https://blog.omiilgo.com/categories/network-security/ Recent content in Network Security on Security Notes Hugo en-us Fri, 18 Sep 2026 14:30:00 +0800 https://blog.omiilgo.com/posts/network-tls-handshake-notes/ Fri, 18 Sep 2026 14:30:00 +0800 https://blog.omiilgo.com/posts/network-tls-handshake-notes/ Lab openssl s_client -msg against a loopback nginx: handshake record dump, redacted CN, alert on a bad name — not a MITM cookbook. https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Sat, 11 Apr 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Lab SQLite ledger: UPDATE without a version column vs WITH version, plus an IDOR that is not a race — no money-drain client. https://blog.omiilgo.com/posts/tabnabbing-and-target-blank/ Fri, 12 Sep 2025 11:00:00 +0800 https://blog.omiilgo.com/posts/tabnabbing-and-target-blank/ Lab HTML: target=_blank without rel, opener check in the opened tab, rel=noopener fix, harmless location rewrite — no phishing kit. https://blog.omiilgo.com/posts/yaml-parser-footguns/ Sat, 30 Nov 2024 12:00:00 +0800 https://blog.omiilgo.com/posts/yaml-parser-footguns/ Lab PyYAML: yaml.safe_load vs yaml.load, implicit typing, billion-laughs-sized crash — no os.system gadget via YAML tags. https://blog.omiilgo.com/posts/web-race-conditions-notes/ Fri, 19 May 2023 15:00:00 +0800 https://blog.omiilgo.com/posts/web-race-conditions-notes/ Lab Go counter without a mutex, then with one; HTTP coupon handler; lost-update logs — no inventory-drain exploit script. https://blog.omiilgo.com/posts/apache-http-path-confusion-notes/ Sat, 11 Jun 2022 13:00:00 +0800 https://blog.omiilgo.com/posts/apache-http-path-confusion-notes/ Lab Apache Alias map: raw vs normalized paths as text, Require/Alias mismatch, 403/404 artifacts — no working traversal into /etc. https://blog.omiilgo.com/posts/jndi-injection-class-lessons/ Fri, 28 Jan 2022 10:00:00 +0800 https://blog.omiilgo.com/posts/jndi-injection-class-lessons/ Lab Java snippet that logs a lookup string, how to disable JNDI/message lookups, sanitized crash on a bad URL — no LDAP exploit server. https://blog.omiilgo.com/posts/dom-xss-and-dom-clobbering/ Wed, 14 Apr 2021 16:20:00 +0800 https://blog.omiilgo.com/posts/dom-xss-and-dom-clobbering/ Lab HTML+JS page: location.hash into innerHTML, name=form clobber of a config object, harmless redacted payload, CSP as the fix. https://blog.omiilgo.com/posts/command-injection-taxonomy/ Sat, 05 Sep 2020 14:00:00 +0800 https://blog.omiilgo.com/posts/command-injection-taxonomy/ Lab Python ping wrapper: subprocess shell=True vs argv list, dangerous call, the fix, ASAN-irrelevant crash on a C popen helper — no reverse shell. https://blog.omiilgo.com/posts/sql-injection-probing-methodology/ Tue, 18 Feb 2020 09:30:00 +0800 https://blog.omiilgo.com/posts/sql-injection-probing-methodology/ Lab Flask+SQLite app: concatenated vs parameterized queries, SQL logs, WAF noise, ASAN-irrelevant crash on the concat path — no production DB dump. https://blog.omiilgo.com/posts/jwt-failure-modes-for-defenders/ Mon, 22 Jul 2019 11:00:00 +0800 https://blog.omiilgo.com/posts/jwt-failure-modes-for-defenders/ Lab JWT verifier in Go: decoded header/payload dumps, alg=none rejected, wrong aud rejected, HS256 with a lab secret — no forged production tokens. https://blog.omiilgo.com/posts/http-request-smuggling-mental-model/ Tue, 12 Mar 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/http-request-smuggling-mental-model/ Lab walkthrough of HTTP/1.1 framing disagreement: raw frames, nginx vs Python http.server parse notes, sanitized logs, hop-boundary hardening.