A core thinking framework for vulnerability discovery distilled from 5,600+ security documents on the Xianzhi community.
Core Meta-Thinking Models
┌─────────────────────────────────────────────────────────────────────────┐
│ 安全研究思维金字塔 │
├─────────────────────────────────────────────────────────────────────────┤
│ L4: 防御反推 ← 从补丁/过滤规则/安全机制反推绕过点 │
│ L3: 边界探索 ← 在已知攻击面上寻找corner case │
│ L2: 假设验证 ← 构建推理链条，逐步验证假设 │
│ L1: 攻击面识别 ← 寻找数据与指令不分离的接口 │
└─────────────────────────────────────────────────────────────────────────┘
General Decision Cycle
输入点识别 → 上下文分析 → 假设构建 → payload构造 → 响应分析 → 迭代优化
↑ │
└──────────────────────────────────────────────────────────────┘
Cross-Domain Core Formulas
| Domain | Core Formula | Key Insight |
|---|---|---|
| General | Vulnerability = Boundary out of control + State inconsistency + Violation of trust assumptions | The essence of all vulnerabilities |
| Code Audit | Vulnerability = Source reaches Sink && No effective Sanitizer | Taint propagation analysis |
| Binary | Exploitation = Information leak + Primitive construction + Control flow hijacking | Primitive combination and amplification |
| Domain Penetration | Attack = Gradual collapse of the trust chain | Delegation error = Entire domain compromised |
Quick Navigation
Select the corresponding methodology module based on the research scenario:
| Scenario | Reference Document | Core Thinking |
|---|---|---|
| Web Injection Vulnerabilities | references/web-injection.md | Semantic difference exploitation, WAF bypass strategy tree |
| Deserialization Vulnerabilities | references/deserialization.md | Gadget chain construction, version boundary quick reference |
| Binary Security | references/binary-exploitation.md | ROP genealogy, House of series |
| Domain Penetration/Internal Network | references/domain-pentest.md | Delegation attacks, persistence matrix |
| Code Audit | references/code-audit.md | Source-Sink model, framework audit |
| Reverse Engineering | references/reverse-engineering.md | VM confrontation, six dimensions of sandbox bypass |
| Fuzzing | references/fuzzing.md | Target selection matrix, coverage-driven |
| Privilege Escalation/Bypass | references/privilege-bypass.md | Anti-detection technique levels, EDR evasion |
| Red Team/CTF | references/redteam-ctf.md | Complete attack chain, cloud security |
| Case Index | references/case-index.md | Case library categorized by technique/CVE |
Meta-Thinking Principles
1. Hypothesis-Validation Cycle
All security research follows: Hypothesis → Test → Iterative optimization
2. Boundary Condition Thinking
Corner cases are the common breeding ground for all vulnerability types
3. Defense Reverse Reasoning
Reasoning backward from known defensive measures to attack paths is an efficient research strategy
4. Chain Thinking
The value of a single vulnerability is limited; only a vulnerability chain can complete a full attack
5. Version Sensitive
The same vulnerability point requires different exploitation methods in different versions
6. Semantic Difference
Differences in how different components parse the same input are the core of bypasses
Usage Guide
- Determine the research objective: Clarify the vulnerability type or attack scenario to be analyzed
- Consult the corresponding module: Select the appropriate methodology document according to the quick navigation table
- Apply the meta-thinking framework: Use the L1-L4 thinking pyramid to guide the analysis process
- Reference case index: Find specific cases of related CVEs or technologies
- Iterative optimization: Adjust the strategy according to the actual situation
Core insights quick reference
Web security
- Essence of vulnerabilities = failure of data-instruction separation
- JNDI version boundary: after JDK 8u191, different exploitation paths are required
- WAF bypass = exploitation of semantic differences
Deserialization
- "Everything can be a Gadget": any Serializable class can become a link in the chain
- Secondary deserialization is the key to protocol downgrade (SignedObject)
- Blacklists always have omissions; proxy encapsulation is a general approach for bypassing in higher versions
Binary security
- Essence of exploitation chains: combination and amplification of primitives
- The glibc version determines the available techniques (2.27 tcache, 2.32 safe-linking)
- Evolution of IO exploitation: after vtable checks, _wide_data becomes the breakthrough point
Domain penetration
- SPN queries are superior to port scanning (more precise and stealthier)
- Delegation configuration errors may lead to the compromise of the entire domain
- The stealthiest attacks often exploit legitimate domain features rather than vulnerabilities
Reverse analysis
- Reverse engineering = process of reducing information entropy
- Three paths for VM protection: opcode restoration, z3 constraints, instrumentation brute force
- Triton + Z3 + AI is the modern paradigm for OLLVM deobfuscation
Red team offense and defense
- Complete chain: boundary breach -> privilege escalation -> penetration -> lateral movement -> domain controller -> persistence
- "Internal network password reuse" is the key to experience-driven lateral movement
- New cloud-native attack surface: K8S hostPath + tolerations