Orange Tsai

blog.orange.twDR 67 Accessible 46 views

Reading & Learning Orange Tsai is a security researcher's personal blog featuring detailed write-ups on web and binary exploitation, including Microsoft Exchange ProxyLogon and PHP RCE research.

Visit now Favorite

Editor's Review

For reference only

The blog stands out for deep, first-hand vulnerability research rather than news roundups, with long technical narratives covering real-world exploit chains against Exchange, Apache, Windows, and PHP. Posts are dense and assume solid background knowledge, so newcomers may struggle, but experienced r

Site introduction

Orange Tsai is the personal site of a well-known security researcher, built around a chronological article archive rather than a typical corporate blog. The homepage lists posts by date, alongside sections for talks and an about page, making it a compact record of years of offensive security work.

The core content is original vulnerability research: full exploit chains against Microsoft Exchange, Apache HTTP Server, Windows ANSI, IIS, and PHP, plus CTF journey write-ups and conference talk notes. Several posts document named attack surfaces such as ProxyLogon, ProxyShell, and ProxyOracle, giving readers the author’s own account of discovery and exploitation.

The site is aimed at security researchers, penetration testers, CTF competitors, and bug bounty hunters who want technical depth. Readers without a background in web or binary exploitation will find most articles difficult, as they assume familiarity with HTTP internals, memory corruption, and exploit development.

A practical approach is to start with the retrospective posts on a decade of web security trends, then move to the specific CVE write-ups that match your interests. Talks and about pages provide context on the author’s work. Overall, it is a valuable archive for anyone studying real-world exploitation.