kinsey973's Blog

website·Indexed 30 days ago

A personal technical blog focusing on CTF write-ups, cryptography, and programming. Content includes detailed guides on RSA, AES, and DES encryption, web vulnerability analysis (XSS, SSRF, RCE, and file upload bypasses), and learning notes for Java, Python, and Rust.

Tokens: 57.6K
Snippets: 280
Records: 354
Agent score: 50%

What's inside kinsey973

Overview of Java IO Stream Classifications
Java IO streams are categorized by direction and data type:
1. By Direction:
  Input Stream: Used for reading data.
  Output Stream: Used for writing data.
2. By Data Type:
  Byte Streams: Handle all file types (binary data). Key classes include InputStream, OutputStream, FileInputStream, and FileOutputStream.
  Character Streams: Handle pure text files (e.g., .txt, .md). Key classes include Reader and Writer.
Note: The base stream classes are abstract classes.
https://kinsey973.top/posts/Java
Overview of Block Cipher Modes of Operation
Block ciphers use different modes of operation to handle data larger than the block size:
- ECB (Electronic Codebook): The simplest mode. Data is split into blocks, and each block is encrypted independently using the same key. It is generally insecure because identical plaintext blocks produce identical ciphertext blocks.
- CBC (Cipher-block Chaining): Each plaintext block is XORed with the previous ciphertext block before being encrypted. The first block is XORed with an Initialization Vector (IV).
- CTR (Counter): Turns a block cipher into a stream cipher. An incrementing counter is encrypted to generate a keystream, which is then XORed with the plaintext. This allows for parallel encryption.
- CFB (Cipher Feedback): Converts a block cipher into a stream cipher by feeding the previous ciphertext block back into the encryption process.
- OFB (Output Feedback): Generates a keystream by repeatedly encrypting the IV. The keystream is then XORed with the plaintext. Encryption and decryption processes are identical due to the symmetry of the XOR operation.
https://kinsey973.top/posts/crypto-AES-DES
RSA Encryption Algorithm Fundamentals
The RSA algorithm relies on the mathematical properties of large prime numbers and modular arithmetic. The core components are:
- p, q: Two distinct large prime numbers used to generate the key pair.
- n (Modulus): The product of the two primes ($n = p \times q$). It is shared by both public and private keys.
- $\phi(n)$ (Euler's Totient Function): For RSA, $\phi(n) = (p-1)(q-1)$. It represents the count of positive integers up to $n$ that are relatively prime to $n$.
- e (Public Exponent): Used for encryption. Typically a small fixed value, commonly 65537.
- d (Private Exponent): Used for decryption. It is the modular multiplicative inverse of $e$ modulo $\phi(n)$, satisfying $e \times d \equiv 1 \pmod{\phi(n)}$.
- m (Plaintext): The original message to be encrypted.
- c (Ciphertext): The encrypted message, calculated as $c = m^e \pmod n$. The plaintext is recovered via $m = c^d \pmod n$.
https://kinsey973.top/posts/crypto-rsa
Implement Dependency Injection (DI) and Inversion of Control (IoC) in Spring
To achieve low coupling and high cohesion in a layered architecture, Spring uses IoC and DI. Use @Component to mark a class for management by the IoC container and @Autowired to automatically inject the required bean into a member variable at runtime.
https://kinsey973.top/posts/Javaweb
DES Algorithm Overview and Specifications
The Data Encryption Standard (DES) is a symmetric-key block cipher.
Key Specifications:
- Working Key: 8 bytes (64 bits). Only 56 bits are used for computation; 8 bits are parity bits (positions 8, 16, 24, 32, 40, 48, 56, 64) and are ignored.
- Final Round Key: Each round uses a 48-bit subkey.
- Plaintext/Ciphertext: Processed in blocks of 8 bytes (64 bits).
https://kinsey973.top/posts/crypto-AES-DES
Understand Zabbix Architecture and Purpose
Zabbix is a network monitoring and management system developed by Alexei Vladishev. It utilizes a Server-Client architecture to monitor the status of various network services, servers, and network devices. Key capabilities include real-time monitoring, alerting mechanisms, performance statistics, and data visualization.
https://kinsey973.top/posts/vulhub
Understand Wiener's Attack on RSA
Wiener's Attack is a cryptanalytic attack on RSA that succeeds when the private exponent $d$ is very small (typically $d < rac{1}{3} N^{1/4}$). It uses continued fractions to find $d$ by approximating the ratio $rac{e}{N}$ with $rac{k}{d}$. If the condition $ed mod ext{phi}(N) = 1$ is met, the attack can recover the private key. This attack is particularly effective when the public exponent $e$ is very large.
https://kinsey973.top/posts/crypto-rsa
Understand Reflected (Non-Persistent) XSS Principles
Reflected XSS occurs when an application receives data in an HTTP request and includes that data within the immediate response in a way that allows a browser to execute it as code. The attack is typically 'one-time' because the malicious payload is delivered via a link (e.g., in an email). When the victim clicks the link, the payload is sent to the server and 'reflected' back to the victim's browser, which then executes the script.
https://kinsey973.top/posts/ctfshow-xss
Write data to local files using FileOutputStream
Use FileOutputStream to write byte data to a local file.
Key Behaviors:
- File Creation: If the file does not exist, it is created automatically (provided the parent directory exists).
- Overwriting: By default, writing to an existing file overwrites its content.
- Append Mode: To append data instead of overwriting, set the second constructor parameter to true (new FileOutputStream(path, true)).
- Line Breaks: To create new lines, write the platform-specific line break characters: \r\n for Windows, \n for Linux, or \r for Mac. Java often optimizes these internally on Windows.
Steps:
1. Create the FileOutputStream object.
2. Write data using write() (accepts integers/ASCII or byte arrays).
3. Close the stream to release resources.
```
import java.io.FileOutputStream;
import java.io.IOException;

public class StreamDemo {
    public static void main(String[] args) throws IOException {
        // Overwrite mode (default)
        FileOutputStream fos = new FileOutputStream("a.txt");
        
        // Write a single character ('a' is ASCII 97)
        fos.write(97);
        
        // Write a byte array
        byte[] buf = {97, 98, 99, 100}; // "abcd"
        fos.write(buf);
        
        // Write with line break
        String str = "Hello";
        fos.write(str.getBytes());
        fos.write("\r\n".getBytes());
        
        fos.close();
    }
}
```
https://kinsey973.top/posts/Java
Read data from local files using FileInputStream
Use FileInputStream to read byte data from a local file into a program.
Key Behaviors:
- File Existence: If the target file does not exist, a FileNotFoundException is thrown.
- End of Stream: The read() method returns -1 when the end of the file is reached.
- Data Format: read() returns the ASCII integer value of the byte; it must be cast to char for text display.
Steps:
1. Create the FileInputStream object.
2. Read data using read() (single byte) or read(byte[] b) (multiple bytes).
3. Close the stream to release resources.
```
import java.io.FileInputStream;
import java.io.IOException;

public class StreamDemo {
    public static void main(String[] args) throws IOException {
        FileInputStream fis = new FileInputStream("a.txt");
        int b;
        // Loop until end of file (-1)
        while ((b = fis.read()) != -1) {
            System.out.println((char) b);
        }
        fis.close();
    }
}
```
https://kinsey973.top/posts/Java

Prevent Reflected and Stored XSS in Java Spring

Cross-Site Scripting (XSS) occurs when untrusted user input is rendered in the browser without proper encoding. Reflected XSS happens when input is immediately returned in the response, while Stored XSS occurs when input is saved (e.g., in a cookie) and later rendered. To prevent XSS, all user-supplied data must be HTML-encoded before being returned to the client.

@RequestMapping("/safe")
@ResponseBody
public static String safe(String xss) {
    return encode(xss);
}

private static String encode(String origin) {
    origin = StringUtils.replace(origin, "&", "&amp;");
    origin = StringUtils.replace(origin, "<", "&lt;");
    origin = StringUtils.replace(origin, ">", "&gt;");
    origin = StringUtils.replace(origin, "\"", "&quot;");
    origin = StringUtils.replace(origin, "'", "&#x27;");
    origin = StringUtils.replace(origin, "/", "&#x2F;");
    return origin;
}

Recover plaintext with low encryption exponents
If the encryption exponent $e$ is very small (e.g., $e=3$), it may be possible to recover the plaintext if the value $m^e$ is not significantly larger than the modulus $n$, or if it can be expressed as $k imes n + c$. In such cases, you can brute-force the integer $k$ and check if $k imes n + c$ is a perfect power (e.g., a perfect cube).
```
import gmpy2

# Example: Brute-forcing k to find a perfect cube
for k in range(40000, 45000):
    root = gmpy2.iroot(k * n + ce2, 3)[0]
    if root == int(root):
        print(f"Found root: {root}")
```
https://kinsey973.top/posts/crypto-rsa