https://blog.arok.win Web security, penetration testing, cloud security, and offensive-defense research en https://blog.arok.win/posts/ssrf-internal-probing/ https://blog.arok.win/posts/ssrf-internal-probing/ Sun, 31 May 2026 00:00:00 +0800 paradise My workflow for finding server-side request forgery, confirming it with callbacks, and safely mapping internal services. https://blog.arok.win/posts/sensitive-info-leak-hunting/ https://blog.arok.win/posts/sensitive-info-leak-hunting/ Sat, 16 May 2026 00:00:00 +0800 paradise My notes on finding exposed version control data, backup archives, editor artifacts, and configuration files. https://blog.arok.win/posts/subdomain-takeover/ https://blog.arok.win/posts/subdomain-takeover/ Tue, 14 Apr 2026 00:00:00 +0800 paradise My notes on how stale CNAME records become takeover candidates, how to validate them safely, and how to prevent them. https://blog.arok.win/posts/sql-injection-waf-bypass/ https://blog.arok.win/posts/sql-injection-waf-bypass/ Thu, 26 Feb 2026 00:00:00 +0800 paradise My notes on understanding WAF normalization, using comments and encodings, and verifying a bypass is actually exploitable. https://blog.arok.win/posts/honeypot-detection/ https://blog.arok.win/posts/honeypot-detection/ Wed, 18 Feb 2026 00:00:00 +0800 paradise My notes on how port, banner, and interaction anomalies reveal deceptive services before committing real tools. https://blog.arok.win/posts/supply-chain-attack-surface/ https://blog.arok.win/posts/supply-chain-attack-surface/ Fri, 23 Jan 2026 00:00:00 +0800 paradise My notes on how package managers, CI pipelines, containers, and third-party SDKs expand the attack surface. https://blog.arok.win/posts/mobile-traffic-capture/ https://blog.arok.win/posts/mobile-traffic-capture/ Mon, 27 Oct 2025 00:00:00 +0800 paradise My workflow for proxying mobile apps, installing a CA, inspecting HTTPS traffic, and bypassing certificate pinning. https://blog.arok.win/posts/api-security-checklist/ https://blog.arok.win/posts/api-security-checklist/ Mon, 06 Oct 2025 00:00:00 +0800 paradise The checklist I use for authentication, authorization, input handling, rate limits, debug endpoints, and logging. https://blog.arok.win/posts/zero-trust-least-privilege/ https://blog.arok.win/posts/zero-trust-least-privilege/ Sun, 01 Jun 2025 00:00:00 +0800 paradise My study notes on moving from implicit network trust to identity verification, microsegmentation, and least privilege. https://blog.arok.win/posts/access-log-forensics/ https://blog.arok.win/posts/access-log-forensics/ Sun, 16 Feb 2025 00:00:00 +0800 paradise My notes on using time windows, path sequences, user agents, and outbound connections to reconstruct attacks. https://blog.arok.win/posts/idor-access-control-testing/ https://blog.arok.win/posts/idor-access-control-testing/ Fri, 24 Jan 2025 00:00:00 +0800 paradise My notes on finding object-level and role-level authorization flaws without relying on HTTP status codes alone. https://blog.arok.win/posts/red-team-opsec/ https://blog.arok.win/posts/red-team-opsec/ Sun, 01 Dec 2024 00:00:00 +0800 paradise My notes on traffic, timing, credentials, tooling, and communication discipline during adversary simulations. https://blog.arok.win/posts/xss-to-session-hijack/ https://blog.arok.win/posts/xss-to-session-hijack/ Wed, 23 Oct 2024 00:00:00 +0800 paradise My notes on how stored cross-site scripting becomes cookie theft, account actions, and persistent access. https://blog.arok.win/posts/web-recon-methodology/ https://blog.arok.win/posts/web-recon-methodology/ Wed, 22 May 2024 00:00:00 +0800 paradise My personal workflow for collecting domains, subdomains, IP ranges, fingerprints, and content paths before active testing. https://blog.arok.win/posts/jwt-security-bypass/ https://blog.arok.win/posts/jwt-security-bypass/ Thu, 18 Apr 2024 00:00:00 +0800 paradise My study notes on JSON Web Token failures including algorithm confusion, weak keys, header injection, and defenses. https://blog.arok.win/posts/ai-assisted-vuln-hunting/ https://blog.arok.win/posts/ai-assisted-vuln-hunting/ Sun, 17 Mar 2024 00:00:00 +0800 paradise My notes on where language models help in security analysis, how to prompt them, and why results need validation. https://blog.arok.win/posts/internal-port-forwarding/ https://blog.arok.win/posts/internal-port-forwarding/ Thu, 29 Feb 2024 00:00:00 +0800 paradise My notes on choosing and operating local forwards, SOCKS tunnels, and reverse proxies in constrained environments. https://blog.arok.win/posts/waf-fingerprint-identification/ https://blog.arok.win/posts/waf-fingerprint-identification/ Thu, 28 Dec 2023 00:00:00 +0800 paradise How I tell whether an application sits behind a WAF by combining headers, block pages, timing, and request mutations. https://blog.arok.win/posts/cloud-privilege-escalation/ https://blog.arok.win/posts/cloud-privilege-escalation/ Wed, 18 Oct 2023 00:00:00 +0800 paradise My study notes on instance metadata, role credentials, and permissive policies as cloud escalation paths. https://blog.arok.win/posts/cors-misconfiguration/ https://blog.arok.win/posts/cors-misconfiguration/ Fri, 25 Aug 2023 00:00:00 +0800 paradise My notes on reflected origins, wildcard credentials, null origins, and subdomain trust in CORS testing.