<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[ygdream的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/ygdream</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; ygdream]]></copyright><item><title><![CDATA[Hacker101_Rend_Asunder_Writeup]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/164190533</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/164190533</guid><author>ygdream</author><pubDate>Sun, 30 Aug 2026 18:59:06 +0800</pubDate><description><![CDATA[难度：★★★★★（V8 JIT 漏洞利用 + 渲染沙箱逃逸数据渗出）涉及：Chrome 67 headless / TurboFan 类型混淆 / WASM RWX / seccomp 边界 / 盲信道数据渗出。]]></description><category></category></item><item><title><![CDATA[Model E1337 v2 - Hardened Rolling Code Lock]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163990138</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163990138</guid><author>ygdream</author><pubDate>Sun, 23 Aug 2026 08:32:31 +0800</pubDate><description><![CDATA[知识点说明3 轮仿射变换v2 每 bit 做 3 轮prng_step，等效矩阵为 A³，仍为仿射变换64-bit 输出next(64)输出 64 bit，提供 64 个 LSB 观测方程Rank 48 即够用Nibble 约束使有效维度降为 48，null space 中的状态产生相同输出序列全 LSB 观测法直接用 64 个 LSB 观测（不用 nibble 约束行），比 v1 的混合方法更简洁只需 1 个码64 bit 观测 ≥ 48 有效自由度，1 个码即可恢复状态/rng。]]></description><category></category></item><item><title><![CDATA[Model E1337 - Rolling Code Lock]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163978788</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163978788</guid><author>ygdream</author><pubDate>Sun, 23 Aug 2026 08:30:42 +0800</pubDate><description><![CDATA[知识点说明XXE 注入利用的 SAX XML 解析器读取服务器源码PRNG 仿射变换移位、XOR、nibble 置换均可表示为 GF(2) 矩阵运算I_p 真值表推导每个 nibble 的 4-bit 置换可精确建模为 4x4 GF(2) 矩阵Nibble 约束PRNG 内部结构导致 state[4g] = state[4g+3]，有效维度降为 48GF(2) 高斯消元在二元域上求解线性方程组，加法=XOR，乘法=ANDRank 48 即够用。]]></description><category></category></item><item><title><![CDATA[Encrypted Pastebin]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163958363</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163958363</guid><author>ygdream</author><pubDate>Sat, 22 Aug 2026 00:13:47 +0800</pubDate><description><![CDATA[知识点说明利用服务器错误反馈判断填充是否正确AES-CBC解密过程依赖 IV 和前一个密文块自定义 Base64替换!字符的 Base64 变体JSON 注入通过加密功能构造任意 JSONSQL 注入Union 注入读取 tracking 表。]]></description><category></category></item><item><title><![CDATA[Mobile WebDev]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163958359</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163958359</guid><author>ygdream</author><pubDate>Sat, 22 Aug 2026 00:11:15 +0800</pubDate><description><![CDATA[知识点说明APK 硬编码密钥在源码中搜索HmacKey找到密钥HMAC-MD5 计算使用密钥和文件内容计算签名文件上传绕过必须同时提交正确的 HMACZip Slip 漏洞ZIP 内文件路径含../实现目录穿越curl 上传避免 Burp 重放导致的 HMAC 失效。]]></description><category></category></item><item><title><![CDATA[Oauthbreaker]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163936547</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163936547</guid><author>ygdream</author><pubDate>Fri, 21 Aug 2026 09:05:53 +0800</pubDate><description><![CDATA[知识点说明OAuth redirect_uri 校验未校验的 redirect_uri 可导致 token 泄露Deep Link 利用通过 ADB 发送自定义 Intent 触发 Deep LinkWebView JavaScript 接口暴露 Java 方法给 JSWebView JavaScript 执行允许执行 JSADB Intent 构造。]]></description><category></category></item><item><title><![CDATA[OSU CTF]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163936446</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163936446</guid><author>ygdream</author><pubDate>Fri, 21 Aug 2026 09:04:02 +0800</pubDate><description><![CDATA[知识点说明SQL 注入' OR 1=1;--绕过登录验证JS 源码分析发现未链接的路由Base64 编码学生 ID =名字_姓氏的 Base64换行符陷阱echo默认加\n，应使用printfIDOR通过构造 ID 访问并修改其他学生信息。]]></description><category></category></item><item><title><![CDATA[Intentional Exercise]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163924413</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163924413</guid><author>ygdream</author><pubDate>Thu, 20 Aug 2026 18:13:35 +0800</pubDate><description><![CDATA[知识点说明APK 静态分析使用 JADX 反编译分析源码WebView 页面源码在远程页面中，不在 APK 中Deep Link 分析截取路径SHA-256 哈希计算密钥 + 路径的拼接字符串哈希构建配置，此题中为空位置内容密钥、URL 生成逻辑Deep Link 配置(空)WebView 页面源码路径←在这里发现！]]></description><category></category></item><item><title><![CDATA[H1 Thermostat]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163924382</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163924382</guid><author>ygdream</author><pubDate>Thu, 20 Aug 2026 18:10:50 +0800</pubDate><description><![CDATA[知识点说明APK 反编译使用 JADX、apktool 或 Android Studio 反编译 APK源码搜索在反编译后的源码中搜索^FLAG^或flag字节码查看Android Studio 中右键文件选择 Show Bytecode信息泄露APK 中硬编码的敏感信息可被提取静态分析不运行应用，直接分析文件内容。]]></description><category></category></item><item><title><![CDATA[Y2FuIHlvdSByZWNvbj8]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163804597</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163804597</guid><author>ygdream</author><pubDate>Mon, 17 Aug 2026 00:11:08 +0800</pubDate><description><![CDATA[知识点说明目录枚举403 错误不代表没有利用点，需寻找其他入口文件上传绕过.phtml可绕过 PHP 扩展名黑名单路径遍历将文件写入上级目录命令执行读取敏感文件错误信息利用“php files are not allowed” 暴露了过滤规则。]]></description><category></category></item><item><title><![CDATA[XSS Playground by zseano]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163804577</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163804577</guid><author>ygdream</author><pubDate>Mon, 17 Aug 2026 00:10:13 +0800</pubDate><description><![CDATA[知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等。]]></description><category></category></item><item><title><![CDATA[RTFM WriteUp]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163804230</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163804230</guid><author>ygdream</author><pubDate>Sun, 16 Aug 2026 23:40:38 +0800</pubDate><description><![CDATA[知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等。]]></description><category></category></item><item><title><![CDATA[Photo Gallery]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163783273</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163783273</guid><author>ygdream</author><pubDate>Sun, 16 Aug 2026 23:34:38 +0800</pubDate><description><![CDATA[知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等。]]></description><category></category></item><item><title><![CDATA[Hackyholidays CTF]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163764218</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163764218</guid><author>ygdream</author><pubDate>Sat, 15 Aug 2026 00:40:22 +0800</pubDate><description><![CDATA[知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等。]]></description><category></category></item><item><title><![CDATA[Grayhatcon CTF]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163764095</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163764095</guid><author>ygdream</author><pubDate>Sat, 15 Aug 2026 00:25:48 +0800</pubDate><description><![CDATA[知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等知识点说明信息收集源码审计、目录爆破、接口发现漏洞利用根据发现的漏洞类型构造 Payload工具使用Burp Suite、sqlmap、ffuf 等。]]></description><category></category></item><item><title><![CDATA[Ticketastic Live Instance]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163763185</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163763185</guid><author>ygdream</author><pubDate>Fri, 14 Aug 2026 22:33:46 +0800</pubDate><description><![CDATA[知识点说明弱口令Demo 环境SSRF工单内容中插入本地链接，触发服务器访问本地接口XSS工单内容渲染时触发链接点击SQL 注入ticket?id=1存在注入点sqlmap 自动化-r读取请求文件，-p id指定参数本地接口XSS工单内容渲染时触发链接点击SQL 注入ticket?id=1存在注入点sqlmap 自动化-r读取请求文件，-p id指定参数。]]></description><category></category></item><item><title><![CDATA[TempImage]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163763124</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163763124</guid><author>ygdream</author><pubDate>Fri, 14 Aug 2026 22:26:10 +0800</pubDate><description><![CDATA[知识点说明文件上传绕过修改文件名后缀绕过前端/后端校验路径遍历../../跳出上传目录WebShell上传 PHP 木马获取服务器控制权限蚁剑连接使用中国蚁剑连接 WebShell 管理文件传目录WebShell上传 PHP 木马获取服务器控制权限蚁剑连接使用中国蚁剑连接 WebShell 管理文件。]]></description><category></category></item><item><title><![CDATA[Postbook]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163730127</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163730127</guid><author>ygdream</author><pubDate>Thu, 13 Aug 2026 17:03:50 +0800</pubDate><description><![CDATA[知识点说明弱口令登录IDOR通过修改 ID 查看/操作他人的 post用户 ID 伪造Cookie 中使用 MD5 编码的用户 ID水平越权创建、修改、删除操作都未校验用户权限弱口令登录IDOR通过修改 ID 查看/操作他人的 post用户 ID 伪造Cookie 中使用 MD5 编码的用户 ID水平越权创建、修改、删除操作都未校验用户权限。]]></description><category></category></item><item><title><![CDATA[Petshop Pro]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163698706</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163698706</guid><author>ygdream</author><pubDate>Thu, 13 Aug 2026 16:54:37 +0800</pubDate><description><![CDATA[知识点说明客户端校验绕过价格由客户端参数控制，可任意修改用户名枚举错误提示区分用户名不存在和密码错误Hydra 爆破比 Burp Intruder 更适合大量字典存储型 XSS宠物名称/描述在首页和购物车中渲染误提示区分用户名不存在和密码错误Hydra 爆破比 Burp Intruder 更适合大量字典存储型 XSS宠物名称/描述在首页和购物车中渲染。]]></description><category></category></item><item><title><![CDATA[Cody‘s First Blog]]></title><link>https://blog.youkuaiyun.com/ygdream/article/details/163698595</link><guid>https://blog.youkuaiyun.com/ygdream/article/details/163698595</guid><author>ygdream</author><pubDate>Wed, 12 Aug 2026 14:55:42 +0800</pubDate><description><![CDATA[知识点说明PHP 代码执行输入框可执行?源码注释泄露隐藏入口未授权访问?无需登录LFI通过page参数包含本地文件远程包含触发执行让注释代码重新解析执行e=admin.inc` 无需登录LFI通过page参数包含本地文件远程包含触发执行让注释代码重新解析执行。]]></description><category></category></item></channel></rss>