Top all-time · #2915
Orange Tsai
Personal blog · blog.orange.twsecurityprogramming
Orange Tsai's personal blog at blog.orange.tw covers security and programming. Since 2016, 26 different Hacker News readers have linked it 31 times, most often “How I Chained 4 vulnerabilities on GitHub Enterprise”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Orange Tsai's security research write-ups on exploit chains, URL parsing and SSRF, and bugs in GitHub Enterprise and Facebook, and one commenter lists the blog among favourite security blogs.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
This is 🍊 Speaking!
Most-linked posts?
- How I Chained 4 vulnerabilities on GitHub Enterprise4 people · 4 mentions · first linked 2017-07-28
- I Hacked Facebook Again Unauthenticated RCE on MobileIron MDM4 people · 4 mentions · first linked 2020-09-12
- Attacking SSL VPN: PreAuth RCE on Palo Alto GlobalProtect, with Uber as PoC2 people · 2 mentions · first linked 2019-07-21
- Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server2 people · 2 mentions · first linked 2024-08-09
- Forging a Microsoft Edge Full Chain with Logic Bugs Only2 people · 2 mentions · first linked 2026-10-28
What Hacker News says?
True but FYI if you want to, you can reverse engineer the code of the GitHub enterprise version: https://blog.orange.tw/2017/01/bug-bounty-github-enterprise-...
Comment linking /2017/01/bug-bounty-github-enterprise-sql-injection.html
on “I'm Open Sourcing the Have I Been Pwned Code Base”Submitted WorstFit: Unveiling Hidden Transformers in Windows ANSI as a story · 373 points
HN discussionHere is my list of solo developer blogs. Usually they are on topic. This does not include personal blogs I follow that happen to be developers. @mdo (Bootstrop) - http://markdotto.com/ Keith Cirkel - https://www.keithcirkel.co.uk/ Coding – Corbin's Treehouse - https://www.corbinstreehouse.com/blog Aaditya Purani – Ethical Hacker - https://aadityapurani.com/ Ben Balter - http://ben.balter.com/ fulldecent - https://pr…
Comment linking /
on “Ask HN: What are good solo developer blogs that you enjoy reading?”Submitted GitHub Enterprise SQL Injection as a story · 346 points
HN discussionI'm directionally with Micah Lee on this in that I think all of these kinds of applications are activism theater, and I would hate for anything I say to sound like I'm getting the "ICEBlock" guy's back --- I'm sure it's bad and you shouldn't use it (though: Micah Lee's previous takedown of ICEBlock more or less comes down to "anybody can claim they saw ICE anywhere and also they don't have warrant canaries", which i…
Comment linking /posts/2024-08-confusion-attacks-en/
on “ICEBlock handled my vulnerability report in the worst possible way”Submitted Forging a Microsoft Edge Full Chain with Logic Bugs Only as a story · 253 points
HN discussionAside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”Submitted Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server as a story · 120 points
HN discussionI wasn't aware of the issues described in the linked post about MobileIron exploits. Really interesting to hear about vulnerabilities in such a big MDM. https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-m...
Comment linking /2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
on “Applying Offensive Reverse Engineering to Facebook Gameroom (2021)”Submitted Uber.com Bug Bounty: Remote Code Execution via Flask Jinja2 Template Injection as a story · 5 points
HN discussionBlackhat/Defcon videos aren't up yet but Orange Tsai gave the same talk at HITBGSEC and that video is up: https://www.youtube.com/watch?v=D1S-G8rJrEk He also has a blog post about it: http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilitie... The premise is that URL parsing is complex and libraries get it wrong. This problem is pervasive and leads to server side request forgery vulnerabilities, which Orange was…
Comment linking /2017/07/how-i-chained-4-vulnerabilities-on.html
on “Some problems of URLs”Submitted A New Attack Surface on MS Exchange – ProxyLogon as a story · 4 points
HN discussionSubmitted An analysis and thought about recently PHP-FPM RCE(CVE-2019-11043) as a story · 4 points
HN discussionSubmitted Attacking SSL VPN: PreAuth RCE on Palo Alto GlobalProtect, with Uber as PoC as a story · 4 points
HN discussionSubmitted How I Chained 4 vulnerabilities on GitHub Enterprise as a story · 4 points
HN discussionSubmitted The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic as a story · 3 points
HN discussionSubmitted How I Chained 4 Vulnerabilities on GitHub Enterprise, from SSRF to RCE as a story · 3 points
HN discussionSubmitted Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server as a story · 2 points
HN discussionSubmitted I Hacked Facebook Again Unauthenticated RCE on MobileIron MDM as a story · 2 points
HN discussionSubmitted I Hacked Facebook Again Unauthenticated RCE on MobileIron MDM as a story · 2 points
HN discussionSubmitted I Hacked Facebook Again Unauthenticated RCE on MobileIron MDM as a story · 2 points
HN discussionSubmitted VPN PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study as a story · 2 points
HN discussionSubmitted An RCE in Palo Alto’s SSL VPN allowed access to an internal Uber network as a story · 2 points
HN discussionSubmitted Attacking SSL VPN – Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber As as a story · 2 points
HN discussionSubmitted A New Attack Surface on MS Exchange – ProxyLogon as a story · 1 points
HN discussionSubmitted A Journey Combining Web Hacking and Binary Exploitation in Real World as a story · 1 points
HN discussionSubmitted Abusing Meta Programming for Unauthenticated RCE in Jenkins as a story · 1 points
HN discussionSubmitted Hacking Jenkins Part 1 – Play with Dynamic Routing as a story · 1 points
HN discussionSubmitted How I Chained 4 vulnerabilities on GitHub Enterprise as a story · 1 points
HN discussionSubmitted GitHub Enterprise SQL Injection as a story · 1 points
HN discussion
