TrebledJ's personal blog on programming, cybersecurity, music, and memes.
Deserialization attacks have grown in popularity over the past decade, with major flaws hitting tech giants and modern frameworks — even in 2025. Last July, a question came to mind: "What if we took insecure deserialization and brought it to C++?" I’ve had fond memories using .NET and PHP deserialization attacks to pop shells in CTFs, courses, and engagements, plus I enjoy tinkering with C++, so I…
Last autumn, as a typhoon hammered against the hotel windows, I found myself locked into a different kind of storm— a pentest that refused to stay routine. What began as a run-of-the-mill exercise quickly spiralled into yet another thrilling adventure of vulnerability disclosure. This writeup walks through my discovery of a Cross-Site Scripting (XSS) sanitization bypass and a powerful Server-Side…
Breakfast is a CTF challenge I designed for CrewCTF 2025. With deserialization attacks being in vogue, I wanted to explore the topic in C++ and as a result, found an interesting niche bug in the cereal library . In this writeup, we'll revisit C++ internals and explore binary exploitation techniques beyond ROP . We’ll learn how even a properly written C++ program could be vulnerable to remote code…
Under the sweltering heat of the Hong Kong summer, we entered a looming building and kicked off what was supposed to be a simple penetration test. Little did we know, this ordeal would lead to panic-stricken emails, extra reports, and a few new CVEs. This is a tale of the unexpected discovery of three CVEs in a Siemens logic controller, reverse engineering a bespoke architecture, and an…
In a recent pentest, I tested a system which automates and streamlines a time-consuming business process. The web app would process .docx business files by transforming unstructured data to structured JSON. To expedite the pentest (because time is precious), I asked the developer: "How does the backend parse the document? Is there any particular format, say, specific headings or column names?"…
BOOMlang v2.0 Released: The First Shockwave-Optimized Language Inspired by Doom’s simplistic genius, the power of the BEAM model, and butterflies 1 , BOOMlang is the world’s first shockwave-native programming language , perfect for building concurrent AI-driven applications. AI proponents hail BOOMlang as “the next Java” , destined to take the world by storm as a general-purpose language for…
Scanning the internet is not trivial, but Python excels at such network I/O tasks thanks to its simplicity and its vast ecosystem of libraries. Still, when dealing with the internet, it’s not uncommon to encounter rate-limited endpoints and strongly firewalled sites. For penetration testing and red-teaming, opsec is also an important consideration. This means features such as delay and interactive…
Over the past year, I've been pentesting various systems, diving into a variety of web apps, mobile apps, IoT devices, desktop apps, and the occasional Active Directory network. Some were ancient projects wielding unmaintained code. Some were using popular modern tech stacks. Each software was unique, but a lot were plagued by common issues. So to end this year, I thought it would be nice to…
With over 7 million weekly downloads on NPM, PrismJS is one of the most widely used code highlighting packages in JavaScript, lauded for its unparalleled extensibility through plugins. But one recurring issue plagues developers: most plugins require a DOM ! Fancy plugins such as command-line , line-numbers , and the toolbar suite require a DOM to manipulate HTML. This isn't normally possible in…
Earlier this month, I released two CTF web challenges for CrewCTF 2024: Nice View 1 and Nice View 2. These build upon an earlier challenge — an audio synthesis web service running on the Drogon Web Framework. This time, our focus shifts from exploring zip attacks in Juce to exploring an alarming configuration in Drogon: Dynamic Views Loading (hereafter abbreviated DVL). In a hypothetical situation…
When performing a penetration test, we occasionally come across SQL injection (SQLi) vulnerabilities. One particular class of SQLi is particularly tedious to exploit — Boolean-Based SQLi. Tedious, heavily-repetitive tasks often present themselves as nice opportunities for automation. In this post, we’ll review Boolean-Based SQL Injection, and explore how to automate it with Python by starting with…
I decided to spend this Labour Day doing a bit of frontend performance engineering, learning Typescript along the way. I've been eyeing my Font Awesome (FA) assets for a while, and lately they've been a curious itch. Here’s the dealio: icon webfonts are known to bundle all icons. This includes icons we don't use. For Font Awesome, this means the browser downloads 19kB CSS + 287kB WOFF2 gzipped…
Among the various certifications available to the infosec community, the Offensive Security Certified Professional (OSCP) stands out as a highly regarded entry-level credential for its demanding technical challenges and emphasis on real-world penetration testing. Preparing for the OSCP is no easy task, and I wanted to share with the wider community some tips and lessons learnt. enumeration - On…
This is a collection of commands I've picked up over the last few years, which I've found immensely useful. My favourite ones are probably: less : search/filter on a file or long text ^r : reverse search !$ : last argument of previous command By "favourite", I mean I've used these commands a lot , and they've drastically increased my productivity. Cool Stuff Control ( ^ ) Commands ^c # Duh.…
Waterblowing is a Cantonese slang for bullshitting or small talk. But here it mainly refers to the former. I'm thrilled to share a major achievement in my career: I am now officially a Certified Offensive Waterblower (COW)! 🐄💧🔥 After months of rigorous training, unwavering dedication, and countless facepalms, I have successfully mastered the art of offensive waterblowing. 💪💧💨 Curious about…
Zip files are everywhere in our daily lives, seamlessly integrated into our personal, academic, and professional environments. From Java apps to Microsoft Office documents, zip files have become an indispensable tool. But as we know from Silicon Valley , zip files have the potential to be dangerous. YouTube: Silicon Valley - The Ultimate Hack In this post, we'll delve into the intriguing world of…
The people walking in darkness have seen a great light; on those living in the land of deep darkness a light has dawned. – Isaiah 9:2 What is a relay? A race—passing a baton from one to the next. The passing of packets by a router or a gateway server. Or used plainly as a verb without technicalities, a relay may simply mean to receive and pass on information. 1 It's worth taking a moment to…
Last year, a friend lent me his copy of God’s Smuggler , an autobiography of Brother Andrew’s adventures behind the Iron Curtain (into Communist countries). Over the first few chapters we're introduced to Brother Andrew, an adventurous fellow who served alongside his Dutch comrades in World War II. He is portrayed with a rebellious spirit and strong desire to make a difference to the world.…
Oh boy, another C++ reverse challenge. :rubs_hands_in_delight: Decompetition: Vitamin C++ is a reverse engineering challenge in this year's HKCERT CTF, an annual online capture-the-flag competition hosted in Hong Kong. The format is slightly different from usual rev chals in that we’re required to derive the source code of a binary. This really tests our understanding of how the language is…
This is my second meta post on site development... and a lot has changed! In this post, I'll walk through some changes on the site, along with my decision-making process on migrating to Cloudflare, and some general tips in case you're going through something similar. But first things first. Meme. What's new? The previous meta update was dated February 4. That time, I revised the site generator,…
Types are cool! But y'know what's even cooler? A CTF challenge on types! This year's MapleCTF graced us with a challenge involving much class, much inheritance, much confuzzlement, and much eyesore. Description Mostly Harmless Some people consider type annotations to be useless. I consider everything but type annotations redundant. Author: JJ 17/291 solves. The chal is also humorously tagged…
My first Rust rev solve! Though in hindsight, not much Rust knowledge was needed. Description A Rust tool for executing shellcode in a seccomp environment. Your goal is to pass the hidden flag checker concealed in the binary. Author: wxrdnx 40/683 solves. Writeup Running the Server Let’s start by running the binary. We can get a feel by navigating the program with help and other commands. Turns…
This is a curated collection of GDB/GEF commands which I find incredibly useful for dynamic analysis and reverse engineering. These are mainly personal notes and may be incomplete, but suggestions are welcome! If there's a useful GDB/GEF command you use that's not on this list, do leave a comment or let me know so that I can add it. :) The Basics Hjaelp! # Describes how to use a command. help help…
Description Medium. 27/1424 solves. I am getting all the wrong signals from this binary. Author: hashkitten Writeup Analysis On decompilation, the binary appears to be an innocent program which adds and subtracts numbers. The code itself is relatively simple. // Set the SIGSEGV handler. memset ( & sigsegv_sigaction , 0 , 0x98 ) ; sigsegv_sigaction . __sigaction_handler . sa_handler = oops ;…
Getting better hardware is not always the solution. Sometimes; but not always. Don't be clueless. I keep explaining why dynamically allocating on embedded systems is a disagreeable idea, so thought I’d throw it on a post. This is a confusing topic for many junior developers who were taught to use new and delete in early C++ courses. In desktop/web application programming, dynamic allocation is…
As an avid programmer with a passion for technology and programming, I was always intrigued by the world of cybersecurity. In my last two years of university, I was thrilled to explore this field further by joining the HKUST Firebird CTF Team. As someone with a programming background but no cybersecurity knowledge (besides rudimentary SQL injection), I was excited to develop my skills in this…
Slap a timer, DMA, and DAC together, and BAM—non-blocking audio output! — TrebledJ, 2022 Ah… embedded systems—the intersection of robust hardware and versatile software. This is the third (and culminating) post in a series on digital audio synthesis ; but the first (and only?) post touching embedded hardware. In the first post , we introduced basic concepts on audio processing. In the second post…
Algebraic data types (ADTs) encompass a wide range of types commonly used in our day-to-day tasks. Over the past years, they’ve grown in popularity with the rise of modern languages such as Rust and Scala. They allow us to effectively model data, write readable code, and catch bugs at compile time. But rarely do we consider the aesthetics behind such constructs. This post is for the curious…
Midnight Enigma is composed for a musical challenge constraining pitches within two octaves, with the bonus theme of game music. 1 Pitch and range constraints aren't that unusual. When writing for any instrument or voice, it's important to keep in mind its range and register. You probably don't want to see (let alone hear) a bass singer singing an A5 note. Though being limited to two octaves…
And in the days of those kings the God of heaven will set up a kingdom that shall never be destroyed, nor shall the kingdom be left to another people. It shall break in pieces all these kingdoms and bring them to an end, and it shall stand forever… — Daniel 2:44 (NIV) Organisations, institutions, nations, governments, civilisations. Whether big or small, strong or weak, aggressive or meek, each…
This is the second post in a series of posts on Digital Audio Processing. Similar to the previous post , this post stems from a lil’ MIDI keyboard project I worked on last semester and is an attempt to share the knowledge I've gained with others. This post will dive into the wonderful world of audio synthesis and introduce two important synthesis techniques: additive synthesis and wavetable…
A while back I worked on a lil’ MIDI keyboard project and learnt a lot regarding digital audio signal processing. This post is the first in a series of posts related to that project and aims to provide a springboard for those who wish to get their feet wet with audio processing. Dealing with Data 📈 When processing data of any form, we are concerned with the data’s quality. Higher quality data may…
Amorama was composed for a fun little musical challenge on the theme of love ❤️ with the constraint of using the rarely-sighted 13/16 metre. Often, music is made for more balanced, basic metres such as 4/4, 3/4, and 6/8. For some reason, we seem to prefer small subdivisions of 2 or 3. We can still apply this principle with 13/16 though, and it turns out that's what most contestants did. :) I chose…
This post contains a brief explanation of this site’s migration and improvement over the last week. Jekyll and Eleventy (aka 11ty) are static site generators (SSGs)—programs that take us from templated code + blog posts written in Markdown to full-fledged static websites. 11ty is one of the newer, growing SSGs out there. Of course, we can't have a migration post without the appropriate meme, so…
A reflection of the past, composed and mixed during my 7-day covid quarantine. Time ebbs past, As anguish holds fast. Without you I’m filled with remorse, For you are my one driving force. As the season turns, My heart still churns. I’ll leave my sins and remorse, Heading on a different course. The purpose of composing this piece is threefold: it served as an expression of faith and emotions, a…
Seaside Garden is composed for HKUST's Call for Scores for the School Anthem. 1 I present my rationale below, at the expense of being cheesy. Rationale My journey with HKUST started three and a half years ago. This was a period of becoming, exploration, and development. To me, the university is like a garden: cultivating and nurturing flora and fauna, a peaceful sanctuary, a place of life and…
This project was made for a course on embedded systems and is published online . Synopsis The STM32 MIDI Keyboard was a project aimed to practice embedded systems design while also have fun developing a tactile music application. Here are some features found on the keyboard: 2+ octaves (29) piano keys to flexibly play various melodies Supports multi-press, so that we aren't stuck with boring…
This post is a (very very late) writeup on solving the Advent of Code 2021 Day 22 challenge . This was one of the challenges I spent more time on, and ended up developing three algorithms (which is a bit overkill), all using set theory. I also ended up writing all three in both Haskell and Rust, and benchmarking to compare the runtimes. Needless to say, Rust ran about 25%-50% faster, but…
Description 350 points. 4/5 ⭐️. 4/311 solves. Seems someone encrypt their flag with some weird online website. And seems the website is written in C++... Does anyone even use C++ to write their web server? I guess C++ is still charm but it must be easy to reverse.... right? Analysis We’re provided with the server binary written in C++. No source code. 😟 We’re also provided with a link to a…
The challenge looks deceptively simple. Chinese has over 50,000 characters. Base64 just has 64. So it should be easy right? Haha nope. It's not as trivial as I thought. Description 200 points. 3/5 ⭐️. 6/311 solves. People said that base64 is an encoding, not an encryption. Did they have a misconception about that? If you believe that base64 is just an encoding, then convince me that you are able…
Do not say a little in many words, but a great deal in a few. – Pythagoras What the heck are implicit parameters? In software engineering, the Don’t Repeat Yourself principle is one of the foundations of writing modular programs. Implicit parameters (implicits, for short) are one of those language features which hide repetitive code so that developers can focus on the more important aspects of…
This was a fun little break from all the school work piling up. School is tiring, just like something else... Challenge Description CTFing is tiring. Take a break with this easy puzzle! Note: The binary and server in this challenge are the same as "ezpz-pwn". The description is rather terse. But it seems like the same binary is used for two challenges. The binary is available on the DownUnderCTF…
Ah Fall... the time of year when undergrads decide what activities, societies, and extra-curriculars to join. The purpose of this post is to reflect on and share about this experience. The first several sections provide background on my journey in the team. The final section is more reflective. Hopefully the reader finds something meaningful in this jumble of words. Please understand that the team…
MuseScore, a music notation desktop application, allows mini-extensions through its QML Plugins. MuseScore is built with the Qt framework and leverages the QML ecosystem for rapid prototyping and user-developed plugins. QML is a fun language to work with. Generally, the UI is coded in a declarative style and the logic is coded in JavaScript. This, of course, has the downside of losing the static…
Dedicated to everyone feeling stressed, down, lost, or under the weather. As we all know, penguins are great swimmers. Sadly however they can't fly (or so we think!). But as the "Learn to Fly" game series teaches us, with enough dedication, penguins can indeed fly. And with each attempt they reach higher altitudes, even if simply done using a tiny booster rocket. Hopefully this little piece may be…
This post is a writeup on solving the Advent of Code 2021 Day 24 challenge: Arithmetic Logic Unit . The Problem At first glance, I thought it was something similar to the intcode problems from two years ago. After a more thorough read, it turns out this is a completely different problem. To my surprise, the day 24 challenge actually resembles the reverse engineering found in some capture the flag…
This post is a writeup on solving the Advent of Code 2021 Day 16 challenge: Packet Decoder . The Problem We're given as input a string of hexadecimal characters ( 0 to F ). Our mission? To translate those characters into an expression of packets (part 1) and to then evaluate it (part 2). Before diving into code, we should first understand the format of the packets, what exactly we need to parse,…
Haskell, despite its relatively low popularity, is quite up to speed on language features and tooling (unlike– cough cough –some other languages). One of these features is being able to separate and organise files into modules, encouraging clean code practices and cleaner development. In Advent of Code (AOC) 2021, I found it useful to separate common functions into a Utils.hs file. After all, to…
If you're new to Advent of Code (AOC), you can read more about it for some background info. This was my second year completing the full set of challenges and obtaining all 50 stars. These challenges were released in December last year, but I only completed the first few challenges then and completed the rest this summer. The stress and study of the Spring term made me put off AOC until I was…
Challenge Description Wanna take a break from the ctf to do another ctf? Write-Up Ooooh, a C++ challenge. And it's about CTFs. Seems like a fun little exercise. Preliminary Observations and Analysis We're provided a C++ file and its compiled ELF. Upon an initial browse through the source, we see something interesting: void win ( ) { system ( "/bin/sh" ) ; } void * win_addr = ( void * ) & win ; C++…