https://blog.omiilgo.com/ Recent content on Security Notes Hugo en-us Sun, 20 Sep 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/welcome/ Sun, 20 Sep 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/welcome/ Lab notes: dumps, disassembly, sanitized crashes. Network, binary, Android, iOS, OS internals. https://blog.omiilgo.com/posts/network-tls-handshake-notes/ Fri, 18 Sep 2026 14:30:00 +0800 https://blog.omiilgo.com/posts/network-tls-handshake-notes/ Lab openssl s_client -msg against a loopback nginx: handshake record dump, redacted CN, alert on a bad name — not a MITM cookbook. https://blog.omiilgo.com/posts/elf-symbol-and-relocation-basics/ Tue, 15 Sep 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/elf-symbol-and-relocation-basics/ Toy PIE: readelf -s / -r / -d / -S in one sitting. .dynsym UND vs .symtab, JUMP_SLOT vs RELATIVE, how a stripped copy still names puts. gdb bind check. https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Thu, 10 Sep 2026 16:00:00 +0800 https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC. https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Sat, 11 Apr 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Lab SQLite ledger: UPDATE without a version column vs WITH version, plus an IDOR that is not a race — no money-drain client. https://blog.omiilgo.com/posts/container-escape-class-lessons/ Fri, 13 Feb 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/container-escape-class-lessons/ Lab capsh –print and docker inspect seccomp/AppArmor, dropped caps, failed mount — no escape exploit. https://blog.omiilgo.com/posts/postgresql-privilege-boundaries/ Sat, 29 Nov 2025 12:00:00 +0800 https://blog.omiilgo.com/posts/postgresql-privilege-boundaries/ Lab \du dump, a safe SECURITY DEFINER function, failed GRANT, search_path notes — no superuser exploit. https://blog.omiilgo.com/posts/tabnabbing-and-target-blank/ Fri, 12 Sep 2025 11:00:00 +0800 https://blog.omiilgo.com/posts/tabnabbing-and-target-blank/ Lab HTML: target=_blank without rel, opener check in the opened tab, rel=noopener fix, harmless location rewrite — no phishing kit. https://blog.omiilgo.com/posts/java-xxe-exfiltration-paths/ Wed, 16 Jul 2025 15:00:00 +0800 https://blog.omiilgo.com/posts/java-xxe-exfiltration-paths/ Lab DocumentBuilder/TransformerFactory features to disable, tiny file:// entity to a lab file, parser throws or ignores — no FTP exfil. https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Fri, 21 Mar 2025 13:00:00 +0800 https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Lab Swift class LabVault: $s… mangled names, xcrun swift demangle, nm before/after strip, the one @objc method that survives in __objc_methname. class-dump, lldb, ASAN. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-native-library-re-notes/ Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only. https://blog.omiilgo.com/posts/yaml-parser-footguns/ Sat, 30 Nov 2024 12:00:00 +0800 https://blog.omiilgo.com/posts/yaml-parser-footguns/ Lab PyYAML: yaml.safe_load vs yaml.load, implicit typing, billion-laughs-sized crash — no os.system gadget via YAML tags. https://blog.omiilgo.com/posts/ios-dyld-shared-cache-symbolication/ Mon, 19 Aug 2024 15:00:00 +0800 https://blog.omiilgo.com/posts/ios-dyld-shared-cache-symbolication/ Lab crash on a self-signed LabSession: dwarfdump -u, atos against the dSYM, why UIKit frames are not in nm of the app, crash report with [REDACTED] paths. No DSC extraction. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Thu, 20 Jun 2024 10:00:00 +0800 https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Futex, perf_event, and get_user-era Android kernel LPE classes as broken invariants. No kernel exploit code. A toy C file-TOCTOU analog, a planted strcpy, ASAN output. https://blog.omiilgo.com/posts/chrome-version-fingerprinting-notes/ Mon, 25 Mar 2024 11:00:00 +0800 https://blog.omiilgo.com/posts/chrome-version-fingerprinting-notes/ Lab UA / UA-CH request headers, navigator.userAgentData mock dump, nginx log_format for defenders — no exploit targeting. https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Fri, 16 Feb 2024 09:00:00 +0800 https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Self-built AIDL service com.lab.binder. dumpsys and logcat Binder, Parcel bytes for writeInterfaceToken + int + string, ARM64 BnEcho::onTransact. No privilege escalation. https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Mon, 04 Sep 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted. https://blog.omiilgo.com/posts/des-in-active-directory-crypto/ Tue, 08 Aug 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/des-in-active-directory-crypto/ Lab klist encryption types, supported-etype table, GPO ‘Configure encryption types allowed for Kerberos’ — inventory, not cracking. https://blog.omiilgo.com/posts/web-race-conditions-notes/ Fri, 19 May 2023 15:00:00 +0800 https://blog.omiilgo.com/posts/web-race-conditions-notes/ Lab Go counter without a mutex, then with one; HTTP coupon handler; lost-update logs — no inventory-drain exploit script. https://blog.omiilgo.com/posts/ios-entitlements-and-sandbox/ Thu, 06 Apr 2023 10:00:00 +0800 https://blog.omiilgo.com/posts/ios-entitlements-and-sandbox/ codesign -d –entitlements on a self-signed LabSession: get-task-allow, redacted application-identifier, container paths on the simulator, sandbox-exec, deny logs when a file read walks outside the container. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Tue, 14 Mar 2023 14:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Lab klist dump, field-by-field decode of times and checksum types, clock-skew 401 — no ticket-forging steps. https://blog.omiilgo.com/posts/v8-security-surface-notes/ Tue, 17 Jan 2023 12:00:00 +0800 https://blog.omiilgo.com/posts/v8-security-surface-notes/ d8 toy typed-array lab, LAB_ASSERT bounds throw, optional –allow-natives-syntax DebugPrint — a crash, not an exploit. https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Tue, 08 Nov 2022 14:00:00 +0800 https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Lab APK with packed-looking if-eqz obfuscation around a 5-way dispatch. apktool smali, jadx Java, reconstruct a packed-switch, plus a planted stack copy crash. Not a commercial packer unpack. https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Tue, 27 Sep 2022 10:00:00 +0800 https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Lab spooler service ACL and RPC interface dump, Point-and-Print registry, 7036/808 logs — no spool exploit. https://blog.omiilgo.com/posts/packed-elf-init-array-dump/ Mon, 18 Jul 2022 09:30:00 +0800 https://blog.omiilgo.com/posts/packed-elf-init-array-dump/ Lab stub that mprotects RWX, XOR-decodes a 32-byte .text blob, restores r-x, then returns into real code. readelf of .init_array and PT_GNU_STACK, gdb break on mprotect, dump of the r-x region. https://blog.omiilgo.com/posts/apache-http-path-confusion-notes/ Sat, 11 Jun 2022 13:00:00 +0800 https://blog.omiilgo.com/posts/apache-http-path-confusion-notes/ Lab Apache Alias map: raw vs normalized paths as text, Require/Alias mismatch, 403/404 artifacts — no working traversal into /etc. https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Mon, 09 May 2022 16:00:00 +0800 https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires. https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Thu, 03 Mar 2022 10:30:00 +0800 https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack. https://blog.omiilgo.com/posts/jndi-injection-class-lessons/ Fri, 28 Jan 2022 10:00:00 +0800 https://blog.omiilgo.com/posts/jndi-injection-class-lessons/ Lab Java snippet that logs a lookup string, how to disable JNDI/message lookups, sanitized crash on a bad URL — no LDAP exploit server. https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Sat, 11 Dec 2021 12:00:00 +0800 https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit. https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ Wed, 27 Oct 2021 16:40:00 +0800 https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope. https://blog.omiilgo.com/posts/binary-auditing-checklist/ Sat, 21 Aug 2021 16:00:00 +0800 https://blog.omiilgo.com/posts/binary-auditing-checklist/ First-pass checklist actually filled: checksec + readelf + objdump on a 60-line toy with gets/sprintf/printf(user). One-pager of mitigations, sinks, and the ASan crash. https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ Wed, 09 Jun 2021 14:10:00 +0800 https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted. https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Mon, 17 May 2021 15:00:00 +0800 https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain. https://blog.omiilgo.com/posts/dom-xss-and-dom-clobbering/ Wed, 14 Apr 2021 16:20:00 +0800 https://blog.omiilgo.com/posts/dom-xss-and-dom-clobbering/ Lab HTML+JS page: location.hash into innerHTML, name=form clobber of a config object, harmless redacted payload, CSP as the fix. https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Thu, 11 Mar 2021 10:00:00 +0800 https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Two-class toy hierarchy, virtual dtor plus two methods. objdump/readelf of the compiler vtable, ctor writing the vptr, virtual call through [x0,#16], gdb print of the slot. https://blog.omiilgo.com/posts/rop-versus-ret2libc-mental-model/ Tue, 09 Feb 2021 14:00:00 +0800 https://blog.omiilgo.com/posts/rop-versus-ret2libc-mental-model/ Mental model plus objdump of a toy: ret2libc is whole-function reuse, ROP is fragment reuse. Classify epilogue rets vs pop;ret vs leave;ret. Overflow crash with RIP=0x4141… — no system("/bin/sh") chain. https://blog.omiilgo.com/posts/active-directory-recon-notes/ Tue, 10 Nov 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/active-directory-recon-notes/ Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook. https://blog.omiilgo.com/posts/command-injection-taxonomy/ Sat, 05 Sep 2020 14:00:00 +0800 https://blog.omiilgo.com/posts/command-injection-taxonomy/ Lab Python ping wrapper: subprocess shell=True vs argv list, dangerous call, the fix, ASAN-irrelevant crash on a C popen helper — no reverse shell. https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ Mon, 03 Aug 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ AAPCS64 as it shows up in IDA: x0–x7, x29/x30, 16-byte SP, PACIBSP. Toy function with nine integer args so the ninth is on the stack. objdump of prologue and epilogue. https://blog.omiilgo.com/posts/relro-got-plt-reading-notes/ Mon, 15 Jun 2020 09:00:00 +0800 https://blog.omiilgo.com/posts/relro-got-plt-reading-notes/ Partial vs Full RELRO measured on one toy: readelf FLAGS/GNU_RELRO, objdump of puts@plt, gdb GOT slot before and after bind, /proc maps of .got.plt. Companion to the lazy-binding lab. https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Wed, 22 Apr 2020 11:20:00 +0800 https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Lab walkthrough of lazy PLT binding on a PIE: readelf, objdump, GOT slot before/after the first call, Partial vs Full RELRO. https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Tue, 17 Mar 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse. https://blog.omiilgo.com/posts/sql-injection-probing-methodology/ Tue, 18 Feb 2020 09:30:00 +0800 https://blog.omiilgo.com/posts/sql-injection-probing-methodology/ Lab Flask+SQLite app: concatenated vs parameterized queries, SQL logs, WAF noise, ASAN-irrelevant crash on the concat path — no production DB dump. https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Thu, 16 Jan 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Mon, 02 Dec 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy. https://blog.omiilgo.com/posts/aslr-and-information-leaks/ Wed, 20 Nov 2019 11:00:00 +0800 https://blog.omiilgo.com/posts/aslr-and-information-leaks/ /proc/self/maps across runs, gdb measurement of PIE load bias, a toy %p leak of a text pointer. Entropy is what remains after the leak — no exploit chain. https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Sat, 14 Sep 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment. https://blog.omiilgo.com/posts/jwt-failure-modes-for-defenders/ Mon, 22 Jul 2019 11:00:00 +0800 https://blog.omiilgo.com/posts/jwt-failure-modes-for-defenders/ Lab JWT verifier in Go: decoded header/payload dumps, alg=none rejected, wrong aud rejected, HS256 with a lab secret — no forged production tokens. https://blog.omiilgo.com/posts/format-string-vulnerability-patterns/ Wed, 08 May 2019 15:00:00 +0800 https://blog.omiilgo.com/posts/format-string-vulnerability-patterns/ Toy printf(user) lab: gdb dump of stack words matching a %p leak (canary included conceptually), SIGSEGV from %s, ASan on a sprintf companion, patched printf("%s", user). https://blog.omiilgo.com/posts/http-request-smuggling-mental-model/ Tue, 12 Mar 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/http-request-smuggling-mental-model/ Lab walkthrough of HTTP/1.1 framing disagreement: raw frames, nginx vs Python http.server parse notes, sanitized logs, hop-boundary hardening. https://blog.omiilgo.com/about/ Mon, 01 Jan 0001 00:00:00 +0000 https://blog.omiilgo.com/about/ About Jose Adalberto Gutierrez Ochoa