed a trivial accounting discrepancy and told to find it. He followed it through a Berkeley lab into US military networks and out the other side to a West German hacker selling access to the KGB - improvising, along the way, the logbook, the timeline, the honeypot and nearly every reflex the profession now teaches.
阅读Kevin Mitnick: the myth, the man, and what the case actually decided
He was called the world's most dangerous hacker, held for years without trial, and forbidden to touch a telephone unsupervised - on the strength of claims that could not survive contact with the record. The real story is smaller and far more useful: a social engineer of extraordinary skill, a press narrative that became a prosecution, and a case that shaped how computer crime is charged and how researchers are treated to this day.
阅读Kevin Poulsen: the man who won a Porsche by owning the phone company
Dark Dante took over every incoming line at a Los Angeles radio station to guarantee he was caller 102, and drove away in a Porsche. He was also a defence contractor by day, the first American charged with espionage for a computer crime, and - after five years in prison - the editor who broke some of the biggest security stories of the 2000s and co-built a leak system for journalists.
阅读The 414s and the summer of 1983: the year hacking became a crime
Six Milwaukee teenagers with modems wandered into a cancer hospital, a bank and a nuclear weapons laboratory. WarGames opened the same summer. Newsweek put a hacker on the cover, Congress held hearings with the movie playing on a screen, and within three years the United States had the law under which computer crime is still prosecuted.
阅读The Chaos Computer Club, the Btx heist, and the hack that ended in a forest
Germany's hacker scene took a different road from America's: organised, political, and arguing in front of cameras. In 1984 the Chaos Computer Club moved 134,000 marks out of a bank overnight and gave it back on television. Four years later, a different Hanover crew sold their intrusions to the KGB, and one of them died in a forest at twenty-three.
阅读LOD, MOD and Operation Sundevil: the Great Hacker War and the raid that created the EFF
Two crews fought over the American telephone network for pride. Then the Secret Service arrived in fourteen cities, seized a role-playing game manuscript as a hacking manual, and prosecuted a magazine over a document that could be ordered for thirteen dollars. Both cases collapsed, and out of the wreckage came the Electronic Frontier Foundation.
阅读Phrack, 2600 and the underground press: how the scene published itself for fifty years
A Yippie newsletter about cheating the phone company in 1971. A three-sheet quarterly with a circulation of twenty-five in 1984. A St. Louis bulletin-board zine that shipped its first issue in November 1985 and its seventy-second, in fifteen thousand printed copies, in August 2025. Before conferences, bug bounties or a security industry, the scene had a press - and the press paid, in raids, indictments and injunctions, for what it printed.
阅读L0pht, cDc, and the year the underground walked into the Senate
In May 1998 seven hackers testified to the United States Senate under their handles and said they could take down the internet in thirty minutes. Two months later the Cult of the Dead Cow released Back Orifice on a DEF CON stage to force Microsoft's hand. Between them, 1998 is the year the scene stopped being a subculture and started becoming an industry.
阅读The Electronic Frontier Foundation: the lawyers who built a codebreaking machine and a certificate authority
It began with an FBI agent in a Wyoming ranch kitchen in 1990. It established that source code is speech, built the machine that ended DES, put the room on Folsom Street into a courtroom, and then stopped suing long enough to write the software that made HTTPS the default. This is what a civil-liberties organisation did to the network engineer's daily work.
阅读The manifestos: the Mentor, the cypherpunks, the Declaration, and the texts a culture wrote about itself
Four hundred and fifty words typed by a nineteen-year-old the night after his arrest in 1986. A crypto-anarchist's pastiche of Marx read to a conference in 1988. Seven paragraphs on privacy in 1993, sixteen on independence from a hotel in Davos in 1996, and a page written in Italy in 2008 that a prosecutor would later read aloud. What the hacker culture's founding texts say, why each was written when it was, and where to read them in the original.
阅读The named TLS attacks, 2011-2023: what each one broke, and what the protocol removed because of it
BEAST, CRIME, Lucky13, Heartbleed, POODLE, FREAK, Logjam, DROWN, SWEET32, SLOTH, ROBOT, ROCA, Raccoon, ALPACA, Terrapin. Fourteen names, twelve years, one pattern: each attack found a feature the protocol should never have kept, and TLS 1.3 is the list of what was taken away. This is the guide to reading a cipher-suite report as history.
阅读The WANK worm and the International Subversives: the Australian chapter
Days before NASA launched a plutonium-powered probe, its computers greeted operators with an anti-nuclear protest banner. The first hacktivist worm was never definitively attributed, but the trail points to a Melbourne scene that also produced the book Underground - researched by a young hacker called Mendax, who later founded WikiLeaks.
阅读DEF CON: a farewell party that became an institution, and the red shirts who run it
It started in 1993 as a going-away party for a friend's bulletin board network. Thirty years on it fills Las Vegas with tens of thousands of hackers, runs on cash at the door, and is held together by unpaid volunteers in red shirts who pay their own way to be there. The Goons are the reason it works, and the reason it still feels like a community rather than a trade show.
阅读EternalBlue, WannaCry, NotPetya: the year a stolen exploit went to work for everyone
In April 2017 an anonymous group published a working NSA exploit for a protocol running on every Windows machine in the world. Microsoft had patched it a month earlier. Within eight weeks it powered the two costliest cyber incidents in history - one stopped by a researcher who registered a ten-dollar domain, the other unstoppable because it was never meant to be stopped.
阅读Stuxnet: the first cyberweapon, and the day code broke machinery
A worm carrying four unknown Windows exploits crossed an air gap into an Iranian enrichment plant, spun centrifuges to destruction, and played recorded normal readings to the operators watching the screens. It was found only because it escaped. Everything about state cyber operations since - including the leaks that armed the world - starts here.
阅读The RFC series: how the internet writes itself down
In April 1969 a graduate student wrote up some notes about host software and, worried about sounding presumptuous, called them a Request for Comments. Nine thousand documents later that hedge is still the name of the process by which every protocol you operate was agreed. What an RFC is, what its status actually means, and why the numbering has an April Fools tradition.
阅读Anonymous, LulzSec and the hacktivist decade
A leaderless collective from imageboard culture became the public face of protest hacking, defended WikiLeaks, joined the Arab Spring, and then splintered into a six-person crew that breached Sony, PBS and an FBI affiliate in fifty days - while its leader was already an informant. The decade that followed defined what a movement with no accountability structure can and cannot do.
阅读The protocol wars: how TCP/IP won against everyone's expectations
Every government, every telephone company, every major computer manufacturer and the US Department of Defense backed OSI. The specification was more complete, more rigorous, and formally agreed by the world's standards bodies. It lost to a protocol suite designed by graduate students and given away free, and the reason it lost is the most useful lesson in this catalogue for anyone choosing a technology today.
阅读The Crypto Wars: thirty-three years of the same argument
In 1993 a government proposed a telephone chip whose encryption was strong and whose keys it kept a copy of. The proposal died in three years. The argument did not: it returned as export control, as a standards backdoor, as a court order against a phone manufacturer, and as a secret notice to a cloud provider that is still before a tribunal. Every round asks whether exceptional access can be added to a secure system, and every round gets the same engineering answer.
阅读The Crypto Wars: when encryption was a munition
For most of the 1990s, exporting strong cryptography from the United States was legally equivalent to exporting a weapon. A programmer gave away an encryption tool and faced three years of criminal investigation; a T-shirt with four lines of code on it was an export-controlled item; and the government proposed a chip that would encrypt your calls while keeping a copy of the key. The fight over that decade decided whether the modern web could exist.
阅读2011: the year the trust anchors broke
In March a spear-phishing email with an Excel attachment reached the company whose tokens guarded the world's defence contractors. In June a certificate authority trusted by every browser on earth was taken over, and issued 531 fraudulent certificates that were used to read the mail of some 300,000 Iranians. Both were found late, both were disclosed later still, and the second company no longer exists.
阅读The Latin American security conference circuit: an index
Latin America built its own conference circuit rather than importing one - Ekoparty in Buenos Aires since 2001, H2HC in São Paulo since 2004, DragonJAR in Colombia, 8.8 in Chile, RoadSec touring Brazil's capitals. This is the index: who founded each one, what each is actually for, and how they differ from the northern events they are usually compared to.
阅读Moonlight Maze, Titan Rain, Aurora: the three campaigns that taught the industry a new word
Between 1996 and 2010 three intrusion campaigns moved the target from government networks, to the contractors that serve them, to the technology companies everyone uses. One was found by accident, one by a man working nights who lost his job over it, and one was announced by the victim on its own blog - a decision that changed how breaches are disclosed and produced the architecture now sold as zero trust.
阅读The Brazilian scene: from Alternex to a conference every month
Brazil's hacker culture did not start in a dorm room or a phone company - it started in a social-justice NGO that put the country's first public network online, and it grew through BBSs, a world-class fraud underground, an unusually open governance system, and a conference calendar so dense that most weeks of the year have one. What the scene is, how it got here, and what it looks like now.
阅读Brazilian cybercrime: from the boleto to the Pix
Brazil banked online early, invented payment instruments the rest of the world did not have, and grew a criminal industry precisely shaped to them: barcode manipulation, screen overlays, ATM jackpotting, and now social engineering aimed at instant transfers. The techniques, the crews that exported them, the attacks on the state, and the laws written after each shock.
阅读The worm era, 1999-2008: Melissa to Conficker, and the patch that always existed
Seven outbreaks in nine years took email, then web servers, then databases, then any reachable Windows machine. In almost every case the fix had shipped weeks or months earlier and had not been installed - and in the last one, Microsoft's bulletin had said in writing that the flaw was wormable. This is the era that produced automatic updates, the on-by-default firewall, and the argument the industry is still having.
阅读There is no perfect code: why security is a clock, not a codebase
Every vendor of consequence has shipped a flaw that facilitated a breach, and every one of them will again. What separates organisations is not defect density - it is the time between compromise and detection, detection and containment, containment and a definitive fix, and the honesty of what gets said in between. This is the argument, with the evidence, and an open question about what AI does to both sides of the clock.
阅读Why the SSL-VPN is being dismantled, and what is actually replacing it
FortiOS 7.6.3 removed SSL VPN tunnel mode from every FortiGate, and existing settings are not carried over on upgrade. That is a verified fact with real operational consequences. The claim that every vendor is abandoning SSL-VPN is more complicated, and most of the timelines circulating are published by companies selling the replacement. Here is what is established, what is inference, and what a practitioner should actually do.
阅读WireGuard: the argument that a tunnel should be small enough to read
About four thousand lines of code, one cipher suite with no negotiation, no user identity, and no way to ask for a weaker option. It was merged into the Linux kernel in 2020 with a public endorsement from Torvalds, and it is the default inside most of the products now sold as zero-trust access. It also cannot do several things an enterprise needs, and knowing which is the point of this article.
阅读Fiddler, Burp, Cain and the rest: the tools that read a conversation they were not part of
A debugging proxy, a penetration tester's suite, a password recovery program from a one-man Italian site, and a corporate inspection appliance all perform the same operation - terminating a connection the two endpoints believe is theirs. What separates them is not technique but consent and disclosure. Where each one sits, what defeats it, and why the tool everyone learned on has vanished from the web.
阅读Wireshark: the tool that made packets legible, and the stack underneath it
In July 1998 a network engineer at a small Kansas City provider announced a program he had written because the commercial analysers cost fifteen hundred dollars and did not run on his platforms. Within days strangers were sending patches. It lost its own name to a trademark in 2006, outlived three corporate sponsors, and is now the reason a practitioner can read a protocol they have never met.
阅读KRACK and Dragonblood: what happened after WEP, and why a proven-secure handshake still broke
WPA2's four-way handshake had been formally analysed and declared secure. In 2017 a researcher at KU Leuven broke it anyway, by making a client reinstall a key it was already using. Its replacement, WPA3, shipped in 2018 and was broken by the same researcher in 2019. Neither failure was in the cipher, and that is the whole lesson.
阅读Reflections on Trusting Trust: the 1984 lecture that predicted every supply chain attack since
Ken Thompson used his Turing Award lecture to explain how he had put a backdoor in the C compiler that would reinsert itself every time the compiler was rebuilt - and then deleted the evidence from the source. Reading the source would never find it. Forty-two years later there is exactly one method that formally defeats it, and the reason XZ Utils and 3CX worked is that almost nobody uses it.
阅读The Kaminsky flaw: the summer eighty vendors patched the same bug on the same day
In 2008 a researcher realised that a known weakness in DNS was far worse than anyone had calculated - not a way to poison one record, but a way to take a whole domain in seconds, repeatably. What followed was the largest coordinated patch the internet had ever attempted, a fix that bought entropy rather than certainty, and a reminder that publishing a patch also publishes the vulnerability.
阅读Mirai: the botnet that did not exploit anything
Three students in their early twenties built it to win at Minecraft server hosting, and it produced the largest attacks the internet had seen. It used no vulnerability. It logged in, with a list of about sixty factory usernames and passwords, to cameras and routers whose owners did not know they had an account. You cannot patch a default, which is why the eventual fix was a law.
阅读Certificate authorities: the padlock is a list of people you have never met
Your browser trusts a few hundred organisations to vouch for who owns which name, and any one of them can issue a valid certificate for any site on the internet. That design has failed in public at least once badly enough to end a company and expose a country's dissidents. What breaks when a CA is compromised, why revocation barely works, and how the industry replaced trust with surveillance of itself.
阅读Target, 2013: the alerts fired, and nobody moved
An air-conditioning contractor in Pennsylvania opened a phishing email. Six weeks later, malware on the tills of 1,797 stores was reading payment cards out of memory during the busiest three weeks of the retail year. The security tooling detected it and raised alarms while it was happening. That is the part worth teaching, because nothing about this breach was a failure of technology.
阅读Y2K: what it costs to be right about a disaster that then does not happen
Somewhere between two hundred and six hundred billion dollars was spent, midnight passed, almost nothing broke, and the people who did the work have been called frauds ever since. The honest account is more interesting than either side's version: some of the fear was well founded, some of it was demonstrably not, and one comparison has never been satisfactorily answered.
阅读Unix: the operating system inside every box on your network
Log into a load balancer, a firewall or an access point and look underneath the management interface. There is a filesystem, a shell, syslog, cron and tcpdump. The appliance is a Unix with a product on top, and it is that way because of a 1956 antitrust settlement that stopped a telephone company from selling software.
阅读Email authentication: what SPF, DKIM and DMARC each actually do
Mail was designed with no way to check who sent it, and the three records everyone publishes fix different halves of that problem: badly explained, frequently misconfigured, and routinely credited with protection they do not provide. What each one checks, why alignment is the idea that matters, why forwarding breaks things, and the deployment order that actually reaches enforcement.
阅读Shellshock and Log4Shell: when the vulnerability is a feature
Neither was a memory bug. In both cases a widely used component did exactly what its documentation said, to a string that had come from a stranger. One sat undiscovered in bash for about twenty-two years; the other made logging - the single thing every application does with untrusted input - into remote code execution. This is the class of flaw that testing for crashes will never find.
阅读Diffie-Hellman explained without the mathematics
Two people who have never met, shouting across a crowded room where everyone can hear, end the conversation knowing a secret number that nobody else in the room knows. It sounds like a trick. It is the single idea that makes it possible to buy something online, and this is how it works, with one equation and no prior knowledge.
阅读Passkeys: why this MFA is different from the MFA that keeps failing
Most multi-factor authentication stops password reuse and does nothing about phishing, because anything a user can read out or type in can be relayed by an attacker in real time. Passkeys close that by binding the credential to the site's origin in the browser. What WebAuthn actually does, why origin binding is the whole trick, and the recovery and account-lifecycle problems nobody solved yet.
阅读Backups: the control that has to work when every other one has failed
Ransomware turned backups from an availability concern into the last line of defence, and then went after the backups themselves. What changed, why the old 3-2-1 rule needs a fourth clause, why an untested restore is a rumour, and the uncomfortable fact that backups solve the encryption half of a modern extortion attack and nothing of the disclosure half.
阅读Therac-25: the machine whose predecessor had the same bugs and hurt nobody
Between 1985 and 1987 a radiation therapy machine delivered massive overdoses to at least six patients. The software defect was serious. The finding that made it the most-taught case in software engineering is different and worse: the previous model ran comparable faulty code for years without injuring anyone, because it had hardware that would not let it.
阅读DDoS: why the defence is capacity, and why amplification is everyone else's fault
Denial of service is not one attack but three problems with different answers: a pipe that fills, a state table that exhausts, and an expensive request repeated cheaply. The largest attacks are only possible because other people's networks let forged traffic out, which makes the most effective mitigation something you deploy for strangers, not for yourself.
阅读The STJ attack, 2020: the fortnight Brazil's second-highest court stopped
On 3 November 2020 ransomware encrypted the case files of the Superior Court of Justice. Hearings were cancelled, procedural deadlines were suspended by resolution, and the systems came back fifteen days later. It was part of a wave against the Brazilian judiciary, and the accounts of what happened to the backups have never been reconciled.
阅读SATAN, 1995: the scanner that got its author fired
Two researchers built a program that found security holes across a network, explained each one in plain language, and told you how to fix it. Before it was released the press predicted disaster, a national laboratory braced for invasion, and Silicon Graphics fired one of the authors. The industry then spent thirty years agreeing with him, and the argument has just started again.
阅读Zero trust, ZTNA and SASE: what the terms mean when you remove the marketing
Zero trust is an architectural principle, ZTNA (zero trust network access) is a way of publishing applications, and SASE (secure access service edge) is a purchasing arrangement. Vendors blur all three because the confusion sells. Here is what each actually is, what genuinely changes when you adopt them, and the honest list of things they do not fix.
阅读Ariane 5: the code was correct, and the world had changed
Forty seconds into its first flight the rocket destroyed itself. The software that killed it was working exactly as written and had flown successfully many times on the previous model. It was calculating something that was not needed after lift-off, from a routine nobody had thought to switch off, using an assumption that had been true of a different rocket.
阅读Knight Capital: forty-five minutes, and a rollback that spread the fault
A trading firm handling a tenth of American equity volume deployed new code to seven of its eight servers. The eighth still held a feature that had been dead since 2005, wired to a flag the new code had reused. Ninety-seven warning emails went out before the market opened. And when engineers understood what was happening, they rolled back - putting the defective code on all eight.
阅读SIEM: why it costs so much and detects so little
A SIEM is a database with a search box and a scheduler. It detects nothing by itself, and most deployments fail the same way: bought as a product, funded as a project, fed everything, tuned by nobody. What makes the difference is treating detections as engineered artefacts with owners, tests and a documented response.
阅读Schrems II: the day a court read the surveillance record and drew a conclusion
In 2020 Europe's highest court struck down the legal basis five thousand American companies used to move personal data across the Atlantic. Its reasoning was not about contracts. It was about what United States intelligence law actually permits, and whether a European whose data was collected under it had anywhere to complain. The engineering consequence is the part practitioners keep getting wrong.
阅读The 500-mile email: the best debugging story in the profession
A statistics department reported that it could not send email more than about 520 miles. The sysadmin's first reaction was that email does not work that way. The department had a map. The cause was a configuration file, an upgrade, a timeout set to zero, and the speed of light - and every element of it can still happen to you this afternoon.
阅读The Silk Road: the anonymity network held, and the operator did not
Tor was never broken. The site's founder was identified because in 2011 he had advertised the marketplace on public forums under a nickname, and one of those posts carried his real email address. How investigators found the server itself is a different question, and one a court declined to answer - because answering would have required the defendant to admit the server was his.
阅读You Sh0t the Sheriff: the podcast that turned into Brazil's most exclusive security conference
Three people in three cities started a security podcast in 2006. The event came afterwards, and it inherited the podcast's shape: small on purpose, invitation-only, venue kept secret until you are confirmed. Two decades on, the podcast is still recording and the conference has put Jeff Moss and Space Rogue on the same stage as the people who wrote Brazil's own tools.
阅读Security versus availability: the trade nobody writes down
Every security control is also a new way for the system to stop working. The triad puts confidentiality, integrity and availability on the same footing and then organisations staff them separately, measure them separately, and discover the conflict during an incident. The history of the trade-off, where it is decided in practice, the failure modes on both sides, and how mature teams price it before the outage rather than after.
阅读The Pentium FDIV bug: a small defect and a $475 million answer
Five missing entries in a lookup table made certain divisions slightly wrong. Intel had found it internally, decided it did not qualify as an erratum, fixed it quietly and said nothing. When a mathematics professor found it independently, the company offered replacements only to customers who could prove they were affected - and turned a rare arithmetic flaw into the most famous recall in computing.
阅读Mars Climate Orbiter: both sides were correct, and the spacecraft was lost
One program produced impulse figures in pound-force-seconds. The program that consumed them expected newton-seconds. Neither was wrong internally, the specification said which was required, and nothing checked. The famous version of this story is a unit conversion; the useful version is what happens at a boundary between two organisations, and what the team did with four months of warning.
阅读Security through obscurity: what Kerckhoffs actually said
The maxim is quoted as a prohibition on hiding anything, which is not what it says and not what the field practises. Kerckhoffs in 1883 and Saltzer and Schroeder in 1975 were making a narrower and sharper claim about which secret a system may depend on. The history, the difference between a secret and an obscurity, where each is legitimate, and the systems that proved the point by being broken the moment somebody looked.
阅读How systems fail: a reader's map to the cases in this catalogue
Nine failures, sorted not by industry or decade but by where the failure actually lived - in a safeguard someone removed, an assumption that expired, a rollback, a boundary between two organisations, a decision about what to say. Read as a set they stop being anecdotes and start being a checklist of the places to look.
阅读The disclosure record: what happened between finding it and saying it
Every case in this catalogue has an interval in it - between the moment someone knew and the moment anyone else did. Sometimes it was six hours and sometimes it was a decade. This page collects the cases where that interval decided the outcome, and what each one settled about coordinating, withholding, publishing and being believed.
阅读The Firewall: Birth, Generations, and What Comes After the Perimeter
Nobody invented the firewall. It was argued into existence over roughly six years by people at Digital Equipment Corporation, Bell Labs and Trusted Information Systems who disagreed about almost everything except that a network needed a place to say no. This is the family history: the 1988 paper, the first product delivered on 13 June 1991, the stateful inspection patent that decided the market, the proxy camp that lost on performance and was right about inspection, the appliance, the next-generation label, and what happens to a boundary device in an estate that no longer has a boundary.
阅读The Brazil thread: six articles that only make sense together
A market reserve that produced clones and smuggling, a governance model that was multistakeholder before the word existed, a hacker culture that began in a social-justice NGO, a criminal industry shaped to payment instruments no other country had, a data protection law with ten legal bases and a three-day clock, and the fortnight a supreme court stopped. Read separately they are country facts. Read in order they are one argument about what happens when a large country builds its own internet.
阅读Intrusion Detection: The Discipline Built on Reading the Logs
Intrusion detection began as a filing problem. James Anderson's 1980 report proposed auditing a computer's records to find abnormal usage; Dorothy Denning and Peter Neumann turned that into a real-time model between 1984 and 1986; Todd Heberlein moved it onto the wire in 1990; and Marty Roesch gave it away in 1998. This is the family history, including the split into detection and prevention that was a business decision as much as a technical one, and why the hardest problem in the field has always been the person who has to read the output.
阅读The Web Application Firewall: Bought by Auditors, Blamed by Engineers
The first web application firewall and the first web application scanner were built by the same company, which is the structural fact this family is usually explained without. AppShield shipped in the summer of 1999; ModSecurity opened the category in 2002; the OWASP Top 10 gave it a vocabulary in 2003; and PCI DSS made it a purchase in 2004. This is the family history, including why a technology with twenty-five years of development is still described by its own professional bodies as a magic black box that does security.
阅读SAST and DAST: Two Lineages, One Budget Line
Static and dynamic application security testing are sold as a pair and descend from completely different places. SAST comes from lint, written at Bell Labs in 1978 to solve a portability problem and only later pointed at security. DAST comes from the attack tooling of the late 1990s, built by the same company that built the first web application firewall. This is the family history, including why the founding tool's own name became a term of abuse, and why the two approaches disagree by construction rather than by quality.
阅读Encryption: The Standard, the Suspicion, and What the Suspicion Got Wrong
Civilian cryptography has a founding document and a founding argument. The document is the Data Encryption Standard, issued in January 1977 from a cipher IBM built on Horst Feistel's Lucifer. The argument is what the National Security Agency did to it - and the answer, which took seventeen years to emerge, is that the agency made the algorithm stronger against an attack nobody outside knew existed while shortening the key. This is the family history: from a filename too long for an operating system, through the crypto wars, to a standards process that now runs in the open because of what that suspicion cost.
阅读The Hardware Security Module: The Man Who Invented Both Halves
Mohamed Atalla invented the MOSFET at Bell Labs, watched it be overlooked, resigned, and twelve years later invented the hardware security module. The transistor technology that made modern computing possible and the box that protects its most valuable secrets came from the same person - and he had to leave the world's foremost research laboratory to build the second one. This is the family history: the Atalla Box of 1973, a standard created out of fear that one company would dominate, an assurance level almost nobody reaches, and what happens when the answer to key management moves into somebody else's cloud.
阅读Identity: The L in LDAP Is an Argument
X.500 was a good data model wrapped in a protocol nobody could deploy. In July 1993 three engineers published a specification whose entire premise was throwing most of it away, and called the result Lightweight. This is the family history of identity - from per-machine password files to NIS, X.500, LDAP, Kerberos, SAML and OpenID Connect - and the argument that runs through all of it: whether identity is something a network asserts, something a directory stores, or something a third party vouches for.
阅读PKI: An Undergraduate Thesis, and a Trust Model Nobody Would Design Today
In May 1978 an MIT undergraduate wrote a thesis that named the certificate, named the revocation list, and laid out the structure the web still runs on. What grew around it is a trust model that no one would propose from scratch: roughly a hundred trusted issuers, any of which can vouch for any name on the internet, with the weakest setting the strength for everyone. This is the family history - Kohnfelder in 1978, X.509 in 1988, the compromises of 2011, Certificate Transparency as the fix, and a price that fell from hundreds of dollars to nothing.
阅读Denial of Service: The Keynote Interrupted by Its Own Subject
In February 2000 Steven Bellovin was five minutes into a conference keynote on denial-of-service attacks when pagers started going off and the room emptied. The attack under way was launched by a fifteen-year-old using tools he had not written. This is the family history - Trinoo in 1999, the week that took down Yahoo, Amazon, eBay and CNN, the amplification pattern this catalogue has now documented three times, and why the only real defence is capacity nobody can afford alone.
阅读Email: A Side Project That Became the Identity Layer
Ray Tomlinson's employer did not ask him to build email. He was, in a colleague's words, just fooling around, looking for something to do with the ARPANET - and he assembled it from a local messaging tool and a file transfer program. The specification written eleven years later allowed the sender shown to a human to differ from the sender declared to the server, which is the design decision that created phishing. This is the family history, and it ends with the clearest exception yet to a rule this catalogue thought it had established.
阅读Network Access Control: The Idea That Was Right Too Early, Twice
Network access control was not invented for the local area network. It was invented in 1984, at BBN, for the device you dialled into - and it was built to make people authenticate less, not more. This is the family history: from the terminal access controller through dial-up authentication and 802.1X to Cabletron's connection-oriented fabric, the Enterasys loop that detected, located, contained and remediated automatically, the decade in which the whole idea was declared a failure, and its return under a name with better marketing.
阅读How a Proxy Knows Who You Are: User Authentication Methods Inline
Policy per user is the whole promise of an inline proxy - which means the proxy must attach an identity to every flow, including the ones that cannot log in. The four working patterns: explicit 407 challenges, cookie-based web authentication, agent-asserted identity, and the surrogate-IP compromise - plus where each one breaks, because every one of them breaks somewhere.
阅读Data Loss Prevention: How Machines Recognize Secrets
Every DLP product answers the same question - is this outbound content sensitive? - with the same four instruments: patterns, dictionaries, exact data matching against fingerprinted records, and indexed document matching against fingerprinted files. What each instrument can and cannot recognize, why confidence scores and proximity exist, and why the hard part of DLP was never the matching.
阅读Sandbox Detonation: Judging a File by What It Does
Signatures recognize malware that has been seen; a sandbox convicts malware that has not - by running the file in an instrumented cage and watching its behavior. What detonation actually observes, why verdicts take minutes, the patient-zero window that timing creates, how hash sharing turns one verdict into everyone's protection, and the evasion arms race that keeps cage-builders employed.
阅读Browser Isolation: When You Cannot Trust the Page, Move the Browser
Remote Browser Isolation stops asking whether a page is safe and removes the question: the real browser runs in a disposable cloud container, and the endpoint receives only a rendered projection - pixels or a reconstructed DOM. What each rendering mode trades, why isolation is the answer for the uncategorizable middle, what it costs, and where its honest limits sit.
阅读CORS Explained: The Border Control of the Browser
CORS is the most misunderstood error message in web development, because it punishes the wrong mental model. It is not a wall - the same-origin policy is the wall; CORS is the door: a header protocol by which a server volunteers 'that other origin may read my responses.' Simple requests vs preflights, what OPTIONS is doing in your network tab, why credentials tighten every rule, why '*' is not the fix, and why CORS never protected the server in the first place.
阅读LDAP search filters: reading the parentheses
Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.
阅读OAuth flows: choosing the grant in 2026
One decision starts every integration: which flow. The modern answer is short - authorization code + PKCE for humans, client credentials for machines, the device grant for TVs - and the reasons implicit and ROPC died are worth knowing by heart. RFC 9700 finally wrote it all down.
阅读Memory safety: the bug classes and the defenses that answer them
Buffer overflow, use-after-free, null dereference, integer overflow - four names for two failures, staying inside an object and only touching it while it is alive. How each one works, why roughly seventy percent of serious vulnerabilities in large C and C++ codebases belong to this family, and what each defensive layer actually buys.
阅读Tor: how onion routing actually works, and what it does not protect
Onion routing was invented at a US Navy lab, and that paradox is the key to understanding it: anonymity only works if the crowd is diverse. How a three-hop circuit is built, what onion services really are, the threat model Tor openly admits it loses to, and why most Tor traffic never touches the dark web at all.
阅读DNS blocklists: RPZ, ratings, and what a refused answer costs
Blocking a domain at the resolver is the cheapest security control there is, which is why every vendor sells one. How RPZ feeds work, what a vendor DNS rating actually rates, the two failure modes nobody plans for, and why the block you cannot see is worse than the one you can.
阅读The SolarWinds compromise: how a signed update became the largest supply chain attack on record
From September 2019 an intruder sat inside SolarWinds' build system, tested in October, and from February 2020 inserted a backdoor into the Orion monitoring platform that SolarWinds itself signed and shipped. Fewer than 18,000 customers installed it; a handful were walked through. Found in December 2020 by a victim investigating its own breach, named to Russia's SVR in April 2021, and still in court in 2024 over what the company had said about its security.
阅读Traffic diversion and the man in the middle: the family, and the one move they share
A map of the ways traffic is steered through somewhere it was not meant to go, and the defence that answers each. Every method, from ARP poisoning on a LAN to a BGP hijack across the internet, is a variation on one move: become the path. This opener explains the shared principle, sorts the methods by the layer they work at, and links to the detailed walkthrough for each, with the standard mitigation named beside every one, because the reason to understand an attack on a training site is to recognise and stop it.
阅读