https://baozongwi.xyz/tags/websocket/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/java-memshell-basics/Sat, 29 Aug 2026 01:27:26 +0800https://baozongwi.xyz/p/java-memshell-basics/TL;DR 之前把这四种内存马拆开写了，回头翻的时候一直在几个文件之间跳，干脆合到一篇里。这里主要看 Tomcat 收到请求以后到底从哪里取组件，以及我们运行时往哪些对象里塞东西。 这几个 demo 统一使用 Spring Boot 2.7.18、Java 8 和内置 Tomcat 9，代码还是 …https://baozongwi.xyz/p/byuctf2025/Sat, 17 May 2025 10:02:30 +0000https://baozongwi.xyz/p/byuctf2025/Anaken21sec1 from math import ceil cipher = "cnpiaytjyzggnnnktjzcvuzjexxkvnrlfzectovhfswyphjt" key = "orygwktcjpb" # 1. 生成 keyNums 序列 keyNums = [ord(c) - …https://baozongwi.xyz/p/plaidctf2025/Sat, 05 Apr 2025 11:13:08 +0000https://baozongwi.xyz/p/plaidctf2025/defcon外卡，看看题学习一下，由于经常重开所以放个命令 docker rm -f $(docker ps -aq) && docker rmi -f $(docker images -q) The Sundown Vault(65 solves done) import cookieParser from …https://baozongwi.xyz/p/bsidescf2020/Wed, 21 Aug 2024 15:56:14 +0000https://baozongwi.xyz/p/bsidescf2020/[BSidesCF 2020]Bulls23 先搞下来，解压发现是个html 本地搞个html网页来加载发现可以登录 发现第一个链接就是 http://bash.org/?random 找到是websocket流量 发现第二个链接 http://n-gate.com 中途发现端口是8888 但还是不懂，说的要追踪TCP …