Research

International conferences we participate in

Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities

只需一次 API 呼叫的致命一擊：從硬體逆向到突破保護機制的精準攻擊

只需一次 API 呼叫的致命一擊：從硬體逆向到突破保護機制的精準攻擊

Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities

Compromising Linux the Right Way: 0-days, Novel Techniques, and Lessons from Failure

The Art of PHP — My CTF Journey and Untold Stories!

Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes

Hacking to the Gate(way): Take Over Samsung SmartThings with a Single API Call

Cache the Frames, Catch the Vulnerabilities in Kernel Streaming

Arise From The Wireless: Breaking The Security Barrier In Wi-Fi

Arise From The Wireless: Breaking The Security Barrier In Wi-Fi

Returned to QNAP TS-464 at Pwn2Own and Pwned It Again!

From Convenience to Contagion: The Libarchive Vulnerabilities Lurking in Windows 11

Black Hat Europe

WorstFit: Unveiling Hidden Transformers in Windows ANSI!

How I use a novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024

Proxying to Kernel : Streaming Vulnerabilities from Windows Kernel

Proxying to Kernel : Streaming Vulnerabilities from Windows Kernel

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

Proxying to Kernel : Manipulate Flow to Make Windows Kernel Great Again

全境擴散：從 Windows 11 到 libarchive 的深層威脅與全面影響

Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

A Comprehensive Review on the Less-Traveled Road: 9 Years of Overlooked MikroTik Pre-Auth RCE

A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned

A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned

A Comprehensive Review on the Less-Traveled Road: 9 Years of Overlooked MikroTik Pre-Auth RCE

A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned

A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned

搭配模糊測試對Linux核心遠端檔案系統進行漏洞挖掘

入無人之徑：於 MikroTik 蟄伏九載的 Pre-Auth RCE

A Comprehensive Review on the Less-Traveled Road: 9 Years of Overlooked MikroTik Pre-Auth RCE

從 2013 到 2023: Web Security 十年之進化及趨勢！

Your Printer is not your Printer ! - Hacking Printers at Pwn2Own

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Your Printer is not your Printer ! - Hacking Printers at Pwn2Own

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

你的 NAS 不是你的 NAS !

ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!

The Proxy Era of Microsoft Exchange Server

ProxyLogon is Just the Tip of the Iceberg, A New Attack Surface on Microsoft Exchange Server!

ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!

ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!

OWASP HK Techday 2021

A Journey Combining Web Hacking and Binary Exploitation in Real World!

Real World CTF Forum

A Journey Combining Web Hacking and Binary Exploitation in Real World!

你的資安策略夠明確嗎？透過框架優先緩解真實威脅

My journey on SMBGhost

How I Hacked Facebook Again!

Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs

Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs

HITB GSEC - Singapore

Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs

Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs

Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs

Hacking Jenkins!

Hacking Jenkins!

Red Team Summit

Red Team In Taiwan: Zero To One

Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!

Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!

Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!

Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

從一個脆弱點到串起整個攻擊鏈

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

HITB GSEC - Singapore

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

HITCON Community

Play with File Structure - Yet Another Binary Exploit

HITCON Community

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

HITCON Community

Bug Bounty 獎金獵人甘苦談 - 那些年我回報過的漏洞

HITCON Community

Web Hacking 中的奇技淫巧

被遺忘的資訊洩漏