Technical investigations, browser exploitation, vulnerability research, and systems reverse engineering.https://www.3lyly0.dev/en-usThu, 24 Sep 2026 00:00:00 GMThttps://www.3lyly0.dev/research/sha256-sha384-type-confusion-oob-write-explained/https://www.3lyly0.dev/research/sha256-sha384-type-confusion-oob-write-explained/From 15 out-of-bounds bytes to full root and a walk out of a chroot jail: a technical teardown of a Linux kernel exploit chain that starts with a size mix-up between SHA-256 and SHA-384 inside a custom crypto module, travels through MSG_COPY, pipe_buffer, and struct page, and ends with a data-only write into cred followed by swapping task->fs for init_fs.Thu, 24 Sep 2026 00:00:00 GMTlinux-kernelexploit-developmentheap-exploitationtype-confusionprivilege-escalationhttps://www.3lyly0.dev/research/safestack-bypass/https://www.3lyly0.dev/research/safestack-bypass/SafeStack splits your stack so a buffer overflow can only smash the half nobody misses. Solid plan, except the pointer that defines where the smashable half lives is stored in TLS, and TLS was sitting right next to the overflow. This is the story of how one bad memory layout took down a shadow stack, a canary, and a homemade CFI check in a single chain.Tue, 22 Sep 2026 00:00:00 GMTBinary ExploitationMemory SafetySafeStackMitigation BypassExploit Developmenthttps://www.3lyly0.dev/research/mqtt-debug-topic-leaks-explained/https://www.3lyly0.dev/research/mqtt-debug-topic-leaks-explained/A retained MQTT debug topic is the IoT equivalent of leaving the master key on a public noticeboard that never gets cleaned. Here is how firmware analysis, weak broker credentials, and one forgotten retain flag turn a thermostat into a leaky vault.Mon, 21 Sep 2026 00:00:00 GMTMQTTIoTFirmware AnalysisRetained MessagesWeak Credentialshttps://www.3lyly0.dev/research/side-channel-ecdsa-explained/https://www.3lyly0.dev/research/side-channel-ecdsa-explained/How a custom binary modular division implementation leaks the ECDSA nonce through traced function calls, and how an attacker can recover the private key from the execution trace alone.Mon, 21 Sep 2026 00:00:00 GMTcryptographyecdsaside-channelbinary-gcdkey-recoveryhttps://www.3lyly0.dev/research/non-transitive-comparators/https://www.3lyly0.dev/research/non-transitive-comparators/A comparison function that looks innocent can turn qsort into an out-of-bounds write primitive. This article breaks down how integer overflow in comparators breaks the assumptions of insertion sort, forces the slow path with a memory limit, and opens a full chain from stack corruption to code execution.Fri, 18 Sep 2026 00:00:00 GMTMemory CorruptionInteger OverflowqsortBinary ExploitationComparatorshttps://www.3lyly0.dev/research/browser-session-hijacking-explained/https://www.3lyly0.dev/research/browser-session-hijacking-explained/You spent money on MFA, zero-trust policies, and password managers. Then a friendly-looking extension quietly copied your live session tokens out of Chrome's LevelDB and left. This write-up shows how the theft works, how the artifacts survive on disk, and why the browser itself became the weakest link.Thu, 17 Sep 2026 00:00:00 GMTDFIRSession HijackingMalicious ExtensionsLevelDBBrowser Forensicshttps://www.3lyly0.dev/research/hybrid-mobile-reward-check-explained/https://www.3lyly0.dev/research/hybrid-mobile-reward-check-explained/A cross-platform mobile app splits its reward check across managed code and a tiny native helper, with mixing passes, a bytecode runner, and anti-debug on top. None of that moves the decision off the phone. Here is how to map the chain, port the transforms, and drive the native exports in order.Fri, 11 Sep 2026 00:00:00 GMTReverse EngineeringMobile REAndroidNative CodeClient-Side Trusthttps://www.3lyly0.dev/research/blinded-heap-exploitation/https://www.3lyly0.dev/research/blinded-heap-exploitation/A practical deep dive into turning a one-byte heap write into controlled memory corruption on modern glibc. We will walk from the bug itself to allocator metadata, dynamic linking structures, and a deterministic final code-execution primitive.Wed, 02 Sep 2026 00:00:00 GMTHeap ExploitationglibcMemory CorruptionDynamic LinkingPwnhttps://www.3lyly0.dev/research/obfuscated-state-machine/https://www.3lyly0.dev/research/obfuscated-state-machine/Some binaries do not check a secret with a simple comparison. They turn the input into bits and drive it through a state machine filled with transitions, dictionary lookups, and 256-bit arithmetic constraints. This write-up shows how to reverse that verifier into a graph you can actually solve.Wed, 02 Sep 2026 00:00:00 GMTReverse EngineeringBinary AnalysisObfuscationState MachinesCTFhttps://www.3lyly0.dev/research/arbitrary-pointer-manipulation-explained/https://www.3lyly0.dev/research/arbitrary-pointer-manipulation-explained/A memory-safe language can prevent whole classes of memory corruption, then leave one perfectly valid pointer in exactly the wrong place. This write-up breaks down how pointer corruption, stale length metadata, and indirect callbacks can turn an innocent note cache into code execution.Tue, 01 Sep 2026 00:00:00 GMTMemory SafetyPointer CorruptionRCEZigBinary Exploitationhttps://www.3lyly0.dev/research/replacement-string-injection-explained/https://www.3lyly0.dev/research/replacement-string-injection-explained/An escape function can look perfectly safe while JavaScript quietly interprets the replacement string underneath it. Here's how the bug works, how the XSS chain develops, and why String.replace() makes a terrible template engine.Tue, 01 Sep 2026 00:00:00 GMTXSSJavaScriptCSPTemplate InjectionSecure Codinghttps://www.3lyly0.dev/research/rend-asunder-explained/https://www.3lyly0.dev/research/rend-asunder-explained/Three years circling the same Hacker101 challenge. HeadlessChrome 67, an opaque iframe, an old V8 typer bug, and three flags. I finally broke all of them. This is not a short summary. It is the full map from the moment you open the instance until you read the file from disk, step by step, so anyone can reproduce the entire exploit.Thu, 27 Aug 2026 00:00:00 GMTBrowser ExploitationV8Chrome 67Hacker101RCESOP BypassWebAssemblyhttps://www.3lyly0.dev/research/approximate-gcd-explained/https://www.3lyly0.dev/research/approximate-gcd-explained/A homemade encryption scheme hides a giant secret prime inside a pile of noise and multiplication. Turns out a lattice can filter out the noise faster than you can say 'I rolled my own crypto.' Here's the math, the break, and why you should never do this at home.Sat, 22 Aug 2026 00:00:00 GMTApproximate GCDLattice CryptanalysisLLLCryptographyHomomorphic EncryptionCTFhttps://www.3lyly0.dev/research/predictable-quantum-randomness-explained/https://www.3lyly0.dev/research/predictable-quantum-randomness-explained/A cold wallet swears its private key came from an unbreakable quantum experiment. The experiment turns out to be pure math running on a public seed. Here is how that works, why it still fails the Bell test in practice, and how to stop treating deterministic code as physics.Sun, 16 Aug 2026 00:00:00 GMTQuantum CryptographyRandom Number GeneratorsKey GenerationCryptographyDevice IndependenceBell Testhttps://www.3lyly0.dev/research/prng-stream-reuse-explained/https://www.3lyly0.dev/research/prng-stream-reuse-explained/A random-looking validation flow can collapse when two code paths consume the same PRNG stream. Add an empty-iterator check and silently ignored values, and the whole thing starts behaving less like security and more like a vending machine that gives refunds.Sat, 15 Aug 2026 00:00:00 GMTPRNGPythonLogic BugsInput ValidationOracle AttackCTFhttps://www.3lyly0.dev/research/client-side-password-validation-explained/https://www.3lyly0.dev/research/client-side-password-validation-explained/A password checker can look wonderfully complicated, decrypt code at runtime, and even run a custom virtual machine. That still does not make the secret unbreakable. Here is how to pull the VM apart, recover its instructions, and reverse the final checks.Wed, 12 Aug 2026 00:00:00 GMTReverse EngineeringVirtual MachineObfuscationBinary AnalysisPassword ValidationGDhttps://www.3lyly0.dev/research/encrypted-c2-loader-explained/https://www.3lyly0.dev/research/encrypted-c2-loader-explained/This challenge started with exactly two artifacts: `capture.pcapng` and `DbgInfo.DMP`. From there, the investigation moved through C2 decryption, screenshot and binary recovery, and reverse engineering of a loader that hid an encrypted in-memory stage.Tue, 11 Aug 2026 00:00:00 GMTReverse EngineeringForensicsPCAPShellcodeWindowsMalware Analysishttps://www.3lyly0.dev/research/insecure-opc-ua-write-access-explained/https://www.3lyly0.dev/research/insecure-opc-ua-write-access-explained/OPC-UA is supposed to be the grown-up industrial protocol. Hand it a self-signed certificate and a writable safety node, and it becomes a remote kill switch. Here is how that happens and how to stop it.Mon, 10 Aug 2026 00:00:00 GMTOPC-UAICSSCADAIndustrial ControlWrite Accesshttps://www.3lyly0.dev/research/rf-protocol-reverse-engineering-explained/https://www.3lyly0.dev/research/rf-protocol-reverse-engineering-explained/A proprietary wireless security protocol looked solid on paper. Then someone opened the packets, fixed the CRC, and discovered that self-addressed commands plus one wrong transmission parameter were all that stood between locked sensors and open doors.Mon, 10 Aug 2026 00:00:00 GMTRFProtocol Reverse EngineeringCRCWireless SecurityHardware Hackinghttps://www.3lyly0.dev/research/flutter-app-reverse-engineering-explained/https://www.3lyly0.dev/research/flutter-app-reverse-engineering-explained/A full walkthrough of pulling a Flutter banking app apart, recovering its custom RSA+AES API protocol from the Dart AOT snapshot, and talking to the backend like the real client. Spoiler: encrypting the wire does not mean the server checks who owns the account.Sun, 09 Aug 2026 00:00:00 GMTFlutterMobile REDart AOTAPI SecurityCryptographyhttps://www.3lyly0.dev/research/php-extension-heap-overflow-explained-when-metadata-owns-the-allocator/https://www.3lyly0.dev/research/php-extension-heap-overflow-explained-when-metadata-owns-the-allocator/A custom PHP extension that parses image metadata with a fixed-size buffer and classic strcpy can hand the entire process to an attacker. Pair it with a loose file reader and you get ASLR bypass plus reliable RCE.Sat, 08 Aug 2026 00:00:00 GMTHeap OverflowPHP ExtensionsZend AllocatorLFIRCEMemory Corruptionhttps://www.3lyly0.dev/research/upnp-command-injection-explained/https://www.3lyly0.dev/research/upnp-command-injection-explained/UPnP was supposed to make devices play nice automatically. Instead it often hands attackers a SOAP endpoint, a password, and a shell. Here's how a diagnostic service turns into remote code execution.Fri, 07 Aug 2026 00:00:00 GMTUPnPCommand InjectionIoTRouter SecuritySOAPhttps://www.3lyly0.dev/research/insecure-deserialization/https://www.3lyly0.dev/research/insecure-deserialization/A deep dive into insecure deserialization vulnerabilities, from Java gadgets to PHP object injection. Learn how attackers weaponize your own data formats, real breaches that made headlines, vulnerable examples, exploitation chains, and rock‑solid defenses. With jokes. Of course.Sat, 21 Feb 2026 00:00:00 GMTInsecure DeserializationWeb SecuritySerializationOWASPApplication Securityhttps://www.3lyly0.dev/research/broken-authentication/https://www.3lyly0.dev/research/broken-authentication/An exhaustive, witty walkthrough of authentication failures: weak passwords, flawed reset flows, session fixation, MFA bypass, and more. Learn from real breaches, vulnerable code samples, and defense checklists that'll harden your login system without hurting UX.Fri, 20 Feb 2026 00:00:00 GMTBroken AuthenticationWeb SecurityOWASPLoginSession Managementhttps://www.3lyly0.dev/research/path-traversal/https://www.3lyly0.dev/research/path-traversal/A massively detailed, story-driven deep dive into Path Traversal vulnerabilities. From classic ../ tricks to modern cloud, container, zip slip, and symlink abuse. Real-world breaches, vulnerable code in every major language, advanced exploitation chains, and defense strategies that actually work.Thu, 19 Feb 2026 00:00:00 GMTPath TraversalDirectory TraversalWeb SecurityOWASPFile System SecurityPenetration Testinghttps://www.3lyly0.dev/research/command-injection/https://www.3lyly0.dev/research/command-injection/A massively detailed, entertaining deep dive into Command Injection (OS Command Injection). We're covering every injection variant, real-world breaches that rocked the industry, vulnerable code examples in multiple languages, exploitation techniques from basic to advanced, and rock-solid defense strategies. Plus plenty of humor because system shells don't have to be terrifying... okay, they do.Mon, 16 Feb 2026 00:00:00 GMTCommand InjectionWeb SecurityOS SecurityOWASPPenetration Testinghttps://www.3lyly0.dev/research/stuxnet-nuclear-hack/https://www.3lyly0.dev/research/stuxnet-nuclear-hack/The satirical step-by-step guide nobody asked for, followed by the absolutely wild true story of Stuxnet - the cyber weapon that physically destroyed centrifuges while making the world rethink everything about security. Spoiler: It involves USB sticks, zero-days, and a whole lot of 'wait, that actually worked?!'Mon, 16 Feb 2026 00:00:00 GMTStuxnetCyber WarfareSCADAZero-DayIndustrial SecurityNation-State Attackshttps://www.3lyly0.dev/research/sql-injection/https://www.3lyly0.dev/research/sql-injection/A massively detailed, entertaining deep dive into SQL Injection attacks. We're covering every injection type, real-world breaches that shook the industry, vulnerable code in multiple languages, exploitation techniques from basic to advanced, and bulletproof defense strategies. Plus plenty of jokes because SQL doesn't have to be boring!Sun, 15 Feb 2026 00:00:00 GMTSQL InjectionWeb SecurityDatabase SecurityOWASPPenetration Testinghttps://www.3lyly0.dev/research/csrf/https://www.3lyly0.dev/research/csrf/The ultimate deep dive into Cross-Site Request Forgery (CSRF). We're covering the mechanics, attack vectors, real-world breach case studies, exploitation techniques, vulnerable code examples across multiple languages, advanced bypasses, and a comprehensive defense strategy. From basic concepts to advanced mitigation, everything you need to protect your applications.Sat, 14 Feb 2026 00:00:00 GMTCSRFWeb SecurityAuthenticationOWASPDefensive Securityhttps://www.3lyly0.dev/research/xss/https://www.3lyly0.dev/research/xss/A ridiculously detailed, humor-filled deep dive into Cross-Site Scripting (XSS). We're talking every flavor of XSS, vulnerable code in all your favorite languages, real-world breaches that made headlines, exploitation techniques, and comprehensive mitigation strategies. Buckle up for a wild ride through the world of malicious scripts!Fri, 13 Feb 2026 00:00:00 GMTXSSWeb SecurityJavaScriptOWASPOffensive Securityhttps://www.3lyly0.dev/research/owasp-top-ten-2025/https://www.3lyly0.dev/research/owasp-top-ten-2025/Buckle up for a super-detailed, hilarious deep dive into the OWASP Top 10. We're talking explanations that go on forever, code snippets that actually make sense, real-world horror stories, and enough mitigation tips to make your head spin. Oh, and some dad jokes because why not?Thu, 12 Feb 2026 00:00:00 GMTOWASPWeb SecurityCybersecurityApplication Security